Glitch Tokens in Large Language Models: Categorization Taxonomy and Effective Detection
Not on the map. Why?
Abstract (arXiv)
With the expanding application of Large Language Models (LLMs) in various domains, it becomes imperative to comprehensively investigate their unforeseen behaviors and consequent outcomes. In this study, we introduce and systematically explore the phenomenon of "glitch tokens", which are anomalous tokens produced by established tokenizers and could potentially compromise the models' quality of response. Specifically, we experiment on seven top popular LLMs utilizing three distinct tokenizers and involving a totally of 182,517 tokens. We present categorizations of the identified glitch tokens and symptoms exhibited by LLMs when interacting with glitch tokens. Based on our observation that glitch tokens tend to cluster in the embedding space, we propose GlitchHunter, a novel iterative clustering-based technique, for efficient glitch token detection. The evaluation shows that our approach notably outperforms three baseline methods on eight open-source LLMs. To the best of our knowledge, we present the first comprehensive study on glitch tokens. Our new detection further provides valuable insights into mitigating tokenization-related errors in LLMs.
Key facts. Cited by 27 papers in the map (data through 7 Oct 2026). Builds on 26 of its 52 references that are in the map. First posted on arXiv 15 Apr 2024.
Builds on
26 of 52 references.
References · 26
- 2020Language Models are Few-Shot Learnerscited by 32,199
- 2023LLaMA: Open and Efficient Foundation Language Modelscited by 13,958
- 2018UMAP: Uniform Manifold Approximation and Projection for Dimension Reductioncited by 2,841
- 2019Fine-Tuning Language Models from Human Preferencescited by 2,124
- 2021GLM: General Language Model Pretraining with Autoregressive Blank Infillingcited by 1,026
- 2022Teaching Models to Express Their Uncertainty in Wordscited by 731
- 2023Prompt Injection attack against LLM-integrated Applicationscited by 568
- 2019Release Strategies and the Social Impacts of Language Modelscited by 505
- 2023Jailbreaking ChatGPT via Prompt Engineering: An Empirical Studycited by 478
- 2018From Louvain to Leiden: guaranteeing well-connected communitiescited by 379
- 2022Text and Code Embeddings by Contrastive Pre-Trainingcited by 358
- 2023MasterKey: Automated Jailbreak Across Multiple Large Language Model Chatbotscited by 172
14 more
- 2023PentestGPT: An LLM-empowered Automatic Penetration Testing Toolcited by 94
- 2023CMATH: Can Your Language Model Pass Chinese Elementary School Math Test?cited by 89
- 2024Pandora: Jailbreak GPTs by Retrieval Augmented Generation Poisoningcited by 62
- 2024Play Guessing Game with LLM: Indirect Jailbreak Attack with Implicit Cluescited by 57
- 2023BiasAsker: Measuring the Bias in Conversational AI Systemcited by 52
- 2023Large Language Models are Edge-Case Fuzzers: Testing Deep Learning Libraries via FuzzGPTcited by 36
- 2022NNSmith: Generating Diverse and Valid Test Cases for Deep Learning Compilerscited by 29
- 2023MTTM: Metamorphic Testing for Textual Content Moderation Softwarecited by 20
- 2020BARD: A structured technique for group elicitation of Bayesian networks to support analytic reasoningcited by 13
- 2023E-NER: Evidential Deep Learning for Trustworthy Named Entity Recognitioncited by 7
- 2023Validating Multimedia Content Moderation Software via Semantic Fusioncited by 5
- 2024MeTMaP: Metamorphic Testing for Detecting False Vector Matching Problems in LLM Augmented Generationcited by 4
- 2023Automated Testing and Improvement of Named Entity Recognition Systemscited by 3
- 2023An Image is Worth a Thousand Toxic Words: A Metamorphic Testing Framework for Content Moderation Softwarecited by 3
Built on by
Citing papers per year: 2024: 9; 2025: 10; 2026: 8.
27 papers.
