Tokenizer transplant in cross-vocabulary model composition reconstructs donor-only embedding rows as weighted combinations over shared lexical anchors and reuses those coefficients on the base. We identify a structural geometric property of this reconstruction: the same coefficient vector reaches different sets in the donor and base anchor spans, an \emph{asymmetric realizability} gap. Across 65 donor-base pairs under OMP, with cross-operator validation on CLP, WECHSEL, and FOCUS, we construct \textit{breaker tokens}: single coefficient vectors that remain statistically inert in the donor anchor span while producing a high-salience reconstruction in the base. The same Gemma-2-2B donor checkpoint admits this construction against 13 different downstream bases drawn from five model families. The planted direction passes weight-merging with a clean reference unchanged. In a deployer case study, standard LoRA fine-tuning suppresses the breaker primarily on prompts whose distribution matches the training corpus and is not a sufficient mitigation against this attack family in our setting. The tested spectral filters miss the asymmetry. We discuss potential misuse in the open-weight composition supply chain.

翻译：在跨词汇模型组合的分词器移植中，重构的仅捐赠者嵌入行被表示为共享词汇锚点的加权组合，并将这些系数复用于基模型。我们识别出该重构的一个结构性几何特性：相同的系数向量在捐赠者和基模型锚点跨度内到达不同的集合，即一种"非对称可实现性"差距。通过OMP框架下65组捐赠者-基模型对，结合CLP、WECHSEL和FOCUS的跨算子验证，我们构建了"破坏令牌"：单个系数向量在捐赠者锚点跨度内保持统计惰性，却在基模型中产生高显著性重构。同一Gemma-2-2B捐赠者检查点可针对来自五个模型家族的13个不同下游基模型实现此构造。植入方向与纯净参考权重合并后保持不变。在部署者案例研究中，标准LoRA微调主要抑制了那些训练语料分布匹配提示词中的破坏令牌，且在我们的设定下不足以充分防御此类攻击家族。测试的谱滤波器未能捕捉到该非对称性。我们讨论了该结果在开放权重组合供应链中的潜在滥用风险。