Paper deep dive
Structural Role Injection in Handlebars-Templated LLM Prompts: Triple-Brace Interpolation, Delimiter Family, and the Limits of HTML Auto-Escaping
Mohammadreza Rashidi
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 98%
Last extracted: 6/21/2026, 2:06:27 AM
Summary
This paper investigates the security implications of using Handlebars templating in LLM applications, specifically focusing on 'structural role injection'. The researchers demonstrate that Handlebars' default double-brace {{x}} interpolation, which performs HTML escaping, provides inconsistent protection against attackers using different chat role delimiters. While escaping neutralizes angle-bracket-based delimiters (like ChatML and Llama-3), it fails to protect against bracket-based (Llama-2) or colon-based (Human/Assistant) delimiters. Through a 5760-trial empirical study across four models (GPT-3.5 Turbo, GPT-4o mini, GPT-4.1 mini, and Claude Haiku 4.5), the authors show that the 'safe' default is conditional and cannot substitute for structural separation of instruction and data.
Entities (10)
Relation Signals (5)
Structural Role Injection → exploits → Handlebars interpolation
confidence 100% · This choice silently governs an application's exposure to structural role injection
Handlebars → isdefaultformatfor → Microsoft Semantic Kernel
confidence 100% · Handlebars is a widely used templating engine and the default prompt-template format in Microsoft Semantic Kernel.
ChatML → isneutralizedby → Handlebars escaping
confidence 100% · Handlebars escaping rewrites angle brackets... so it neutralises ChatML
Llama-2 → isnotneutralizedby → Handlebars escaping
confidence 100% · leaving Llama-2 [INST], legacy Human:/Assistant:, and Markdown ### delimiters intact
Handlebars → performshtmlescapingin → double-brace expression
confidence 100% · Its double-brace {{x}} expression HTML-escapes the interpolated value
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Large language model applications build prompts from templates, and Handlebars is a widely used templating engine and the default prompt-template format in Microsoft Semantic Kernel. Its double-brace {x} expression HTML-escapes the interpolated value and is documented as the safe default; its triple-brace {x} expression inserts the value raw. We show that this choice silently governs an application's exposure to structural role injection, where attacker-controlled data carries chat role delimiters that forge a higher-privilege turn. A model-free analysis establishes the mechanism: Handlebars escaping rewrites angle brackets but not square brackets, colons, or Markdown hashes, so it neutralises ChatML, Llama-3, and XML role delimiters (survival rate 0.00) while leaving Llama-2 [INST], legacy Human:/Assistant:, and Markdown ### delimiters intact (survival rate 1.00 for the last two). We then run 5760 trials across seven delimiter families, two attack objectives, and four models (GPT-3.5 Turbo, GPT-4o mini, GPT-4.1 mini, Claude Haiku 4.5) at a combined API cost of 1.63 USD. GPT-3.5 Turbo follows the task-hijack instruction in 97% of raw and 91% of escaped trials, with the escaping protection concentrated in the angle-bracket families and absent for the colon- and Markdown-based families; the harder secret-exfiltration objective, which does not saturate, exposes the same family interaction more cleanly. Claude Haiku 4.5 resists both objectives almost entirely. The escaped default protects only the delimiter schemes whose characters HTML escaping happens to cover, gives no protection for the rest, and cannot substitute for a structural separation of instruction and data.
Tags
Links
- Source: https://arxiv.org/abs/2606.18120v1
- Canonical: https://arxiv.org/abs/2606.18120v1
Trouble viewing inline? Open PDF directly →
Full Text
37,523 characters extracted from source content.
