--- title: 'DefensiveToken: Token-Level Security' url: https://www.emergentmind.com/topics/defensivetoken type: topic --- # DefensiveToken: Token-Level Security DefensiveToken denotes a family of token-centric defense mechanisms in which security control is attached to tokens, token representations, or token-level probability mass rather than only to full-sequence classifiers or global retraining. In the explicit formulation introduced for prompt injection, DefensiveTokens are newly inserted as special tokens whose embeddings are optimized for security and prepended at test time; in broader usage, recent work extends the same logic to single-token sentinels, last-token activation gates, probability-shaping over early tokens, tokenizer-level anomaly scores, token-level data selection, and multimodal token suppression [2507.07974]. ## 1. Conceptual scope and taxonomy The most concrete definition of DefensiveToken is the one given by "Defending Against Prompt Injection With a Few DefensiveTokens" [2507.07974]: a small number of new special tokens are added to the vocabulary, their embeddings are optimized while the base model weights remain fixed, and system developers can prepend them only in security-sensitive cases. The resulting mechanism is a test-time defense with a flexible on/off switch: with the tokens present, the model gains prompt injection robustness; without them, the model behaves as the original base model. The paper formalizes the defended input as \([t; x]\), where \(t = (t_1,\dots,t_n)\in\mathbb{R}^{n\times e}\) are learned defensive embeddings and \(x\in\mathbb{R}^{k\times e}\) is the original input embedding sequence [2507.07974]. Subsequent work uses the term in a broader, more abstract sense. "STShield: Single-Token Sentinel for Real-Time Jailbreak Detection in Large Language Models" treats a single extra output token as a binary safety indicator, effectively a one-token defense interface attached to the model’s own generation head [2503.17932]. "GUARD-SLM: Token Activation-Based Defense Against Jailbreak Attacks for Small Language Models" treats the last-token hidden state at a selected layer as a safety sentinel whose geometry in activation space determines whether decoding is allowed, even though no explicit token is inserted [2603.28817]. A useful synthesis is that DefensiveToken is not yet a single standardized architecture. Current usage spans at least four regimes: explicit learned prefix tokens, output-side sentinel tokens, implicit activation tokens, and token-level distribution or selection mechanisms. This suggests that the unifying idea is not the surface form of a token, but the use of a small token-level control interface as the locus of defense. ## 2. Explicit inserted tokens and single-token sentinels In the explicit prompt-injection defense, the learned token embeddings \(t\) are optimized with the loss \[ \mathcal{L}_t^{\text{DefensiveToken}}(x,y) = -\log p_{\theta,t}(y \mid [t;x]), \] where \(\theta\) is fixed and only \(t\) is trained on a StruQ-style defensive instruction-tuning dataset constructed from self-labeled Cleaned Alpaca data. With \(n=5\) defensive tokens, one epoch of training, and learning rate \(0.1\), the method attains average ASR \(0.24\%\) on TaskTracker across Llama3-8B-Instruct, Llama3.1-8B-Instruct, Falcon3-7B-Instruct, and Qwen2.5-7B-Instruct, while utility changes on AlpacaEval2 are small and sometimes favorable; random initialization outperforms vocabulary-based initialization, and prepending the tokens at the start is critical, since end insertion can drive WinRate down to \(5.08\) even when ASR reaches \(0\) [2507.07974]. STShield implements a different explicit token interface. For an input prompt \(\mathbf{x}_{1:n}\), the model is trained to generate a normal answer \(\mathbf{x}_{n+1:n+m}\), then \(x_{\text{eos}}\), then a binary detection token \(x_d\in\{x_{\text{safe}},x_{\text{harm}}\}\). The full target