{"_canonicalization":{"envelope_id":"axm_ + sha256(envelope minus {signature, axiom_id, anchors})","envelope_signature":"ed25519(envelope minus {signature, axiom_id})","json":"sort_keys=True, separators=(',',':'), ensure_ascii=False, allow_nan=False, utf-8","leaf_hash":"sha256(0x00 || canonical_json(envelope_full))","seal_signature":"ed25519(seal minus {signature, sig_algorithm})"},"axiom_id":"axm_55dc63e4c503fc976a17f2ec32714365c14a0b8cc9ba032ab58825f97f2d7b07","bitcoin_anchor":{"bitcoin_attestations":[],"calendar_attestations":[],"ots_url":"","stamped_at":"","status":"pending_next_stamp"},"envelope":{"anchors":[{"chain":"crovia.axiom_graph","height":0,"merkle_proof":"spider_vendor_press_v1","root_at_anchor":"spider_vendor_press_v1"}],"axiom_id":"axm_55dc63e4c503fc976a17f2ec32714365c14a0b8cc9ba032ab58825f97f2d7b07","axiom_type":"AX.OBS","body":{"axiom_subtype":"news.vendor_press.v1","category":"news","fingerprint":"a399f9639a5de3ba7f3174a4b1e00b2726deb5a739eb0dd012e06d7f57a1d836","published":"Fri, 03 Jul 2026 00:00:00 -0400","receipt_hash":"a399f9639a5de3ba7f3174a4b1e00b2726deb5a739eb0dd012e06d7f57a1d836","schema":"spider.news.vendor_press.v1","spider":"vendor_press","spider_record":{"axiom_subtype":"news.vendor_press.v1","category":"news","decision_hint":"POSITIVE","envelope_target":"AX.OBS","fingerprint":"a399f9639a5de3ba7f3174a4b1e00b2726deb5a739eb0dd012e06d7f57a1d836","observed_at":"2026-07-03T04:43:38.241623Z","parent_run_hash":"f0e30469786257a5e74170498cacb4c028623bf32d6d06d4dbadc488960545be","published":"Fri, 03 Jul 2026 00:00:00 -0400","runtime_version":"0.1.0","schema":"spider.news.vendor_press.v1","source_status":200,"source_url":"https://export.arxiv.org/rss/cs.AI","spider":"vendor_press","summary_excerpt":"arXiv:2607.01239v1 Announce Type: cross \nAbstract: Character-level perturbations bypass safety alignment in modern LLMs despite leaving prompts human-readable. We identify and test a central structural mechanism: BPE tokenization fragments safety-critical words into sub-word pieces, and the three public alignment datasets we surveyed contain no intentionally fragmented inputs. The mechanism is a chain, tested end-to-end on five model families (Qwen-3-4B, Qwen-2.5-7B, Gemma-3-4B, Llama-3.1-8B, Mistral-7B). An optimization targeting safety-token fragmentation flips the first-token refusal trigger on 80-100% of refused HarmBench prompts, with 48% of those flips producing genuinely harmful outputs (per-model 29-65%; gap-vs-behavior ROC-AUC 0.66-0.98, pooled 0.84). Activation patching localizes the disrupted signal to the last ${\\sim}30\\%$ of layers; an alignment-data scan finds zero fragmented prompts among 30,000 examples (positive-control recall $\\geq 99\\%$ at attack-relevant intensities","title":"Breaking Safety at the Token Boundary: How BPE Tokenization Creates Exploitable Gaps in LLM Alignment","url":"https://arxiv.org/abs/2607.01239","vendor":"arxiv_cs_ai"},"summary":"arXiv:2607.01239v1 Announce Type: cross \nAbstract: Character-level perturbations bypass safety alignment in modern LLMs despite leaving prompts human-readable. We identify and test a central structural mechanism: BPE tokenization fragments safety-critical words into sub-word pieces, and the three public alignment datasets we surveyed contain no intentionally fragmented inputs. The mechanism is a chain, tested end-to-end on five model families (Qwen-3-4B, Qwen-2.5-7B, Gemma-3-4B, Llama-3.1-8B, Mistral-7B). An optimization targeting safety-token fragmentation flips the first-token refusal trigger on 80-100% of refused HarmBench prompts, with 48% of those flips producing genuinely harmful outputs (per-model 29-65%; gap-vs-behavior ROC-AUC 0.66-0.98, pooled 0.84). Activation patching localizes the disrupted signal to the last ${\\sim}30\\%$ of layers; an alignment-data scan finds zero fragmented prompts among 30,000 examples (positive-control recall $\\geq 99\\%$ at attack-relevant intensities","title":"Breaking Safety at the Token Boundary: How BPE Tokenization Creates Exploitable Gaps in LLM