PaperlayerView exact revision on arXiv

Source-linked AI summary

Where a Model Sends Its Own Repeated Token

Nicolás Vera Zúñiga

arXiv:2609.31181v1cs.CL

TL;DR

Prior model identification scores natural-language responses, leaving the model’s response to non-language input as a different question. This paper maps the destinations of repeated tokens across whole vocabularies, finding that non-fixed-point destinations attribute families while the fixed-point estimand fails.

  • Problem

    Prior model identification scores natural-language responses; the paper asks what a model does when its input is not language.

    Source: §1 · p. 1

  • Method

    The paper reads each model’s argmax on a repeated-token input in one pass and maps token destinations across the vocabulary.

    Source: §1 · pp. 1–2

  • Results

    Family attribution reaches 0.8333 against 0.1389 chance, while the fixed-point comparison is reported as a failed estimand.

    Source: §1 · p. 2, §6 · p. 5, §9 · p. 7

  • Takeaways & Limitations

    Non-fixed-point destinations carry more information about model identity than whether a token repeats itself, within the reported comparison.

    Source: §9 · p. 7

    The observational checkpoint comparison cannot explain why models disagree, and uncontrolled corpus variation supports no corpus-attribution claim.

    Source: §8 · pp. 6–7

Abstract

from arXiv · show

Black-box model identification works by scoring a model's response to natural-language prompts. One line of work feeds models a degenerate input -- their own token, repeated -- to find a failure mode rather than an identity. We take that input and ask where the model goes when it does not. For each token t, read argmax p(. | t, t) in one forward pass; the result is a map on the whole vocabulary, with two halves. The first -- which tokens are fixed points -- is partially anticipated, and we report it as a failed estimand: the natural distance on it is 83% cardinality, separates a corpus manipulation by two bits in 3471 against a precision floor of zero, and attributes families at 0.5833. The second half, where the map sends tokens that are not fixed points, is unrecorded; the one paper holding those tokens logged them as a zero. Pairing on the source token removes the cardinality confound by construction (r from 0.9128 to -0.0932) and attributes families at 0.8333 -- twelve models scored against a pool of nineteen -- with chance 0.1389, across seven tokenizer groups and several corpora. Two nulls clear it: frequency-matched destinations agree at 0.1429, independent marginals at 0.0798. Family predicts agreement better than tokenizer (0.2031 against 0.1205), and recurrent architectures cluster at balanced accuracy 1.0 against a 0.7895 majority rate, or 0.90 once each model's dominant destination is excluded -- the figure we stand behind. We measure the robustness envelope: 8-bit weight rounding moves the map less than deduplicating the training corpus does (0.9004 against 0.6353, on one support), 4-bit destroys it (0.0098; 0.1812 at deployment granularity, so not a coarseness artefact), and the precision floor varies by model from 0.201 to 0.9778. All estimands and kill conditions were registered before the data, and the failed one is reported as fully as the surviving one.

1 Introduction

The paper asks what a model does when its input is not language, using a repeated-token probe to study its whole-vocabulary map. It reports the fixed-point comparison as a failed estimand and focuses on destinations for tokens that do not repeat.

1 Introduction

  • One forward pass on a token repeated twice yields both whether it repeats itself and, if not, its destination.These are a bit per token and a destination per token, respectively.Source: §1 · pp. 1–2
  • The repeated-token probe and fixed-point framing were previously published by Hammouri et al. [2025], and the argmax map was identified in the authors’ earlier work [Vera Z´u˜niga, 2026].The paper distinguishes its contribution from these prior results.Source: §1 · p. 2
  • The paper’s contribution is a vocabulary-wide map of token destinations, compared as decoded strings across models with different tokenizers.It characterizes robustness rather than assuming it.Source: §1 · p. 2
  • The fixed-point set is a failed estimand because its natural distance is dominated by set size rather than token identity.The paper reports this negative result at length alongside the surviving result.Source: §1 · p. 2

2 Setup

The setup measures each model’s deterministic argmax response to a repeated-token input, using a frozen shared-string probe set. Sources and destinations are compared differently within and across models, and the cohort spans multiple architectures, tokenizers, and corpora.