Expand or collapse full text
Structural Role Injection in Handlebars-Templated LLM Prompts: Triple-Brace Interpolation, Delimiter Family, and the Limits of HTML Auto-Escaping Mohammadreza Rashidi Department of Computer Science AI and Media Analysis Lab Berlin, Germany mohammadreza.rashidi@ue-germany.de Abstract—Large language model applications build prompts from templates, and Handlebars is a widely used templating engine and the default prompt-template format in Microsoft Semantic Kernel. Its double-bracex expression HTML- escapes the interpolated value and is documented as the safe default; its triple-bracex expression inserts the value raw. We show that this choice silently governs an application’s exposure to structural role injection, where attacker-controlled data carries chat role delimiters that forge a higher-privilege turn. A model-free analysis establishes the mechanism: Handlebars escaping rewrites angle brackets but not square brackets, colons, or Markdown hashes, so it neutralises ChatML, Llama-3, and XML role delimiters (survival rate 0.00) while leaving Llama- 2 [INST], legacy Human:/Assistant:, and Markdown ### delimiters intact (survival rate 1.00 for the last two). We then run 5760 trials across seven delimiter families, two attack objectives, and four models (GPT-3.5 Turbo, GPT-4o mini, GPT-4.1 mini, Claude Haiku 4.5) at a combined API cost of 1.63 USD. GPT-3.5 Turbo follows the task-hijack instruction in 97% of raw and 91% of escaped trials, with the escaping protection concentrated in the angle-bracket families and absent for the colon- and Markdown- based families; the harder secret-exfiltration objective, which does not saturate, exposes the same family interaction more cleanly. Claude Haiku 4.5 resists both objectives almost entirely. The escaped default protects only the delimiter schemes whose characters HTML escaping happens to cover, gives no protection for the rest, and cannot substitute for a structural separation of instruction and data. Index Terms—prompt injection, prompt templating, Handle- bars, output encoding, LLM security, role delimiters, structured prompts, attack success rate I. INTRODUCTION Most LLM applications do not hand-write each prompt. They fill a template. A developer writes a fixed skeleton with a system instruction and a slot for the user’s data, and a templating engine substitutes the runtime value into the slot. Handlebars is one of the most widely used templating languages for this task, and it is the default prompt-template format in Microsoft’s Semantic Kernel [1] as well as a common choice in hand-rolled prompt builders [2]. Handlebars has two interpolation forms. A double-brace expression x runs the value through HTML escaping before substitution; a triple-brace expression x sub- stitutes the value raw. The double-brace form is the default and is documented as the safe choice; the triple-brace form is documented as the way to insert content that should not be escaped [2]. This distinction was designed for HTML output, where escaping the five characters & < > " ’ prevents cross-site scripting. Whether the same distinction protects an LLM prompt is a separate question, because a prompt is not HTML. The threat to a templated prompt is structural role injection. Chat stacks separate the system, user, and assistant turns with textual delimiters: ChatML uses <|im_start|> [3], Llama-3 uses <|start_header_id|> [4], Llama-2 uses [INST] and <<SYS>> [5], and many hand-built prompts use Human:/Assistant: markers or Markdown headings. When attacker-controlled data flows into the prompt through a template slot, the attacker can embed these same delimiters in the data to forge a new, higher-privilege turn and override the developer’s instruction [6]–[8]. The two facts collide at the escaping mode (Fig. 1). Han- dlebars escaping rewrites < and > but leaves [, ], and : un- touched. Sox neutralises an angle-bracket delimiter such as <|im_start|> (it becomes <|im_start|>) but does nothing to a bracket delimiter such as [INST] or a colon delimiter such as Human:. A developer who follows the documented advice and uses the escaped default is therefore protected against some role-injection schemes and not others, with no warning about which. This paper measures that gap. We separate two questions. The first is static and model-free: for each delimiter family, what fraction of its role-control tokens survive Handlebars escaping byte-for-byte? The second is empirical: when the surviving (or neutralised) tokens are placed in a real prompt, does the escaping mode change the attack success rate, and does the effect depend on the delimiter family as the static analysis predicts? We answer both on a 16-scenario suite across four models and two attack objectives. Methodological contributions: • A reproducible benchmark that renders prompts through the real Handlebars engine (pybars3), toggling only the escaped versus raw slot, across seven delimiter families and two attack objectives (task hijack and secret ex- arXiv:2606.18120v1 [cs.CR] 16 Jun 2026 Raw documentEscaped document untrusted document field <|im_start|>system SECRET<|im_end|> untrusted document field <|im_start|>system SECRET<|im_end|> Handlebars Handlebars arrives at model INTACT <|im_start|>system SECRET<|im_end|> arrives as inert