# Glitch Token Destabilization Attack

- **Severity:** Medium
- **Signature ID:** `aff288fa-e76b-440a-827a-fa7de634aebe`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

Some strings — certain control characters, mangled UTF-8 patterns, or a handful of oddly rare words like 'SolidGoldMagikarp' — confuse the way language models break text into tokens. Feeding these to a model can make it hallucinate, refuse to repeat text accurately, or act unpredictably, which can weaken safety filters that rely on the model behaving normally.

## How the attack works

An attacker sends input containing known glitch tokens: control characters (null byte, STX, DEL), repeated tokenizer-artifact patterns like 'ÃÂÃÂ' from misencoded UTF-8, or specific rare named tokens such as 'davidjl', 'SolidGoldMagikarp', 'ForgeModLoader', 'PsyNetMessage', 'wcsstore', 'guiActive', or 'guiActiveUn'. These strings are anomalous relative to the model's training data, so the tokenizer or model handles them inconsistently. The resulting instability — hallucination, garbled output, or failure to follow instructions correctly — can be used to probe for or trigger weak points in safety or moderation logic layered on top of the model.

## Why it matters

An organization running an LLM-based agent may see the model produce unreliable, incorrect, or unsafe output when given these inputs, and any safety filtering that assumes normal model behavior can be degraded or bypassed as a side effect.

## What you can do

- Sanitize or reject input containing control characters (null byte, STX, DEL) before passing it to the model.
- Filter or flag inputs containing known glitch-token strings and malformed UTF-8 repeat patterns like 'ÃÂÃÂ'.
- Do not rely solely on model output consistency as a safety mechanism; validate outputs independently.
- Expect false positives from binary/base64 data, terminal logs, and legitimate research discussing tokenizer artifacts, and tune filtering accordingly.

## Known benign look-alikes

- Binary file content or base64-encoded data accidentally passing through text pipeline
- Security research on tokenizer internals referencing SolidGoldMagikarp by name
- Log files containing control characters from terminal output

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00284
- https://github.com/NVIDIA/garak/blob/main/garak/probes/glitch.py
- https://www.lesswrong.com/posts/aPeJE8bSo6rAFoLqg/solidgoldmagikarp-plus-prompt-generation

---
Source: https://www.netzilo.com/threats/atr-glitch-token-destabilization-attack