Pith. sign in

REVIEW 4 major objections 4 minor 1 cited by

A single crafted vocabulary token, statistically inert in the model that carries it, becomes a high-salience trigger when tokenizer transplant reuses its coefficients in a host model.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-03 13:09 UTC pith:KZXYJTXJ

load-bearing objection A genuinely new attack surface with solid empirical coverage, but the core activation heuristic is under-justified and the appendix contains an internal contradiction; worth serious peer review. the 4 major comments →

arxiv 2601.00065 v3 pith:KZXYJTXJ submitted 2025-12-31 cs.LG cs.CLcs.CR

When the Same Coefficients Reach Different Places: Asymmetric Realizability in Transplanting Tokenizers across Large Language Models

Xiaoze Liu , Weichen Yu , Matt Fredrikson , Xiaoqian Wang , Jing Gao This is my paper
classification cs.LG cs.CLcs.CR
keywords tokenizer transplantmodel compositionsupply-chain attackasymmetric realizabilitycoefficient reuseembedding attackmodel merging securitysparse reconstruction
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper tries to establish that the standard interoperability step of tokenizer transplant—reconstructing a donor-only embedding as a weighted combination of shared tokens and reusing those weights on a base model—is a structural vulnerability, not just an engineering convenience. It claims that a single 'breaker token' can be optimized to be statistically invisible in the donor model yet, once transplanted, reliably dominate the base model's generation. The attack is training-free: the attacker only crafts one new embedding row, using public-text statistics for the base target and the donor's principal directions for suppression. Across 65 donor–base pairs spanning five model families, one donor checkpoint is reported to work against 13 different downstream bases, with near-perfect emission in the host and no donor utility regression. If right, this means the trusted glue of model composition carries a dormant trojan that standard outlier detection, weight merging, and even fine-tuning do not remove.

Core claim

The central claim is an asymmetric realizability gap: the same coefficient vector, solved once against shared anchor tokens, reaches a low-salience region of the donor's representation space and a high-salience region of the base's. Because the transplant reuses donor-side coefficients on base anchors, the attacker controls the base reconstruction by engineering the donor embedding. The paper constructs a single vocabulary item whose donor-side embedding has near-zero emission probability, while the base-side reconstruction lands at the empirical mean of the base's last-layer hidden states and becomes a top logit during decoding. This pattern holds across operator variants, survives merging

What carries the argument

The mechanism is coefficient reuse in a shared-basis transplant. For a donor-only token, the operator solves sparse coefficients α such that donor anchor vectors approximate the crafted embedding, then applies exactly those coefficients to base anchor vectors to produce the base embedding. The attack inverts this pipeline: it optimizes α so the base reconstruction aligns with the empirical mean of the base's last-layer hidden states while the donor reconstruction is pushed into low-variance directions, by penalizing its projection onto the top principal components of donor states. The dual-objective loss (base salience plus donor inertness) is solved with a sparse greedy solver whose support

Load-bearing premise

The construction assumes that an embedding row placed near the empirical mean of the base model's last-layer hidden states will be emitted with high probability after transplant; the paper uses this heuristic without a formal derivation, so if a base model's output head does not amplify that direction, the optimized coefficients would aim somewhere harmless and the attack would not activate.

What would settle it

Take a base model, compute the empirical mean of its last-layer hidden states from public text, set a single token's embedding to exactly that mean, and measure its rank in the output logits on null prompts. If that token is not near the top of the distribution, the load-bearing target heuristic fails. Alternatively, rerun the breaker-token designer with a random target vector of the same norm and transplant both versions: if the random-target version emits just as often as the real one, the claimed dependence on the hidden-state mean is wrong; if the real version emits at near-zero rate, the

