PaperlayerView exact revision on arXiv

Source-linked AI summary

When Is Noise Response Universal? Tokenization as the Hidden Variable in Language Models

Yefan Tao, Gerald Friedland, Luyang Kong

arXiv:2608.26319v1cs.CLcs.LG

TL;DR

Textual neural models can degrade under noisy inputs, but it is unclear when different models share the same degradation behavior and how robustness can be predicted. The paper studies embeddings and decoder-only LLMs across noise scales, identifying shared training objectives and tokenizer-dependent perturbations as key factors. Word-level responses are nearly universal, character-level responses diverge, and the resulting mechanism supports clean-accuracy prediction and noise-augmented robustness training.

  • Problem

    The paper addresses the limited ability to predict how neural language models degrade under noisy inputs without exhaustive per-model noisy evaluation.

  • Method

    The paper compares sentence embeddings and decoder-only LLMs under multiple noise scales, measuring normalized degradation, training-objective effects, and tokenizer-induced token perturbations.

  • Results

    Word-level noise yields nearly identical degradation curves across models, whereas character-level noise separates them; shared contrastive training also collapses diverse encoders onto a common curve.

  • Takeaways & Limitations

    Clean accuracy can forecast degradation within a universal regime, and noise-augmented training can install robustness at a chosen perturbation scale while preserving clean performance.

  • Takeaways & Limitations

    The study tests only character- and word-scale perturbations, covers English open-weight models up to 72B parameters, and treats tokenization as an empirical mechanism rather than a first-principles derivation.

Abstract

from arXiv · show

The performance of textual neural models often degrades when their inputs are corrupted by noise such as typos, OCR errors, or dropped words. We study the degradation rate across neural models, both sentence embeddings and decoder-only LLMs, and find that how consistent it is depends on the scale of the noise: under word-level noise, models with very different architectures decline along nearly the same curve, while under character-level noise they separate. We further identify the determining factor to be the training objective, not the architecture: eight encoders spanning six pretraining paradigms are scattered initially, and collapse onto a common curve after a short contrastive training recipe. We trace the word/character split to tokenization: a single character edit forces the tokenizer to re-segment the surrounding word, disturbing the token sequence far more than dropping a whole word does. This finding and its underlying mechanism provide a practical means to predict a model's robustness to noise without any noisy evaluation, and to install robustness at a chosen noise scale through noise-augmented training.

Introduction

The paper finds that noise universality depends on corruption scale: architecturally different models respond similarly to word-level noise but diverge under character-level noise. Shared training objectives promote convergence, while tokenizer-specific re-segmentation explains the split and enables practical robustness prediction and training.

  • CV 2% across nine sentence-embedding models under word-level noise versus 14% under character-level noise shows a clear universality split.
  • Dropping a word leaves remaining tokens intact, whereas a character substitution re-segments the surrounding word into unrelated subwords.
  • Character noise produces 4–10× more token-edit distance than word dropout at matched corruption rates, with divergence depending on tokenizer vocabulary.
  • Eight encoders spanning six pretraining paradigms collapse onto one degradation curve after shared contrastive training, indicating the training objective rather than architecture determines convergence.
  • Clean accuracy predicts degradation with 3.5% leave-one-out error in the universal regime, while noise-augmented training improves noisy accuracy by up to 19% without reducing clean performance.

Related Work

Prior work documents noise sensitivity, adversarial attacks, contrastive representation learning, and geometric universality. This paper differs by studying dynamic output responses to naturally occurring noise across architecturally distinct models.

  • Earlier studies report substantial degradation from typos, OCR-like errors, and other character-level noise in translation and BERT-class models.
  • Adversarial robustness work crafts perturbations against specific target models, whereas this paper examines random, naturally occurring noise across models.
  • Contrastive embedding research characterizes alignment and uniformity, providing the training-objective context for examining shared robustness responses.
  • Related universality studies examine static clean-input geometry, while this paper studies dynamic changes in model outputs as noise increases.

Setup

The study measures normalized output degradation for sentence embeddings and decoder-only LLMs under four controlled perturbations. It evaluates universality through exponential decay rates and fitting-free cross-model agreement measures.

