Linguistic Zero-Breakage Guarantee

• Linguistic Zero-Breakage Guarantee is a formal design objective that preserves specified invariants when language contexts or tokenizations change.
• It uses mechanisms such as target glue code and convertibility judgments to ensure that no new failures emerge at language boundaries.
• Applications span semantic interoperability, autoregressive generation, and personalized systems, balancing performance and robust safety guarantees.

Linguistic Zero-Breakage Guarantee denotes a class of formally scoped non-degradation guarantees in which crossing a language boundary, applying a linguistic transformation, or forming a structured commitment does not introduce new failures relative to an explicitly modeled invariant. In the semantic interoperability setting, it is the promise that “no source-level invariant ever gets violated at a language boundary” after compilation to a common target and insertion of target-level glue code (Patterson et al., 2022). In later language-model work, analogous guarantees were formulated for clause purification and punctuation suppression (Kilictas et al., 22 Jun 2025), validator-bounded commitments in personalized systems (Tang et al., 15 May 2026), cross-lingual safety invariance under temporal variation (Said et al., 31 Dec 2025), and resistance to BPE-fragmentation attacks on safety-critical words (Li et al., 1 May 2026).

1. Conceptual scope and research domains

The phrase is used across several technically distinct domains, but in each case the guarantee is framed as preservation of a formally specified invariant under transformation, interoperation, or perturbation. In interoperability, the protected object is semantic type soundness; in autoregressive generation, clause coherence under token suppression; in personalized systems, validator-covered commitments; in multilingual alignment, bounded cross-lingual safety gaps; and in token-boundary safety, stability of refusal behavior under linguistically admissible perturbations (Patterson et al., 2022).

Domain	Protected invariant	Representative mechanism
Language interoperability	No source-level invariant violation at a boundary	$\tau_A \sim \tau_B$ plus target glue code
Clause purification	No punctuation-induced clause breakdown	$\phi^{(\infty)}$ plus embedding realignment and masking
Personalized language systems	Zero measured control-failure within validator scope	CBEA plus LCV
Multilingual safety	Safety-score gap bounded across languages	Invariant Alignment
Token-boundary safety	Refusal behavior unchanged under perturbation	Tokenizer-level and training-distribution conditions

This distribution of usages suggests that the term does not denote a single theorem schema. Rather, it names a recurring design objective: invariants must survive the exact point at which one representation, language, tokenization, or commitment regime is translated into another.

2. Semantic interoperability as the original formalization

The most explicit formal treatment appears in “Semantic Soundness for Language Interoperability” (Patterson et al., 2022). The paper starts from the observation that programs are rarely implemented in a single language, and that questions of type soundness should therefore address not only the semantics of a single language, but how it interacts with others. Matthews and Findler’s 2007 multi-language construction introduced boundaries that allow code from one language to be embedded in another, but the paper argues that such source-level interoperability does not reflect practical implementations, where interaction is defined after compilation to a common target.

The framework therefore adopts an “interoperation-after-compilation” strategy. Language designers specify which types are interconvertible via a declarative relation $\tau_A \sim \tau_B$, and they specify target glue code implementing those conversions. The zero-breakage claim is then stated in operational terms: if an A-program $e_1$ with $\vdash_A e_1 : \tau_1$ and a B-program $e_2$ with $\vdash_B e_2 : \tau_2$ are linked by a multi-language context using boundaries only at convertible types, then after compilation and glue insertion the target program never gets stuck in a new “bad” way. Every reachable configuration either makes progress or ends in a well-defined success or well-defined boundary error that corresponds exactly to a source-level conversion error; no new “type bugs” are introduced (Patterson et al., 2022).

The semantic core of the framework is a realizability or logical-relations model that interprets each source type as a set of target terms. The paper presents this as

$$[[\tau]] \;=\; \{\,P \mid (W,P)\in E\llbracket \tau\rrbracket\}$$

and more fully as

$$E\llbracket \tau\rrbracket(W) = \{\,P \mid P\text{ runs in world }W\text{ to a value }v\text{ with }(W',v)\in V\llbracket \tau\rrbracket\}.$$

Even purely source-level invariants, such as an affine usage discipline, are represented as subsets of untyped target terms. Because both source languages compile to the same target, their type interpretations live in one universe of target terms and can be compared directly.

3. Boundary relations, glue code, and the soundness theorem

The convertibility judgment $\tau_A \sim \tau_B$ is declarative. The examples given include bool ∼ int, ref bool ∼ ref int, and, in the affine/unrestricted setting, $\phi^{(\infty)}$0 (Patterson et al., 2022). Its intended meaning is that there exist two pieces of target glue code,

$\phi^{(\infty)}$1

which mediate values without violating the semantic invariants of either language.

