Loading page…
Explore ArkGraph and select the steps to run.
The paper’s claims are available in Research claims.
0 / 15 claims verified
the rest still being verified
Experiment plan ready; no runs yet.
0/26 assessed
The complete result group stays with its claim. Assessed rows come first; their judgments do not replace the whole-claim conclusion. Expand a row for conditions, sources, and evidence history.
| Metric and conditions | Reported | Latest observation | Evidence judgment |
|---|---|---|---|
| 200 items | — | Not assessed | |
defense: None · question: Copy | 6.8% | — | Not assessed |
defense: None · question: First | 20% | — | Not assessed |
defense: None · question: Count | 6.4% | — | Not assessed |
defense: None · question: Redact | 0.8% | — | Not assessed |
defense: None · question: All | 8.5% | — | Not assessed |
defense: Strip · question: Copy | 0% | — | Not assessed |
defense: Strip · question: First | 8.8% | — | Not assessed |
defense: Strip · question: Count | 0% | — | Not assessed |
defense: Strip · question: Redact | 0% | — | Not assessed |
defense: Strip · question: All | 2.2% | — | Not assessed |
defense: Mask · question: Copy | 0% | — | Not assessed |
The text-interface boundary is methodological context, and the duplicated 46.9%/68.0% forged-system observation is derived from the represented task-only attack claim rather than a separate experiment.
0/2 assessed
The complete result group stays with its claim. Assessed rows come first; their judgments do not replace the whole-claim conclusion. Expand a row for conditions, sources, and evidence history.
| Metric and conditions | Reported | Latest observation | Evidence judgment |
|---|---|---|---|
attack: Forged system · tokenization: standard · systemMessage: task-only | 46.9% | — | Not assessed |
attack: Forged system · tokenization: nameless · systemMessage: task-only | 68% | — | Not assessed |
Experiment plan ready; no runs yet.
0/31 assessed
The complete result group stays with its claim. Assessed rows come first; their judgments do not replace the whole-claim conclusion. Expand a row for conditions, sources, and evidence history.
| Metric and conditions | Reported | Latest observation | Evidence judgment |
|---|---|---|---|
row: Clean accuracy · tokenization: standard · trainingSeparation: None | 86.1% | — | Not assessed |
row: Naive · tokenization: standard · trainingSeparation: None | 7.4% | — | Not assessed |
row: Lookalike · tokenization: standard · trainingSeparation: None | 74% | — | Not assessed |
row: Forged turn · tokenization: standard · trainingSeparation: None | 61.1% | — | Not assessed |
row: Forged system · tokenization: standard · trainingSeparation: None | 98% | — | Not assessed |
row: Clean accuracy · tokenization: nameless · trainingSeparation: None | 86.1% | — | Not assessed |
row: Naive · tokenization: nameless · trainingSeparation: None | 7.4% | — | Not assessed |
row: Lookalike · tokenization: nameless · trainingSeparation: None | 74% | — | Not assessed |
row: Forged turn · tokenization: nameless · trainingSeparation: None | 60.8% | — | Not assessed |
row: Forged system · tokenization: nameless · trainingSeparation: None | 66.6% | — | Not assessed |
row: Clean accuracy · tokenization: standard · trainingSeparation: ISE | 85.1% | — | Not assessed |
row: Naive · tokenization: standard · trainingSeparation: ISE | 15.5% | — | Not assessed |
Experiment plan ready; no runs yet.
0/5 assessed
The complete result group stays with its claim. Assessed rows come first; their judgments do not replace the whole-claim conclusion. Expand a row for conditions, sources, and evidence history.
| Metric and conditions | Reported | Latest observation | Evidence judgment |
|---|---|---|---|
| 16,415 perturbations | — | Not assessed | |
defense: none | 27.3% | — | Not assessed |
scope: all tested models · defense: split_special_tokens | 5.1% | — | Not assessed |
model: Qwen3.8-27B · defense: split_special_tokens | 18.3% | — | Not assessed |
defense: nameless tokenization | 0% | — | Not assessed |
Experiment plan ready; no runs yet.
0/60 assessed
The complete result group stays with its claim. Assessed rows come first; their judgments do not replace the whole-claim conclusion. Expand a row for conditions, sources, and evidence history.