  • Sentence embeddings are evaluated through similarity and downstream quality scores, primarily STS-B Spearman correlation, while LLM response shifts use next-token JS divergence.
  • Four perturbations—character noise, word dropout, keyboard typos, and OCR errors—are applied at rates ε ∈ [0, 0.5] across 13 levels.
  • The model set includes nine contrastively trained sentence embeddings spanning 23M–335M parameters, four backbones, three dimensions, and multiple pooling schemes.
  • The normalized curve c_m(ε) = q_m(ε)/q_m(0) expresses each model’s quality or retained agreement relative to its clean value.
  • Universality is defined by a shared exponential decay rate, with overlapping bootstrap confidence intervals for fitted k_m values.
  • CV and ICC provide fitting-free checks: CV measures normalized cross-model disagreement, while ICC measures variance attributable to model identity.

Universality of Embedding Models

Embedding models form a near-universal response under word-level noise but diverge under character-level noise. This split holds across model architectures and is reshaped by the training objective.

  • Under word noise, all nine embedding models share a decay rate near k ≈1.5, forming one universality class.Every bootstrap interval contains the common rate, with fitted rates from 1.41 to 1.57.
  • 2.2% versus 14.2%: cross-model CV is six times larger under character substitution than word dropout.The ICC likewise attributes 14% of variance to model identity under word noise versus 60% under character noise.
  • The word/character split survives before normalization and across three additional embedding tasks.
  • Eight pretrained encoders spanning six paradigms have word-noise exponent CV of 71% before, versus 3.2% after identical contrastive training.Their inter-model CV falls from 14.3% to 2.8%, converging to the same k ≈1.5.
  • Contrastive training tightens character-noise variation only partly, reducing CV from 29.7% to 13.0% while leaving models non-universal.Four models that never receive the sentence-level objective remain off the common curve, with inter-model CV above 20%.

Universality of Decoder-Only LLMs

Decoder-only LLMs exhibit the same ordering as embeddings: word-noise responses are tightly shared, whereas character-noise responses vary more across models. This result persists across readouts and realistic character perturbations.

  • 2.0% versus 4.8%: LLM normalized-curve CV is lower under word dropout than character noise.The bootstrap 95% confidence intervals do not overlap: [1.4, 2.3] versus [3.3, 5.8].
  • Model identity explains 0.7% of word-noise variance versus 4.6% of character-noise variance, a roughly sixfold increase.The leave-one-model-out estimates are 0.007±0.002 and 0.046±0.012, respectively.
  • The LLM decay amplitude varies from 0.53 to 0.75, so amplitude-controlled exponent fitting requires an extra step.The amplitude is treated as non-universal, while fitting-free CV and ICC provide the primary comparison.
  • Keyboard typos, OCR confusions, and adjacent-character swaps produce character-noise CVs of 4.6%–5.5% across eight LLMs.These spreads are comparable to random character noise.
  • The split remains under alternate readouts: JS/saturation gives 7.0% character variation versus 5.7% word variation.The readout changes the absolute size but not the ordering of the effects.

Tokenization Causes the Split

Tokenization explains why word noise is comparatively universal while character noise separates models. Character edits trigger tokenizer-dependent re-segmentation, making token perturbation a continuous predictor of cross-model variation.

  • Dropping a word removes its tokens, whereas one character substitution can re-segment the surrounding word into unrelated subwords.At matched corruption rates, character noise induces 4–10× more token-edit distance than word dropout.
  • Across embedding models, character-noise CV falls from 14.2% overall to 5.6% within MiniLM-tokenizer models and 8.6% within BERT-WordPiece models.Holding the tokenizer fixed roughly halves the variation.
  • Token count is a strong mediator but not sufficient, because matched token-edit distance leaves word edits about three times more disruptive than character edits.
  • A character-level backbone retains 70% of clean STS performance under character noise, versus 49–55% for subword backbones at ε=0.1.Word-noise retention is comparable across all four models at 85–90%.
  • Token perturbation predicts spread continuously: embedding CV declines from 14.3% to 5.6% as block size g increases from 1 to 12.Token-edit distance per token simultaneously falls from 0.73 to 0.36.

