## 2 Related Work
### Limitations of External Correction Methods in Tokenization  
Although LLMs have made significant advances in natural language processing, they still exhibit vulnerability when confronted with input perturbations, particularly in the tokenization stage [16]. Tokenization is the process of converting the input text into discrete units (tokens) that the model can understand [17]. However, LLMs generally rely on tokenizers that are deterministic and vulnerable to input perturbations, such as case changes. Even a small number of text perturbations can cause significant variations in input tokens, which in turn affects the model's understanding of the text.  
In recent research, the primary focus has been on improving model architectures, such as the Transformer, and newer architectures such as Mamba [18; 19] and RWKV [20]. These models are designed to improve efficiency and performance in various natural language processing (NLP) tasks, but the underlying tokenization is often overlooked. Although these advances focus on improving model capacity and generalization, they do not address the issue caused by input perturbations during tokenization.  
Existing solutions to mitigating errors rely predominantly on external correction methods, such as applying predefined rules or employing additional trained models to post-process perturbed inputs [21]. However, these approaches have critical drawbacks. First, external correction modifies the original input text to align with the expectations of the tokenizer, which risks altering or discarding semantically important information. For example, case normalization may erase distinctions between proper nouns and common terms. Second, such methods lack scalability: each type of perturbation often requires manual drafting rules or retraining of correction models [22]. Some recent efforts attempt to enhance robustness through runtime anomaly detection using large language models or statistical learning [23], or by embedding Covert Timing Channel (CTC) detection in system-level defenses [24]. Others improve semantic understanding with contextualized embeddings [25]. Although these methods reflect a growing emphasis on system resilience and align in part with Zero Trust principles, they still operate as external additions and do not fundamentally address the vulnerability of the tokenizers. As a result, these solutions often struggle to generalize across diverse and unpredictable perturbations in real-world inputs.  
In summary, while external correction methods have achieved some success in mitigating errors during tokenization, they inherently limit the adaptability and scalability of LLM. The challenge lies in developing a more intrinsic approach that mirrors human cognitive agility and automatically adapts to noise during tokenization. Our proposed method addresses this gap by integrating self-correction capabilities through the tokenization process, ensuring semantic fidelity without external interventions. Table 1 illustrates the key differences between our approach and existing methods, emphasizing the advantages of our self-correcting mechanism in handling diverse perturbations autonomously.  
\begin{table}
\begin{tabular}{l c c c} \hline \hline
**Method** & **External Intervention** & **Scalability** & **Semantic Integrity** \\ \hline Standard External Correction & Required & Limited & Potentially Compromised \\ Self-Correction (ours) & Not Required & High & Preserved \\ \hline \hline \end{tabular}
\end{table}
Table 1: Comparison of external correction methods and the self-correction reflection.