Handlebars模板默认转义机制无法防范角色注入攻击，关键漏洞在方括号和冒号等符号未被处理。
Structural Role Injection in Handlebars-Templated LLM Prompts: Triple-Brace Interpolation, Delimiter Family, and the Limits of HTML Auto-Escaping
- 用三重花括号插入原始数据，使攻击者可操控角色分隔符
- 97%的GPT-3.5 Turbo在未转义情况下被任务劫持，但冒号/标记类分隔符仍有效
- 现有转义机制仅对部分符号有效，不能替代指令与数据的结构隔离
大型语言模型应用通过模板构建提示词，Handlebars是常用模板引擎，也是微软Semantic Kernel的默认格式。其双花括号{ x }表达式会转义内容以防止注入，被视为安全默认；三花括号{ x }则原样插入。本文揭示该选择暗中决定了应用对结构化角色注入攻击的暴露程度——攻击者可利用控制数据中的角色分隔符伪造高权限对话回合。模型无关分析表明：HTML转义仅能消除尖括号，无法处理方括号、冒号或Markdown井号，导致ChatML、Llama-3、XML角色分隔符完全失效（存活率0.00），而Llama-2 [INST]、旧版Human:/Assistant:及Markdown ### 分隔符仍完整保留（存活率1.00）。在7种分隔符族、2种攻击目标、4个模型（GPT-3.5 Turbo、GPT-4o mini、GPT-4.1 mini、Claude Haiku 4.5）上共执行5760次试验，总API成本1.63美元。GPT-3.5 Turbo在原始输入下97%被任务劫持，转义后降至91%，保护仅限于尖括号类；更难的机密外泄目标未达饱和，更清晰地暴露了分隔符族间的差异。Claude Haiku 4.5几乎完全抵御两类攻击。可见，转义默认值仅对特定符号有效，无法替代指令与数据的结构性分离。
原文摘要 · Abstract (English)
Large language model applications build prompts from templates, and Handlebars is a widely used templating engine and the default prompt-template format in Microsoft Semantic Kernel. Its double-brace {x} expression HTML-escapes the interpolated value and is documented as the safe default; its triple-brace {x} expression inserts the value raw. We show that this choice silently governs an application's exposure to structural role injection, where attacker-controlled data carries chat role delimiters that forge a higher-privilege turn. A model-free analysis establishes the mechanism: Handlebars escaping rewrites angle brackets but not square brackets, colons, or Markdown hashes, so it neutralises ChatML, Llama-3, and XML role delimiters (survival rate 0.00) while leaving Llama-2 [INST], legacy Human:/Assistant:, and Markdown ### delimiters intact (survival rate 1.00 for the last two). We then run 5760 trials across seven delimiter families, two attack objectives, and four models (GPT-3.5 Turbo, GPT-4o mini, GPT-4.1 mini, Claude Haiku 4.5) at a combined API cost of 1.63 USD. GPT-3.5 Turbo follows the task-hijack instruction in 97% of raw and 91% of escaped trials, with the escaping protection concentrated in the angle-bracket families and absent for the colon- and Markdown-based families; the harder secret-exfiltration objective, which does not saturate, exposes the same family interaction more cleanly. Claude Haiku 4.5 resists both objectives almost entirely. The escaped default protects only the delimiter schemes whose characters HTML escaping happens to cover, gives no protection for the rest, and cannot substitute for a structural separation of instruction and data.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。