Nameless tokenization does not prevent an injection that persuades the model in ordinary language, and its guarantee applies only to the text-to-identifier interface. Callers that directly supply token identifiers or systems that reconstruct prompts outside the renderer are out of scope. Removing identifiers can also worsen behavior: averaged forged-system success rose from 46.9% with standard tokenization to 68.0% with nameless tokenization.

Nameless tokenization does not prevent an injection that persuades the model in ordinary language, and its guarantee applies only to the text-to-identifier interface. Callers that directly supply token identifiers or systems that reconstruct prompts outside the renderer are out of scope. Removing identifiers can also worsen behavior: averaged forged-system success rose from 46.9% with standard tokenization to 68.0% with nameless tokenization. · CiteArk

Measurement results

0/2 assessed

0 supported0 disputed or conflicting2 not assessed

The complete result group stays with its claim. Assessed rows come first; their judgments do not replace the whole-claim conclusion. Expand a row for conditions, sources, and evidence history.

Each row is a measurement with its reported value, latest available observation, and cumulative evidence state.
Metric and conditions	Reported	Latest observation	Evidence judgment
attack: Forged system · tokenization: standard · systemMessage: task-only	46.9%	—	Not assessed
attack: Forged system · tokenization: nameless · systemMessage: task-only	68%	—	Not assessed

Reported and observed measurements

Assessments (0)

Runs (0)

Measurement results