Hidden Activations are not Enough I: Knowledge Matrices as Higher Representations

1 Introduction

• Hidden activations change under function-preserving parameter transformations, whereas the knowledge matrix depends on the realized function germ.The theory applies to any hidden layer; experiments use the customary penultimate layer.Source: §1 · pp. 1–3
• Under (LCS), the knowledge matrix equals per-class gradient×input plus an exact aggregate bias attribution, and its fixed shape enables comparison across architectures without alignment.Its row sums are the logits, and its displacement splits into logit-visible and logit-invisible components.Source: §1 · pp. 2–3
• Median adversarial coherence is A ≤ 0.23, and attack-family ordering is concordant across six raters (Kendall W = 0.921).The population-matched full-scale panel reproduces the family-level grouping with W = 0.97.Source: §1 · p. 3
• On AlexNet/CIFAR-10, penultimate features win 5 of 6 detectors and all 16 attacks, and the matrix-direction counterfactual fails structurally on three pretrained ImageNet networks.The paper does not claim that knowledge matrices outperform penultimate features at any task.Source: §1 · pp. 3–4
• The knowledge matrix determines the local function germ, not merely the network’s value at the input.This germ recovery is distinct from row-sum completeness, which says the entries sum to the output.Source: §1 · pp. 3–4
• Under (LCS), the knowledge matrix is invariant to the germ stabilizer among encodings regular at x, when every input coordinate is nonzero.For a fixed architecture, this stabilizer is exactly the germ stabilizer; neuron permutation is a special case.Source: §1 · p. 3

2 Previous Work

• Prior quiver-representation work supplies the induced representation and matrix contraction; the row-sum identity and invariance under network isomorphisms are inherited properties.The paper extends the contraction to max-pooling and to quivers with skip connections and parallel branches.Source: §2 · pp. 4–5
• The attribution literature relates gradient×input, bias attribution, and locally affine networks; the paper identifies the knowledge matrix with gradient×input plus an aggregate bias attribution under (LCS).The authors claim no priority for that decomposition and make no attribution-quality claim.Source: §2 · p. 5
• Representation-similarity measures provide Study 1’s comparison panel and controls, while the knowledge-matrix distance is invariant under the quiver-isomorphism group and needs no alignment step.The panel asks whether existing measures quotient out a function-preserving transformation.Source: §2 · pp. 5–6
• Against work on network symmetries and identifiability, the paper proves that the matrix stabilizer equals the germ stabilizer for regular encodings with no vanishing input coordinate.Across architectures, encodings realizing the same regular germ yield the same matrix.Source: §2 · p. 6
• The knowledge matrix is positioned as a complement, not a replacement, to interpretability methods: its quiver-defined basis makes no monosemanticity claim, and it is defined for feedforward convolutional networks rather than transformer residual streams.The paper reports no row-lens experiment.Source: §2 · p. 6

3 The knowledge matrix is the germ of the network function

• Under (LCS), the matrix encodes the local affine germ: its path-sum Jacobian equals the network Jacobian, while its bias column completes the local affine map.The row-sum identity holds on the nonzero-preactivation set for every activation, but germ identity requires (LCS); piecewise linearity alone does not suffice.Source: §3 · pp. 9–10
• Because the matrix is gradient×input plus an exact aggregate bias attribution, it connects the germ representation to attribution while retaining the logit sum.Under (LCS), J is the input Jacobian and c = Ψ − Jx; the bias sources are summed into one matrix column.Source: §3 · pp. 8, 10

3.1 Invariance: the largest possible group

• Among encodings regular at x, the matrix is invariant to any change preserving the germ, including architecture changes, and hidden-layer permutations leave it unchanged at every input.The germ-stabilizer characterization requires regularity; distinct encodings can disagree at a breakpoint where one is not regular.Source: §3.1 · pp. 11–12