The correctness condition for a convertibility declaration is stated semantically:

$\phi^{(\infty)}$2

Operationally, this yields two soundness obligations. If $\phi^{(\infty)}$3, then $\phi^{(\infty)}$4; if $\phi^{(\infty)}$5, then $\phi^{(\infty)}$6. The framework emphasizes that the glue need not be uniform: it may be identity glue for equal representations, thunking and dynamic tests for affine arrows, or memory-management transitions such as gcmov, alloc, and free (Patterson et al., 2022).

The proof structure proceeds in five steps: construction of the realizability model, conversion lemmas for each $\phi^{(\infty)}$7, compatibility lemmas for ordinary typing rules, a fundamental theorem showing that every closed well-typed source term compiles into the semantic model, and finally multi-language type safety. The resulting semantic soundness theorem states that if every boundary is used only at convertible types with corresponding glue code, then compilation plus glue insertion yields a target program that never gets stuck outside designated conversion errors (Patterson et al., 2022).

4. Case studies and efficiency trade-offs in interoperation-after-compilation

The framework is illustrated with three case studies, each showing that the guarantee constrains correctness but still permits different performance profiles (Patterson et al., 2022). In the shared-memory reference case, ref bool ∼ ref int, the semantic model requires $\phi^{(\infty)}$8, because aliasing must be identical. The glue code is therefore the identity on pointers, with no costly proxies or copies.

In the affine versus unrestricted case, the key convertibility declaration is

$\phi^{(\infty)}$9

The glue thunk-wraps unrestricted callers so that a second invocation fails. Static affine binders use phantom flags in the model, incurring no runtime cost, while dynamic ones use heap-allocated flags and therefore “pay only where needed” (Patterson et al., 2022). The significance of this example is that the protected invariant is not representation alone but usage discipline.

In the garbage-collected versus manual-memory case, REF τ ∼ ref τ links a linear capability-plus-pointer representation to a GC pointer. The A-to-B direction can use gcmov in place, yielding zero copy; the B-to-A direction uses a single alloc plus copy but avoids deep copying of substructures when not needed. The same case study introduces foreign polymorphic types #τ, allowing one language to instantiate the other’s universal quantification on safely Duplicable types with no run-time cost at the boundary for Duplicable $\tau_A \sim \tau_B$0 (Patterson et al., 2022).

These examples are important because they show that zero-breakage is not equivalent to maximal mediation. The guarantee permits aliasing when aliasing preserves invariants, copying when copying is necessary, and mixed strategies when the target and compiler make them sound.

5. Reinterpretation in autoregressive generation and personalized systems

In “$\tau_A \sim \tau_B$1: Clause Purification, Embedding Realignment, and the Total Suppression of the Em Dash in Autoregressive LLMs,” the guarantee is recast as protection against “recursive punctuation-induced breakdown of clause coherence” (Kilictas et al., 22 Jun 2025). The symbolic component defines a purification operator on the set $\tau_A \sim \tau_B$2 of all well-formed clauses:

$\tau_A \sim \tau_B$3

with repeated application

$\tau_A \sim \tau_B$4

Because $\tau_A \sim \tau_B$5 is idempotent once all em dashes are removed, the limit exists in at most one step for clause purification, and $\tau_A \sim \tau_B$6 is an idempotent projection onto the subspace of $\tau_A \sim \tau_B$7-free clauses. The continuous component realigns the em-dash embedding either by orthogonal projection out of the principal semantic subspace of content tokens or by copying the comma embedding, and the decoding component masks the token by setting $\tau_A \sim \tau_B$8. On a 10,000-clause benchmark using a GPT-style base model with 1.3B parameters, the full system reduces Clause-Boundary Hallucination Rate from 14.8 to 0.0, reduces Semantic Drift $\tau_A \sim \tau_B$9 from 0.72 to 0.46, raises Topic Coherence Score from 0.63 to 0.78, and changes Perplexity from 12.4 to 12.6 (Kilictas et al., 22 Jun 2025).

In “Recall Isn’t Enough: Bounding Commitments in Personalized Language Systems,” the zero-breakage claim is explicitly limited to “validator-covered commitments” (Tang et al., 15 May 2026). The framework defines a full evidence pool

$e_1$0

and selects a bounded activated evidence set

$e_1$1

CBEA scores candidates using typed coverage, tail witnesses, consequence debt, relevance, and overpersonalization penalties. LCV then validates candidate commitments lexicographically via a violation-utility vector

$e_1$2

filters to

$e_1$3

and routes infeasible states to clarification, abstention, recontract, or fallback. Across 360 fixtures and three generation backends, CBEA+LCV reaches zero failures within validator scope at 0.49–0.60 availability over attempted runs, whereas raw and long-context baselines with the same LCV gate reach zero only at 0.003–0.092. A shadow oracle diagnostic further shows that CBEA+LCV recalls 0.012 of uncompiled visible facts, while raw recalls 0.53, establishing what the paper calls a bounded operating point rather than “universal memory dominance” (Tang et al., 15 May 2026).