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Any training-free tokenizer transplant that reuses coefficients inherits this attack surface; post-transplant behavioral verification, not donor-side statistics, becomes the relevant audit.
  • Weight-space merging with a clean reference does not wash out the planted direction, so merge-based remediation is not sufficient.
  • Fine-tuning suppresses the trigger only on distribution-matched prompts; the adversarial direction persists and reactivates under a mild magnitude boost.
  • Because the token's surface string is arbitrary, the same geometric trigger can deliver any payload—toxic content, watermark, or service degradation—without changing the optimization.
  • Breaker tokens can mimic the statistical mode of natural vocabulary, so spectral outlier detection and token-health scanners miss them; detection needs differential emission analysis.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper: if the hidden-state-mean target is replaced by a direction that a given LM head actually amplifies, the construction could likely be adapted to learned or data-driven transplant operators, which the paper does not test.
  • Beyond the paper: the same asymmetric geometry may transfer to image, audio, or multimodal tokenizers whenever a shared anchor basis and coefficient reuse exist, but that remains an open question.
  • Beyond the paper: the suppression-versus-erasure distinction suggests a practical defense—stress tests that scale a token's embedding magnitude and watch for reactivation, plus null-context probes for context-invariant high-logit tokens.
  • Beyond the paper: the attack's reliance on public-text statistics implies a natural countermeasure: randomizing or privatizing the target statistics a deployer exposes could break the attacker's ability to aim the coefficient vector, though the paper does not explore this.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes a supply-chain attack on tokenizer transplantation for open-weight LLMs. It argues that shared-basis transplant operators (OMP and variants such as CLP, WECHSEL, FOCUS) reuse donor-side reconstruction coefficients on the base model, and that this coefficient reuse creates an 'asymmetric realizability gap.' The authors design a single 'breaker token' by optimizing Eq. (2): maximizing alignment of the reconstructed base embedding with a target vector μ_base (the empirical mean of base last-layer hidden states) while penalizing projection of the donor embedding onto a PCA subspace, with per-pair weight λ. Experiments across 65 directed pairs report high base-side Sequence Emission Rate (SER) with low donor-side SER, donor utility preservation, persistence after LoRA fine-tuning and weight merging, and evasion of spectral/Magikarp auditing. The paper also provides a dual-use mitigation discussion and auditing guidelines.

Significance. The core phenomenon — that a crafted donor-only embedding can be inert on the donor yet become high-salience on the base after shared-basis coefficient reuse — is novel and, if the evidence supports it, constitutes a real supply-chain vulnerability for training-free transplant pipelines. The paper's strengths are its breadth: 65 directed pairs, multiple model families and scales, three non-OMP operators, and detailed appendices that report both successes and failures. The persistence results and the spectral-mimicry observation are also useful. The claim of 'reliable reconstruction' is currently not fully established, because the target-vector heuristic (μ_base) is not derived or ablated, λ is selected per pair via a proxy, and several reported pairs exhibit near-zero base SER. The contribution is best read as demonstrating feasibility for a substantial fraction of pairs, rather than a universal property.