sequence is \[ \mathbf{x}_{n+1:n+m} \oplus x_{\text{eos}} \oplus x_d . \] This uses the existing LM head rather than a separate classifier head. On Vicuna-13B, STShield reports \(2.40\%\) ASR on DAN, \(0.63\%\) on MultiJail, AlpacaEval Prefix ASR \(91.43\%\), MT-Bench \(6.24\) versus \(6.54\) for no defense, and latency close to no defense because the additional cost is essentially one extra decode step after EOS [2503.17932]. "One Trigger Token Is Enough: A Defense Strategy for Balancing Safety and Usability in Large Language Models" reports a related observation: safety-aligned LLMs and multiple defense strategies generate highly similar initial refusal tokens, termed safety trigger tokens, and the proposed D-STT explicitly decodes a safety trigger constrained to a single token [2505.07167]. Taken together, these works indicate that, in many aligned LLMs, the first token or first few tokens of a refusal trajectory function as a compact control point for downstream safety behavior. ## 3. Implicit activation controllers and decoding-time probability shaping GUARD-SLM replaces explicit token insertion with an activation-space gate. For a decoder-only transformer with hidden states \(H^{(\ell)}\in\mathbb{R}^{T\times d}\), it extracts the last-token activation at a selected layer, \[ \mathbf{h}^{\mathrm{last}_\ell} = H_T^{(\ell)} \in \mathbb{R}^d, \] standardizes it, and feeds it to an RBF-kernel SVM \(f:\mathbb{R}^d\to\{0,1\}\). If \(\hat y=1\), generation is blocked; otherwise the model decodes normally. The paper shows that optimized jailbreak prompts form distinct activation clusters across layers, that middle and late layers often give near-perfect separability, and that on LLaMA-2-7B-Chat the defended model reaches \(0\%\) ASR on all attacks except Jailbroken, where ASR is \(0.74\%\), with inference time \(0.43\)s and \(0\) additional tokens [2603.28817]. At decoding time, a related family of methods treats token probabilities themselves as the defensive control surface. "Alignment-Enhanced Decoding:Defending via Token-Level Adaptive Refining of Probability Distributions" defines a Competitive Index \[ I = \frac{S}{S_t}, \] where \(S\) is the size of the top-\(p\) candidate set and \(S_t\) is an upper bound estimated from harmless data. It then computes post-alignment logits \(\mathbf{L}_{\text{post}}\) by re-running the model on its own generated output and forms \[ \mathbf{L}_{\text{AED}} = (1-c)\mathbf{L}_{\text{model}} + c\mathbf{L}_{\text{post}}, \] with \(c\) determined by the gap between \(I_{\text{model}}\) and \(I_{\text{post}}\). The effect is to increase refusal-token probability when competing harmful and harmless continuations are simultaneously present, while preserving high Not Rejection Rate on benign datasets [2408.07663]. LightDefense uses a simpler token-level bias. It estimates a safety-oriented direction \(D_{\text{safety}}(x)=P^+(x)-P^-(x)\) from early-token distributions of safe refusals and unsafe responses, defines a restricted candidate space \(\bar{\mathcal{V}}_n=\mathcal{V}_n^k\cup\mathcal{D}_n^k\), and shifts early-token logits by \(\alpha D_{\text{safety}}(x)\). The strength \(\alpha\) is set by an uncertainty score \(UQ\), with \(\alpha=0\) for \(UQ>\tau\) and \(\alpha=\beta e^{\tau-UQ}\) for \(UQ\le\tau\); the paper reports Pearson correlation \(-0.86\) between uncertainty and harmfulness, ATGR \(1.01\times\), SHB \(0.924\) on Vicuna and \(0.975\) on Llama2, and near-zero ASR on XSTest and several jailbreak attacks without major BAR degradation [2504.01533]. A training-time analogue appears in TokenBuncher, where the “token” being defended is the model’s output distribution itself. TokenBuncher minimizes token-level entropy on harmful queries using entropy-as-reward RL, \[ R^{\mathrm{TB}}(\mathbf{q},\mathbf{y})=-\bar H\bigl(p_\theta(\mathbf{y}\mid\mathbf{q})\bigr), \] and corrupts low-probability tokens with a Token Noiser so that