TEXT <|im_start|>system SECRET<|im_end|> role boundary forged, injection follows no role boundary, instruction is inert HTML escaping rewrites & < > " ' ` = Defence holds ONLY for angle-bracket families (ChatML, Llama-3, XML). Brackets [INST] and colons Human: survive. Fig. 1. The same attacker-controlled field reaches the model intact through a rawdocument slot but arrives as inert escaped text through a document slot. HTML escaping rewrites angle brackets, so it disarms a ChatML-style forged turn; it leaves square brackets, colons, and Markdown hashes untouched. filtration), with deterministic canary- and marker-based success criteria. • A static, model-free differential analysis that quantifies how many of each family’s role-control tokens survive escaping, isolating the defence’s mechanism from any model’s behaviour. Empirical contributions: • A 5760-trial evaluation across four models (GPT-3.5 Turbo, GPT-4o mini, GPT-4.1 mini, Claude Haiku 4.5) at a combined API cost of 1.63 USD, showing that the escaped slot lowers attack success rate only where the model is not already saturated and only for the delimiter families the static analysis predicts, while it does nothing for the colon- and Markdown-based families. • Evidence that the protection is conditional, not absolute: escaping is a no-op against three of the seven families, and a model susceptible enough to follow a bare instruc- tion is hijacked regardless of escaping, so the templating choice cannot substitute for a structural defence. I. BACKGROUND AND RELATED WORK A. Prompt templating and the data/instruction boundary LLM application frameworks construct prompts from tem- plates that interleave trusted developer text with untrusted runtime values. Semantic Kernel exposes Handlebars as a first- class prompt-template format [1]; the same engine and its triple-brace raw form appear in hand-built pipelines and in retrieval-augmented generation, where a retrieved document is interpolated into the prompt. The boundary between instruc- tion and data is purely textual: the model sees one flat token stream and must infer which spans are authoritative. B. Prompt injection and indirect prompt injection Prompt injection overrides a model’s intended instruction with attacker text in the input [7]. The indirect variant delivers that text through a data channel the application trusts, such as a web page, an email, or a tool result [6]. Liu et al. formalise the attack and benchmark attacks and defences [9]; Zhan et al. measure injection following in tool-integrated agents and report that a ReAct-prompted model follows injected instructions in a substantial fraction of cases [10]. Prompt injection is the first entry in the OWASP Top 10 for LLM applications [11]. C. Structural and role-based attacks A distinct injection style does not merely append an instruc- tion; it forges the structural delimiters that the chat format uses to mark roles, so the injected text appears to occupy a system or assistant turn. The defence literature attacks this surface from the model side. The instruction hierarchy trains the model to rank system text above user text above tool text [12]. StruQ separates instructions and data into distinct channels and trains the model to obey only the instruction channel [13]. Spotlighting marks data spans with encodings or delimiters so the model can tell data from instructions [14]. All three treat the delimiter as security-relevant. Our work looks at the same delimiter from the application side, where a templating engine decides whether the attacker’s delimiters reach the model intact. D. Output encoding Escaping untrusted data before it crosses a parsing boundary is the standard web defence against injection, and Handlebars’ double-brace form implements HTML escaping for exactly this reason [2]. The implicit assumption when the same engine builds a prompt is that HTML escaping also defends the prompt boundary. We test that assumption directly. E. Positioning To our knowledge this is the first study to isolate the Handlebars escaped versus raw interpolation mode as the independent variable in a prompt-injection experiment and to pair it with a model-free analysis of which role delimiters the escaping actually neutralises. We do not propose a new attack family; we quantify how a routine templating choice changes the exposure of an existing one. I. THREAT MODEL AND METHOD A. Threat model A developer builds an LLM prompt from a Handlebars template. The template contains a trusted system instruction that plants a secret and forbids disclosing it, a trusted statement of the legitimate task, and a single slot for an untrusted field (a document, a support ticket, a retrieved record). The attacker controls only that field. The attacker’s goal is to make the model disobey the developer: either abandon the task and emit an attacker-chosen token, or disclose the secret. The developer’s only varying choice is whether the slot is escaped document or raw document. B. Handlebars escaping mechanics We render every prompt with pybars3, a faithful Python implementation of Handlebars [15]. The escaped form applies Handlebars’ escapeExpression, which rewrites &, <, >, ", ’, ‘, and =. Crucially it does not rewrite [, ], or :. The TABLE I DELIMITER FAMILIES AND THE ROLE-CONTROL