[GH-ISSUE #3679] [Feature] LLM prompt-package reverse engineering: Jinja chat templates, prompt DSLs, presets and multi-message assembly reconstruction #1392

New issue

Open

opened 2026-10-16 21:05:02 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:05:02 +00:00

Owner

Originally created by @matbrgz on GitHub (Oct 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3679

Summary

In modern AI applications and agent frameworks, the final text stream submitted to a foundation model is synthesized through a multi-stage Prompt Packaging pipeline. Prompt packaging pipelines combine:

Jinja2 Chat Templates: Declarative template logic iterating over conversation histories, formatting tool definitions, and applying generation delimiters;
Prompt DSLs & Frameworks: LangChain prompt templates, Semantic Kernel templates, LlamaIndex prompt specifications, and Guidance/Outlines grammar templates;
Model Presets & Hyperparameters: Sampling presets, repetition constraints, and stop sequences;
Multi-Message Assembly: Injecting developer personas, few-shot demonstration pairs, dynamic tool result payloads, and user messages.

While issue #3323 touches upon embedded chat template strings inside GGUF metadata, it does not analyze external prompt packages, prompt DSLs, or dynamic message assembly pipelines.

This feature proposal introduces dedicated LLM Prompt-Package Reverse Engineering to REA, enabling static de-sugaring of Jinja templates, parsing of prompt DSLs, simulation of multi-message assembly, and exact reconstruction of the final tokenized prompt sent to language models.

Technical Capabilities & Architecture

                                    +-----------------------------------------+
                                    | Input: Prompt Package (Jinja, YAML,     |
                                    |        JSON, LangChain prompt template) |
                                    +--------------------+--------------------+
                                                         |
                         +-------------------------------+-------------------------------+
                         |                                                               |
                         v                                                               v
           +---------------------------+                                   +---------------------------+
           | Jinja2 Chat Template      |                                   | Prompt DSL & Template     |
           | AST Parser                |                                   | Extractor (LangChain/SK)  |
           +-------------+-------------+                                   +-------------+-------------+
                         |                                                               |
                         +-------------------------------+-------------------------------+
                                                         |
                                                         v
                                     +---------------------------------------+
                                     | Dynamic Variable & Slot Identifier    |
                                     | (User inputs, system state, tools)    |
                                     +-------------------+-------------------+
                                                         |
                         +-------------------------------+-------------------------------+
                         |                                                               |
                         v                                                               v
           +---------------------------+                                   +---------------------------+
           | Multi-Message Assembler   |                                   | Delimiter & Stop-Sequence |
           | (System, User, Tool turns)|                                   | Inversion (<|im_start|>)  |
           +-------------+-------------+                                   +-------------+-------------+
                                                         |
                                                         v
                                     +---------------------------------------+
                                     | REA Evidence: Assembled Prompt Trace, |
                                     | Template Logic & Variable Schema      |
                                     +---------------------------------------+

1. Jinja2 Chat Template AST Inversion

Template Parser: Statically parse Jinja2 template syntax without executing arbitrary Python:
- Control tags: {% for message in messages %}, {% if message['role'] == 'system' %}, {% set ... %}.
- Variable filters: | trim, | tojson, | default.
- Macro definitions and template comments.
Role & Delimiter Mapping: Extract header tokens (e.g. <|im_start|>system\n, <|start_header_id|>assistant<|end_header_id|>) and trailing generation prompts.

2. Prompt DSL & Preset Ingestion

Framework Templates: Parse structured prompt definitions from popular libraries:
- LangChain ChatPromptTemplate and PromptTemplate JSON/YAML specifications.
- Microsoft Semantic Kernel skprompt.txt and config.json.
- OpenAI Assistants API prompt packages.
Model Presets: Extract generation stop tokens (e.g. ["<|im_end|>", "<|end_of_text|>"]), logit biases, and frequency/presence penalties.

3. Multi-Message Assembly Simulation

Sample Dialogue Simulation: Feed mock conversation histories (system instructions, user query, tool invocation request, tool return payload) into the template engine.
Byte-Accurate Assembly: Generate the exact string output produced by the template, verifying token boundaries and whitespace handling.

4. Vulnerability & Injection Surface Auditing

Unescaped Slot Auditing: Identify template slots where untrusted user input is directly concatenated without delimiter sanitization, highlighting prompt injection vectors.
System Prompt Leaking Risk: Evaluate whether the template enforces strict role separation or allows user messages to spoof system headers.

Acceptance Criteria

Introduce analyze_prompt_package in REA CLI and MCP contracts, accepting .jinja, .yaml, and .json prompt files.
Ingest synthetic Jinja2 chat templates and extract role conditions and delimiter tokens into structured JSON.
Parse LangChain and Semantic Kernel prompt templates and identify input variable schemas.
Simulate multi-turn conversation assembly and produce verified byte-accurate prompt text.
Detect prompt injection vulnerabilities where user input slots bypass role boundaries.

