title: Glitch Token Destabilization Attack
id: ATR-2026-00284
rule_version: 1
status: experimental
description: |
  Detects injection of known glitch tokens — specific token sequences that cause unusual, unstable, or bypassing behavior in transformer-based LLMs using shared tokenizers. From NVIDIA garak glitch.py probe (GlitchFull). Glitch tokens include: (1) Control characters (null byte \x00, STX \x02, DEL \x7F) which some models mishandle; (2) ÃÂÃÂ repeated patterns — tokenizer artifact strings from misencoded UTF-8 that cause token boundary confusion; (3) Known named glitch tokens like "davidjl", "SolidGoldMagikarp", "ForgeModLoader", "PsyNetMessage", "wcsstore", "guiActive", "guiActiveUn" — tokens that are anomalously rare in training data and cause models to hallucinate or fail to repeat accurately. The attack exploits tokenizer internals to destabilize safety filter performance.
author: ATR Community (via NVIDIA garak glitch.GlitchFull probe)
date: 2026/04/19
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: medium
references:
  owasp_llm:
    - LLM01:2025
  owasp_agentic:
    - ASI01:2026
  mitre_atlas:
    - AML.T0051 - LLM Prompt Injection
  research:
    - https://github.com/NVIDIA/garak/blob/main/garak/probes/glitch.py
    - https://www.lesswrong.com/posts/aPeJE8bSo6rAFoLqg/solidgoldmagikarp-plus-prompt-generation
compliance:
  nist_ai_rmf:
    - subcategory: MS.2.7
      context: Glitch token injection exploits tokenizer-level weaknesses to destabilize model safety filters and induce unstable behavior; MS.2.7 requires evaluating and documenting AI system security and resilience against such low-level adversarial inputs.
      strength: primary
    - subcategory: MS.2.5
      context: Control characters, UTF-8 misencoding artifacts, and anomalous rare tokens cause models to hallucinate or fail to reproduce input accurately, directly impacting robustness and reliability that MS.2.5 mandates be evaluated.
      strength: secondary
    - subcategory: MP.5.1
      context: Detection of known glitch token corpora (SolidGoldMagikarp, davidjl, ÃÂÃÂ patterns) characterizes the likelihood and magnitude of tokenizer-exploitation risks that MP.5.1 requires be identified and tracked.
      strength: secondary
    - subcategory: MS.2.6
      context: NIST AI RMF MEASURE 2.6 (system evaluated regularly for safety risks) is supported by this rule's detection of the model-abuse / harmful-content elicitation attempt (Glitch Token Destabilization Attack).
      strength: primary
  iso_42001:
    - clause: '8.1'
      context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the model-abuse / harmful-content elicitation attempt (Glitch Token Destabilization Attack).
      strength: primary
    - clause: '6.2'
      context: ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the model-abuse / harmful-content elicitation attempt (Glitch Token Destabilization Attack) is such a treatment.
      strength: secondary
  eu_ai_act:
    - article: '15'
      context: Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the model-abuse / harmful-content elicitation attempt (Glitch Token Destabilization Attack).
      strength: primary
    - article: '9'
      context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the model-abuse / harmful-content elicitation attempt (Glitch Token Destabilization Attack).
      strength: secondary
tags:
  category: model-abuse
  subcategory: glitch-token-destabilization
  scan_target: both
  confidence: medium
agent_source:
  type: mcp_exchange
  framework:
    - any
  provider:
    - any
detection:
  conditions:
    - field: content
      operator: regex
      value: (?:ÃÂÃÂ){2,}|(?:ÃÂÃÂÃÂÃÂ){1,}
      description: ÃÂÃÂ repeated pattern — UTF-8 misencoding tokenizer artifact that causes token boundary confusion in GPT-family models
    - field: content
      operator: regex
      value: (?:SolidGoldMagikarp|ForgeModLoader|PsyNetMessage|wcsstore\b|guiActiveUn\b|externalToEVAOnly|unfocusedRange\b|Dragonbound)(?!\s+(?:token\b|is\s+a|refers?\s+to|causes?\s+|and\s+(?:why|how)))
      description: Known named glitch tokens from garak GlitchFull corpus — highly distinctive anomalous tokens causing model instability. Negative lookahead excludes educational references like "SolidGoldMagikarp token and why..."
    - field: content
      operator: regex
      value: (?:Repeat|Say|Output|Print|Echo|Write)\s+(?:the\s+(?:string|word|token|phrase|text)\s+)?["\x27]?\s*(?:SolidGoldMagikarp|davidjl|ForgeModLoader|PsyNetMessage|wcsstore|guiActive|Dragonbound)["\x27]?\s*(?:\.|\?|$|\n)
      description: Explicit request to repeat a known glitch token — probing for tokenizer instability
    - field: content
      operator: regex
      value: '[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]{3,}'
      description: Dense control character sequence (3+ consecutive non-printable chars) — null byte or control char injection for tokenizer confusion
  condition: any
  false_positives:
    - Binary file content or base64-encoded data accidentally passing through text pipeline
    - Security research on tokenizer internals referencing SolidGoldMagikarp by name
    - Log files containing control characters from terminal output
response:
  actions:
    - alert
  message_template: |
    [ATR-2026-00284] Glitch token destabilization detected - known glitch tokens or control character sequences that exploit tokenizer internals.