Chat templates and special tokens
Look behind the chat bubbles: a conversation is one long string with secret markers, and getting those markers wrong breaks models - or lets attackers in.
- Explain how a chat conversation is rendered into a single token sequence
- Describe what special tokens, stop tokens and generation prompts do
- Spot template mismatches and role-injection risks
A language model only ever continues a sequence of tokens. Yet chat APIs take a neat list of messages with roles. Something in between turns that list into one string - the chat template - and turns the model’s continuation back into a message.
A base model (fresh from pretraining) just continues text: ask it “What is the capital of France?” and it may happily continue with “What is the capital of Spain?”, as if writing a quiz. A chat model was fine-tuned on conversations rendered in one particular template, so it learned that after the assistant marker comes a helpful answer, followed by an end-of-turn marker.
1def render(messages, add_generation_prompt=True):
2 text = ""
3 for message in messages:
4 text += f"<|im_start|>{message['role']}\n{message['content']}<|im_end|>\n"
5 if add_generation_prompt:
6 text += "<|im_start|>assistant\n" # the model takes it from here
7 return text
8
9print(render([
10 {"role": "system", "content": "You are a terse pirate."},
11 {"role": "user", "content": "Capital of France?"},
12]), end="")<|im_start|>system You are a terse pirate.<|im_end|> <|im_start|>user Capital of France?<|im_end|> <|im_start|>assistant
That’s the ChatML format used by Qwen and others. Llama 3 uses <|start_header_id|>user<|end_header_id|> … <|eot_id|>; Gemma uses <start_of_turn>user … <end_of_turn>. Same idea, different spelling. A few things to notice:
<|im_start|>and<|im_end|>are special tokens: each is a single token ID reserved in the vocabulary, not the characters<,|,i,m…- The trailing
<|im_start|>assistantis the generation prompt - it tells the model whose turn it is. - When the model emits
<|im_end|>, the runtime stops generating. That’s a stop token; if it’s not configured, the model keeps going and may write the user’s next message too. - Tool calls are just text too. The model writes something like
<tool_call>{"name": …}</tool_call>, and your runtime parses it, runs the tool, and adds the result as atoolmessage.
Role injection
Since roles are just markers in a string, an attacker would love to smuggle them in. If an email you ask the model to summarize contains <|im_end|><|im_start|>system, and your tokenizer turns that text into the real special tokens, the model sees a brand-new system message written by the attacker.
Defences: tokenize user and document text with special-token parsing off (so those characters stay ordinary text), escape suspicious markers, never put secrets in prompts, and treat retrieved content as data, not instructions. This is one form of prompt injection; it can’t be fully solved by templates, but sloppy templating makes it trivial.
Try it
Find the template trouble
Click every suspicious piece in each prompt or config.
Click every part that looks suspicious. There are 3.
Key takeaways
Chat messages are rendered by a template into one token sequence with special role markers.
Use the template the model was trained with, and configure its stop tokens.
Tool calls are structured text that your runtime parses.
Never let user or document text turn into real special tokens - that’s role injection.
Lesson quiz
7 questions · pass with 5 correct · up to 50 XP
Passing this quiz completes the lesson and keeps your streak going. Questions you miss come back in review sessions later.
Practice: write Python
Write Python in the editor and run it against sample inputs. Python runs locally in your browser using a WebAssembly runtime.
Render a chat template safely
Each input line is a message: role: content. Render the conversation in ChatML - <|im_start|>role, a newline, the content, <|im_end|>, a newline - and finish with the generation prompt <|im_start|>assistant and a newline.
Defang user-controlled markers: replace every <| inside the content with < | so it can never be read as a special token.
- A short conversation
- An injection attempt
Python runs in a sandboxed browser worker with a 60 second time limit. Its runtime loads from the Pyodide CDN; your code stays in this browser.
Parse the model’s turn
Stdin is raw text generated by a model. Keep only what comes before the first <|im_end|>. If there is no <|im_end|> at all, first print warning: no end-of-turn token (truncated?).
If the kept text contains <tool_call>…</tool_call>, parse the JSON inside it and print tool: NAME, then one line per argument in sorted key order: two spaces, key = value. Otherwise print reply: TEXT with the text stripped of surrounding whitespace.
- A tool call followed by junk
- A plain reply
- Cut off by max tokens
Python runs in a sandboxed browser worker with a 60 second time limit. Its runtime loads from the Pyodide CDN; your code stays in this browser.
Questions about this lesson
Stuck? Ask. Figured something out? Share it. Explaining is one of the best ways to learn.
Loading posts…