Tokenization Confusion

This post analyzes how differences in tokenizer architectures (Unigram used by Llama Prompt Guard 2 versus BPE used by many backend LLMs) can be abused to create inputs that the guard classifies as benign while backend models interpret them as malicious or jailbreak prompts. The author walks through tokenization internals, demonstrates automated methods to find confusing subwords, and provides concrete examples and tooling showing practical prompt-injection bypasses against small self-hosted LLM safety models.