The Tokens Remember: When Tokenization Bypasses Knowledge Editing and Unlearning
Toketive shows alternative tokenizations can bypass LLM knowledge edits and recover suppressed answers.
The paper introduces Toketive, a reference-free attack showing that alternative valid tokenizations can bypass knowledge editing and machine unlearning and recover suppressed answers. It requires only the released model, not the pre-edit model, training data, shadow models, or auxiliary classifiers. Across five LLMs, six datasets, and six editing and unlearning techniques, 38.6% of alternative tokenizations recovered the pre-edit response. Toketive detected modified facts at 84.2% F1 and reconstructed pre-edit responses at 74.5% top-5 accuracy.
- Toketive uses alternative valid tokenizations to bypass localized model edits.
- The attack needs only the released model, not the pre-edit original.
- 38.6% of alternative tokenizations recovered the pre-edit response.
- Modified-fact detection reaches 84.2% F1, 26.2% above the best baseline.
- Tests covered five LLMs, six datasets, and six editing or unlearning methods.
From the original article
1 min read at arxiv.orgOpen-weight LLMs give downstream users control over the inference stack, but this flexibility can undermine post-release guarantees that sensitive knowledge has been modified or removed. Model editing and machine unlearning are used to modify or remove targeted knowledge without retraining models from scratch. However, existing security evaluations of these techniques face two critical limitations.
By Manit Baser · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.