Appending one sentence that labels the user message as data had model-specific effects: it nearly stopped naive injection on Gemma and Ministral but not GPT-OSS. With standard tokenization, forged turns still succeeded at 98.3% on Llama and 99.0% on Ministral despite naive rates of 4.1% and 0.0%; nameless tokenization reduced those forged-turn rates to 50.0% and 23.3%. For Qwen's forged-tool attack, nameless reduced success from 53.4% to 0.7%.

model: Gemma-4-31B · attack: Naive · defense: None

model: Gemma-4-31B · attack: Naive · defense: Strip

model: Gemma-4-31B · attack: Naive · defense: Mask

model: Gemma-4-31B · attack: Naive · defense: Escape

model: Gemma-4-31B · attack: Naive · defense: Nameless

model: Gemma-4-31B · attack: Lookalike · defense: None

model: Gemma-4-31B · attack: Lookalike · defense: Strip

model: Gemma-4-31B · attack: Lookalike · defense: Mask

model: Gemma-4-31B · attack: Lookalike · defense: Escape

model: Gemma-4-31B · attack: Lookalike · defense: Nameless

model: Gemma-4-31B · attack: Forged turn · defense: None

model: Gemma-4-31B · attack: Forged turn · defense: Strip