3.2 Completeness: the title claim, as a theorem

• At regular inputs with every input coordinate nonzero, the matrix recovers the germ, whereas hidden activations are gauge-covariant and can remain fixed while the germ changes.The field of matrices determines the network function on the set where it is given, but a field known only on an open set need not determine the function beyond that set.Source: §3.2 · pp. 12–13
• At regular inputs with no zero coordinates, equal knowledge matrices are equivalent to equal function germs, making M(x) complete and gauge-invariant where activations are neither invariant nor complete.For a fixed architecture, the matrix stabilizer equals the germ stabilizer among encodings regular at x; the nonzero-coordinate condition is needed for the reverse implication.Source: §3.2 · p. 13

3.3 Relation to attribution methods

• Under (LCS) at regular inputs without pooling ties, M’s input columns equal per-class gradient×input attributions and its final column is the exact aggregate bias attribution.This is the classwise FullGrad bias identity (Srinivas & Fleuret, 2019), and the equivalence enables computation by vector–Jacobian products.Source: §3.3 · pp. 13–14
• For non-PL activations, chord slopes preserve the fixed C × (d+1) matrix and exact output decomposition without an added implicit-bias term.FullGrad’s arbitrary-nonlinearity route instead appends a separately accounted implicit-bias term per unit (Srinivas & Fleuret, 2019, §4).Source: §3.3 · p. 14

3.4 Input symmetries, and what the contraction forgets

• For G-equivariant networks, input permutations transform M as an equivariant C × (d+1) tensor when both inputs are regular; the effective matrix obeys the corresponding law for any invertible input action.The bias column is equivariant under the output action alone.Source: §3.4 · p. 14
• The contraction can erase distinctions: same-architecture ReLU networks can have identical matrix fields yet non-isomorphic induced representations, while identifiable architectures admit a permutation-and-positive-rescaling equivalence criterion.The 1–2–1 witness differs on an open set despite identical matrices everywhere; the general same-architecture fiber question remains open, and that witness lies outside the identifiable class.Source: §3.4 · p. 15

4 Distance geometry in matrix space

• The row-sum constraint splits any matrix displacement into an orthogonal, minimum-norm visible component fixed by the logit displacement and a zero-row-sum invisible component.The visible component is the projection onto constant-row matrices; equality in the norm relation holds exactly for constant-row displacements.Source: §4 · p. 15
• Crossing dyads encode local-linearization changes invisible to endpoint logits, while the smooth block matches integrated-gradients attribution against baseline x.The crossing decomposition assumes finitely many transverse crossings, one unit or pooling window at a time; the authors have not established the required transversality argument at depth.Source: §4 · pp. 16–17
• Within one strict mask pattern, M(y) − M(x) = [J diag(δ) | 0], so the bias column cancels; across region walls, crossing dyads have zero row sums and contribute nothing to endpoint logit displacement.The endpoint mask-Hamming distance lower-bounds crossings, with equality of parity for networks without max-pooling.Source: §4 · pp. 16–18
• Coherence A = (dΨ/dM)^2 is unit-free; within one activation region, it is bounded by input dimension, equals 1 for a one-pixel change, and is at most k for a k-pixel-supported change.The one-pixel law holds for a nonzero Jacobian column, independent of pixel and perturbation magnitude.Source: §4 · pp. 15–16
• Median adversarial coherence is A ≤ 0.23; the paper treats this as descriptive geometry, not a validated measure of detectability or decision-relevant outcomes.The attack-family ordering is reported independently of any link between A and such outcomes.Source: §4 · pp. 16–17
• The crossing analysis requires transverse, one-at-a-time wall crossings; experiments screen for duplicated wall pieces and rely on random pairs not crossing tangentially.The authors state that the deeper-network transversality argument has not been carried out.Source: §4 · p. 17
• Hidden-activation distances cannot provide germ-level accounting invariant to positive-homogeneous layer rescaling, because the activations rescale while the function, dΨ, and dM remain unchanged.The proposition covers whole-layer rescaling and functions of the three stored distances only.Source: §4 · pp. 15, 18

4.1 Teleportation: what is bounded and what must be measured

• Uniform function-value closeness alone places no bound on knowledge-matrix drift at nonzero inputs, although at x = 0 the matrix difference is bounded by the function-value error.The theorem permits arbitrarily large matrix differences between same-architecture networks with identical masks at x, despite uniformly ε-close functions.Source: §4.1 · p. 18

