Nameless Tokenization: A Lossless Tokenizer-Level Defense Against Control-Token Forgery in Open-Weight LLMs
This is a real vulnerability in deployed systems. Any open-weight model where the chat template strings are public (which is all of them) can have its turn boundaries spoofed unless you implement this fix. The proposal works and costs nothing on clean data. For anyone deploying open-weight chat models in adversarial settings, this moves from interesting to mandatory. For closed-weight systems, your tokenizer is opaque and you're probably safer by accident.