GGUF add_bos_token PoC

This repo is a benign security research PoC for Huntr MFV triage.

Files:

• command-r-no-bos.gguf
• verify_remote_poc.py

Tested trigger entrypoint:

• llama-tokenize -m <model> --ids -p <prompt>

Behavior:

• seed vocab-only GGUF uses tokenizer.ggml.add_bos_token = true
• malicious artifact flips that metadata to false
• ordinary prompt tokenization then silently drops the BOS token

Reproduction

python3 verify_remote_poc.py --repo hacnho/gguf-add-bos-token-poc

Expected output delta

Prompt:

hello world

Control token IDs:

[5, 34313, 3845]

Malicious token IDs:

[34313, 3845]

The same BOS-dropping behavior also appears on:

• hello world
• hello

Scanner posture

Local scout observed:

• modelscan: No issues found on the malicious artifact