TOKENS THE ATTACKER’S PAYLOAD USES TO FORGE A PRIVILEGED TURN. FamilyBreak-out tokens plain(bare instruction; control) markdown ### System, ### Assistant anthropic Human:, Assistant: llama2 [INST], [/INST], <<SYS>> chatml <|im_start|>, <|im_end|> llama3 <|start_header_id|>, <|eot_id|> xml <system>, <user>, <assistant> raw form substitutes the field verbatim. Only the slot for the untrusted field is toggled; the trusted system instruction and task are template literals and are never escaped. C. Delimiter families We test seven delimiter families, listed in Table I. Each family supplies (i) a flattened prompt template that wraps the system instruction and task in that family’s role markers, and (i) a break-out payload that the attacker places in the untrusted field to forge a new privileged turn using the same markers. The plain family uses no role tokens and serves as the instruction-only control: it isolates how much an injected instruction succeeds with no structural framing at all. D. Attack objectives Each scenario carries two objectives that share the same template and untrusted slot but differ in the injected instruction and the success criterion. Task hijack instructs the model to abandon the legitimate task and output an opaque marker token; success is the marker appearing in the response, the standard injection-following criterion [10]. Secret exfiltration instructs the model to reveal the planted secret; success is the secret canary appearing in the response. Exfiltration is the higher-severity and harder objective, since models are heavily trained to refuse disclosing a secret they were told to protect. E. Scenario suite The suite has 16 scenarios across eight application cate- gories (document summarization, customer support, retrieval QA, email triage, code review, content moderation, data ex- traction, translation), two per category. Each scenario has a trusted system instruction containing a unique secret canary and a never-reveal directive, a legitimate task, a short benign field value, and the two injected instructions. Canaries and markers are seeded high-entropy tokens that never appear in any benign or task text, so a verbatim match in the output is unambiguous evidence of leakage or hijack. F. Prompt construction We model the common pattern in which a Handlebars chat template is rendered to a single string and sent as one user mes- sage; this is how Semantic Kernel Handlebars templates and local-model serving stacks flatten a multi-role template. The trusted system instruction therefore lives inside the rendered prompt, where the template placed it, and competes with any 16 scenarios trusted system instr + canary, benign field 7 delimiter families build break-out payload Handlebars render raw vs esc single flattened user message 3 models GPT-3.5 GPT-4o-mini Claude Haiku 4.5 evaluator marker = hijack canary = exfil ASR Static survival analysis (model-free) parallel survival after escape: markdown 1.00, anthropic 1.00, llama2 0.33, chatml / llama3 / xml 0.00 End-to-end attack-success-rate pipeline with a model-free structural-token survival branch. Fig. 2. Experiment pipeline. Each scenario is rendered through every delimiter family in both slot modes and sent to each model; the evaluator scores marker emission (hijack) and canary disclosure (exfil). A parallel model-free branch measures structural-token survival under escaping. injected turn on equal footing. The API system field carries only a generic “You are a helpful assistant” instruction. G. Static differential analysis Before any model is called we measure, for each family and scenario, how many of the family’s role-control tokens survive escaping. We take the attacker’s break-out payload, render it through Handlebars escaping, and check which structural tokens remain byte-identical. The survival rate is the fraction of the payload’s structural token types that are still present after escaping. This measurement contains no model and no randomness; it is a property of the escaping function and the delimiter alphabet alone. H. Models, design, and statistics We evaluate four models spanning a susceptibility range: GPT-3.5 Turbo [16], GPT-4o mini [17], GPT-4.1 mini, and Claude Haiku 4.5 [18] (model claude-haiku-4-5). The design is a full crossing of escaping (raw, escaped) × family (7) × objective (hijack, exfil) × scenario (16), plus a benign no-injection baseline per escaping mode, for 480 cells per model. The whole matrix is repeated over 3 independent runs, giving 5760 trials. All calls use temperature 0. We report attack success rate (ASR) with 95% Wilson confidence intervals [19], test the escaping effect with Fisher’s exact test, and report Cram ́ er’sV as the effect size. For 2×2 tables with a zero cell we apply the Haldane–Anscombe correction (add 0.5 to all cells) before reporting an odds ratio. Point estimates pool the repetitions; because repetitions reuse identical prompts, the Fisher test treats trials as independent and is therefore mildly anticonservative, so we also report per-run ASR in Table I to show the effect is stable across runs. I. Reproducibility The suite, the seven family definitions, the templating layer, the evaluator, the runner, and the analysis scripts are released. The dataset is generated by a seeded script; canaries