Nameless Tokenization: A Lossless Tokenizer-Level Defense Against Control-Token Forgery in Open-Weight LLMs
Kisu Yang, Yoonna Jang, Heuiseok Lim
cs.CL
Quick verdict
A rigorous audit plus an elegant lossless tokenizer fix for control-token forgery; security gains are real but conditional, and one attack class worsens.
Summary
The paper addresses control-token forgery: open-weight chat models publish the surface strings their templates use to mark turns, roles and tool results, and the tokenizer maps those strings in attacker-controlled content back to reserved identifiers the model obeys. Auditing the top-400 downloaded text-generation repositories (256 ship chat templates), the authors find all 256 forgeable, with the recommended split_special_tokens flag leaving 56.6% forgeable because tool-calling and reasoning markers are frequently registered as non-special. They propose nameless tokenization: control vocabulary entries keep their identifier and embedding but lose the surface string, so the content encoder cannot emit control identifiers; the template layer injects identifiers directly by cutting rendered output at its own control literals. Across five models from five tokenizer families, the method reproduces the original token stream exactly on attack-free data (host-task accuracy 89.1% vs 88.9%) and lifts a delimiter-fidelity probe from 8.5% to 59.9%, where sanitizers reach at most 24.1%. Decomposition shows that under a bare task instruction the delimiter's appearance contributes 30.4 points to forged-turn success versus 7.1 for the identifier; only with a defensive system message does removing the identifier stop forged turns and tool forgeries (e.g., Qwen forged tool 53.4% to 0.7%). Limitations: five models only, substring-match success metric, sparse statistical testing, and forged-system attacks worsen under the defense (46.9% to 68.0%). Artifacts are promised but not yet released.
Review complete
Assessment at a glance
5
risk flags identified
● high 0
● medium 2
● low 3
4 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- All 256 audited deployed chat tokenizers convert attacker-controlled text into reserved control identifiers, and the recommended split_special_tokens mitigation leaves 56.6% forgeable, missing chiefly tool-calling and reasoning markers.
- Nameless tokenization makes the text-to-identifier channel unforgeable by construction (E_c(t) ∩ C = ∅) while reproducing standard token streams exactly on attack-free inputs at no accuracy cost (host accuracy 89.1% vs 88.9%).
- Against a bare task instruction, the delimiter's surface appearance contributes far more to forged-turn success (+30.4 points) than the reserved identifier (+7.1 points).
- When the system message instructs models to treat user content as data, removing the identifier is what stops forged turns and tool forgeries (e.g., Qwen forged tool 53.4% to 0.7%; Llama-3.1-8B forged turn 98.3% to 50.0%).
- Where training-level instruction-data separation exists it dominates but costs clean accuracy (11.4 points); nameless tokenization is free and complementary.
Strengths
Deployment-scale audit with a policy-relevant negative result
Section 3 / Table 1: all 256 chat tokenizers drawn from the top-400 downloaded text-generation repositories are forgeable by default, and split_special_tokens — the standard advice — still leaves 56.6% forgeable; the survivors are exactly the tool and reasoning markers (<tool_call>, <think>, <tool_response>), and 56.2% of models register at least one control token as non-special.
Defense is a construction with a by-design guarantee, not a filter
Section 2: emptying the fast tokenizer's added-token table yields E_c(t) ∩ C = ∅ for any attacker text without enumerating strings; verified empirically by 0.0% success over 16,415 perturbed control literals and 100.0% token-stream identity on attack-free prompts (Table 2), at host accuracy 89.1% vs 88.9%.
Honest reporting of unfavorable results
Clean channel isolation and priced baselines
Weaknesses
Standalone security benefit is thin
One attack class regresses under the defense
Narrow evaluation grid with sparse statistics
Unvalidated success metric and fragile tool-channel finding
Missing inference-time baselines
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
The paper targets one specific link in the prompt-injection chain: in open-weight chat models the surface strings of control tokens (<|im_end|>, <|eot_id|>, <tool_call>) are public, and the tokenizer maps those strings back to reserved identifiers wherever they appear, including inside attacker-controlled message content. The authors claim (i) all 256 audited deployed tokenizers are forgeable and the commonly recommended split_special_tokens flag leaves 56.6% forgeable (Section 3, Table 1); (ii) nameless tokenization — retaining identifiers and embeddings for control entries while deleting their surface strings, with the template injecting identifiers directly — makes the channel unforgeable by construction and lossless (Section 2, Table 2); (iii) the security benefit is conditional: under a bare task instruction the delimiter's appearance matters far more than the identifier (30.4 vs 7.1 points, Table 5), whereas with a defensive system message the identifier channel is what carries forged turns and tool results (Table 8). Scope is explicitly the text-to-identifier interface; plain-language injection and caller-supplied token IDs are out of scope (Section 2).
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 4 strengths & 5 weaknesses, analyzed in detail
- 5 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is control-token forgery in LLMs?
In open-weight chat models, the strings that mark turns, roles and tool results (for example <|im_end|> or <|eot_id|>) are public, and the tokenizer converts those strings wherever they appear — including inside user-supplied text — into the same reserved token identifiers the serving stack uses. An attacker who controls message content can therefore write text the model reads as a genuine turn boundary, system turn, or tool result.
What is nameless tokenization?
A tokenizer-level change in which control vocabulary entries keep their reserved identifier and embedding but lose their surface string, so ordinary text can never be encoded into them; the chat template injects control identifiers directly by cutting its rendered output at its own control literals. On benign input it reproduces standard tokenization exactly, so it is lossless for content.
Does nameless tokenization stop prompt injection?
No. It only closes the control-token channel. Plain-language injections still work, and in the paper's experiments a forged-turn attack still succeeded 92.8% of the time without an auxiliary defensive system message (versus 99.9% with standard tokenization), while one attack class (forged system turns) actually became more successful (46.9% to 68.0%). It complements, rather than replaces, instruction-hierarchy training and prompt hygiene.
What is the split_special_tokens flag and why is it insufficient?
A Hugging Face tokenizer option that prevents tokens marked as special from being parsed inside user text. The paper's audit of 256 deployed tokenizers found that with the flag enabled 56.6% remain forgeable, because many models register their tool-call and reasoning markers (such as <tool_call> or <think>) as ordinary added tokens, which the flag does not suppress.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figure 1 (the token-stream diagram) is only partially recoverable from the extracted text, so visual details of the Qwen example could not be verified.
- Appendix tables were extracted with minor layout noise; per-cell values in Tables 5-8 were cross-read carefully but column alignment is not guaranteed.
- Artifact release (harness, per-item generations) is promised but not verifiable at review time; reproducibility assessment assumes the release happens as described.
- This is an arXiv preprint not yet peer-reviewed; the five-model evaluation further limits generalization of absolute attack rates.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.