BPE Tokenization Gaps Enable Safety Alignment Bypasses in LLMs

Character-level perturbations exploit Byte Pair Encoding (BPE) fragmentation to bypass safety filters in models including Llama-3.1-8B and Qwen-2.5-7B. Attacks targeting safety-token fragmentation flipped refusal triggers on 80-100% of HarmBench prompts, with 48% resulting in harmful outputs.