语音扰动暴露大模型分词漏洞，导致安全机制失效。
Phonetic Perturbations Reveal Tokenizer-Rooted Safety Gaps in LLMs
- 用混合语音扰动检测分词导致的安全盲区。
- 扰动使关键安全词被拆成无害子词，抑制识别得分。
- 适用于各类主流模型，对微调后模型仍有效。
安全对齐的大语言模型仍易受文本缩写等数字现象影响，这些现象虽改变词汇的非标准拼写，却保留其发音特征。本文提出一种名为CMP-RT（代码混合语音扰动红队测试）的新诊断工具，揭示分词是该漏洞的根本原因。机制分析表明，语音扰动会将安全敏感词拆分为无害子词，降低其归属得分，同时保持输入可理解性，导致安全机制失效，尽管模型具备良好理解能力。实验显示该漏洞可绕过标准防御，跨模态、跨多个SOTA模型（包括Gemini-3-Pro）持续存在，并可通过简单的监督微调（SFT）放大。层间探查发现，扰动与标准输入在某一临界层深度前表示对齐；强制输出一致可恢复丢失表征，为预训练与对齐阶段间的结构性差距提供了因果证据，确立分词为当前安全流程中被忽视的关键弱点。
原文摘要 · Abstract (English)
Safety-aligned LLMs remain vulnerable to digital phenomena like textese that introduce non-canonical perturbations to words but preserve the phonetics. We introduce CMP-RT (code-mixed phonetic perturbations for red-teaming), a novel diagnostic probe that pinpoints tokenization as the root cause of this vulnerability. A mechanistic analysis reveals that phonetic perturbations fragment safety-critical tokens into benign sub-words, suppressing their attribution scores while preserving prompt interpretability -- causing safety mechanisms to fail despite excellent input understanding. We demonstrate that this vulnerability evades standard defenses, persists across modalities and state-of-the-art (SOTA) models including Gemini-3-Pro, and scales through simple supervised fine-tuning (SFT). Furthermore, layer-wise probing shows perturbed and canonical input representations align up to a critical layer depth; enforcing output equivalence robustly recovers the lost representations, providing causal evidence for a structural gap between pre-training and alignment, and establishing tokenization as a critical, under-examined vulnerability in current safety pipelines.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。