Tokenization attacks expose a new bypass layer in LLM security

At a glance

What this is: This is an analysis of how attackers abuse tokenization quirks in LLM pipelines to bypass guardrails, with HiddenLayer arguing that preprocessing and classifier layers are now part of the security boundary.

Why it matters: It matters because IAM and AI security teams have to govern the whole prompt path, including normalization, inspection and policy enforcement, if they want safeguards to survive adversarial input.

Context

Tokenization is the step that turns text into machine-readable pieces before an LLM can process a prompt. In an AI security programme, that means the security boundary is not just the model output layer, but the preprocessing and inspection stages that shape what the model actually sees.

HiddenLayer argues that adversaries are already exploiting this layer with glitch tokens, invisible Unicode and TokenBreak-style manipulations to evade classifiers and alter model behaviour. For practitioners, that shifts the problem from model-only protection to end-to-end prompt governance across the AI pipeline.

Key questions

Q: What breaks when prompt-injection filters only inspect raw text?

A: They can miss payloads that change character rendering or token boundaries without changing the attacker’s intended meaning. In practice, the classifier and the model may process different representations of the same input, which lets malicious instructions slip through a guardrail even when they look obvious to a human reviewer.

Q: Why do invisible Unicode attacks matter for LLM security?

A: Because the model can parse characters that users and reviewers cannot easily see. That creates a review gap where malicious instructions remain hidden in plain sight, especially in copy-paste workflows, code review and moderation pipelines that rely on human inspection of rendered text.

Q: How should security teams evaluate prompt injection defenses before deploying them in production?

A: Security teams should test prompt injection defenses against realistic attack patterns, not just public benchmark scores. A useful evaluation measures whether controls stop harmful instructions, resist overfitting, and still perform when the test set changes. The goal is to judge operational resilience, not leaderboard performance, because a defense that looks strong in a static dataset can fail under live attack conditions.

Q: What happens when tokenization and moderation use different preprocessing rules?

A: The security layer can score one version of the prompt while the model consumes another. That mismatch makes false negatives more likely, because the control that decides whether input is safe is no longer evaluating the same representation that reaches the LLM.

Technical breakdown

How tokenization becomes an attack surface

Tokenizers split text into tokens that the model maps into embeddings, so small changes in character sequence can produce disproportionate downstream effects. That matters because many guardrails inspect raw text or classifier output, while the model consumes tokenized input. If the tokenizer and the security layer do not normalise input in the same way, an attacker can make the classifier and the model disagree about what was sent. The result is not simply malformed input. It is a security control seeing one string while the model receives another.

Practical implication: Inspect both raw text and tokenized forms before the prompt reaches the model.

Why invisible Unicode and glitch tokens evade control points

Invisible Unicode attacks exploit characters that render poorly or not at all in user interfaces, but still tokenize and carry meaning for the model. Glitch tokens exploit rare or poorly represented tokens that can destabilise attention, alter output formatting, or smuggle strings past blocklists. In both cases, the attacker is not relying on semantic persuasion alone. They are exploiting a mismatch between what humans see, what classifiers score, and what the LLM embeds. That makes visual review, static allowlists and simple content filters unreliable on their own.

Practical implication: Normalize Unicode and test whether your review stack can detect non-printing and rare-token payloads.

How TokenBreak-style attacks flip classifier verdicts

TokenBreak attacks target the classifier or guardrail rather than the LLM itself. By perturbing token boundaries, an attacker can break the patterns a prompt-injection detector has learned while preserving the underlying meaning for the target model. This is a classic boundary problem. The security layer treats the input as benign because its tokens no longer match the malicious signature, while the downstream model still reconstructs the harmful instruction. In practice, that means a guardrail can fail even when the payload remains obvious to a human reader.

Practical implication: Validate prompt-injection detectors against token-level perturbations, not just clean-text samples.

Threat narrative

Attacker objective: The attacker wants to bypass prompt-injection controls and make the LLM obey malicious instructions or unsafe tool actions.

1. Entry occurs when the attacker supplies a prompt containing glitch tokens, invisible Unicode or perturbed word fragments that pass initial review.
2. Credential or policy access is not the issue here; the attacker instead abuses the tokenizer and classifier boundary to change how the input is interpreted.
3. Escalation happens when the guardrail misclassifies the input, allowing the model to receive an instruction stream that should have been blocked.
4. Impact follows when the model leaks instructions, ignores policy, or accepts a manipulated tool call that the security layer failed to stop.

