Tokenization Confusion

This research post examines bypass techniques for Meta’s Llama Prompt Guard 2 by exploiting differences between Unigram and BPE tokenization, showing that prompts can be crafted to appear safe to the guard (via token splitting and normalization quirks) while remaining actionable to back-end LLMs. It details practical methods (hyphenation, prefix insertion, vocabulary-driven subword confusion, and interpretability tooling) to suppress high-importance tokens like “previous” and “instruction,” and confirms effectiveness against models such as Qwen, while noting limitations and related work on adversarial tokenization.