Token smuggling gets a forbidden word or instruction past an input filter by changing how it is tokenised: splitting it across pieces, substituting variables, or encoding it. The filter, which matches on the surface text, never sees the banned token, while the model reconstructs the original word from the pieces. It overlaps payload splitting and obfuscation. The defence is to normalise and decode input before filtering and to classify intent on the reconstructed text.
How does token smuggling work?
Filters and models break text into tokens differently, and token smuggling exploits that gap. The attacker writes the banned word in a form that tokenises around the filter, for example inserting separators, substituting characters, defining it through variables, or encoding it, then relies on the model to stitch it back into the real word. The input filter matches the altered surface and passes it; the model reads the intended meaning.
Why token smuggling matters
Any defence that blocks specific words or phrases is vulnerable, because there are many ways to write the same word that a model still understands. Token smuggling is a core building block of encoded jailbreaks and is frequently combined with payload splitting and obfuscation. Tools that bundle hundreds of text transforms make trying many smuggling forms fast.
How to defend against token smuggling
Normalise input before filtering: apply Unicode normalisation, strip separators and zero-width characters, resolve variables, and decode common encodings, then judge the reconstructed text. Prefer intent classification over word blocklists, filter output on content, and red-team with a wide set of smuggling transforms.
References
- [1]OWASP LLM01:2025, Prompt Injection(OWASP)
- [2]OWASP Top 10 for LLM Applications(OWASP)
- [3]MITRE ATLAS, Adversarial ML tactics(MITRE)
- [4]Parseltongue, text transform and promptcrafting tool(GitHub)
Word blocklists lose to token smuggling. Talk to a security expert about testing your input normalisation and intent checks.