| Metric and conditions | Reported | Latest observation | Evidence judgment |
|---|---|---|---|
model: Gemma-4-31B · component: Absent · objective: Objective A | 57.8% | — | Not assessed |
model: Gemma-4-31B · component: Text · objective: Objective A | 99% | — | Not assessed |
model: Gemma-4-31B · component: Reserved · objective: Objective A | 99.7% | — | Not assessed |
model: Gemma-4-31B · component: Surface · objective: Objective A | 41.2 percentage points | — | Not assessed |
model: Gemma-4-31B · component: Identifier · objective: Objective A | 0.7 percentage points | — | Not assessed |
model: Llama-3.1-8B · component: Absent · objective: Objective A | 63.2% | — | Not assessed |
model: Llama-3.1-8B · component: Text · objective: Objective A | 99.7% | — | Not assessed |
model: Llama-3.1-8B · component: Reserved · objective: Objective A | 100% | — | Not assessed |
model: Llama-3.1-8B · component: Surface · objective: Objective A | 36.5 percentage points | — | Not assessed |
model: Llama-3.1-8B · component: Identifier · objective: Objective A | 0.3 percentage points | — | Not assessed |
model: Ministral-3-8B · component: Absent · objective: Objective A | 3% | — | Not assessed |
model: Ministral-3-8B · component: Text · objective: Objective A | 67.2% | — | Not assessed |
The visible Figure 1 document supports a real paired probe. The other 23 documents are absent, so the catalog retains a clearly labeled proxy route and permits exact rate comparison only if the original manifest is found.
0/3 assessed
The complete result group stays with its claim. Assessed rows come first; their judgments do not replace the whole-claim conclusion. Expand a row for conditions, sources, and evidence history.
| Metric and conditions | Reported | Latest observation | Evidence judgment |
|---|---|---|---|
| 24 documents | — | Not assessed | |
tokenization: standard | 100% | — | Not assessed |
tokenization: nameless | 4.2% | — | Not assessed |
Experiment plan ready; no runs yet.
0/38 assessed
The complete result group stays with its claim. Assessed rows come first; their judgments do not replace the whole-claim conclusion. Expand a row for conditions, sources, and evidence history.
| Metric and conditions | Reported | Latest observation | Evidence judgment |
|---|---|---|---|
| 400 repositories | — | Not assessed | |
| 120 repositories | — | Not assessed | |
| 24 repositories | — | Not assessed | |
| 256 tokenizers | — | Not assessed | |
| 99.6 percent of analyzed tokenizers | — | Not assessed | |
| 56.2 percent of analyzed tokenizers | — | Not assessed | |
family: Qwen | 59 tokenizers | — | Not assessed |
family: Qwen · condition: default | 100% | — | Not assessed |
family: Qwen · condition: split_special_tokens enabled | 84.7% | — | Not assessed |
family: Nvidia | 11 tokenizers | — | Not assessed |
family: Nvidia · condition: default | 100% | — | Not assessed |
family: Nvidia · condition: split_special_tokens enabled | 81.8% | — | Not assessed |
Experiment plan ready; no runs yet.
0/16 assessed
The complete result group stays with its claim. Assessed rows come first; their judgments do not replace the whole-claim conclusion. Expand a row for conditions, sources, and evidence history.
| Metric and conditions | Reported | Latest observation | Evidence judgment |
|---|---|---|---|
| 296 items | — | Not assessed | |
task: sentiment classification | 100 items | — | Not assessed |
task: natural-language inference | 100 items | — | Not assessed |
task: extractive question answering | 96 items | — | Not assessed |
| 0.42% | — | Not assessed | |
| 4 models | — | Not assessed | |
defense: None | 100% | — | Not assessed |
defense: Strip | 100% | — | Not assessed |
defense: Mask | 100% | — | Not assessed |
defense: Escape | 100% | — | Not assessed |
defense: Nameless | 100% | — | Not assessed |
defense: None | 89.1% | — | Not assessed |
Experiment plan ready; no runs yet.
0/110 assessed
The complete result group stays with its claim. Assessed rows come first; their judgments do not replace the whole-claim conclusion. Expand a row for conditions, sources, and evidence history.
| Metric and conditions | Reported | Latest observation | Evidence judgment |
|---|---|---|---|
model: Gemma-4-31B · attack: Naive · defense: None | 58.1% | — | Not assessed |
model: Gemma-4-31B · attack: Naive · defense: Strip | 57.8% | — | Not assessed |
model: Gemma-4-31B · attack: Naive · defense: Mask | 57.8% | — | Not assessed |
model: Gemma-4-31B · attack: Naive · defense: Escape | 57.8% | — | Not assessed |
model: Gemma-4-31B · attack: Naive · defense: Nameless | 57.8% | — | Not assessed |
model: Gemma-4-31B · attack: Lookalike · defense: None | 94.3% | — | Not assessed |
model: Gemma-4-31B · attack: Lookalike · defense: Strip | 94.3% | — | Not assessed |
model: Gemma-4-31B · attack: Lookalike · defense: Mask | 94.3% | — | Not assessed |
model: Gemma-4-31B · attack: Lookalike · defense: Escape | 94.3% | — | Not assessed |
model: Gemma-4-31B · attack: Lookalike · defense: Nameless | 94.3% | — | Not assessed |
model: Gemma-4-31B · attack: Forged turn · defense: None | 99.7% | — | Not assessed |
model: Gemma-4-31B · attack: Forged turn · defense: Strip | 76% | — | Not assessed |
Experiment plan ready; no runs yet.
