Character-level perturbations bypass safety alignment in modern LLMs despite leaving prompts human-readable. We identify and test a central structural mechanism: BPE tokenization fragments safety-critical words into sub-word pieces, and the three public alignment datasets we surveyed contain no intentionally fragmented inputs. The mechanism is a chain, tested end-to-end on five model families (Qwen-3-4B, Qwen-2.5-7B, Gemma-3-4B, Llama-3.1-8B, Mistral-7B). An optimization targeting safety-token fragmentation flips the first-token refusal trigger on 80-100% of refused HarmBench prompts, with 48% of those flips producing genuinely harmful outputs (per-model 29-65%; gap-vs-behavior ROC-AUC 0.66-0.98, pooled 0.84). Activation patching localizes the disrupted signal to the last ${\sim}30\%$ of layers; an alignment-data scan finds zero fragmented prompts among 30,000 examples (positive-control recall $\geq 99\%$ at attack-relevant intensities); and targeted-mutation experiments isolate safety words as the disruption locus. On the defense side, a 68-cell grid (55 trained checkpoints) shows that no DPO configuration achieves seed- and pool-stable ASR closure on the three families with closed pool-size confounds. SFT trained on fragmented prompts closes ASR on 3/5 families but only via global collapse that raises refusal on benign prompts as well, indicating the missing distribution is necessary but not sufficient under the LoRA-16 recipe we tested. To distinguish selective repair from global collapse, we introduce Conv-Benign, a candidate paired diagnostic. All ASR claims are 3-judge-calibrated (cell rankings stable across judges; absolute levels $\pm$18pp; see App.~B.13).
How Important Is Tokenization in French Medical Masked Language Models?
LIA, Avignon University（阿维尼翁大学计算机科学与人工智能实验室）；Zenidoc（Zenidoc公司）；Nantes Université（南特大学）；École Centrale Nantes（南特中央理工学院）；CNRS（法国国家科学研究中心）；LS2N, UMR 6004（南特数字科学实验室）
Scaffold-BPE: Enhancing Byte Pair Encoding for Large Language Models with Simple and Effective Scaffold Token Removal
Beihang University（北京航空航天大学）；Tsinghua University（清华大学）；BNRist（北京信息科学与技术国家研究中心）；Chinese Academy of Sciences（中国科学院）；Beijing Institute Of Technology（北京理工大学）
MorphBPE: A Morpho-Aware Tokenizer Bridging Linguistic Complexity for Efficient LLM Training Across Morphologies
Qatar Computing Research Institute (QCRI)（卡塔尔计算研究所）；German Research Center for Artificial Intelligence (DFKI)（德国人工智能研究中心）；Technical University of Berlin（柏林工业大学）
Stop Taking Tokenizers for Granted: They Are Core Design Decisions in Large Language Models
Princess Nourah Bint Abdulrahman University（普里丝琴·努拉·本·阿卜杜勒拉赫曼大学）；Saudi Data & AI Authority (SDAIA)（沙特数据与人工智能管理局）；University of Alberta（阿尔伯塔大学）；Dialpad（Dialpad公司）；York University（约克大学）；Qatar Computing Research Institute（卡塔尔计算研究所）；Amazon AGI（亚马逊人工智能研究所）
Tokens, the oft-overlooked appetizer: Large language models, the distributional hypothesis, and meaning
Computational Story Lab（计算故事实验室）；Vermont Complex Systems Institute（佛蒙特复杂系统研究所）；University of Vermont（佛蒙特大学）；Department of Computer Science（计算机科学系）；St. Michael’s College（圣米歇尔学院）；Communication Media and Marginalization Lab（传播媒体与边缘化实验室）；Northeastern University（东北大学）；Department of Mathematics & Statistics（数学与统计学系）
Department of Computing Science, Umeå University（乌梅大学计算机科学系）；Department of Computer Science, Stellenbosch University（斯坦福博芝大学计算机科学系）；National Institute for Theoretical and Computational Sciences, South Africa（南非理论与计算科学国家研究所）
From Pixels to Tokens: Byte-Pair Encoding on Quantized Visual Modalities
School of Computer Science, Peking University（北京大学计算机学院）；The Chinese University of Hong Kong（香港中文大学）；University of California, San Diego（加利福尼亚大学圣迭戈分校）；Beijing Academy of Artificial Intelligence（北京人工智能研究院）；Institute of Automation, Chinese Academy of Sciences（中国科学院自动化研究所）
The Limits of BPE Tokenization in Polish: Segmentation-Flexional Forms, Grammatical Anchoring, and First-Person Stability in Inflectional Language Models
