When the Same Coefficients Reach Different Positions: Asymmetric Realizability in Tokenizer Transplantation Across Large Language Models

Researchers found an asymmetric realizability gap in tokenizer transplantation in cross-vocabulary model composition: the same coefficient vector reaches different sets in the anchor span spaces of the donor and the base, which can be used to construct breaker tokens that are statistically inert on the donor side and produce highly salient reconstructions on the base side. The experiments cover 65 donor-base pairs under OMP and complete cross-operator validation on CLP, WECHSEL, and FOCUS. The same Gemma-2-2B donor checkpoint can implement this construction against 13 downstream bases from five model families, and the implanted direction can be preserved through weight merging and remains unchanged compared with a clean reference. A deployment case study shows that standard LoRA fine-tuning mainly suppresses the breaker on prompts matching the training corpus distribution, is not a sufficient mitigation for this type of attack in its setting, and the spectral filtering methods tested also failed to capture this asymmetry. The authors discuss the potential for misuse of this attack in open-weight composition supply chains.