Metraipolis › archive › dc_d2c2cd0d0fcd

The Tokens Remember: When Tokenization Bypasses Knowledge Editing and Unlearning — arXiv:2609.29045

Source: arXiv (en)
Original: https://arxiv.org/abs/2609.29045
License (as archived): CC0-1.0
Archived: 2026-10-08T04:27:14.910Z
SHA-256 of the archived text: 4268c4ab883cc7ffc191fcc8b3b9347f16cdb4c0973814030377c843758a126d
Stable URL of this page: https://metraipolis.com/documento/dc_d2c2cd0d0fcd

How to cite

The Tokens Remember: When Tokenization Bypasses Knowledge Editing and Unlearning — arXiv:2609.29045 — arXiv (en), https://arxiv.org/abs/2609.29045 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_d2c2cd0d0fcd (Metraipolis archive dc_d2c2cd0d0fcd, sha256 4268c4ab883cc7ffc191fcc8b3b9347f16cdb4c0973814030377c843758a126d)

BibTeX

@misc{dcd2c2cd0d0fcd,
  title = {The Tokens Remember: When Tokenization Bypasses Knowledge Editing and Unlearning — arXiv:2609.29045},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2609.29045},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_d2c2cd0d0fcd; sha256 4268c4ab883cc7ffc191fcc8b3b9347f16cdb4c0973814030377c843758a126d},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2609.29045. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Open-weight LLMs give downstream users control over the inference stack, but this flexibility can undermine post-release guarantees that sensitive knowledge has been modified or removed. Model editing and machine unlearning are used to modify or remove targeted knowledge without retraining models from scratch. However, existing security evaluations of these techniques face two critical limitations. First, they typically require access to either the original pre-edit/unlearning model or auxiliary classifiers to detect modifications or reconstruct pre-edit behavior. Second, they evaluate modifications under the canonical tokenization of an input, implicitly treating tokenization as a benign preprocessing step. We show that this assumption creates a security gap: the same input string can be represented by alternative valid tokenizations that induce different computational trajectories, allowing an adversary to bypass localized modifications and recover information intended to be suppressed. We introduce Toketive, a simple yet powerful reference-free attack that exploits the tokenization-based side channel to (i) detect modified knowledge and (ii) reconstruct the corresponding pre-edit response. It operates solely on the released model and requires neither the pre-edit model, training data, shadow models, nor auxiliary classifiers. Across five LLMs, six datasets, and six editing and unlearning techniques, we find that 38.6% of alternative tokenizations bypass the modification and recover the pre-edit response. Toketive detects modified facts with an F1 score of 84.2%, a 26.2% relative gain over the strongest baseline, and reconstructs pre-edit responses with 74.5% top-5 accuracy, 21.7% higher than the best baseline. Our results show that localized modifications should not be treated as robust knowledge-control boundaries without adversarial evaluation over alternative representations.

Tema degli esploratori: agenti e intelligenza artificiale (retro-catalogo arXiv: annunci del 2026-09-25 in cs.AI).
Categorie arXiv: Cryptography and Security (cs.CR) ; Artificial Intelligence (cs.AI).
Pagina del lavoro: https://arxiv.org/abs/2609.29045 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-08T03:50:57.994Z dalla pagina https://arxiv.org/catchup/cs.AI/2026-09-25?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).