Implementation guide
OWASP AISVS v1.01
Input Validation · Prompt Injection Defenses
Stop special tokens being injected
Verify that reserved special tokens are encoded as literal characters and cannot be injected into the model context.
OWASP AISVS v1.01, requirement 2.1.7
In plain English
Models use reserved control tokens to mark where a system message or a turn begins and ends. If a user can type one of those markers and have it treated as the real thing, they can forge a system message. Make sure such strings in untrusted text reach the model as ordinary characters.
What good looks like
- Text from users, documents and tools is tokenised so that reserved token strings become plain text.
- Tests send the model's own reserved strings as input and confirm they have no special effect.
- The tests are repeated when you change model, tokeniser or chat template.
How teams usually do it
- With a hosted model, use the provider's chat API with separate roles and never assemble a raw prompt string yourself. The provider then handles the encoding.
- With a self-hosted model, tokenise untrusted text with special-token parsing turned off (in Hugging Face tokenisers, split_special_tokens=True; in tiktoken, the default disallowed_special behaviour) and add the control tokens yourself around it.
- As a second layer, strip or escape known marker strings such as <|im_start|> in the input layer.
Suggested evidence
- The code that builds prompts, showing how untrusted text is tokenised.
- Test cases containing the model's reserved token strings, with results.
Common mistakes
- Building a raw prompt for a self-hosted model by joining strings, then tokenising the whole thing with special tokens enabled.
- Testing with one model's tokens and then moving to a model that uses different ones.
- Forgetting that chat templates differ between models, and are sometimes changed by fine-tuning.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.