major comments (4)
  1. [§4.1, Eq. (2)] The base-side objective aligns the reconstructed embedding with μ_base, the empirical mean of last-layer hidden states, but actual emission after transplant is governed by the LM head logit, i.e., ⟨h, W_out,τ⟩ after the model's final normalization. The paper neither derives nor bounds the relationship between closeness to μ_base and high token-emission probability. The appendix's own results show pairs with zero activation (e.g., Table 13: Q2-7B←Min-3B has attacked-base SERmax=0.0000; Table 10: Smol1.7B←L3.1-8B has SERmax=0.0000), so the boundary conditions of this heuristic are uncharacterized. A systematic ablation replacing μ_base with a direct logit target, or at least a per-context analysis of when mean-state alignment predicts top-token behavior, is needed to support the 'reliably reconstructs' claim.
  2. [§5.2, Table 4] The main text states 'In almost every pair, the attack achieves high SER on the base model,' but Table 4 shows multiple CLight pairs with base SERmax at or near zero: Q2-0.5B←Q3-0.6B (0.0156), Q3-0.6B←Q2-0.5B (0.0000), Q3-0.6B←Gem3-1B (0.0000), Gem2-2B←Gem3-1B (0.0117). The '65 directed pairs' headline should be qualified by the observed success rate and the fact that λ is selected per pair (Appendix C.2), rather than the number of pairs with a strong asymmetric SER gap.
  3. [Appendix F.4, Table 13] There is a direct internal inconsistency about the pair Q2-7B←Min-3B. The F.4 text states that 'the patched donor has SERmax = 1.0000' and that donor Wikitext perplexity increases from 93.86 to 3200.93, but Table 13 reports patched-donor SERmax = 0.0039 and atk-base SERmax = 0.0000, while Table 15 reports donor perplexity unchanged at 93.86/93.90. The pair is discussed as a 'donor-stealth failure,' yet the table shows no such failure. This discrepancy is load-bearing for the cross-scale analysis because the reader cannot determine whether this is a successful or failed pair; the appendix must be reconciled.
  4. [Appendix C.2, §5.3] The reported SER values are obtained after λ is chosen per pair using a Hits@1 proxy on held-out text, and only the selected λ is used for the headline results. This is legitimate as a feasibility demonstration, but it weakens the claim that the attack 'reliably' transfers across architectures and decoding settings. Since SER is estimated from 256 prompts with one generation each (Appendix C.3), no confidence intervals are given; many table entries differ by 0.0039, which is within the binomial sampling noise for that sample size. Reporting post-selection SER without error bars or a fixed λ protocol makes the quantitative '65-pair' success summary difficult to interpret.
minor comments (4)
  1. [§1 Contributions] Typo: 'accross' should be 'across.' Also in §5.1, 'standart metrics' should be 'standard metrics.'
  2. [Figure 3] The dumbbell plots use a log scale in the SERmax panel, which makes zero values invisible; this obscures the failure cases that are otherwise clear in the tables. A note on how zero-SER pairs are plotted would help.
  3. [Appendix C.3] SER is estimated with one generation per prompt and no variance estimate. A binomial confidence interval or a small number of seeds would strengthen comparisons between entries like 0.0117 and 0.0000.
  4. [Appendix F.4] The downstream transfer section reports Gem3-1B←Q2-7B with donor SERmax=0.2656, which contradicts the unconditional statement that the patched donor is 'statistically inert' in the main text. This is already noted in the appendix, but the main text should be qualified to avoid overgeneralization.

Circularity Check

0 steps flagged

No significant circularity; the central claim is an engineered attack with independent empirical evaluation.

full rationale

The paper does not derive the asymmetric realizability gap from first principles and then predict it; it constructs breaker tokens by explicitly optimizing for the two desired properties (Eq. 2: base alignment to μ_base and donor suppression onto U) and then measures whether these optimized tokens actually achieve high emission (SER) and donor stealth (SER and utility) under free-form generation. The evaluation metrics are independent of the optimization objective: SER is measured by sampling continuations on Alpaca/SQuAD/GSM8K, utility is measured on WikiText/LAMBADA/MMLU/ARC, and external detector Magikarp is used. The fact that the optimization and the measured outcome share the same qualitative goal is normal for attack papers and does not make the empirical result equivalent to the input by construction. The 'asymmetric realizability' label is essentially the definitional observation that the same coefficient vector α yields different vectors under Φ_d^T and Φ_b^T, but the paper's contribution is the empirical demonstration that one can find such α across many model pairs and operators, which is not forced by Eq. (1). There are no load-bearing self-citations: the transplant/operator references (Goddard, Minixhofer, etc.) are external prior work, and any author-overlapping backdoor citations are background only. Concerns worth noting as correctness risks, not circularity: the choice of μ_base as the empirical mean of last-layer hidden states is a heuristic whose link to high logit probability is empirically validated but not derived; and Appendix F.4's text claiming Q2-7B←Min-3B has donor SERmax=1.0000 contradicts Table 13 (0.0039). These do not make the derivation circular.