Alignment","vendor":"arxiv_cs_ai"},"confidence":{"method":"deterministic"},"decision":"POSITIVE","issued_at":"2026-07-03T04:43:38Z","notes":"Spider vendor_press (news) news.vendor_press.v1","object":{"captured_by":"crovia.spider.vendor_press","primary_source_url":"https://arxiv.org/abs/2607.01239"},"predecessors":[],"schema":"crovia.axiom.v1","signature":"ed25519:01630fdd600d6fb1b7bb4eb054cd3499d83f04b92d37ce17de18a06d3b78802bf78a1e8e81aff137c0cb11e190e2b714cdaf80e3baf5dca5e3f4de020382740d","signer":"crovia.substrate","subject":{"observed_at":"2026-07-03T04:43:38Z","source_collector":"spider:vendor_press","target_id":"https://arxiv.org/abs/2607.01239"},"tsa":{"authority":"crovia.substrate.bootstrap","rfc3161_token":"{\"kind\":\"crovia.bootstrap.tsa\",\"source_jsonl\":\"/opt/crovia/spider/data/news/vendor_press_v1.jsonl\",\"source_seal_merkle_root\":\"spider_vendor_press_v1\",\"upgrade_path\":\"Sessione H \\u2014 OpenTimestamps weekly anchor\"}"},"zk_mode":"clear","zk_proof":null},"ledger":{"leaf_hash":"0ec392151ac5e9e41f3e91a4cf932c983eb1aa60614a064d9e1bb1b404d13e7b","leaf_index":275425,"ledger_path":"/opt/crovia/substrate/axiom_ledger.jsonl"},"merkle_proof":{"hash_alg":"sha256","leaf_prefix":"0x00","node_prefix":"0x01","odd_leaf_rule":"duplicate_last","path":[{"sibling":"ffeff1b0514871a79932f11ee6d57ddb88d71a368fc2fc939bbc6d49d292107b","side":"left"},{"sibling":"6df21df355f9473698f713545cedf66c66d7e6a3cd9aa34530e14dcb2b698881","side":"right"},{"sibling":"168589569d8ede0f24c8653967ea3e3d73a6b62b3dd7e34b17748c46ea11c5e1","side":"right"},{"sibling":"783228e4c17a66e80f6f3a42d000ae4825ed73691f300b7c8fc2b5acd50ab591","side":"right"},{"sibling":"b34436ca8f0cb47ef8759be247147392ab37323e922465f3ffe79de849f6568a","side":"right"},{"sibling":"00e73e55684a6565f70c5a5520d27b6038f5ef3a1c75877fbc8bac533c2d6672","side":"left"},{"sibling":"3a4dd616b0a708226bdfc1375ba2f51d5b9f5745b3184702e9cbca38e27d2a27","side":"left"},{"sibling":"fd055e725b36f5bebbaeb18583f9d7011c4d8c2a608a11cbd2c166cd895e7a85","side":"left"},{"sibling":"e1a65581e9d68211aa8ba0d138c8d2a4e80afd551e6d1b00c4575c39085df705","side":"left"},{"sibling":"92c062f377cd53076b8dfe55c25ab217059e20113433673cc5747b9348b07e01","side":"left"},{"sibling":"e36f7633c67452f41a7377a7bec9b2d454442688d26539321eebf92cae9db0f0","side":"right"},{"sibling":"4dbd8247ba08a5432c7d6540711da9acb2f59e6189865aa8552dee37f69286a9","side":"right"},{"sibling":"41cd1885dc3fcb51e49eeb887d6d22ec2cfa58df0e4f8d7c7dddf3a1b0ce8249","side":"left"},{"sibling":"8a09562f6b247c1c3cd1fea36cb3b8f1cf5c575479dd514573856a380a964bf5","side":"left"},{"sibling":"723981908169653ca6d835aa9b8381a8c7ad3e3e3830d0792bc32032cda615ee","side":"right"},{"sibling":"c0594fa1ee81d5f019cccc7b5e51af603c6d7e43995498c451012060c7d06165","side":"right"},{"sibling":"4de6a2fb22efbb50c84dc62abeb0f2cbc8c663a9540aeba9e758ebfdfe3e86dd","side":"right"},{"sibling":"fdbb3519f8dc411a4043dfb5abdbfea5441e130326183ac2247c42584033f152","side":"right"},{"sibling":"1cecb7f447febd025aac272837c80de218aecc6485d2395a509b2a1f1b9c746e","side":"left"}]},"schema":"crovia.axiom_proof.v1","seal":{"first_collector_run_id":"","first_receipt_hash":"","jsonl_path":"/opt/crovia/substrate/axiom_ledger.jsonl","key_id":"430895f101d38164","last_collector_run_id":"","last_receipt_hash":"","leaf_count":275799,"merkle_root":"2581d0d6e5fa345cdf2e8ab3b191ace76d6b14189901ab0e4c2291ca1d1ae1e6","public_key_hex":"cf742e26f75669dc673cb5c0786a1ae23ae8ca19c347317192ce40c28a7ff25c","run_id":"hourly_json_retrofit_20260703T053701Z","schema":"crovia.seal.v1","seal_family_version":"crovia-seal-family/1","seal_kind":"substrate_batch","sealed_at":"2026-07-03T05:38:09Z","sig_algorithm":"ed25519","signature":"e44a386a5ae00c0e7fc67b1179bb9060bf0fefc006e454fec70e27668182ff497d1e2faf0c3b22de0917beefb7c80e880dae925a3f67e1b16aa0eb44bf947407","signer_version":"1.1.0"},"trust_root":{"key_id":"430895f101d38164","public_key_hex":"cf742e26f75669dc673cb5c0786a1ae23ae8ca19c347317192ce40c28a7ff25c","signature_algorithm":"ed25519","url":"/registry/canon/TRUST_ROOT.md"},"verifier":{"spec":"/registry/canon/AXIOM_RECEIPT_v1.md","url":"/v/axm_55dc63e4c503fc976a17f2ec32714365c14a0b8cc9ba032ab58825f97f2d7b07"}}