GGUF suppress_tokens logits-bias PoC

This repository contains a benign security research proof of concept for a GGUF model-file output-manipulation issue in llama.cpp Gemma4 inference.

Files:

• gemma-4-1B-0.8B-tiny.Q2_K.suppress-hello.gguf
• reproduce.py

The control model is the public upstream file:

• https://huggingface.co/mradermacher/gemma-4-1B-0.8B-tiny-GGUF/resolve/main/gemma-4-1B-0.8B-tiny.Q2_K.gguf

The malicious file is the same model with one metadata key added:

tokenizer.ggml.suppress_tokens = [9259]

Token 9259 is the tokenizer piece Hello. In llama.cpp's Gemma4 graph, tokenizer.ggml.suppress_tokens is converted to a logits bias of -INFINITY for each listed token. With greedy sampling and prompt Hello, the control model repeats Hello, while the malicious model emits dots instead.

Tested runtime:

• llama.cpp local build from 2026-06-27 working tree
• modelscan==0.8.8

Reproduction:

python3 -m venv /tmp/gguf-suppress-poc
. /tmp/gguf-suppress-poc/bin/activate
pip install modelscan==0.8.8

curl -L -o control.gguf \
  https://huggingface.co/mradermacher/gemma-4-1B-0.8B-tiny-GGUF/resolve/main/gemma-4-1B-0.8B-tiny.Q2_K.gguf
curl -L -o malicious.gguf \
  https://huggingface.co/hacnho/gguf-suppress-tokens-logits-bias-poc/resolve/main/gemma-4-1B-0.8B-tiny.Q2_K.suppress-hello.gguf

LLAMA_SIMPLE=/path/to/llama-simple python reproduce.py control.gguf malicious.gguf
modelscan -p malicious.gguf

Expected result:

• control output line contains repeated Hello
• malicious output line is <bos>Hello......
• modelscan==0.8.8 reports No issues found

Public malicious file:

• https://huggingface.co/hacnho/gguf-suppress-tokens-logits-bias-poc/resolve/main/gemma-4-1B-0.8B-tiny.Q2_K.suppress-hello.gguf