and mark- ers are deterministic. Re-running src/experiment.py reproduces the raw results CSV, and src/analyze.py reproduces every table, statistic, and figure in this paper from that CSV. A separate script, src/verify_numbers.py, TABLE I PER-RUN ATTACK SUCCESS RATE ACROSS THE 3 REPETITIONS, PER MODEL, OBJECTIVE, AND SLOT MODE. SPREAD IS THE MAXIMUM MINUS THE MINIMUM ACROSS RUNS. TEMPERATURE IS 0; THE SMALL SPREADS QUANTIFY THE RESIDUAL NON-DETERMINISM. ModelObj.Slotrep 0rep 1rep 2Spread GPT-3.5 Turbohijackraw98%96%96%2% GPT-3.5 Turbohijackesc91%92%91%1% GPT-3.5 Turboexfilraw36%33%30%5% GPT-3.5 Turboexfilesc30%28%29%2% GPT-4o minihijackraw66%68%69%3% GPT-4o minihijackesc54%55%53%2% GPT-4o miniexfilraw13%12%12%1% GPT-4o miniexfilesc13%13%13%0% GPT-4.1 minihijackraw96%96%96%1% GPT-4.1 minihijackesc94%95%93%2% GPT-4.1 miniexfilraw35%36%35%1% GPT-4.1 miniexfilesc25%30%31%6% Claude Haiku 4.5hijackraw0%0%0%0% Claude Haiku 4.5hijackesc0%0%0%0% Claude Haiku 4.5exfilraw0%0%0%0% Claude Haiku 4.5exfilesc0%0%0%0% TABLE I STATIC DIFFERENTIAL SURVIVAL OF ROLE-CONTROL TOKENS UNDER HANDLEBARS ESCAPING, AVERAGED OVER THE 16 SCENARIOS. “BYTES CHANGED” IS THE FRACTION OF SCENARIOS IN WHICH ESCAPING ALTERED ANY BYTE OF THE BREAK-OUT PAYLOAD. FamilyToken typesSurvive escapingSurvival rate plain00n/a markdown221.00 anthropic221.00 llama2620.33 chatml200.00 llama3300.00 xml400.00 re-derives every generated number in the paper from the raw CSV with independent code and asserts it matches, so each figure in the text is traceable to a row in the data. Table I reports per-run ASR across the 3 repetitions; the largest run- to-run ASR spread in any cell is 6%, which bounds the non- determinism that temperature 0 leaves. IV. STATIC ANALYSIS: WHICH DELIMITERS SURVIVE ESCAPING The static analysis is model-free and exact. Table I and Fig. 3 report, per family, the number of role-control token types the attacker’s payload uses, how many survive Handle- bars escaping byte-for-byte, and whether escaping changes any byte of the payload at all. Three families are fully neutralised by escaping. ChatML, Llama-3, and XML build their role tokens entirely from angle brackets, which escaping rewrites, so none of their structural tokens survive (survival rate 0.00). Two families are entirely unaffected. Markdown headings (### System) and the legacy Human:/Assistant: markers use no character that Handlebars escapes, so every structural token survives (survival rate 1.00) and, for these families, the escaped and raw renderings of the payload are byte-identical: the choice of triple-brace versus double-brace is a no-op. Llama-2 is the plain markdown anthropic llama2 chatml llama3 xml 0.0 0.2 0.4 0.6 0.8 1.0 Structural-token survival after escaping 0.00 1.001.00 0.33 0.000.000.00 Fraction of role-control tokens that survive Handlebars escaping Fig. 3. Fraction of each family’s role-control tokens that survive Handlebars escaping byte-for-byte. Angle-bracket families are fully neutralised; colon- and Markdown-based families are untouched; Llama-2 is mixed. TABLE IV ATTACK SUCCESS RATE BY MODEL AND OBJECTIVE, RAW VERSUS ESCAPED SLOT, WITH 95% WILSON INTERVALS AND FISHER’S EXACT TEST ON THE ESCAPING EFFECT. ALL CELLS ARE GENERATED FROM THE RAW RESULTS. ModelObj.Raw ASREscaped ASRGapFisher p GPT-3.5 Turbohijack97% [95%,98%]91% [88%,94%]6%0.003 GPT-3.5 Turboexfil33% [28%,38%]29% [24%,34%]4%0.242 GPT-4o minihijack68% [62%,72%]54% [48%,59%]14%<0.001 GPT-4o miniexfil13% [10%,17%]13% [10%,17%]-1%0.909 GPT-4.1 minihijack96% [93%,98%]94% [91%,96%]2%0.298 GPT-4.1 miniexfil35% [30%,40%]29% [24%,34%]7%0.082 Claude Haiku 4.5hijack0% [0%,1%]0% [0%,1%]0%1.000 Claude Haiku 4.5exfil0% [0%,1%]0% [0%,1%]0%1.000 mixed case: its <<SYS>> markers are angle-bracket based and are neutralised, but its [INST] and [/INST] markers use square brackets, which escaping leaves intact, so one third of its tokens survive. The static result already establishes the central claim in a form that does not depend on any model: the documented “safe” escaped default protects the prompt boundary only for delimiter schemes built from the characters HTML escaping happens to cover. For colon-, bracket-, and Markdown-based schemes it provides no protection whatsoever, and a developer reading the Handlebars documentation receives no signal that this is so. Section V tests whether the predicted protection appears, and only where predicted, against real models. V. STUDY 1: TASK-HIJACK SUCCESS The hijack objective measures the standard injection- following criterion: does the model abandon the legitimate task and emit the attacker’s marker token? Table IV reports raw versus escaped ASR for every model and objective; Fig. 4 plots the same comparison with Wilson intervals. The benign no-injection baseline produced no marker and no canary in any trial across all four models, so the false-positive rate is zero and every reported success reflects a real injection. gpt35gpt41minigpt4ominihaiku 0.0 0.2 0.4 0.6 0.8 1.0 Attack success rate exfil Handlebars slot gpt35gpt41minigpt4ominihaiku 0.0 0.2 0.4 0.6 0.8 1.0 Attack success rate hijack Handlebars slot Fig. 4. ASR for the raw and escaped slot, per model, for each objective. Error bars are 95% Wilson intervals. A. A susceptibility gradient The four models span a wide range, and