bpe-tokenization

This paper identifies that BPE tokenization fragments safety-critical words into subword pieces, creating exploitable gaps in LLM alignment. Character-level perturbations can bypass safety by disrupting token boundaries, achieving 80-100% refusal flip on HarmBench prompts with 48% harmful outputs across five model families.