#3651 [Feature] LLM application reverse engineering
#3653 [Feature] LLM tokenizer reverse engineering
#3323 [Feature] Inspect GGUF and safetensors model files without loading them

Originally created by @matbrgz on GitHub (Oct 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3679 [![Type: Feature](https://img.shields.io/badge/type-feature-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Domain: Game & Engine RE](https://img.shields.io/badge/domain-game_&_engine_RE-green.svg?style=flat-square)](https://github.com/morluto/rea) [![Status: Proposed](https://img.shields.io/badge/status-proposed-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Ecosystem: REA](https://img.shields.io/badge/ecosystem-morluto%2Frea-8A2BE2.svg?style=flat-square)](https://github.com/morluto/rea) ## Summary In modern AI applications and agent frameworks, the final text stream submitted to a foundation model is synthesized through a multi-stage **Prompt Packaging** pipeline. Prompt packaging pipelines combine: - **Jinja2 Chat Templates:** Declarative template logic iterating over conversation histories, formatting tool definitions, and applying generation delimiters; - **Prompt DSLs & Frameworks:** LangChain prompt templates, Semantic Kernel templates, LlamaIndex prompt specifications, and Guidance/Outlines grammar templates; - **Model Presets & Hyperparameters:** Sampling presets, repetition constraints, and stop sequences; - **Multi-Message Assembly:** Injecting developer personas, few-shot demonstration pairs, dynamic tool result payloads, and user messages. While issue #3323 touches upon embedded chat template strings inside GGUF metadata, it does not analyze external prompt packages, prompt DSLs, or dynamic message assembly pipelines. This feature proposal introduces dedicated **LLM Prompt-Package Reverse Engineering** to REA, enabling static de-sugaring of Jinja templates, parsing of prompt DSLs, simulation of multi-message assembly, and exact reconstruction of the final tokenized prompt sent to language models. --- ## Technical Capabilities & Architecture ``` +-----------------------------------------+ | Input: Prompt Package (Jinja, YAML, | | JSON, LangChain prompt template) | +--------------------+--------------------+ | +-------------------------------+-------------------------------+ | | v v +---------------------------+ +---------------------------+ | Jinja2 Chat Template | | Prompt DSL & Template | | AST Parser | | Extractor (LangChain/SK) | +-------------+-------------+ +-------------+-------------+ | | +-------------------------------+-------------------------------+ | v +---------------------------------------+ | Dynamic Variable & Slot Identifier | | (User inputs, system state, tools) | +-------------------+-------------------+ | +-------------------------------+-------------------------------+ | | v v +---------------------------+ +---------------------------+ | Multi-Message Assembler | | Delimiter & Stop-Sequence | | (System, User, Tool turns)| | Inversion (<|im_start|>) | +-------------+-------------+ +-------------+-------------+ | v +---------------------------------------+ | REA Evidence: Assembled Prompt Trace, | | Template Logic & Variable Schema | +---------------------------------------+ ``` ### 1. Jinja2 Chat Template AST Inversion - **Template Parser:** Statically parse Jinja2 template syntax without executing arbitrary Python: - Control tags: `{% for message in messages %}`, `{% if message['role'] == 'system' %}`, `{% set ... %}`. - Variable filters: `| trim`, `| tojson`, `| default`. - Macro definitions and template comments. - **Role & Delimiter Mapping:** Extract header tokens (e.g. `<|im_start|>system\n`, `<|start_header_id|>assistant<|end_header_id|>`) and trailing generation prompts. ### 2. Prompt DSL & Preset Ingestion - **Framework Templates:** Parse structured prompt definitions from popular libraries: - LangChain `ChatPromptTemplate` and `PromptTemplate` JSON/YAML specifications. - Microsoft Semantic Kernel `skprompt.txt` and `config.json`. - OpenAI Assistants API prompt packages. - **Model Presets:** Extract generation stop tokens (e.g. `["<|im_end|>", "<|end_of_text|>"]`), logit biases, and frequency/presence penalties. ### 3. Multi-Message Assembly Simulation - **Sample Dialogue Simulation:** Feed mock conversation histories (system instructions, user query, tool invocation request, tool return payload) into the template engine. - **Byte-Accurate Assembly:** Generate the exact string output produced by the template, verifying token boundaries and whitespace handling. ### 4. Vulnerability & Injection Surface Auditing - **Unescaped Slot Auditing:** Identify template slots where untrusted user input is directly concatenated without delimiter sanitization, highlighting prompt injection vectors. - **System Prompt Leaking Risk:** Evaluate whether the template enforces strict role separation or allows user messages to spoof system headers. --- ## Acceptance Criteria 1. Introduce `analyze_prompt_package` in REA CLI and MCP contracts, accepting `.jinja`, `.yaml`, and `.json` prompt files. 2. Ingest synthetic Jinja2 chat templates and extract role conditions and delimiter tokens into structured JSON. 3. Parse LangChain and Semantic Kernel prompt templates and identify input variable schemas. 4. Simulate multi-turn conversation assembly and produce verified byte-accurate prompt text. 5. Detect prompt injection vulnerabilities where user input slots bypass role boundaries. --- ## Related - #3651 [Feature] LLM application reverse engineering - #3653 [Feature] LLM tokenizer reverse engineering - #3323 [Feature] Inspect GGUF and safetensors model files without loading them

bsakaguchi referenced this issue

2026-10-17 21:01:32 +00:00

[GH-ISSUE #2383] [Tracker] Audit analysis and debugging coverage for the TIOBE top 100 languages (October 2026) #794

bsakaguchi referenced this issue

2026-10-17 21:10:59 +00:00

[PR #1392] [CLOSED] fix(javascript): root application graphs at the application manifest #2849