2 Setup

  • For each token, one forward pass on (t, t) records the argmax, whether it equals t, and the winner’s logit margin.Measurements are deterministic and re-measured for bit-for-bit identity; nothing is sampled or generated.Source: §2 · p. 2
  • The frozen probe index contains 4090 candidates, and cross-model comparisons use strings that encode to exactly one token in every model.Candidates include frequent words, printable ASCII in two forms, and a fixed whitespace list.Source: §2 · p. 2
  • Within a model, token identifiers are authoritative; across models, sources are keyed by frozen strings and destinations are compared as decoded strings.Decoded strings provide the bridge across different tokenizers.Source: §2 · p. 2
  • The cohort comprises nineteen models across seven tokenizer groups, and twelve are Pile-trained.The remaining models are not Pile-trained, so corpus varies across the cohort.Source: §2 · pp. 2–3
  • Because corpus is not controlled, the design can show a result is not confined to one corpus but cannot attribute it to corpus.The passage states this as a boundary on what the setup can establish.Source: §2 · p. 3

3 Related work, and what separates this from it

The paper separates its contribution from prior repeated-token and argmax-map work by changing what is measured and recorded. Its novelty claim is the exhaustive, token-identity destination map for non-fixed points, compared across models as decoded strings.

3 Related work, and what separates this from it

  • Hammouri et al. [2025] use repeated tokens and fixed-point framing, but their behavioral measure requires generation; this paper uses a single forward pass.Their study samples 100 words across five aligned models, while this paper sweeps vocabularies across nineteen models.Source: §3 · p. 3
  • The paper’s novelty is recording the destination token where prior work entered zero when a model halted normally.It compares those destinations across models as decoded strings.Source: §3 · p. 3
  • Unlike prior work’s trajectory census, this paper evaluates every token once and retains token identity for both fixed and non-fixed points.A census of 24 random starts counts distinct endpoints; the whole-vocabulary map supports comparing which tokens agree across models.Source: §3 · p. 3
  • The vocabulary-wide, decoded-string destination map is the claimed contribution; the probe, fixed-point framing, agreement statistic, and leave-one-out attribution protocol are not claimed as new.The passage attributes those prior components to Hammouri et al. [2025], earlier work, and the provenance literature.Source: §3 · p. 3

4 E1: the set of fixed points, and why we abandoned it

The registered fixed-point-set estimand fails because Hamming distance largely tracks set size, not identity. Its weak precision floor lets a small corpus-pair distance pass the registered condition, while family attribution remains limited on this measure.

4 E1: the set of fixed points, and why we abandoned it

  • The registered estimand was the self-continuation bit vector over the shared probe intersection, compared by Hamming distance.The intersection across twelve Pile-trained models contains 3471 strings, of which 1684 vary across the cohort.Source: §4 · p. 4
  • 2 bits out of 3471 separate the corpus-deduplication pair, while the precision floor is zero, making the registered test weak.At the strictest margin threshold, the pair’s distance is zero; any nonzero distance clears the zero floor.Source: §4 · p. 4
  • 83% of the apparent identity comparison is cardinality: Hamming distance correlates with the sum of set sizes at r = 0.9128.Family attribution on this estimand is 0.5833.Source: §4 · p. 4
  • The anti-vacuity gate did not catch the defect because it checks constant coordinates, not cardinality dominance.The paper describes the gate’s reasoning as correct but incomplete.Source: §4 · p. 4

5 E2: where the map sends the tokens that do not stay

Pairing models on the same source token compares their decoded destinations and removes the fixed-point set-size confound. The destination comparison clears two nulls, while the paper reports the corpus manipulation as resolved above numeric noise.

5 E2: where the map sends the tokens that do not stay

  • r falls from 0.9128 to -0.0932 when models are compared on decoded destinations paired by shared source token.Pairing removes the cardinality confound by construction.Source: §5 · p. 4
  • The destination-map comparison resolves the corpus manipulation above numeric noise, where the fixed-point set could not.Table 2 presents this corpus-manipulation result.Source: Table 2 · p. 5
  • Table 3 covers 19 models, a 3355-string intersection, and seven tokenizer groups, with corpus not fixed.Source: Table 3 · p. 5
  • 0.6355 observed agreement exceeds frequency-matched agreement at 0.1429 and independent-marginal agreement at 0.0798, so it is not a frequency effect.The frequency-matched destinations are redrawn within their own frequency band.Source: §5 · pp. 4–5

6 E3: nineteen models, seven tokenizers, several corpora

Across seven tokenizer groups, agreement is better predicted by shared family than by shared tokenizer. The expanded comparison adds distractors rather than family-attribution models, and recurrent clustering is qualified by the small recurrent cohort and a reduced score when dominant destinations are excluded.

