Adversarial Tokenization
Paper • 2503.02174 • Published
canonical_bf16
Research checkpoint from a study of tokenization (reader) invariance and its
effect on robustness to adversarial re-tokenization. Fine-tuned from
allenai/OLMo-2-1124-7B-Instruct.
These are research artifacts, not products. Numbers below are measured on a 200-prompt AdvBench holdout that was excluded from training by construction.
Measured
| metric | value |
|---|---|
| — | not yet measured |
AdvTok ASR is attack success rate under adversarial tokenization
(Geh et al., arXiv:2503.02174), Llama-Guard-3-8B judged, greedy decoding.
XSTest over-refusal is the refusal rate on safe prompts — the cost side.
Training configuration
| field | value |
|---|
Parameter drift from base (training-happened guard)
| group | relative L2 |
|---|
Caveats
- Single seed. No claim of significance across seeds.
- Evaluated on English AdvBench/XSTest/Alpaca only.
- The safety numbers are for the specific attack studied; they do not imply robustness to other jailbreaks.
- Downloads last month
- 24
Inference Providers NEW
This model isn't deployed by any Inference Provider. 🙋 Ask for provider support
Model tree for Sahmeee/olmo2-7b-instruct-canonical-bf16
Base model
allenai/OLMo-2-1124-7B Finetuned
allenai/OLMo-2-1124-7B-SFT Finetuned
allenai/OLMo-2-1124-7B-DPO Finetuned
allenai/OLMo-2-1124-7B-Instruct