Reshaping the Noise Response by Training

Training can reshape robustness at selected noise scales, but robustness and universality are distinct outcomes. Shared contrastive training installs word-scale universality, whereas noise augmentation improves model-specific robustness.

  • Within about 200 steps, contrastive fine-tuning moves BERT-base onto the word-dropout universal curve and keeps it there.The intervention uses an InfoNCE objective with 100K sentence pairs.
  • Character augmentation reduces an embedding model’s fitted decay rate k from 8.4 to 6.2.The same contrastive loss is used, but one model replaces 50% of positive pairs with clean, character-noised pairs.
  • LLM augmentation lowers mean character-noise JS at ε=0.1 from 0.30 to 0.17, while word-noise JS is already 0.17.Lower JS means the noisy output distribution stays closer to the clean one.
  • Augmentation improves robustness without creating universality: character-noise CV rises from 4.9% at baseline to about 12%.Models improve along divergent, model-specific paths rather than collapsing onto a common curve.

Discussion

The paper turns its universality findings into practical guidance for predicting robustness and targeting input cleanup, while identifying important scope boundaries. It also shows that output robustness need not be reflected in internal representation geometry.

  • Predicting robustness without noisy evaluation: A model’s clean accuracy can forecast its word-noise degradation without noisy evaluation, while character-noise prediction remains less precise.Held-out character-noise divergence is predicted with 3.5% mean absolute error, but the result is not a promise about top-1 accuracy.
  • Matching the cleanup to the model: Character-level normalization is the most valuable cleanup for embedding retrieval because embeddings tolerate word edits but are more brittle to character corruption.LLMs degrade more gently under character noise, so the same cleanup generally provides less benefit for them.
  • Universality lives at the output, not the internal geometry: For LLMs, similar word-noise responses coexist with substantial variation in middle-layer geometry, so internal geometry need not reveal output degradation.Representation geometry tracks universality on the embedding side, but not necessarily on the LLM side.
  • Limitations: The study tests only character- and word-scale perturbations; paraphrase and content drift remain untested.The authors identify semantic perturbations as outside the study’s evaluated noise scales.
  • Limitations: The tokenization account is an empirical regularity rather than a first-principles derivation, and token-edit distance is not a sufficient statistic.At matched token distance, a word edit still displaces a representation about three times more than a character edit.
  • Limitations: The JS-divergence readout restricts the LLM analysis to open-weight English models, including models up to 72B parameters.Extending the account beyond 100B parameters, to other languages, and to semantic perturbations is left for future work.

Conclusion

Universality depends on noise scale: diverse models align under word noise but separate under character noise. The evidence shows that this split is not an artifact of normalization or architecture alone, and that tokenization and training objectives jointly determine it.

  • Conclusion: Word-level noise produces nearly identical degradation curves across sentence embeddings and 18 decoder-only LLMs, whereas character-level noise separates models.The paper attributes the scale dependence to shared training objectives and tokenizer-specific re-segmentation.
  • A Normalization Does Not Manufacture the Agreement: Normalized universality concerns shared degradation-curve shape, not equal absolute performance loss relative to each model’s clean baseline.Raw STS-B retention already stays within a two-point word-noise band but spreads by roughly twelve points under character noise.
  • A Normalization Does Not Manufacture the Agreement: The word/character split persists across CV, decay-exponent, and ICC measures, so it cannot be explained by clean-value normalization alone.The exponent and ICC do not divide by the clean baseline, and their word/character confidence intervals remain separated.
  • ICC measurement: ICC must use per-input noise-response variance rather than dataset-level aggregate wobble, because aggregate estimation error shrinks with evaluation-set size.The correct construction is sample-size-independent and uses per-sentence or per-pair readouts.
  • Shared-Exponent Test and the Non-Universal Amplitude: Universality-class testing compares shared decay exponents while controlling model-specific amplitudes, especially for LLMs.LLM amplitudes range from 0.53–0.75, so saturation normalization removes amplitude variation before exponent comparison.
  • Shared-Exponent Test and the Non-Universal Amplitude: Word exponents are several times less dispersed than character exponents in both architectures, with non-overlapping bootstrap confidence intervals.This exponent result agrees with the CV and ICC verdicts.