Sort:
By area:
- 2024LLMmap: Fingerprinting For Large Language Modelscited by 56
- 2024garak: A Framework for Security Probing Large Language Modelscited by 48
- 2024BPE Gets Picky: Efficient Vocabulary Refinement During Tokenizer Trainingcited by 30
- 2025Token embeddings violate the manifold hypothesiscited by 14
- 2025From Assistants to Adversaries: Exploring the Security Risks of Mobile LLM Agentscited by 10
- 2024Insights and Current Gaps in Open-Source LLM Vulnerability Scanners: A Comparative Analysiscited by 9
- 2024Constructing a BPE Tokenization DFAcited by 5
- 2024Repairing Catastrophic-Neglect in Text-to-Image Diffusion Models via Attention-Guided Feature Enhancementcited by 5
- 2025Speculating LLMs' Chinese Training Data Pollution from Their Tokenscited by 5
- 2024GlitchProber: Advancing Effective Detection and Mitigation of Glitch Tokens in Large Language Modelscited by 3
- 2024GlitchMiner: Mining Glitch Tokens in Large Language Models via Gradient-based Discrete Optimizationcited by 3
- 2025Breaking the Loop: Detecting and Mitigating Denial-of-Service Vulnerabilities in Large Language Modelscited by 3
15 more
- 2025Probing the topology of the space of tokens with structured promptscited by 3
- 2025Addressing Tokenization Inconsistency in Steganography and Watermarking Based on Large Language Modelscited by 3
- 2026AdaptBPE: From General Purpose to Specialized Tokenizerscited by 3
- 2026LiteToken: Removing Intermediate Merge Residues From BPE Tokenizerscited by 3
- 2025Circumventing Safety Alignment in Large Language Models Through Embedding Space Toxicity Attenuationcited by 2
- 2024Can Large Language Models put 2 and 2 together? Probing for Entailed Arithmetical Relationshipscited by 1
- 2025Demystifying optimized prompts in language modelscited by 1
- 2026Disentangling MLP Neuron Weights in Vocabulary Spacecited by 1
- 2026Trusted Weights, Treacherous Optimizations? Optimization-Triggered Backdoor Attacks on LLMscited by 1
- 2025Logit-Gap Steering: A Forward-Pass Diagnostic for Alignment Robustnesscited by 0
- 2025TokenBlowUp: Resolving Representational Singularities in LLM Token Spaces via Monoidal Transformationscited by 0
- 2026Generative Chemical Language Models for Energetic Materials Discoverycited by 0
- 2026Check Your LLM's Secret Dictionary! Five Lines of Code Reveal What Your LLM Learned (Including What It Shouldn't Have)cited by 0
- 2026Beyond Perplexity: UTF-8 Validity in Byte-aware Language Modelscited by 0
- 2026Out of Sight: Compression-Aware Content Protection against Agentic Crawlerscited by 0
- 2026Out of Sight: Compression-Aware Content Protection against Agentic Crawlers9 Jul 2026
- 2026Beyond Perplexity: UTF-8 Validity in Byte-aware Language Models12 Jun 2026
- 2026Check Your LLM's Secret Dictionary! Five Lines of Code Reveal What Your LLM Learned (Including What It Shouldn't Have)21 May 2026
- 2026Trusted Weights, Treacherous Optimizations? Optimization-Triggered Backdoor Attacks on LLMs20 May 2026
- 2026Disentangling MLP Neuron Weights in Vocabulary Space7 Apr 2026
- 2026Generative Chemical Language Models for Energetic Materials Discovery30 Mar 2026
- 2026LiteToken: Removing Intermediate Merge Residues From BPE Tokenizers4 Feb 2026
- 2026AdaptBPE: From General Purpose to Specialized Tokenizers29 Jan 2026
- 2025Addressing Tokenization Inconsistency in Steganography and Watermarking Based on Large Language Models28 Aug 2025
- 2025Speculating LLMs' Chinese Training Data Pollution from Their Tokens25 Aug 2025
- 2025TokenBlowUp: Resolving Representational Singularities in LLM Token Spaces via Monoidal Transformations26 Jul 2025
- 2025Circumventing Safety Alignment in Large Language Models Through Embedding Space Toxicity Attenuation8 Jul 2025
15 more
- 2025Logit-Gap Steering: A Forward-Pass Diagnostic for Alignment Robustness30 Jun 2025
- 2025From Assistants to Adversaries: Exploring the Security Risks of Mobile LLM Agents19 May 2025
- 2025Demystifying optimized prompts in language models4 May 2025
- 2025Token embeddings violate the manifold hypothesis1 Apr 2025