Axiom & Free-Parameter Ledger

4 free parameters · 6 axioms · 1 invented entities

The central construction depends on several free parameters and domain assumptions. Most notably, λ is tuned per pair via a Hits@1 proxy; m, K, and ρ are attacker-chosen. The theoretical leap from geometric alignment to token emission is unproven. The breaker token is an engineered artifact rather than an unexplained new entity, and it carries direct empirical evidence.

free parameters (4)
  • λ (donor suppression weight) = per-pair value chosen from {1,2,4,8,16,32,64,128,256,512,768,1024,1280,1536,2048}
    Controls the trade-off between donor inertness and base activation in Eq. 2/3/4; selected per pair via Hits@1 proxy (Appendix C.2), so reported SER reflects a tuned hyperparameter.
  • m (number of PCA components in donor subspace U) = 256 for OMP designer; 1024 for operator-specific designer
    Defines the donor innocuity subspace U; the attacker chooses how many principal directions to penalize.
  • K (sparsity budget) = 64 for OMP; 32 for FOCUS/CLP/WECHSEL designer
    Support size for the coefficient vector and the victim-side transplant; directly affects which anchors are used.
  • ρ (ridge regularization) = 10^-3
    Numerical-stability ridge in the normal equations and optimization losses.
axioms (6)
  • domain assumption The attacker has white-box read access to both donor and base weights and to the transplant algorithm logic (Threat Model, Sec. 1).
    The attack requires knowing the shared anchors and the operator's reconstruction behavior.
  • domain assumption The actual transplant operator will recover coefficients β≈α from the crafted donor embedding xd (Sec. 4.1, Eq. 1).
    The whole construction assumes the victim's OMP/operator selects the designed support and coefficients closely enough to trigger the base-side target.
  • ad hoc to paper Proximity of the reconstructed base embedding to the mean of base last-layer hidden states (µbase) yields high token-emission probability (Sec. 4.1).
    This is an empirical heuristic; the paper provides no derivation linking embedding-to-hidden-state distance to SER.
  • domain assumption Suppressing projection onto the top PCA components of donor hidden states makes a token statistically inert in the donor (Sec. 4.1).
    The donor-inertness objective assumes low projection onto high-variance donor directions implies low emission probability.
  • standard math OMP greedy pursuit and PCA are valid mathematical tools for the stated reconstruction and subspace estimation (Sec. 3, Sec. 4.1).
    Standard linear-algebra/optimization background used without proof.
  • domain assumption SER measured on Alpaca, SQuAD v2, and GSM8K is a sufficient proxy for attack success, since the token's surface string is arbitrary (Sec. 4.3, Appendix A.1).
    The paper argues any payload can be mapped to the triggered token ID, so emission rate is the key metric.
invented entities (1)
  • Breaker token (τ*) independent evidence
    purpose: A crafted vocabulary item whose embedding is inert in the donor but reconstructs into a high-salience trigger in the base after transplant.
    This is a constructed artifact, not a hypothesized new physical or theoretical entity. Its behavior is empirically demonstrated across many donor-base pairs via SER and utility measurements.

pith-pipeline@v1.3.0-alltime-deepseek · 45418 in / 11704 out tokens · 123388 ms · 2026-08-03T13:09:11.395352+00:00 · methodology

0 comments
read the original abstract

Tokenizer transplant in cross-vocabulary model composition reconstructs donor-only embedding rows as weighted combinations over shared lexical anchors and reuses those coefficients on the base. We identify a structural geometric property of this reconstruction: the same coefficient vector reaches different sets in the donor and base anchor spans, an \emph{asymmetric realizability} gap. Across 65 donor-base pairs under OMP, with cross-operator validation on CLP, WECHSEL, and FOCUS, we construct \textit{breaker tokens}: single coefficient vectors that remain statistically inert in the donor anchor span while producing a high-salience reconstruction in the base. The same Gemma-2-2B donor checkpoint admits this construction against 13 different downstream bases drawn from five model families. The planted direction passes weight-merging with a clean reference unchanged. In a deployer case study, standard LoRA fine-tuning suppresses the breaker primarily on prompts whose distribution matches the training corpus and is not a sufficient mitigation against this attack family in our setting. The tested spectral filters miss the asymmetry. We discuss potential misuse in the open-weight composition supply chain.

