{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":[]},"type":"markdown"},"seo":{"title":"TokenBreak","siteUrl":"https://docs.hiddenlayer.ai"},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"tokenbreak","__idx":0},"children":["TokenBreak"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"detection-summary","__idx":1},"children":["Detection Summary"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The model is using a tokenizer type that is vulnerable to the TokenBreak attack technique, where prefixes can be added to a word to alter how inputs are tokenized, changing semantic understanding. Attackers can leverage this to manipulate model outputs for classification, predictive and generative models."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"security-impact","__idx":2},"children":["Security Impact"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["TokenBreak attacks can allow adversaries to bypass safety classifiers, while preserving the harmful intent of their input text. Because of this, dangerous instructions or harmful content can evade detection and reach their target, potentially leading to policy violations, unsafe outputs, or misuse of AI systems. They can also lead to manipulation of output from generative models."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"risk-considerations","__idx":3},"children":["Risk Considerations"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This finding does not indicate malicious activity in and of itself, so is not susceptible to what can be considered False Positives.. Instead, it highlights that the model uses a tokenizer that can be exploited by an attacker to manipulate output."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Consumers of the model should be aware of this inherent risk and consider appropriate safeguards, particularly where the model is used in security-sensitive or policy-enforced contexts."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"recommended-mitigation","__idx":4},"children":["Recommended Mitigation"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["For classification tasks, consider using models that typically use Unigram tokenization (such as DeBERTa-v2 or v3, or XLM-RoBERTa) instead of typically BPE or"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["WordPiece-based models (such as BERT, DistilBERT, or RoBERTa), which are vulnerable to TokenBreak."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["When choosing to implement the model in spite of the risks, consider implementing a defense-in-depth approach to securing the system."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Incorporate TokenBreak techniques into existing red team testing to validate robustness to the attack."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Consider retraining the model with the TokenBreak technique taken into account in the adversarial examples used."]}]}]},"headings":[{"value":"TokenBreak","id":"tokenbreak","depth":1},{"value":"Detection Summary","id":"detection-summary","depth":2},{"value":"Security Impact","id":"security-impact","depth":2},{"value":"Risk Considerations","id":"risk-considerations","depth":2},{"value":"Recommended Mitigation","id":"recommended-mitigation","depth":2}],"frontmatter":{"seo":{"title":"TokenBreak"}},"lastModified":"2026-05-26T18:25:46.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/docs/products/supply-chain/remediation-guide/tokenbreak","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}