Token Smuggling

The core mechanism splits forbidden words across token boundaries so they never appear as a single, recognizable unit in the model's input.

• Example: The word 'bomb' might be split as 'b' + 'omb' or 'bo' + 'mb'
• Why it works: Safety classifiers scan for exact token sequences matching prohibited terms; fragmented tokens evade these signatures
• Execution: Attackers insert spaces, zero-width characters, or exploit natural subword boundaries to force the tokenizer to segment words differently
• Impact: The model still reconstructs the semantic meaning during inference, but the filter sees only innocuous fragments

Attackers substitute standard characters with visually identical Unicode homoglyphs that tokenize differently, bypassing text-based filters while remaining readable to the model.

• Homoglyph substitution: Replacing 'a' (U+0061) with Cyrillic 'а' (U+0430) changes tokenization entirely
• Normalization gap: Safety filters may not normalize Unicode before scanning, while the model's tokenizer processes the raw bytes
• Combining characters: Using diacritical marks to split tokens without altering visual appearance
• Zero-width characters: Inserting U+200B (zero-width space) between characters forces token boundaries where none should exist

BPE tokenizers merge frequent character pairs into single tokens. Attackers exploit this by constructing inputs that force specific, unexpected tokenization patterns.

• Rare token forcing: Using uncommon character combinations to ensure words tokenize as individual bytes rather than merged subwords
• Vocabulary gap exploitation: Targeting words absent from the tokenizer's vocabulary, which default to character-level tokenization
• Merge rule awareness: Understanding which character pairs the BPE algorithm merges first allows precise control over final token boundaries
• Cross-token reconstruction: The model's attention mechanism reassembles meaning across fragmented tokens during processing

In multimodal systems, forbidden instructions can be encoded in non-text modalities that bypass text-only safety filters while being interpreted by vision or audio encoders.

• Image steganography: Embedding malicious text as rendered pixels that OCR-like vision encoders read but text filters never see
• Audio frequency encoding: Hiding instructions in spectrogram patterns or ultrasonic frequencies processed by audio tokenizers
• Cross-modal attention leakage: Instructions in one modality influencing generation through shared latent representations
• File format exploitation: Using metadata fields, EXIF data, or comment sections that tokenizers process but filters ignore

The primary defense normalizes all input through a strict canonicalization pipeline before any safety scanning occurs.

• Unicode normalization: Apply NFKC normalization to collapse homoglyphs and combining characters into standard forms
• Whitespace canonicalization: Strip zero-width characters and normalize all spacing before tokenization
• Re-tokenization verification: Tokenize, detokenize, and re-tokenize input to detect fragmentation anomalies
• Semantic similarity scanning: Deploy embedding-based detectors that catch smuggled content by meaning rather than exact token match
• Limitation: Aggressive normalization can break legitimate multilingual input and requires careful tuning

Statistical defenses analyze token sequences for structural anomalies characteristic of smuggling attempts without relying on keyword blocklists.

• Perplexity scoring: Smuggled inputs often exhibit unusual token distributions with higher statistical surprise
• Token boundary analysis: Detecting unnatural splits where semantic units are fragmented across improbable boundaries
• Attention pattern monitoring: Smuggled content creates distinctive cross-token attention patterns as the model reconstructs hidden meaning
• Byte-level inspection: Scanning raw UTF-8 byte sequences for encoding tricks before tokenization occurs
• Adversarial training: Fine-tuning safety classifiers on known smuggling patterns to recognize fragmentation signatures

An obfuscation technique that encodes a malicious prompt in Base64 format to bypass text-based safety classifiers. The attack relies on the model's ability to decode and execute the hidden instruction during autoregressive generation. While token smuggling manipulates token boundaries, Base64 injection exploits the model's instruction-following capability to perform decoding as a computational step.

• Encoded payloads evade keyword filters
• Model acts as both decoder and executor
• Defenses must inspect decoded semantic content

A jailbreak method that instructs a language model to communicate using a simple substitution cipher. Safety alignment trained on natural language patterns fails to recognize harmful content when encoded in ciphertext. This technique exploits the distributional shift between training data and cipher-encoded inputs, similar to how token smuggling exploits tokenization artifacts.

• Caesar cipher and Morse code variants documented
• Model safety training lacks cipher representations
• Demonstrates brittleness of surface-level alignment

A defense mechanism that analyzes the statistical likelihood of an input sequence under the model's training distribution. Token-smuggled prompts often exhibit anomalously high perplexity because the forced token splits create unnatural sub-word sequences. Perplexity filters flag these statistical outliers before model processing.

• Measures n-gram probability of input tokens
• Effective against adversarial suffixes and token splits
• Can be bypassed with fluency-optimized attacks
• Low computational overhead for real-time filtering

A seemingly nonsensical string of characters appended to a malicious prompt that exploits model gradients to maximize the probability of an affirmative harmful response. While token smuggling hides forbidden words through tokenization artifacts, adversarial suffixes use gradient-based optimization to discover token sequences that suppress refusal behavior.

• Generated via GCG (Greedy Coordinate Gradient) attacks
• Universal suffixes transfer across similar prompts
• Both techniques target the input-filtering layer