0/85 assessed
The complete result group stays with its claim. Assessed rows come first; their judgments do not replace the whole-claim conclusion. Expand a row for conditions, sources, and evidence history.
| Metric and conditions | Reported | Latest observation | Evidence judgment |
|---|---|---|---|
model: Gemma-4-31B · attack: Naive · defense: None | 0% | — | Not assessed |
model: Gemma-4-31B · attack: Naive · defense: Strip | 0% | — | Not assessed |
model: Gemma-4-31B · attack: Naive · defense: Mask | 0% | — | Not assessed |
model: Gemma-4-31B · attack: Naive · defense: Escape | 0% | — | Not assessed |
model: Gemma-4-31B · attack: Naive · defense: Nameless | 0% | — | Not assessed |
model: Gemma-4-31B · attack: Lookalike · defense: None | 2% | — | Not assessed |
model: Gemma-4-31B · attack: Lookalike · defense: Strip | 2% | — | Not assessed |
model: Gemma-4-31B · attack: Lookalike · defense: Mask | 2% | — | Not assessed |
model: Gemma-4-31B · attack: Lookalike · defense: Escape | 2% | — | Not assessed |
model: Gemma-4-31B · attack: Lookalike · defense: Nameless | 2% | — | Not assessed |
model: Gemma-4-31B · attack: Forged turn · defense: None | 8.1% | — | Not assessed |
model: Gemma-4-31B · attack: Forged turn · defense: Strip | 0.7% | — | Not assessed |
Experiment plan ready; no runs yet.
0/10 assessed
The complete result group stays with its claim. Assessed rows come first; their judgments do not replace the whole-claim conclusion. Expand a row for conditions, sources, and evidence history.
| Metric and conditions | Reported | Latest observation | Evidence judgment |
|---|---|---|---|
model: gemma-4-31B-it · owner: google | 13 identifiers | — | Not assessed |
model: gemma-4-31B-it · toolRole: no | 0 identifiers | — | Not assessed |
model: Llama-3.1-8B-Instruct · owner: meta-llama | 4 identifiers | — | Not assessed |
model: Llama-3.1-8B-Instruct · toolRole: no | 0 identifiers | — | Not assessed |
model: Ministral-3-8B-Instruct-2512 · owner: mistralai | 12 identifiers | — | Not assessed |
model: Ministral-3-8B-Instruct-2512 · toolRole: yes | 0 identifiers | — | Not assessed |
model: Qwen3.8-27B · owner: Qwen | 8 identifiers | — | Not assessed |
model: Qwen3.8-27B · toolRole: yes | 6 identifiers | — | Not assessed |
model: gpt-oss-20b · owner: openai | 7 identifiers | — | Not assessed |
model: gpt-oss-20b · toolRole: no | 0 identifiers | — | Not assessed |
This is source context limiting interpretation to five models, three host tasks, two objectives, and one defensive sentence, not an additional independent empirical result. The represented experiment packages preserve those boundaries.
0/4 assessed
The complete result group stays with its claim. Assessed rows come first; their judgments do not replace the whole-claim conclusion. Expand a row for conditions, sources, and evidence history.
| Metric and conditions | Reported | Latest observation | Evidence judgment |
|---|---|---|---|
| 5 models | — | Not assessed | |
| 3 tasks | — | Not assessed | |
| 2 objectives | — | Not assessed | |
| 1 sentences | — | Not assessed |
Experiment plan ready; no runs yet.
0/29 assessed
The complete result group stays with its claim. Assessed rows come first; their judgments do not replace the whole-claim conclusion. Expand a row for conditions, sources, and evidence history.
| Metric and conditions | Reported | Latest observation | Evidence judgment |
|---|---|---|---|
attack: Naive · defense: None | 62.5% | — | Not assessed |
attack: Naive · defense: Strip | 62.2% | — | Not assessed |
attack: Naive · defense: Mask | 62.2% | — | Not assessed |
attack: Naive · defense: Escape | 62.3% | — | Not assessed |
attack: Naive · defense: Nameless | 62.4% | — | Not assessed |
attack: Lookalike · defense: None | 93% | — | Not assessed |
attack: Lookalike · defense: Strip | 93% | — | Not assessed |
attack: Lookalike · defense: Mask | 93% | — | Not assessed |
attack: Lookalike · defense: Escape | 93% | — | Not assessed |
attack: Lookalike · defense: Nameless | 93% | — | Not assessed |
attack: Forged turn · defense: None | 99.9% | — | Not assessed |
attack: Forged turn · defense: None | 99.8% | — | Not assessed |
The independent renderer is inspected and challenged by the finite perturbation property test. Execution must state that passing finite tests can falsify defects but cannot prove the universal text-to-identifier guarantee.
This is an actual limitation on external validity—synthetic content frequency is not estimated and custom-code tokenizers are excluded—not an independently testable result. Both constraints remain explicit in the corresponding objectives.