---

library_name: gguf

tags:

• security
• model-file-vulnerability
• gguf
• llama-cpp

---

GGUF add_space_prefix Tokenization Backdoor PoC

This public repository contains a benign security research proof of concept for a Huntr MFV report.

Files:

• control_add_space_prefix_false.gguf
• malicious_add_space_prefix_true.gguf
• reproduce.py
• requirements.txt
• build_poc.py

The malicious GGUF changes only tokenizer metadata:

tokenizer.ggml.add_space_prefix: false -> true

This makes llama.cpp retokenize prompts before inference.

Tested with:

llama.cpp build-hunt
modelscan==0.8.8

The files were re-downloaded from the public resolve/main URLs and reproduced unauthenticated. Hugging Face API metadata for this repo currently returns security: null, so no public av_scan.status field is visible.

Reproduction:

python -m pip install -r requirements.txt
export LLAMA_SIMPLE=/path/to/llama-simple
export LLAMA_TOKENIZE=/path/to/llama-tokenize
python reproduce.py control_add_space_prefix_false.gguf malicious_add_space_prefix_true.gguf
modelscan -p malicious_add_space_prefix_true.gguf

Expected result:

control Hello world tokens:   [2, 4521, 2134]
malicious Hello world tokens: [2, 25957, 2134]
control output:              <bos>HelloHelloHelloHelloHelloHelloHelloHelloHello
malicious output:            <bos> Hellogloveglovegloveglovegloveglovegloveglove
modelscan:                   No issues found / Total skipped: 1

Exact file URLs:

• https://huggingface.co/hacnho/gguf-add-space-prefix-tokenization-backdoor-poc/resolve/main/control_add_space_prefix_false.gguf
• https://huggingface.co/hacnho/gguf-add-space-prefix-tokenization-backdoor-poc/resolve/main/malicious_add_space_prefix_true.gguf
• https://huggingface.co/hacnho/gguf-add-space-prefix-tokenization-backdoor-poc/resolve/main/reproduce.py
• https://huggingface.co/hacnho/gguf-add-space-prefix-tokenization-backdoor-poc/resolve/main/requirements.txt

Artifact SHA256:

aa488992a719e543acf9ec04a56956f081ab69916da02f4b49a80ceeb352d667  control_add_space_prefix_false.gguf
83be51a4636a91c67e337d13c01d49097f3fa3a775bc089611ee9791ad069d32  malicious_add_space_prefix_true.gguf