Token Smuggling.

A class of jailbreak technique that hides harmful instructions for an LLM inside encodings, languages, or token sequences the safety filter does not recognise as dangerous. It belongs to the AI & ML Security category of cybersecurity.

A class of jailbreak technique that hides harmful instructions for an LLM inside encodings, languages, or token sequences the safety filter does not recognise as dangerous.

Token smuggling exploits the mismatch between how a model tokenizes and decodes text and how its content classifiers analyse it. Attackers split forbidden words across multiple tokens, use Base64, ROT-13, Unicode look-alikes, leet-speak, low-resource languages, or instruct the model to assemble the malicious string from harmless pieces — for example "concatenate the second letter of each word". Variants include payload smuggling through tool inputs and obfuscated function calls. The technique works because guardrails often inspect surface text rather than the model's reconstructed intent. Mitigations include classifier ensembles that operate on decoded text, semantic-level intent detection, decoding-aware safety models, runtime sandboxing of tool calls, and continuous adversarial red-team evaluations.

Defences for Token Smuggling typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Token smuggling jailbreak, Encoded prompt injection.