Figures

Figures reproduced from arXiv: 2601.00065 by Jing Gao, Matt Fredrikson, Weichen Yu, Xiaoqian Wang, Xiaoze Liu.

Figure 1
Figure 1. Figure 1: Breaker token attack illustration. A malicious token is embedded in the donor tokenizer (left) and remains hidden pre-transplant; after tokenizer transplant (middle), the token is realized in the base model (right), causing emission of the red < MALICIOUS > token within the output. mental structural flaw, demonstrating that it provides a manipulatable interface for injecting adversarial depen￾dencies. • Tr… view at source ↗
Figure 2
Figure 2. Figure 2: Attack visualization: Pipeline, Victim transplant, and Asymmetric Realizability. coefficients β to reconstruct the base row (xbb = Φ⊤ b β). To exploit this, we operate it in reverse. We engineer a set of designed coefficients α either by optimizing them directly or implicitly via the donor embedding parameteri￾zation xd = Φ⊤ d α. The designed α is then used to dictate the injection geometry. The attack suc… view at source ↗
Figure 3
Figure 3. Figure 3: SER via dumbbell plots. Left-to-right columns show per-task SER, plus the maximum SER accorss tasks in log scale. X-axis groups pairs by the base model; within each base, color/marker indicates the donor model (legend at top). Each dumbbell connects patched-donor SER (open marker) to attacked-base SER (filled marker). Note that pairs split across two rows for compactness. 10 1 10 2 pretrained 10 1 10 2 aft… view at source ↗
Figure 4
Figure 4. Figure 4: Donor utility preservation. Each point is a pair of (base←donor); x-axis is the donor’s pretrained utility and y-axis is post-patch utility. The dashed line is identity. 5.1. Experimental Settings Model Configurations. We conduct exhaustive pairwise experiments across five diverse models from different fam￾ilies: Qwen2-0.5B (Yang et al., 2024a), Qwen3-0.6B (Yang et al., 2025), Gemma-2-2B-it (Gemma Team, 20… view at source ↗
Figure 5
Figure 5. Figure 5: Three-stage base-utility slope charts. Each line is a pair of (base←donor) and connects the base’s pretrained, after￾OMP, and after-attack utilities. also evaluate the utility of different states by tracking the performance of those states. Datasets and Prompt Pools. For evaluating SER, we con￾struct a prompt pool from standard benchmarks to serve as trigger contexts. We use Alpaca (Taori et al., 2023), SQ… view at source ↗
Figure 7
Figure 7. Figure 7: Demonstration of Spectral Mimicry. Distribution of spectral anomaly scores (Z-scored residuals) for donor tokens (grey) vs. breaker tokens (red stars). appears in the top-1, 10, or 20 logits) [PITH_FULL_IMAGE:figures/full_fig_p007_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: Persistence under fine-tuning on the attacked base. Each panel tracks attacked-base SER versus training epoch for one pair and one prompt pool, with an additional column showing the average over the three pools. Solid curves show attacked-base SER with scaling factors f ∈ {1.0, 1.2, 1.5, 2.0}; dashed horizontal lines show the corresponding patched-donor SER baselines. filtering is ineffective, as any thres… view at source ↗
Figure 9