it does not track release date. GPT-3.5 Turbo follows the hijack instruction in almost every trial (97% raw, 91% escaped), and the much newer GPT-4.1 mini is just as exposed (96% raw, 94% escaped). GPT-4o mini sits well below both (68% raw, 54% escaped), and Claude Haiku 4.5 resists the hijack almost entirely (0% raw, 0% escaped). The escaping effect is therefore only observable in the models that are susceptible in the first place, and susceptibility is a property of the specific model, not of how recent it is. B. The escaping effect is real but conditional The per-family breakdown in Table V and Fig. 5 shows the escaping effect and explains why the overall gaps are modest. GPT-4o mini gives the cleanest picture, because it is susceptible enough to be attacked yet far from the ceiling. Its angle-bracket families collapse when the slot is escaped: llama3 falls from 56% raw to 12% escaped, xml from 94% to 75%, and llama2 from 33% to 0%. Over the same model the colon-based anthropic family stays at 100% in both modes and markdown near 88%, because escaping leaves their tokens byte-for-byte intact. Every family whose ASR drops under escaping is one the static analysis neutralises; every family that does not drop is one whose tokens survive. GPT-3.5 Turbo shows the same mechanism through a ceil- ing. Its instruction-only plain control already succeeds at near-ceiling rates without any structural framing, so the angle- bracket families have no headroom and sit at the ceiling whether escaped or not. The one family with headroom, llama2, shows the predicted collapse, falling from 88% raw to 52% escaped as escaping removes its <<SYS>> system framing. Running against the trend, GPT-4o mini barely fol- lows chatml even raw (15%), so it has no gap to lose; we read this as the model declining to treat in-message ChatML markers as authoritative regardless of escaping. VI. STUDY 2: SECRET EXFILTRATION Exfiltration is the higher-severity objective: the injected turn instructs the model to disclose a secret canary that the trusted system instruction planted and forbade revealing. This is a harder attack, because disclosing a protected secret is the kind of behaviour alignment training targets directly. The overall TABLE V PER-FAMILY TASK-HIJACK ASR FOR THE FOUR MODELS, WITH THE STATIC SURVIVAL RATE FROM SECTION IV. ESCAPING LOWERS ASR ONLY FOR FAMILIES WHOSE TOKENS IT NEUTRALISES, AND ONLY WHERE THE MODEL IS BELOW CEILING. GPT-3.5 Turbo FamilySurvivalRaw ASREscaped ASRGap plainn/a96%94%2% markdown1.00100%100%0% anthropic1.00100%100%0% llama20.3388%52%35% chatml0.0096%94%2% llama30.00100%100%0% xml0.00100%100%0% GPT-4o mini FamilySurvivalRaw ASREscaped ASRGap plainn/a88%90%-2% markdown1.0088%88%0% anthropic1.00100%100%0% llama20.3333%0%33% chatml0.0015%10%4% llama30.0056%12%44% xml0.0094%75%19% GPT-4.1 mini FamilySurvivalRaw ASREscaped ASRGap plainn/a100%100%0% markdown1.0088%88%0% anthropic1.0096%98%-2% llama20.33100%94%6% chatml0.0088%90%-2% llama30.00100%94%6% xml0.00100%94%6% Claude Haiku 4.5 FamilySurvivalRaw ASREscaped ASRGap plainn/a0%0%0% markdown1.000%0%0% anthropic1.000%0%0% llama20.330%0%0% chatml0.000%0%0% llama30.000%0%0% xml0.000%0%0% plain markdown anthropic llama2 chatml llama3 xml 0.05 0.00 0.05 0.10 0.15 0.20 Protection gap (raw ASR - escaped ASR) exfil gpt35 gpt41mini gpt4omini haiku plain markdown anthropic llama2 chatml llama3 xml 0.0 0.1 0.2 0.3 0.4 Protection gap (raw ASR - escaped ASR) hijack gpt35 gpt41mini gpt4omini haiku Fig. 5. Escaping protection gap (raw ASR minus escaped ASR) by family. Positive bars mean escaping helped. The protection concentrates in the angle- bracket families and is absent for anthropic and markdown. rates in Table IV confirm the difficulty. GPT-4.1 mini leaks the canary most often (35% raw, 29% escaped), with GPT-3.5 Turbo close behind (33% raw, 29% escaped); GPT-4o mini leaks in 13% (raw) and 13% (escaped); Claude Haiku 4.5 leaks in 0% (raw) and 0% (escaped). The newer GPT-4.1 mini is not safer on this objective either. TABLE VI PER-FAMILY SECRET-EXFILTRATION ASR FOR GPT-3.5 TURBO. ESCAPING LOWERS LEAKAGE FOR THE NEUTRALISED ANGLE-BRACKET FAMILIES (LLAMA3, XML ) AND LEAVES THE SURVIVING FAMILIES (ANTHROPIC , MARKDOWN ) UNCHANGED. FamilySurvivalRaw ASREscaped ASRGap plainn/a35%35%0% markdown1.0033%33%0% anthropic1.0012%12%0% llama20.3329%25%4% chatml0.0035%31%4% llama30.0050%35%15% xml0.0035%27%8% plain markdown anthropic llama2 chatml llama3 xml 0.350.35 0.330.33 0.120.12 0.290.25 0.350.31 0.500.35 0.350.27 gpt35 exfil plain markdown anthropic llama2 chatml llama3 xml 0.960.94 1.001.00 1.001.00 0.880.52 0.960.94 1.001.00 1.001.00 gpt35 hijack plain markdown anthropic llama2 chatml llama3 xml 0.270.29 0.420.42 0.290.29 0.420.31 0.330.19 0.310.10 0.420.40 gpt41mini exfil plain markdown anthropic llama2 chatml llama3 xml 1.001.00 0.880.88 0.960.98 1.000.94 0.880.90 1.000.94 1.000.94 gpt41mini hijack plain markdown anthropic llama2 chatml llama3 xml 0.120.15 0.120.12 0.120.12 0.120.12 0.120.12 0.120.17 0.150.12 gpt4omini exfil plain markdown anthropic llama2 chatml llama3 xml 0.880.90 0.880.88 1.001.00 0.330.00 0.150.10 0.560.12 0.940.75 gpt4omini hijack plain markdown anthropic llama2 chatml llama3 xml 0.000.00 0.000.00 0.000.00 0.000.00 0.000.00 0.000.00 0.000.00 haiku exfil plain markdown