Empirical setup

• The experiments use pretrained ResNet-152, DenseNet-121, and GoogLeNet on ImageNet-normalized 224 × 224 RGB inputs, with penultimate features as the hidden-activation comparison.The three primary networks span residual, dense, and inception families; ResNet-18, AlexNet, and VGG enter only as attack-ordering raters.Source: §5 · p. 19
• Each knowledge matrix has fixed shape 1000 × 150,529, enabling alignment-free comparisons across the three ImageNet architectures.Distances use Frobenius norm reported as RMS per coordinate for matrices and ℓ2 reported as RMS per dimension for penultimate features.Source: §5 · p. 19
• The adversarial suite spans six attacks across one-shot, iterative ℓ∞, ℓ2 margin-optimizing, minimal-norm boundary, and gradient-free score-based families.Study 2 medians exclude only pairs whose logits did not move under its relative division guard; separate analyses apply a stricter success filter.Source: §5 · p. 19
• The similarity panel uses unbiased HSIC1 on full 25,000-sample Gram matrices and reports a shuffled-pair control with debiased CKA ≤ 5.4 × 10^-4.The paper's two bootstrap intervals resample distinct units: 50 teleportation draws for the mean and adversarial pairs within one cell for the median.Source: §5 · p. 20

6.1 Why the invariance itself needs no experiment

• Neuron permutation and per-neuron rescaling preserve the network function but change penultimate features; the knowledge matrix is invariant under both symmetries.The invariance follows by construction, so the experiment is not needed to establish it.Source: §6.1 · p. 20

6.2 The nine-measure panel

• The panel ran nine measures, but only eight returned values; Gromov–Wasserstein returned a degenerate plan on every cell.The panel used 25,000 ImageNet-validation samples, while the Gromov–Wasserstein computation used a 5,000-sample subsample.Source: §6.2 · p. 21
• Anisotropic diagonal teleportation lies outside the invariance classes of the panel’s measures, so none is predicted to quotient out the full drift.Raw CCA and PWCCA, which are not in the panel, quotient this transform out exactly.Source: §6.2 · p. 21
• Procrustes distance measured 0.23–0.30 of its bound, while soft-matching measured 0.8–1.2% of its bound across the three architectures.Both distances are unnormalized, and both figures scale as √n.Source: §6.2 · p. 23
• All eight measures that returned values registered teleportation drift; none matched exact invariance, while the knowledge matrix remains invariant by construction.The panel assesses penultimate-feature drift, not the knowledge matrix’s invariance itself.Source: Table 2 · p. 22, §6.2 · p. 24

Setup

• The study computes per-pair matrix and logit displacements, applies a division guard, and reports per-cell median A and attack-family ordering.The 200-pair headline cells contain 110–200 valid pairs; several attack cells are low-n.Source: §7 · pp. 24–25

Result

• Every attack family has median coherence A ≤0.23 on the three ImageNet networks, below the single-pixel reference A = 1.The maximum of the 18 cell medians is 0.228 for GoogLeNet/APGD; these are per-cell medians, not pooled data.Source: §7 · p. 25, Table 3 · p. 25
• Across six architectures, attack-family ordering is concordant (Kendall W = 0.921), with minimal-norm attacks above FGSM and iterative PGD attacks in dM/dΨ.The full-scale three-network cross-check reproduces the family-level grouping at W = 0.97.Source: Table 4 · p. 26, §7 · p. 26

Interpretation

• The family ordering tracks how far attacks push past the decision boundary, not a per-unit-displacement property of germ motion or perturbation density.Minimal-norm attacks halt near the class flip, while budget-exhausting iterative attacks push logits farther past it.Source: §7 · pp. 26, 28

Mechanism and caveats

• The proposed wall-crossing explanation remains a conjecture, supported by a VGG pilot whose negative partial correlations use dΨ as a proxy for perturbation size.The three tested attacks share the same 200 base images, so their bootstrap intervals are not independent.Source: §7 · pp. 27–28

