{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":[]},"type":"markdown"},"seo":{"title":"Tokenizer Tampering","siteUrl":"https://docs.hiddenlayer.ai"},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"tokenizer-tampering","__idx":0},"children":["Tokenizer Tampering"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"detection-summary","__idx":1},"children":["Detection Summary"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The model's ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["tokenizer.json"]}," contains two or more tokens that share the same token ID. Tokenizers assume each ID maps to a single token. An attacker can add a malicious token with the same ID as an existing one, giving them control over what text the model outputs for that ID. The original token remains in the vocabulary to prevent the tokenizer from failing on load. The attacker's token is then used when the model's output is converted back to text."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This attack targets BPE and WordPiece tokenization strategies. Unigram-based tokenizers are not affected. The finding indicates a tampered tokenizer that should be corrected before relying on the model in security or policy sensitive settings."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"security-impact","__idx":2},"children":["Security Impact"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Duplicate token IDs enable deterministic output substitution. The model generates token IDs with no awareness of the tampered vocabulary, and the attacker's token is used when converting those IDs back to text. This can be used to redirect URLs through attacker-controlled proxies, inject tool calls, or substitute commands. In security-sensitive or policy-enforced contexts (e.g., safety classifiers, content filters, or access control), this can undermine the integrity of model outputs used for classification, filtering, or generation."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"risk-considerations","__idx":3},"children":["Risk Considerations"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This finding is not a bug or misconfiguration. Duplicate token IDs in a published model indicate deliberate tampering with the tokenizer artifact. It is a supply chain integrity concern. Consumers of the model should treat duplicate token IDs as a security issue, especially where the model is used for classification, filtering, or generation in high-assurance or policy-enforced contexts."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"recommended-mitigation","__idx":4},"children":["Recommended Mitigation"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Restore the tokenizer:"]}," Remove the duplicate token entry that does not belong to the original model's vocabulary. The original token must be preserved to maintain valid merge rules. If the original tokenizer file is available from the base model's source, replace the tampered file entirely."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Validate after changes:"]}," After removing the duplicate, verify that tokenization and decoding produce expected results, including round-trip checks."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Inspect the full model:"]}," Tokenizer tampering is a supply chain attack and may indicate that other model artifacts have also been compromised. Review other artifacts, including weights and configuration files, for signs of further tampering."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"general-mitigations","__idx":5},"children":["General mitigations:"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This attack targets BPE and WordPiece tokenization strategies. Models using Unigram tokenization (e.g., ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["DeBERTa-v2/v3,"]}," ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["XLM-RoBERTa"]},") are not affected as they do not use token-to-ID mappings in the same way."," ","Use defense-in-depth when deploying the model."," ","Include tokenizer integrity checks in red-team or robustness testing."]}]},"headings":[{"value":"Tokenizer Tampering","id":"tokenizer-tampering","depth":1},{"value":"Detection Summary","id":"detection-summary","depth":2},{"value":"Security Impact","id":"security-impact","depth":2},{"value":"Risk Considerations","id":"risk-considerations","depth":2},{"value":"Recommended Mitigation","id":"recommended-mitigation","depth":2},{"value":"General mitigations:","id":"general-mitigations","depth":2}],"frontmatter":{"seo":{"title":"Tokenizer Tampering"}},"lastModified":"2026-07-06T22:30:55.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/docs/products/supply-chain/remediation-guide/tokenizer_tampering","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}