D Detailed Embedding Model Specifications

The embedding specifications span diverse architectures, dimensions, pooling schemes, and training lineages. Despite this diversity, sentence-trained models align under word dropout, while training objective and noise type remain decisive for dispersion.

  • Embedding model specifications: The nine sentence-trained embedding models span four backbones, three embedding dimensions, and both mean and CLS pooling.The listed models range from 23M to 335M parameters.
  • Decay-exponent comparison: Across-model decay-exponent dispersion is much lower for word noise than character noise, with disjoint bootstrap 95% confidence intervals.Embedding uses the raw exponent, while LLM uses an amplitude-controlled exponent with joint-bootstrap refitting.
  • Embedding model specifications: All sentence-trained models join the common word-dropout curve, unlike four non-sentence-trained masked-LM or decoder baselines.This contrast supports the relevance of sentence-level training lineage to word-noise universality.
  • Objective-not-architecture experiment: Before shared contrastive training, eight encoders have scattered word-dropout curves; after one identical recipe, they collapse onto a common curve.The recipe uses InfoNCE, τ=0.05, 50K SNLI entailment pairs, and 5K steps.
  • Noise-type comparison: Figure 5 shows coincident sentence-trained curves only for word dropout, while all four character-level noise types produce visible spread.The spread increases as the perturbation becomes finer-grained.

H Stretched-Exponential Analysis

The stretched-exponential analysis distinguishes memoryless character corruption from cooperative word removal, while training-time interventions improve robustness more safely than post-hoc tuning.

  • H Stretched-Exponential Analysis: β = 0.958, 95% CI [0.899, 1.017], and β = 1 cannot be rejected under character noise, consistent with independent, memoryless hits.The paper models this as a Poisson-like process acting token-by-token.
  • H Stretched-Exponential Analysis: β = 1.181, 95% CI [1.028, 1.334], and p < 10−4 under word noise indicate cooperative damage from early word losses before saturation.Word dropout directly attacks the sentence’s compositional scaffold.
  • H Stretched-Exponential Analysis: Naive post-hoc fine-tuning causes downstream accuracy to collapse near 0%, whereas lr = 10−6 preserves clean accuracy but yields only +5–8 points on SST-2.Already-robust models show no improvement, while weaker models gain +7–16 points on top-1 matching.
  • H Stretched-Exponential Analysis: Noise robustness is therefore modified during training: embeddings use contrastive data augmentation, while LLMs use noise augmentation during instruction tuning.The intervention is applied during training rather than after pre-training.

K Cross-Dataset Validation

Cross-dataset and cross-architecture evaluations preserve the word/character universality split. The results connect model disagreement to tokenization and show that noise-augmented training improves robustness at larger corruption levels.

  • K Cross-Dataset Validation: Word-dropout universality extends beyond STS-B: inter-model CV is 1.7% on AG News and 7.6% on 20 Newsgroups.This supports universality as a property of the contrastive representation rather than one evaluation task.
  • K Cross-Dataset Validation: 2.2% word-dropout CV and a 95% CI of [1.3, 2.6] on SciFact confirm universal retrieval degradation, while character responses separate.The benchmark corrupts noisy user queries against a clean index.
  • K Cross-Dataset Validation: 2.0% word-noise CV versus 4.8% character-noise CV under 1 −JS, and 5.7% versus 7.0% under JS/saturation, preserve the LLM split across normalizations.The conclusion does not depend on the chosen normalization.
  • K Cross-Dataset Validation: Token-edit distance falls from 0.73 at g=1 to 0.36 at g=12, while inter-model CV falls from 14.3% to 5.6% in lockstep.Larger corruption blocks touch fewer words and induce less token shattering.
  • K Cross-Dataset Validation: The word/character split appears across both architectures: word-noise CV is near 2%, whereas character-noise CV is larger for embeddings and milder for LLMs.Architecturally diverse encoders measured before the shared objective show 14.3% CV.
  • K Cross-Dataset Validation: Noise-augmented LLM training cuts character-noise JS from 0.30 to 0.17, while word-noise JS is already low and barely changes.The intervention primarily improves robustness at the character scale.
Loading 2608.26319v1…