🛰️ Daily AI Frontier
‹ back to 2026-09-16

Nameless Tokenization: A Lossless Tokenizer-Level Defense Against Control-Token Forgery in Open-Weight LLMs

Research LLM Agents

Ranking

Overall 82
Content 100
Popularity 39

Observed public metrics from 1 member.

Merged summary

TL;DR - Nameless tokenization removes surface strings from reserved control-token identifiers, preventing prompt content from forging chat, tool, or reasoning boundaries without altering benign inputs. An audit of 256 deployed chat tokenizers found all were forgeable, while the commonly recommended mitigation still left 56.6% vulnerable.

  • The defense ensures ordinary content encoders cannot emit reserved control identifiers while preserving message text unchanged.
  • Across five tokenizer families, it exactly reproduced standard token streams for attack-free data.
  • Accuracy on delimiter-bearing text increased from 8.5% to 59.9%, outperforming sanitization approaches that discard or alter content.
  • Experiments indicate reserved identifiers carry most of the influence in forged tool results and forged turns when system instructions frame user content as data.

Sources (1)

Nameless Tokenization: A Lossless Tokenizer-Level Defense Against Control-Token Forgery in Open-Weight LLMs

arXiv cs.CL Kisu Yang, Yoonna Jang, Heuiseok Lim 2026-09-15 arXiv:2609.16984
Public signals Semantic Scholar citations 0 · Semantic Scholar influential citations 0
Providers: Hugging Face · N/A OpenAlex · N/A Publisher · N/A Semantic Scholar · Citations 0 · Influential citations 0 X · N/A Fetched 2026-09-22 14:21:07.803429 UTC

TL;DR - Nameless tokenization removes surface strings from reserved control-token identifiers, preventing prompt content from forging chat, tool, or reasoning boundaries without altering benign inputs. An audit of 256 deployed chat tokenizers found all were forgeable, while the commonly recommended mitigation still left 56.6% vulnerable.

  • The defense ensures ordinary content encoders cannot emit reserved control identifiers while preserving message text unchanged.
  • Across five tokenizer families, it exactly reproduced standard token streams for attack-free data.
  • Accuracy on delimiter-bearing text increased from 8.5% to 59.9%, outperforming sanitization approaches that discard or alter content.
  • Experiments indicate reserved identifiers carry most of the influence in forged tool results and forged turns when system instructions frame user content as data.
item →