Nameless Tokenization: A Lossless Tokenizer-Level Defense Against Control-Token Forgery in Open-Weight LLMs
Ranking
Overall
82
Content
100
Popularity
39
Observed public metrics from 1 member.
Merged summary
TL;DR - Nameless tokenization removes surface strings from reserved control-token identifiers, preventing prompt content from forging chat, tool, or reasoning boundaries without altering benign inputs. An audit of 256 deployed chat tokenizers found all were forgeable, while the commonly recommended mitigation still left 56.6% vulnerable.
- The defense ensures ordinary content encoders cannot emit reserved control identifiers while preserving message text unchanged.
- Across five tokenizer families, it exactly reproduced standard token streams for attack-free data.
- Accuracy on delimiter-bearing text increased from 8.5% to 59.9%, outperforming sanitization approaches that discard or alter content.
- Experiments indicate reserved identifiers carry most of the influence in forged tool results and forged turns when system instructions frame user content as data.
Sources (1)
Nameless Tokenization: A Lossless Tokenizer-Level Defense Against Control-Token Forgery in Open-Weight LLMs
Public signals
Semantic Scholar citations 0 · Semantic Scholar influential citations 0
TL;DR - Nameless tokenization removes surface strings from reserved control-token identifiers, preventing prompt content from forging chat, tool, or reasoning boundaries without altering benign inputs. An audit of 256 deployed chat tokenizers found all were forgeable, while the commonly recommended mitigation still left 56.6% vulnerable.
- The defense ensures ordinary content encoders cannot emit reserved control identifiers while preserving message text unchanged.
- Across five tokenizer families, it exactly reproduced standard token streams for attack-free data.
- Accuracy on delimiter-bearing text increased from 8.5% to 59.9%, outperforming sanitization approaches that discard or alter content.
- Experiments indicate reserved identifiers carry most of the influence in forged tool results and forged turns when system instructions frame user content as data.