Same Bytes, Different Authority: Reserved-Token Representations in Chat-Template Prompt Injection
In every base and instruction-tuned pair the authors test, instruction tuning strengthens the model's preference for reserved markers, and the gap persists on that channel.