6. Cross-lingual invariance and token-boundary safety in LLM alignment

“Safe in the Future, Dangerous in the Past” audits three models on HausaSafety using a $e_1$4 factorial design over language and tense, and reports that safety is determined by the intersection of variables rather than by a simple multilingual degradation story (Said et al., 31 Dec 2025). The safety score is defined as

$e_1$5

with English versus Hausa and Past, Present, Future, and Disp. as the evaluation cells. The paper identifies “Complex Interference,” “Reverse Linguistic Effect,” and “Temporal Asymmetry.” For Claude 4.5 Opus, safety in Hausa is 45.0% versus 36.7% in English overall, while past-tense framing is 15.6% safe and future-tense framing 57.2% safe. The absolute extremes across models are 8.3% for Gemini in English plus Past and 76.7% for Claude in Hausa plus Future, yielding a 9.2× disparity. Two-way ANOVA reports $e_1$6, $e_1$7, and $e_1$8, all with $e_1$9 (Said et al., 31 Dec 2025). The proposed remedy is “Invariant Alignment,” combining a standard refusal-training loss with an invariance penalty so that the worst-case language gap stays within a tolerance $\vdash_A e_1 : \tau_1$0.

“Breaking Safety at the Token Boundary” addresses a different failure surface: BPE fragmentation of safety-critical words (Li et al., 1 May 2026). The paper defines a zero-breakage guarantee as the promise that no linguistically admissible perturbation of any safety-critical word can fragment that word into unfamiliar BPE sub-tokens and thereby collapse the model’s refusal trigger. The mechanism tested end to end is a four-link chain: character perturbation, BPE token fragmentation, late-layer disruption, and refusal collapse. An optimization targeting safety-token fragmentation flips the first-token refusal trigger on 80–100% of refused HarmBench prompts, and 48% of those flips produce genuinely harmful outputs, with per-model rates of 29–65% and pooled ROC-AUC of 0.84 for logit-gap-versus-behavior prediction. Activation patching localizes the disrupted signal to the last $\vdash_A e_1 : \tau_1$1 of layers, while an alignment-data scan finds zero fragmented prompts among 30,000 examples. On the defense side, no DPO configuration achieves seed- and pool-stable ASR closure on the three families with closed pool-size confounds; SFT trained on fragmented prompts closes ASR on 3/5 families but only via global collapse that raises refusal on benign prompts as well (Li et al., 1 May 2026).

A proposed formal specification therefore requires both tokenizer-level and training-distribution conditions. The tokenizer must provide indivisible reserved tokens for a protected vocabulary of safety-critical words, or equivalently use a character-level or morphological tokenizer that guarantees zero sub-tokenization of safety words. The alignment data must include all syntactic or orthographic variants of each protected word up to a finite equivalence class. Quantitatively, the proposed compliance criteria are $\vdash_A e_1 : \tau_1$2 with $\vdash_A e_1 : \tau_1$3, $\vdash_A e_1 : \tau_1$4, and fragmentation index

$\vdash_A e_1 : \tau_1$5

for every supported perturbation (Li et al., 1 May 2026).

7. Scope, limitations, and common misunderstandings

A recurrent misconception is that zero-breakage means absolute absence of failure. The interoperability theorem is narrower: it states that no new stuck states arise beyond designated conversion errors, not that every boundary crossing succeeds. Well-defined boundary errors that correspond exactly to source-level conversion errors remain part of the model (Patterson et al., 2022).

A second misconception is that zero-breakage implies global competence outside the protected invariant. The commitment-bounded formulation rejects this explicitly. Its guarantee holds “within the validator scope,” and the shadow-oracle diagnostic shows that the system intentionally excludes many uncompiled visible facts from what it can safely emit (Tang et al., 15 May 2026). Similarly, the punctuation-suppression formulation notes surface-fluency trade-offs, reliance on a hand-picked set of risky tokens, and possible embedding side-effects from orthogonalization (Kilictas et al., 22 Jun 2025).

A third misconception is that multilingual safety gaps are simple resource gaps. The HausaSafety results argue instead for a non-linear interaction between language and temporal framing, with “Safety Pockets” produced by context-dependent heuristics rather than robust semantic understanding (Said et al., 31 Dec 2025). The token-boundary results make a parallel point at the tokenizer level: absent both reserved-token support and exhaustive perturbation coverage in alignment data, BPE fragmentation continues to create exploitable gaps in otherwise aligned models (Li et al., 1 May 2026).

Taken together, these formulations indicate that a Linguistic Zero-Breakage Guarantee is always conditional on an explicit boundary model. In programming languages that model is a logical relation over target terms; in clause purification it is an idempotent projection plus decoding surgery; in personalized systems it is a validator and routing discipline; in multilingual safety it is a bounded invariance objective; and in token-boundary safety it is a tokenizer and alignment distribution with stated thresholds. This suggests that the unifying content of the term is not “perfect robustness,” but formally delimited preservation of invariants under precisely characterized transformations.