Reject spoofed audio markers and reserved tokens in transcripts - #116
Merged
Conversation
Addresses review findings #3 (P0, marker spoofable from user text) and #16 (P2, transcript tokenized with special tokens parsed) — the same defect in opposite directions. <|audio|> is a registered special token, so text a caller types is tokenized into the *real* marker. vLLM pairs markers with audio items positionally and stops once every item is matched, appending the rest of the prompt verbatim, so an extra marker is not an error: the leftmost one wins the transcript and vLLM's own _validate_mm_placeholders still sees matching counts and passes. A caller could therefore move the transcript to a position of their choosing, and in a multi-clip request shift every transcript onto the wrong clip, with no error raised. The reverse case — markers with no audio payload — is the vector behind vLLM's own CVE-2026-44222 (GHSA-hpv8-x276-m59f), where models indexing a grid from a spoofed placeholder hit an unhandled IndexError. Inbound, encode(..., add_special_tokens=False) only suppresses *added* BOS and EOS; special-token strings already present in the text are still parsed into genuine ids. Since the switch sets requires_raw_input_tokens and detects adapters on raw input_ids, a control token arriving via the transcript would steer adapter selection from audio content. Two guards: - apply() requires the marker count to equal the audio item count, for both str and token-id prompts. Enforced there rather than in _call_hf_processor because that runs with only the cache-*missing* items, so on a processor cache hit its item count is smaller than the request's and the comparison would be wrong. apply() is the only entry point that always sees the whole request. Its parameters differ across the vLLM versions this package supports, so both shapes are read defensively; an unrecognised signature raises rather than skipping the check, since a security control that silently no-ops is worse than none. - _transcribe refuses a transcript that tokenized into the audio marker or any adapter control token. Rejected rather than neutralized with split_special_tokens=True so the condition is visible instead of silently rewriting model output: such a transcript means either an attack or a badly misbehaving ASR backend, and both are worth surfacing. Consequence worth knowing: a text-only prompt containing <|audio|> is now refused. That is the CVE vector, but it also rejects legitimate prose that mentions the marker — the accepted cost of count-based rather than provenance-based validation. Stripping the marker from user content at chat template render time is the only fix for that, and it waits on finding #15 making the template injection robust and tested. Tests: 13 new cases covering injection from text, from token ids, with no audio payload at all, and from the transcript (both the marker and an adapter control token), plus negative controls so that rejecting everything would not pass. Verified as genuine guards by reverting each fix in turn: 3 fail without the apply() check, 2 without the transcript guard. The tokenizer fakes in the test module gained convert_tokens_to_ids, which every real tokenizer has and the new guard needs. The apply() signature handling was verified against an installed vLLM 0.21 only; 0.19/0.20 behaviour needs the GPU run to confirm. Signed-off-by: aviv ron <rona@il.ibm.com>
GitHub did not schedule a workflow run for the pull_request opened event on 3fcbecf, so no CI or DCO check suite was created. This empty commit fires a synchronize event to schedule them. Signed-off-by: aviv ron <rona@il.ibm.com>
Collaborator
Author
|
/gpu-test |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
❌ GPU tests failed —
|
❌ GPU tests failed —
|
aviv1ron1
marked this pull request as ready for review
August 9, 2026 18:01
aviv1ron1
requested review from
antonpibm,
freunda and
yairallouche
as code owners
August 9, 2026 18:01
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Addresses review findings #3 (P0, marker spoofable from user text) and #16 (P2, transcript tokenized with special tokens parsed) — the same defect in opposite directions.
<|audio|> is a registered special token, so text a caller types is tokenized into the real marker. vLLM pairs markers with audio items positionally and stops once every item is matched, appending the rest of the prompt verbatim, so an extra marker is not an error: the leftmost one wins the transcript and vLLM's own _validate_mm_placeholders still sees matching counts and passes. A caller could therefore move the transcript to a position of their choosing, and in a multi-clip request shift every transcript onto the wrong clip, with no error raised. The reverse case — markers with no audio payload — is the vector behind vLLM's own CVE-2026-44222 (GHSA-hpv8-x276-m59f), where models indexing a grid from a spoofed placeholder hit an unhandled IndexError.
Inbound, encode(..., add_special_tokens=False) only suppresses added BOS and EOS; special-token strings already present in the text are still parsed into genuine ids. Since the switch sets requires_raw_input_tokens and detects adapters on raw input_ids, a control token arriving via the transcript would steer adapter selection from audio content.
Two guards:
apply() requires the marker count to equal the audio item count, for both str and token-id prompts. Enforced there rather than in _call_hf_processor because that runs with only the cache-missing items, so on a processor cache hit its item count is smaller than the request's and the comparison would be wrong. apply() is the only entry point that always sees the whole request. Its parameters differ across the vLLM versions this package supports, so both shapes are read defensively; an unrecognised signature raises rather than skipping the check, since a security control that silently no-ops is worse than none.
_transcribe refuses a transcript that tokenized into the audio marker or any adapter control token. Rejected rather than neutralized with split_special_tokens=True so the condition is visible instead of silently rewriting model output: such a transcript means either an attack or a badly misbehaving ASR backend, and both are worth surfacing.
Consequence worth knowing: a text-only prompt containing <|audio|> is now refused. That is the CVE vector, but it also rejects legitimate prose that mentions the marker — the accepted cost of count-based rather than provenance-based validation. Stripping the marker from user content at chat template render time is the only fix for that, and it waits on finding #15 making the template injection robust and tested.
Tests: 13 new cases covering injection from text, from token ids, with no audio payload at all, and from the transcript (both the marker and an adapter control token), plus negative controls so that rejecting everything would not pass. Verified as genuine guards by reverting each fix in turn: 3 fail without the apply() check, 2 without the transcript guard. The tokenizer fakes in the test module gained convert_tokens_to_ids, which every real tokenizer has and the new guard needs.
The apply() signature handling was verified against an installed vLLM 0.21 only; 0.19/0.20 behaviour needs the GPU run to confirm.