6 E3: nineteen models, seven tokenizers, several corpora

  • The wider cohort tests two earlier confounds: Mamba attribution errors could reflect architecture class, and eleven of twelve models shared a GPT-NeoX or GPT-2 vocabulary.The authors registered all three questions with kill conditions before collecting the new cells.Source: §6 · p. 5
  • Agreement is better predicted by shared family than by shared tokenizer across seven tokenizer groups.The wider cohort tests whether family attribution is principally a tokenizer effect.Source: §6 · p. 5
  • Excluding each model’s single most common destination changes perfect recurrent-class separation to 0.90, which remains above the base rate but is not perfect.Source: §6 · p. 5
  • As the distractor pool widened without any new family reaching two members, the same twelve models remained scored for attribution, and the chance rate fell from 0.2273 to 0.1389.Source: §6 · p. 5

7 The robustness envelope, measured

The destination map is more robust to 8-bit rounding than to corpus deduplication, but 4-bit quantization sharply reduces agreement even at deployment granularity. Precision floors vary by model, and margin thresholding removes the corpus signal along with near-tie flips.

7 The robustness envelope, measured

  • 0.9004 destination agreement under 8-bit rounding exceeds the 0.6353 agreement after corpus deduplication on the same 3355-string support.At 4 bits agreement falls to 0.0098; grouped 4-bit quantization reaches 0.1812, still below 0.6353.Source: §7 · p. 6
  • At 4 bits, pythia-410m keeps 0 of its 8 self-continuing tokens, despite only 8 differing positions out of 3471.The Hamming count appears near-perfect, but the kept fraction shows the fixed-point set does not survive.Source: §7 · p. 6
  • Precision floors range from 0.201 to 0.9778 across eight models, so robustness is reported per model.In bfloat16, batch grouping changes 163 of 3683 argmaxes; float32 changes 0 of 18254.Source: §7 · p. 6
  • At the registered primary margin threshold, corpus agreement is 0.9981 against a 0.9983 floor, indistinguishable from numeric noise.Thresholding raises the precision floor while removing low-confidence sources that carried discrimination.Source: §7 · p. 6

8 Limits

The comparison is observational and cannot isolate why checkpoints differ; tokenizer overlap, a small recurrent cohort, uncontrolled corpora, and limited quantization settings constrain the conclusions.

8 Limits

  • The checkpoint comparison cannot explain why models differ or separate architecture from training schedule and hyperparameters.It is observational, not a controlled causal comparison.Source: §8 · pp. 6–7
  • Family remains confounded with tokenizer: seven groups across nineteen models support a relative prediction claim, not a claim that tokenizer contributes nothing.The family–tokenizer confound is reduced but not removed.Source: §8 · p. 7
  • The architecture result rests on four recurrent models from two families, and the informative hybrid test could not load because of weight-tying incompatibility.The reported separation falls to 0.90 after excluding each model’s dominant destination.Source: §8 · p. 7
  • A 30k non-Latin-vocabulary model shrank the shared-string intersection from 3471 strings to 152, bounding cross-lingual extensions.Corpora also vary without being controlled, so the comparisons do not support corpus claims.Source: §8 · p. 7
  • The measured quantization envelope excludes activation quantization, real serving stacks, and deployed quantized checkpoints.The limitation passage says quantization beyond weight rounding is untested.Source: §8 · p. 7
  • The deterministic measurement supports family attribution, not instance identification; repeated measurements of one checkpoint are bit-identical.The test that would license an instance claim therefore cannot fail.Source: §8 · p. 7

9 Conclusion

The paper argues that destinations for tokens that are not fixed points carry more family-identification signal than fixed-point status. The surviving comparison attributes families at 0.8333, while the fixed-point estimand is undermined by cardinality.

9 Conclusion

  • Family attribution reaches 0.8333 for non-fixed-point destinations, while fixed-point identity comparisons are dominated by set cardinality.The paper frames this contrast as its central distinction: what a model does when it does not repeat itself carries more about model identity than whether it repeats itself.Source: §9 · p. 7
Loading 2609.31181v1…