Figure 9. Figure 9: SER dumbbell plots for The Standard-Scale Clique (CStd). Columns show Alpaca, SQuAD v2, and GSM8K SER (plus SERmax in the last column). Each dumbbell connects patched-donor SER (open) to attacked-base SER (filled). pretrained after OMP after attack 10 0 10 1 10 2 value Wikitext pretrained after OMP after attack 0.34 0.57 0.81 LAMBADA pretrained after OMP after attack 0.46 0.62 0.78 MMLU pretrained after OM… view at source ↗
Figure 10
Figure 10. Figure 10: Three-stage base-utility slope charts for The Standard-Scale Clique (CStd). Each line is one pair (base←donor), tracking pretrained → after-OMP → after-attack utilities [PITH_FULL_IMAGE:figures/full_fig_p025_10.png] view at source ↗
Figure 11
Figure 11. Figure 11: Donor utility identity scatter for The Standard-Scale Clique (CStd). Each point is an pair; x-axis is donor pretrained utility and y-axis is post-patch utility (identity dashed). a large capacity gap. Concretely, the bases include SmolLM2, Qwen2.5, Gemma-2/3, and Llama-3.2, while the donors include Qwen2/3, Llama-3, and Mistral-7B. Activation and donor innocuity (SER) [PITH_FULL_IMAGE:figures/full_fig_p0… view at source ↗
Figure 12
Figure 12. Figure 12: SER dumbbell plots for T ↓ Cross (downstream; small base←large donor). Each dumbbell connects patched-donor SER (open) to attacked-base SER (filled). set because the donor-side constraints must be satisfied in a lower-capacity geometry while still producing a strong base-side effect after transplant. Here the bases include Qwen2-7B, Llama-3, and Mistral-7B, while the donors include Qwen3-0.6B, Gemma-2/3, … view at source ↗
Figure 13
Figure 13. Figure 13: Three-stage base-utility slope charts for T ↓ Cross (downstream; small base←large donor). 30 [PITH_FULL_IMAGE:figures/full_fig_p030_13.png] view at source ↗
Figure 14
Figure 14. Figure 14: Donor utility identity scatter for T ↓ Cross (downstream; small base←large donor). Q2-7B L3.1-8B 0.0 0.5 1.0 SER Alpaca Q2-7B L3.1-8B 0.0 0.5 1.0 SQuAD v2 Q2-7B L3.1-8B 0.0 0.5 1.0 GSM8K Q2-7B L3.1-8B 10 4 10 3 10 2 10 1 10 0 SER max (log) ML3-8B M7B-v0.1 0.0 0.5 1.0 SER ML3-8B M7B-v0.1 0.0 0.5 1.0 ML3-8B M7B-v0.1 0.0 0.5 1.0 ML3-8B M7B-v0.1 10 4 10 3 10 2 10 1 10 0 Q3-0.6B Gem2-2B Gem3-1B Min-3B Q3-0.6B … view at source ↗
Figure 15
Figure 15. Figure 15: SER dumbbell plots for T ↑ Cross (upstream; large base←small donor). 31 [PITH_FULL_IMAGE:figures/full_fig_p031_15.png] view at source ↗
Figure 16
Figure 16. Figure 16: Three-stage base-utility slope charts for T ↑ Cross (upstream; large base←small donor). 10 1 10 2 10 1 10 2 after patch Wikitext 0.15 0.3 0.45 0.6 0.75 0.15 0.3 0.45 0.6 0.75 LAMBADA 0.15 0.3 0.45 0.6 0.75 0.15 0.3 0.45 0.6 0.75 MMLU 0.2 0.3 0.4 0.5 0.6 0.2 0.3 0.4 0.5 0.6 ARC-C 10 1 10 2 pretrained 10 1 10 2 after patch 0.15 0.3 0.45 0.6 0.75 pretrained 0.15 0.3 0.45 0.6 0.75 0.15 0.3 0.45 0.6 0.75 pretr… view at source ↗
Figure 17
Figure 17. Figure 17: Donor utility identity scatter for T ↑ Cross (upstream; large base←small donor). 32 [PITH_FULL_IMAGE:figures/full_fig_p032_17.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. The Vision Wormhole: Latent-Space Communication in Heterogeneous Multi-Agent Systems

