Phonetic Perturbations Reveal Tokenizer-Rooted Safety Gaps in LLMs

2025/05/20 by Aswal, Darpan, Siddharth D Jaiswal, Jaiswal, Siddharth D
Arts and Humanities · Computer Science · Social Sciences · #Artificial Intelligence (cs.AI) #Computation and Language (cs.CL) #FOS: Computer and information sciences #Multilingual Education and Policy #Natural Language Processing Techniques #Translation Studies and Practices

paper · pdf · doi:10.48550/arxiv.2505.14226

openalex publication_date 2025/05/20 · openalex created_date 2025/10/10 · openalex updated_date 2026/08/03

Abstract

Safety-aligned LLMs remain vulnerable to digital phenomena like textese that introduce non-canonical perturbations to words but preserve the phonetics. We introduce CMP-RT (code-mixed phonetic perturbations for red-teaming), a novel diagnostic probe that pinpoints tokenization as the root cause of this vulnerability. A mechanistic analysis reveals that phonetic perturbations fragment safety-critical tokens into benign sub-words, suppressing their attribution scores while preserving prompt interpretability -- causing safety mechanisms to fail despite excellent input understanding. We demonstrate that this vulnerability evades standard defenses, persists across modalities and state-of-the-art (SOTA) models including Gemini-3-Pro, and scales through simple supervised fine-tuning (SFT). Furthermore, layer-wise probing shows perturbed and canonical input representations align up to a critical layer depth; enforcing output equivalence robustly recovers the lost representations, providing causal evidence for a structural gap between pre-training and alignment, and establishing tokenization as a critical, under-examined vulnerability in current safety pipelines.

Citations

• Gemini 2.5: Pushing the Frontier with Advanced Reasoning, Multimodality, Long Context, and Next Generation Agentic Capabilities
• Audio Jailbreak: An Open Comprehensive Benchmark for Jailbreaking Large Audio-Language Models
• Attributional Safety Failures in Large Language Models under Code-Mixed Perturbations
• Best-of-N Jailbreaking
• GPT-4o System Card
• Faster-GCG: Efficient Discrete Optimization Jailbreak Attacks against Aligned Large Language Models
• MIRAGE-Bench: Automatic Multilingual Benchmark Arena for Retrieval-Augmented Generation Systems
• The Llama 3 Herd of Models
• Arondight: Red Teaming Large Vision Language Models with Auto-generated Multi-modal Jailbreak Prompts
• AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases
• Refuse Whenever You Feel Unsafe: Improving Safety in LLMs via Decoupled Refusal Training
• Multilingual Blending: LLM Safety Alignment Evaluation with Language Mixture
• Code-Switching Red-Teaming: LLM Evaluation for Safety and Multilingual Understanding
• Improved Few-Shot Jailbreaking Can Circumvent Aligned Language Models and Their Defenses
• White-box Multimodal Jailbreaks Against Large Vision-Language Models
• The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions
• How (un)ethical are instruction-centric responses of LLMs? Unveiling the vulnerabilities of safety guardrails to harmful queries
• TrustAgent: Towards Safe and Trustworthy LLM-based Agents
• Towards Red Teaming in Multimodal and Multilingual Translation
• The Language Barrier: Dissecting Safety Challenges of LLMs in Multilingual Contexts
• Sowing the Wind, Reaping the Whirlwind: The Impact of Editing Language Models
• Steering Llama 2 via Contrastive Activation Addition
• Tree of Attacks: Jailbreaking Black-Box LLMs Automatically
• Mistral 7B
• Detecting Language Model Attacks with Perplexity
• Red-Teaming Large Language Models using Chain of Utterances for Safety-Alignment
• "Do Anything Now": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Models
• Code of "Sirens' Whisper: Inaudible Near-Ultrasonic Jailbreaks of Speech-Driven LLMs"
• Jailbroken: How Does LLM Safety Training Fail?
• Judging LLM-as-a-Judge with MT-Bench and Chatbot Arena
• Red Teaming Language Models to Reduce Harms: Methods, Scaling Behaviors, and Lessons Learned
• No Language Left Behind: Scaling Human-Centered Machine Translation
• Benchmarking Neural Network Robustness to Common Corruptions and Perturbations
• Axiomatic Attribution for Deep Networks
• CHAI for LLMs: Improving Code-Mixed Translation in Large Language Models through Reinforcement Learning with AI Feedback
• Formalizing and Benchmarking Prompt Injection Attacks and Defenses

Related

• A Cross-Language Investigation into Jailbreak Attacks in Large Language Models
• Multilingual Jailbreak Challenges in Large Language Models
• Align is not Enough: Multimodal Universal Jailbreak Attack against Multimodal Large Language Models
• JailBreakV: A Benchmark for Assessing the Robustness of MultiModal Large Language Models against Jailbreak Attacks
• Jailbreaking Multimodal Large Language Models via Shuffle Inconsistency