hacnho/gguf-eos-token-id-eog-stop-poc

GGUF eos_token_id EOG Stop PoC

This repository contains a benign security research proof of concept for a GGUF model-file output-manipulation issue in llama.cpp.

The malicious artifact changes tokenizer.ggml.eos_token_id to token ID 9259, whose piece is Hello. llama.cpp treats the configured EOS token as an end-of-generation token, so deterministic generation stops when that normal text token is selected.

Files:

• gemma-4-1B-0.8B-tiny.Q2_K.eos-hello.gguf
• reproduce.py

The control model is public here:

https://huggingface.co/mradermacher/gemma-4-1B-0.8B-tiny-GGUF/resolve/main/gemma-4-1B-0.8B-tiny.Q2_K.gguf

Reproduce:

curl -L -o control.gguf \
  https://huggingface.co/mradermacher/gemma-4-1B-0.8B-tiny-GGUF/resolve/main/gemma-4-1B-0.8B-tiny.Q2_K.gguf
python reproduce.py control.gguf gemma-4-1B-0.8B-tiny.Q2_K.eos-hello.gguf
modelscan -p gemma-4-1B-0.8B-tiny.Q2_K.eos-hello.gguf

Expected result:

• control output line is <bos>HelloHelloHelloHelloHelloHelloHello
• malicious output line is <bos>Hello
• modelscan==0.8.8 reports No issues found