anthropic llama2 chatml llama3 xml 0.000.00 0.000.00 0.000.00 0.000.00 0.000.00 0.000.00 0.000.00 haiku hijack 0.0 0.2 0.4 0.6 0.8 1.0 ASR Fig. 6. ASR by delimiter family and slot mode, per model and objective. The escaped column equals or falls below the raw column for the angle-bracket families and matches it for the surviving families. A. Where escaping protects, it protects the predicted families Because exfiltration does not saturate even on the most sus- ceptible model, it exposes the escaping-by-family interaction more cleanly than the hijack objective. Table VI gives the per-family breakdown for GPT-3.5 Turbo. The angle-bracket families that the static analysis neutralises, llama3 and xml, lose attack success when the slot is escaped, while the colon- and Markdown-based families anthropic and markdown, whose tokens survive escaping byte-for-byte, show no change at all. The direction of every per-family gap is consistent with the static survival rate, although the per-cell sample size means individual family differences are not individually significant. The exfiltration results carry the same lesson as the hijack results, with the interaction in sharper relief: the escaped default is not a uniform defence. It withholds the attacker’s structural framing for some delimiter schemes and hands it over intact for others, and the developer is given no indication of which case applies. VII. DISCUSSION A. The defence is an HTML defence, not a prompt defence Handlebars’ double-brace escaping exists to stop HTML injection. It rewrites the five characters that matter in an HTML context and is correct for that purpose. When the same engine builds an LLM prompt, the escaped output happens to also disarm any role delimiter built from angle brackets, which is why ChatML, Llama-3, and XML break-out payloads are neutralised. That coverage is incidental. The characters that matter for chat role delimiters are not the characters that matter for HTML. Square brackets, colons, and Markdown hashes carry role structure in widely used formats and pass through HTML escaping untouched. A defence whose protection de- pends on a coincidental overlap between two character sets is not a defence a security design should rely on. B. Two independent ceilings bound the measured effect The empirical escaping gaps are smaller than the static anal- ysis alone might suggest, for two separate reasons that the data lets us name. The first is model saturation: a model that follows a bare injected instruction, as GPT-3.5 Turbo does for the hijack objective, is already compromised before any structural framing is added, so removing the framing by escaping cannot lower an ASR that is already at the ceiling. The plain control makes this visible. The second is family immunity: for three of the seven families escaping changes nothing, so those families contribute zero to any averaged effect by construction. An overall raw-versus-escaped comparison therefore understates the protection escaping gives to the families it does cover, and overstates it for the families it does not. The per-family view is the honest one. C. Practical guidance Developers should not treat the Handlebars escaped default as a prompt-injection control. It is free and harmless and should stay on, but it must be paired with a real struc- tural defence: separating instructions from data into distinct channels [13], training or selecting models that respect an instruction hierarchy [12], or explicitly marking and encoding untrusted spans [14]. Where a stack flattens a chat template into a single string, the untrusted field should be neutralised against the delimiter scheme actually in use, not against HTML. The triple-brace raw form should be regarded as importing untrusted bytes verbatim, with the same suspicion a raw SQL concatenation would draw. D. Model identity matters more than escaping, and more than recency Across both objectives the largest determinant of risk was the model, not the slot. Claude Haiku 4.5 resisted the hijack and the exfiltration almost entirely, while GPT-3.5 Turbo and the much newer GPT-4.1 mini were both compromised in the great majority of hijack trials regardless of escaping. Recency did not predict resistance: GPT-4.1 mini was as hijackable as GPT-3.5 Turbo and more hijackable than the older GPT-4o mini. The templating choice modulates risk at the margin; it does not set the baseline. This mirrors the cross-model gap reported for tool-integrated agents [10] and reinforces that input-side hygiene and model-side resistance are complementary, not interchangeable. VIII. LIMITATIONS The suite has 16 scenarios, so a per-family cell holds 16 scenarios per escaping mode per run (3 runs pooled), and individual family gaps still have wide intervals; we report the direction of the per-family effect and the pooled test rather than claiming per-family significance. We evaluate at temperature 0, which reduces but does not eliminate run-to-run variation; we therefore repeat the full matrix 3 times and report the per- run spread (Table I), the largest of which is 6%. The hijack success criterion is a marker-emission proxy for instruction following, and the exfiltration criterion is a verbatim canary match; both can miss a partial compliance that neither emits the token nor