    cs.CL 2026-02 conditional novelty 6.0

    Reasoning messages between heterogeneous VLMs can be routed through the image-token span: a distilled universal codec plus affine alignment transmits latent traces across model families, cutting wall-clock time in sma...

Reference graph

Works this paper leans on

15 extracted references · 1 canonical work pages · cited by 1 Pith paper

  1. [2]

    19 The Trojan in the Vocabulary: Stealthy Sabotage of LLM Composition Results.We evaluated the breaker tokens generated across our 20 lightweight clique pairs

    Garbage Alignment:The embedding exhibits high cosine similarity to the centroid of known unused/reserved tokens. 19 The Trojan in the Vocabulary: Stealthy Sabotage of LLM Composition Results.We evaluated the breaker tokens generated across our 20 lightweight clique pairs. The tokens successfully evaded detection in75% of cases (15/20). Crucially, regardin...

    2023

  2. [9]

    Perez, E., Huang, S., Song, F., Cai, T., Ring, R., Aslanides, J., Glaese, A., McAleese, N., and Irving, G

    arXiv:2410.15236 [cs.CR]. Perez, E., Huang, S., Song, F., Cai, T., Ring, R., Aslanides, J., Glaese, A., McAleese, N., and Irving, G. Red teaming language models with language models. InProceed- ings of the 2022 Conference on Empirical Methods in Natural Language Processing (EMNLP), pp. 3419–3448, Abu Dhabi, United Arab Emirates, 2022. Association for Comp...

    Pith/arXiv arXiv 2022

  3. [12]

    Wang, N., Walter, K., Gao, Y ., and Abuadbba, A

    URL https://proceedings.mlr.press/ v202/wan23b.html. Wang, N., Walter, K., Gao, Y ., and Abuadbba, A. Large language model adversarial landscape through the lens of attack objectives.arXiv preprint arXiv:2502.02960, 2025a. Wang, S., Zhu, T., Liu, B., Ding, M., Guo, X., Ye, D., Zhou, W., and Yu, P. S. Unique security and privacy threats of large language m...

    Pith/arXiv arXiv 2023

  4. [14]

    URL https: //arxiv.org/abs/2311.17391

    doi: 10.48550/arXiv.2311.17391. URL https: //arxiv.org/abs/2311.17391. Wortsman, M., Ilharco, G., Gadre, S. Y ., Roelofs, R., Gontijo-Lopes, R., Morcos, A. S., Namkoong, H., Farhadi, A., Carmon, Y ., Kornblith, S., and Schmidt, L. Model soups: averaging weights of multiple fine- tuned models improves accuracy without increasing in- ference time. In Chaudh...

    Pith/arXiv arXiv doi:10.48550/arxiv.2311.17391

  5. [20]

    mrl-1.20/

    URL https://aclanthology.org/2023. mrl-1.20/. Feher, D., Vuli´c, I., and Minixhofer, B. Retrofitting large language models with dynamic tokenization. InProceed- ings of the 63rd Annual Meeting of the Association for Computational Linguistics (ACL), 2025. Gehman, S., Gururangan, S., Sap, M., Choi, Y ., and Smith, N. A. Realtoxicityprompts: Evaluating neura...

    Pith/arXiv arXiv doi:10.48550/arxiv.2408.00118 2023

  6. [36]

    emnlp-industry.36

    URL https://aclanthology.org/2024. emnlp-industry.36. Grattafiori, A., Dubey, A., Jauhri, A., Pandey, A., Kadian, A., Al-Dahle, A., Letman, A., Mathur, A., Schelten, A., Vaughan, A., Yang, A., Fan, A., et al. The Llama 3 Herd of Models.arXiv preprint arXiv:2407.21783, 2024. Greshake, K., Abdelnabi, S., Mishra, S., Endres, C., Holz, T., and Fritz, M. Not w...

    Pith/arXiv arXiv 2024

  7. [94]

    findings-naacl.94/

    URL https://aclanthology.org/2024. findings-naacl.94/. Huang, X., Ruan, W., Huang, W., Jin, G., Dong, Y ., Wu, C., Bensalem, S., Mu, R., Qi, Y ., Zhao, X., Cai, K., Zhang, Y ., Wu, S., Xu, P., Wu, D., Freitas, A., and Mustafa, M. A. A survey of safety and trustworthiness of large language models through the lens of verification and validation. Artificial ...

