Image generators do not read words. In between sits a multimodal foundation model such as CLIP, trained on hundreds of millions of pictures and their captions. It has two encoders, a Vision Transformer for images and a text transformer for language, and places both in one shared space, where a picture and a sentence can be compared as a distance. Many text-to-image models reuse CLIP's text encoder to steer what they draw.
Before that encoder reads a prompt, a tokenizer cuts the words into tokens: pieces taken from a fixed dictionary of about 49,000 entries. “giraffe” is one of them, but the same word can also be put together from smaller pieces, in 51 different ways, from giraffe in one piece down to g|i|r|a|f|f|e letter by letter.
The hijack
Normally nobody chooses these spellings: type “giraffe” into a prompt box and the tokenizer always cuts it the same way. We patched an open-source diffusion pipeline so that it skips this step and accepts token IDs directly, handing them to the text encoder as embeddings. With the cut in our hands, every spelling becomes a prompt of its own. What the model receives is never the word but a short list of numbers: giraffe as one token is 22826; gira + ffe is 16949, 8631; gi + ra + ff + e is 4478, 1735, 1304, 324.
Most spellings still produce a giraffe: one token or gira|ffe look much the same. Cut into gi|ra|ff|e, it turns into spotted creatures somewhere between a lemur and a dog; other spellings drift towards an elephant or a horse. What appears depends not only on what we write, but on how the dictionary cuts it.
The dictionary
The dictionary is not neutral. It is built by Byte Pair Encoding: the pairs of characters that occur most often in text scraped from the web are merged, again and again, into new tokens. Brand names, platform slang and hashtags end up as single tokens, while rarer and non-English words fall apart into long chains of fragments. Some words were taken out on purpose, so certain images cannot be asked for at all. All of this is settled before the model has seen a single picture.
The research reads this hidden layer as a language of its own: who it was written for, what it leaves out, and what it lets through.
Talk
51 Ways to Spell the Image Giraffe: The Hidden Politics of Token Languages in Generative AI, 39th Chaos Communication Congress (39C3), Hamburg, December 2025, with Leon-Etienne Kühr. The recording is on media.ccc.de.
A related work, Sixteen Tokens for a Cave, writes with these tokens instead of studying them.
Talk and research: Ting-Chun Liu, Leon-Etienne Kühr
Images: slides from the talk, 39C3, 2025; photograph of the speakers: still from the recording, media.ccc.de, CC BY 4.0
