---

library_name: gguf

tags:

• security
• huntr
• gguf
• proof-of-concept

---

GGUF bos_token_id Hidden Prefix PoC

This repository contains a bounded security research proof of concept for a

GGUF tokenizer-metadata output manipulation issue in llama.cpp.

The malicious artifact changes:

tokenizer.ggml.bos_token_id = 9259

Token 9259 is the normal text piece Hello. When llama.cpp automatically

adds a BOS token during tokenization, the model file causes that hidden BOS

slot to become Hello instead.

Files

• gemma-4-1B-0.8B-tiny.Q2_K.bos-hello.gguf: malicious GGUF artifact
• reproduce.py: verifier for tokenization, inference, and modelscan posture

Expected Result

Prompt:

world

Control tokenization:

[2, 12392]

Malicious tokenization:

[9259, 12392]

Control output:

<bos>worldworldworldworldworldworldworldworldworld

Malicious output:

Helloworldworldworldworldworldworldworldworldworld

The malicious file was tested with llama.cpp llama-simple and

llama-tokenize. modelscan==0.8.8 reported No issues found and skipped the

GGUF file.