- 2025Probing the topology of the space of tokens with structured prompts19 Mar 2025
- 2025Breaking the Loop: Detecting and Mitigating Denial-of-Service Vulnerabilities in Large Language Models1 Mar 2025
- 2024Insights and Current Gaps in Open-Source LLM Vulnerability Scanners: A Comparative Analysis21 Oct 2024
- 2024GlitchMiner: Mining Glitch Tokens in Large Language Models via Gradient-based Discrete Optimization19 Oct 2024
- 2024BPE Gets Picky: Efficient Vocabulary Refinement During Tokenizer Training6 Sep 2024
- 2024GlitchProber: Advancing Effective Detection and Mitigation of Glitch Tokens in Large Language Models9 Aug 2024
- 2024LLMmap: Fingerprinting For Large Language Models22 Jul 2024
- 2024Repairing Catastrophic-Neglect in Text-to-Image Diffusion Models via Attention-Guided Feature Enhancement24 Jun 2024
- 2024garak: A Framework for Security Probing Large Language Models16 Jun 2024
- 2024Constructing a BPE Tokenization DFA13 May 2024
- 2024Can Large Language Models put 2 and 2 together? Probing for Entailed Arithmetical Relationships30 Apr 2024
- 2024garak: A Framework for Security Probing Large Language Modelscited by 48
- 2024Insights and Current Gaps in Open-Source LLM Vulnerability Scanners: A Comparative Analysiscited by 9
- 2025Addressing Tokenization Inconsistency in Steganography and Watermarking Based on Large Language Modelscited by 3
- 2026Trusted Weights, Treacherous Optimizations? Optimization-Triggered Backdoor Attacks on LLMscited by 1
- 2026Trusted Weights, Treacherous Optimizations? Optimization-Triggered Backdoor Attacks on LLMs20 May 2026
- 2025Addressing Tokenization Inconsistency in Steganography and Watermarking Based on Large Language Models28 Aug 2025
- 2024Insights and Current Gaps in Open-Source LLM Vulnerability Scanners: A Comparative Analysis21 Oct 2024
- 2024garak: A Framework for Security Probing Large Language Models16 Jun 2024
- 2024LLMmap: Fingerprinting For Large Language Modelscited by 56
- 2024BPE Gets Picky: Efficient Vocabulary Refinement During Tokenizer Trainingcited by 30
- 2025Token embeddings violate the manifold hypothesiscited by 14
- 2024Constructing a BPE Tokenization DFAcited by 5
- 2025Speculating LLMs' Chinese Training Data Pollution from Their Tokenscited by 5
- 2024GlitchProber: Advancing Effective Detection and Mitigation of Glitch Tokens in Large Language Modelscited by 3
- 2024GlitchMiner: Mining Glitch Tokens in Large Language Models via Gradient-based Discrete Optimizationcited by 3
- 2025Breaking the Loop: Detecting and Mitigating Denial-of-Service Vulnerabilities in Large Language Modelscited by 3
- 2025Probing the topology of the space of tokens with structured promptscited by 3
- 2026AdaptBPE: From General Purpose to Specialized Tokenizerscited by 3
- 2026LiteToken: Removing Intermediate Merge Residues From BPE Tokenizerscited by 3
- 2024Can Large Language Models put 2 and 2 together? Probing for Entailed Arithmetical Relationshipscited by 1
12 most cited of 18 All 18 (JSON)
- 2026Beyond Perplexity: UTF-8 Validity in Byte-aware Language Models12 Jun 2026
- 2026Check Your LLM's Secret Dictionary! Five Lines of Code Reveal What Your LLM Learned (Including What It Shouldn't Have)21 May 2026
- 2026Disentangling MLP Neuron Weights in Vocabulary Space7 Apr 2026
- 2026Generative Chemical Language Models for Energetic Materials Discovery30 Mar 2026
- 2026LiteToken: Removing Intermediate Merge Residues From BPE Tokenizers4 Feb 2026
- 2026AdaptBPE: From General Purpose to Specialized Tokenizers29 Jan 2026
- 2025Speculating LLMs' Chinese Training Data Pollution from Their Tokens25 Aug 2025
- 2025TokenBlowUp: Resolving Representational Singularities in LLM Token Spaces via Monoidal Transformations26 Jul 2025
- 2025Demystifying optimized prompts in language models4 May 2025
- 2025Token embeddings violate the manifold hypothesis1 Apr 2025
- 2025Probing the topology of the space of tokens with structured prompts19 Mar 2025
- 2025Breaking the Loop: Detecting and Mitigating Denial-of-Service Vulnerabilities in Large Language Models1 Mar 2025
12 newest of 18 All 18 (JSON)