Every evaluated defense reproduced standard tokenization's token stream on 100.0% of attack-free host prompts; mean host-task accuracy ranged from 88.6% to 89.1%, with the paper attributing the small spread to non-bitwise-reproducible batched decoding on GPT-OSS-20B because the other four models scored identically across conditions.

Every evaluated defense reproduced standard tokenization's token stream on 100.0% of attack-free host prompts; mean host-task accuracy ranged from 88.6% to 89.1%, with the paper attributing the small spread to non-bitwise-reproducible batched decoding on GPT-OSS-20B because the other four models scored identically across conditions. · CiteArk

Measurement results

0/16 assessed

0 supported0 disputed or conflicting16 not assessed

The complete result group stays with its claim. Assessed rows come first; their judgments do not replace the whole-claim conclusion. Expand a row for conditions, sources, and evidence history.

Each row is a measurement with its reported value, latest available observation, and cumulative evidence state.
Metric and conditions	Reported	Latest observation	Evidence judgment
	296 items	—	Not assessed
task: sentiment classification	100 items	—	Not assessed
task: natural-language inference	100 items	—	Not assessed
task: extractive question answering	96 items	—	Not assessed
	0.42%	—	Not assessed
	4 models	—	Not assessed
defense: None	100%	—	Not assessed
defense: Strip	100%	—	Not assessed
defense: Mask	100%	—	Not assessed
defense: Escape	100%	—	Not assessed
defense: Nameless	100%	—	Not assessed
defense: None	89.1%	—	Not assessed

Reported and observed measurements

Assessments (0)

Runs (0)

Measurement results