A study characterizes "FragileTokens," vocabulary entries in open-weight language models that successfully copy when isolated but exhibit errors when embedded in surrounding text. The research highlights that literal identity preservation is not guaranteed by standard isolation tests, as tokens can be deleted, substituted, or truncated within sequences.

  • Tested eight open-weight models from the Qwen and OLMo families using fixed token IDs inserted into random common-word sequences of varying lengths.
  • Found that a probability-based screen flags 0.4% to 10.9% of isolation-passing tokens as susceptible in at least 10% of tested contexts.
  • Demonstrated specific failure modes including deletion, substitution, truncation, and translation, with some errors occurring even under concentrated output distributions.
  • Evaluated geometric signals, finding that input- and output-embedding proximity achieved an AUROC of 0.744 to 0.881 on seven models for identifying these tokens.
  • Showed that selected fragile candidates are preserved less often than stable controls in instruction and simulated tool-use tasks.

The findings motivate the use of contextual verification protocols, arguing that passing an isolation probe should not be treated as a general certificate of literal reliability.