Breaches seen in the wild

• DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.
• Moltbook AI agent keys breach: Moltbook breach exposed 1.5M AI agent keys.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Tokenization policy is now a security control, not a text-processing detail: The article shows that adversaries can attack the layer between user input and model comprehension, where preprocessing, tokenization and classifier scoring diverge. That means the effective trust boundary is wider than the model endpoint, and governance has to cover how text is normalised, segmented and evaluated before inference. Practitioners should treat tokenization as part of the control plane for AI access and content policy.

Classifier-based guardrails are vulnerable to boundary mismatch: TokenBreak demonstrates that a detector can be made to see a different input than the target LLM without changing the semantic payload. This is not a simple evasion trick, it is an architectural weakness in systems that score raw or lightly normalised text while the model consumes tokenized variants. The implication is that content moderation and prompt-injection controls need shared preprocessing assumptions, not separate ones.

Token-level manipulation widens the blast radius of prompt injection: The more an enterprise depends on text classifiers, the more attractive token-level bypasses become, because one successful perturbation can move malicious content through multiple layers at once. This raises the governance bar for AI deployments that allow tools, code generation or data retrieval from untrusted prompts. Security teams should assume the attacker will target the weakest parser in the chain.

Invisible prompt payloads create a new human review failure mode: Human reviewers can miss what the model can read, and that gap is large enough to defeat code review, moderation and copy-paste workflows. That makes AI content handling closer to NHI trust problems than traditional application text filtering, because policy must survive machine-readable input that is intentionally unreadable to people. The practical conclusion is that review processes must be machine-parsed, not visually trusted.

Prompt security is becoming a full pipeline discipline: HiddenLayer's analysis reinforces a broader shift in AI governance, where security outcomes depend on preprocessing, normalization, classifier robustness and downstream model behaviour together. Organisations that treat guardrails as a single control will miss the real failure mode, which is compositional. Practitioners should govern the entire prompt path as one security workflow rather than a collection of disconnected checks.

From our research library:

• AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
• Read next: AI Agent Observability, Audit and Incident Response Guide

What this signals

Prompt security is now a pipeline problem: The practical control point is no longer the model alone, because tokenization, normalization and moderation each change what the downstream system receives. Teams that only harden the classifier will still miss payloads that survive through a different representation of the same text.

Token-level bypasses will keep outpacing visual review: As attacker tradecraft moves toward invisible characters and segmentation tricks, human inspection becomes a weak last line rather than a reliable control. Organisations need machine-enforced prompt handling that compares raw input, normalized input and tokenized input before execution.

AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026: that pattern reinforces the broader lesson that AI security failures often emerge in the surrounding control layers rather than the model core alone.

For practitioners

• Normalize Unicode before inspection Apply a canonical Unicode normalization step ahead of classification, moderation and model ingestion so invisible or variant characters are handled consistently.
• Test guardrails with token-level perturbations Build a red-team corpus that includes glitch tokens, invisible characters and fragmented word forms to measure whether prompt-injection detectors still classify correctly.
• Inspect prompts at both raw and tokenized layers Compare the raw text, normalized text and tokenized sequence for every sensitive prompt path so the classifier and the LLM do not see materially different inputs.
• Validate tool-call formatting before execution Require structured output checks on any model-generated tool request so malformed or manipulated token sequences cannot become executable actions.

Key takeaways

• Tokenization attacks show that an LLM guardrail can fail even when the malicious prompt is visible to the model and invisible to the reviewer.
• The article’s examples demonstrate that rare tokens, invisible characters and fragmented words can change how classifiers score input without neutralising the payload.
• Security teams need end-to-end prompt controls that normalise, inspect and validate input before the model or any tool action can proceed.

Key terms

• Tokenisation: Tokenisation replaces a sensitive value with a non-sensitive substitute that preserves workflow utility without revealing the original data. It is useful when systems need to process or display records while keeping direct personal identifiers out of normal operating paths.
• Invisible Unicode Characters: Invisible Unicode characters are text code points that do not visibly render in most interfaces but still affect how systems parse or interpret content. In agentic workflows, they can hide instructions inside tool descriptions or scripts, creating a mismatch between what humans review and what machines consume.
• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
• Protocol-Level Evasion: Protocol-level evasion occurs when malicious activity is shaped to look like valid protocol traffic. The attack does not need to break the protocol, only to imitate expected behavior closely enough that network tools cannot distinguish it from legitimate sessions.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.