RL-based harmful fine-tuning cannot exploit reward gradients to reopen harmful modes. Across PPO, GRPO, RLOO, and REINFORCE++, Harmful Scores on Qwen2.5-7B-Instruct drop from roughly \(45.00/78.59\) on HarmBench/StrongREJECT under GRPO to \(0.75/0.32\), while GSM8K, MATH, and MMLU-pro remain close to the base model [2508.20697]. ## 4. Tokenization, anomaly localization, and substitution-based defenses A second major branch uses token-level anomaly signals rather than inserted control tokens. RTD-Guard is a strict black-box detector for word-substitution adversarial examples. It computes per-token replacement probabilities \(p_i=D_{\text{RTD}}(x,i)\), masks the top-\(k\) suspicious tokens, queries the victim model on \(x\) and \(x^m\), and scores the example by \[ S_x = \bigl(f(x)_c - f(x^m)_c\bigr)^2 . \] With \(k=5\) and threshold \(\tau=0.09\), the method uses exactly two victim queries, no adversarial training data, and on 11 of 12 dataset–attack combinations attains the highest detection metrics; on AG-News/TextFooler it reports \(97.5/94.9/98.4\) for TPR10/F1/AUC, and total runtime is \(35.3\)s on \(2{,}444\) examples [2603.12582]. Broken-Token focuses on obfuscated jailbreak prompts by exploiting BPE inefficiency. It defines average characters per token \[ \overline{\mathrm{CPT}}(x)=\frac{\text{number of characters in }x}{\text{number of tokens produced by the tokenizer on }x}, \] and classifies prompts as obfuscated when \(\overline{\mathrm{CPT}}(x)<\tau\). Across more than \(100{,}000\) prompts and four tokenizers, thresholding CPT yields \(99.7\%-99.9\%\) accuracy and \(0.991-0.997\) F1 on combined obfuscations, with tokenizer-specific thresholds such as \(2.92\) for GPT-4o and \(2.71\) for Llama 3.2 [2510.26847]. TokenBreak inverts the perspective by showing that tokenization itself is an attack surface: a single prepended character can cause BPE or WordPiece classifiers to miss malicious content. The proposed defense places a Unigram tokenizer in front of BPE or WordPiece models and maps Unigram tokens back to the base tokenizer without retraining. This reduces mean TokenBreak success across BPE and WordPiece models from \(33.09\%\) to \(12.63\%\); for WordPiece prompt injection it drops from \(11.90\%\) to \(0.17\%\), and for WordPiece toxicity from \(76.05\%\) to \(22.93\%\) [2506.07948]. For training-stage backdoor defense, "Defense Against Syntactic Textual Backdoor Attacks with Token Substitution" preserves potential trigger carriers in \(\mathcal{S}\cup\mathcal{L}\), replaces semantically meaningful tokens with same-POS tokens associated with a different class, and flags an input as poisoned when the original label persists with high confidence over repeated substitutions. On Hidden Killer syntactic triggers, recall is \(100\%\) in all reported settings, and F1 commonly exceeds \(94\%\) across SST-2, AG’s News, and DBpedia14 [2407.04179]. ## 5. Training-time token selection, unlearning, and privacy defense In safe fine-tuning, DefensiveToken ideas reappear as token-level data curation. TOSS trains a safety-degraded model \(f_{\theta^h}\) and a utility-oriented model \(f_{\theta^u}\), scores each response token by \[ \mathcal{S}(y_{i,j}^{\text{cus}})= -\log P(y_{i,j}^{\text{cus}}\mid\cdot;\theta^u)+\log P(y_{i,j}^{\text{cus}}\mid\cdot;\theta^h), \] globally masks the top \(d\) fraction of risky tokens, and fine-tunes on the remaining tokens only. On Llama-3-8B-Instruct, vanilla SFT on the mixed REDORCA data yields ASR \(96.25/86.96\) on Anthropic HH and HEx-PHI; TOSS reduces this to \(78.90/54.54\), and TOSS-Pro further to \(76.56/43.63\), while average win rate over two safety benchmarks and one utility benchmark rises from \(50\) for SFT to \(81.6\) for TOSS and \(83.8\) for TOSS-Pro [2603.01185]. DuoLearn applies the same token-level perspective to privacy. Using a reference model \(\theta_{\text{ref}}\), it scores each token by \[ s(t_i)=\log P(t_i\mid t_{