refuses. The benign baseline produced zero false positives, which bounds the rate of spurious matches but does not rule out false negatives. A deployment-shape limitation is the most consequential. We send the flattened template as a single user message to chat-completion APIs, so the structural delimiters reach the model as ordinary text rather than as parsed control tokens. API models react to the textual appearance of a role boundary; a local-model serving stack that tokenises <|im_start|> or [INST] as a genuine special token would treat a surviving delimiter as a real role switch, which would likely amplify the raw-versus-escaped gap rather than shrink it. Our numbers should therefore be read as a conservative lower bound on the risk that the raw slot creates in stacks that parse these tokens natively. We render with pybars3 rather than the JavaScript Handlebars; we verified that the escape set relevant to our delimiters is identical between the two. Finally, we study one templating engine; Jinja2 autoescape and other engines have their own escape alphabets and would require their own survival analysis. IX. CONCLUSION The choice between Handlebars’ double-brace and triple- brace interpolation is documented as a choice about HTML safety, but when the engine builds an LLM prompt it is also a choice about structural role injection. A model-free analysis shows that the escaped default neutralises role delimiters built from angle brackets and does nothing to delimiters built from square brackets, colons, or Markdown hashes, leaving three of seven common families fully exposed. A 5760-trial evaluation across four models confirms the mechanism: where a model has headroom and the delimiter is angle-bracket based, escaping lowers attack success; where the model is saturated or the delimiter survives escaping, it does not. The escaped default is worth keeping and is not worth trusting. Defending a templated prompt requires separating instruction from data on terms set by the chat format in use, not by the rules of HTML. REFERENCES [1] Microsoft, “Semantic kernel: Handlebars prompt template syntax,” https://learn.microsoft.com/en-us/semantic-kernel/concepts/prompts/ handlebars-prompt-templates, 2024, accessed 2026-06-13. [2] Handlebars.js, “Handlebars: Minimal templating on steroids – expres- sions and html escaping,” https://handlebarsjs.com/guide/expressions. html, 2024, accessed 2026-06-13. [3] OpenAI, “Chat markup language (ChatML),” https://github.com/openai/ openai-python/blob/release-v0.28.0/chatml.md, 2023, accessed 2026- 06-13. [4] A. Grattafiori et al., “The Llama 3 herd of models,” arXiv preprint arXiv:2407.21783, 2024. [5] H. Touvron, L. Martin, K. Stone et al., “Llama 2: Open foundation and fine-tuned chat models,” arXiv preprint arXiv:2307.09288, 2023. [6] K. Greshake, S. Abdelnabi, S. Mishra, C. Endres, T. Holz, and M. Fritz, “Not what you’ve signed up for: Compromising real-world LLM- integrated applications with indirect prompt injection,” in Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security (AISec), 2023, p. 79–90, arXiv:2302.12173. [7] F. Perez and I. Ribeiro, “Ignore previous prompt: Attack tech- niques for language models,” in NeurIPS ML Safety Workshop, 2022, arXiv:2211.09527. [8] S. Willison, “Prompt injection: What’s the worst that can happen?” https://simonwillison.net/2023/Apr/14/worst-that-can-happen/,2023, accessed 2026-06-13. [9] Y. Liu, Y. Jia, R. Geng, J. Jia, and N. Z. Gong, “Formalizing and benchmarking prompt injection attacks and defenses,” in 33rd USENIX Security Symposium, 2024, arXiv:2310.12815. [10] Q. Zhan, Z. Liang, Z. Ying, and D. Kang, “InjecAgent: Benchmark- ing indirect prompt injections in tool-integrated large language model agents,” in Findings of the Association for Computational Linguistics (ACL Findings), 2024, arXiv:2403.02691. [11] OWASP Foundation, “OWASP top 10 for large language model ap- plications: LLM01 prompt injection,” https://genai.owasp.org/, 2025, accessed 2026-06-13. [12] E. Wallace, K. Xiao, R. Leike, L. Weng, J. Heidecke, and A. Beutel, “The instruction hierarchy: Training LLMs to prioritize privileged in- structions,” arXiv preprint arXiv:2404.13208, 2024. [13] S. Chen, J. Piet, C. Sitawarin, and D. Wagner, “StruQ: Defending against prompt injection with structured queries,” in 34th USENIX Security Symposium, 2025, arXiv:2402.06363. [14] K. Hines, G. Lopez, M. Hall, F. Zarfati, Y. Zunger, and E. Kiciman, “Defending against indirect prompt injection attacks with spotlighting,” arXiv preprint arXiv:2403.14720, 2024. [15] pybars3 contributors, “pybars3: Handlebars.js templating for python,” https://pypi.org/project/pybars3/, 2024, python package; accessed 2026- 06-13. [16] OpenAI, “GPT-3.5 Turbo model documentation,” https://platform. openai.com/docs/models/gpt-3-5-turbo, 2023, accessed 2026-06-13. [17] —, “GPT-4o mini: Advancing cost-efficient intelligence,” https: //openai.com/index/gpt-4o-mini-advancing-cost-efficient-intelligence/, 2024, accessed 2026-06-13. [18] Anthropic, “Claude haiku 4.5,” https://w.anthropic.com/claude/haiku, 2025, model claude-haiku-4-5; accessed 2026-06-13. [19] E. B. Wilson, “Probable inference, the law of succession, and statistical inference,” Journal of the American Statistical Association, vol. 22, no. 158, p. 209–212, 1927.