    Pith/arXiv arXiv 2024

  8. [293]

    naacl-main.293/

    URL https://aclanthology.org/2022. naacl-main.293/. Minixhofer, B., Ponti, E. M., and Vuli ´c, I. Zero-shot tokenizer transfer.arXiv preprint arXiv:2405.07883,

    arXiv 2022

  9. [329]

    acl-long.329/

    URL https://aclanthology.org/2021. acl-long.329/. Ouyang, L., Wu, J., Jiang, X., Almeida, D., Wainwright, C., Mishkin, P., Zhang, C., Agarwal, S., Slama, K., Ray, A., Schulman, J., Hilton, J., Kelton, F., Miller, L., Simens, M., Askell, A., Welinder, P., Christiano, P. F., Leike, J., and Lowe, R. Training language models to follow instructions with human ...

    Pith/arXiv arXiv 2021

  10. [371]

    findings-naacl.371/

    URL https://aclanthology.org/2025. findings-naacl.371/. Mundra, N., Khandavally, A. N. K., Dabre, R., Pudup- pully, R., Kunchukuttan, A., and Khapra, M. M. An empirical comparison of vocabulary expansion and ini- tialization approaches for language models. InProceed- ings of the 28th Conference on Computational Natural Language Learning (CoNLL 2024), pp. ...

    Pith/arXiv arXiv 2025

  11. [829]

    emnlp-main.829/

    URL https://aclanthology.org/2023. emnlp-main.829/. Downey, C. M., Blevins, T., Goldfine, N., and Steinert- Threlkeld, S. Embedding structure matters: Compar- ing methods to adapt multilingual vocabularies to new languages. InProceedings of the 3rd Workshop on Multi-lingual Representation Learning (MRL), pp. 268– 281, Singapore, December 2023. Association...

    work page doi:10.18653/v1/2023.mrl-1 2023

  12. [2021]

    URL https: //arxiv.org/abs/2112.04359

    doi: 10.48550/arXiv.2112.04359. URL https: //arxiv.org/abs/2112.04359. Wen, J., Ke, P., Sun, H., Zhang, Z., Li, C., Bai, J., and Huang, M. Unveiling the implicit toxicity in large language models.arXiv preprint arXiv:2311.17391,

    Pith/arXiv arXiv doi:10.48550/arxiv.2112.04359

  13. [2022]

    invisible

    URL https://proceedings.mlr.press/ v162/wortsman22a.html. 13 The Trojan in the Vocabulary: Stealthy Sabotage of LLM Composition Xu, H., Wang, S., Li, N., Wang, K., Zhao, Y ., Chen, K., Yu, T., Liu, Y ., and Wang, H. Large language models for cyber security: A systematic literature review.arXiv preprint arXiv:2405.04760, 2024a. URL https:// arxiv.org/abs/2...

    arXiv 2024

  14. [2023]

    Shi, D., Shen, T., Huang, Y ., Li, Z., Leng, Y ., Jin, R., Liu, C., Wu, X., Guo, Z., Yu, L., Shi, L., Jiang, B., and Xiong, D

    arXiv:2309.15025, submitted/published Sep 26, 2023. Shi, D., Shen, T., Huang, Y ., Li, Z., Leng, Y ., Jin, R., Liu, C., Wu, X., Guo, Z., Yu, L., Shi, L., Jiang, B., and Xiong, D. Large language model safety: A holistic survey, Dec 2024. URLhttps://arxiv.org/abs/2412.17686. Stiennon, N., Ouyang, L., Wu, J., Ziegler, D. M., Lowe, R., V oss, C., Radford, A.,...

    Pith/arXiv arXiv 2023

  15. [2024]

    URL https://arxiv.org/abs/2405. 07883. Comments: NeurIPS 2024. Minixhofer, B., Vuli´c, I., and Ponti, E. M. Universal cross- tokenizer distillation via approximate likelihood match- ing.arXiv preprint arXiv:2503.20083, 2025. 11 The Trojan in the Vocabulary: Stealthy Sabotage of LLM Composition Mistral AI team. Un ministral, des ministraux. https:// mistra...

    arXiv 2024