Procedure

• The study computes one knowledge-matrix distance per sample directly, alongside population-level penultimate-feature measures on the same architecture pairs.The knowledge matrices share a uniform 1000 × 150,529 shape, while penultimate feature widths differ.Source: §8 · p. 29

Interpretation

• Penultimate measures induce different pair orderings, and their scales differ; the knowledge-matrix distance is not presented as a quality ranking.For example, knowledge-matrix distance and soft-matching agree on the closest pair, whereas RSA-Spearman ranks that pair least similar.Source: §8 · pp. 30–31

Result

• Knowledge-matrix Frobenius distance is available without alignment for all three architecture pairs, ranging from 0.0107 for ResNet-152–GoogLeNet to 0.0180 for DenseNet-121–GoogLeNet.The reported values are RMS-per-coordinate distances computed on 25,000 ImageNet-validation samples.Source: §8 · pp. 29, 31, Table 5 · p. 30

Limitations

• The comparison establishes that the distance is well-posed, but does not test whether independently trained networks converge to the same knowledge matrix.Supporting random-network and shuffled-pair controls were pending, and no confidence intervals were reported for the three architecture pairs.Source: §8 · pp. 30–31

9 Honest negatives

• The paper limits its negative claims to the specific tasks tested, not to every downstream use of knowledge matrices.The detection bake-off uses AlexNet on CIFAR-10, rather than the three ImageNet networks studied elsewhere.Source: §9 · p. 31, §9.1 · p. 31

9.1 Adversarial detection: penultimate features win the bake-off

• On AlexNet/CIFAR-10, penultimate features beat the knowledge matrix on all 16 attacks and win 5 of 6 detector configurations.The Lee et al. baseline also exceeds both representations on the per-attack best-detector comparison.Source: §9.1 · p. 31

9.2 Single-region LP-counterfactual: 0/54

• The single-region counterfactual flips logits in 0 of 54 trials; all proposals leave the source activation region and exceed standard perturbation budgets.The perturbation changes ReLU activation patterns or pooling argmaxes, so a different local linearization governs the endpoint.Source: §9.2 · p. 32

L1

• Cross-architecture invariance lacks transform-based evidence: the tested symmetries confirm theory within architectures, while the cross-architecture study compares different functions.A test using different architectures realizing the same function on a neighborhood is the highest-priority follow-up.Source: §10 · p. 32

L2

• The cross-architecture study omits random-network and shuffled-pair controls, so its results establish distance availability rather than a control-calibrated quality ranking.Adding both controls is described as a mechanical follow-up.Source: §10 · p. 32

L3

• The box-constrained LP counterfactual has region_ok = 0/54, leaving a clean adversarial-style counterfactual unsupported in this ImageNet setting.Per-nonlinearity constraints or a homotopy/continuation method are proposed but not pursued; the per-LP records were not preserved for recomputation.Source: §10 · p. 33

L4

• Deeper benchmarking of shape-space metrics and Gromov–Wasserstein, including multi-architecture and transformer-family sweeps, is deferred.The full ReSi protocol and direct comparison to model stitching are also future work.Source: §10 · p. 33

L5

• Experiments cover residual, dense, and inception CNNs, while attention-layer library support is absent and transformer experiments remain future work.The framework applies to attention architectures; the stated barrier is library engineering rather than theory.Source: §10 · p. 33

L6

• Cross-architecture penultimate-distance rankings are not interpreted because the RMS-per-dimension metric is not normalized by feature norm and reflects feature scale.Within-architecture comparisons and the two implementation checks are unaffected.Source: §10 · p. 33

L7

• Coherence A is pixel-basis dependent, its cells contain 110–200 valid pairs, and its medians lack intervals, limiting interpretation of per-cell magnitudes.The attack-family ordering is reported to survive the filter recut at the family level on every tested rater.Source: §10 · p. 33

L8

• All comparisons use fixed pretrained networks; population statistics across training runs, seed-to-seed baselines, and training trajectories are out of scope.Source: §10 · p. 33

Study 1

• Teleportation leaves the knowledge matrix unchanged, while the nine-measure similarity panel does not recover exact invariance; output JSD alone is approximately zero.The knowledge-matrix implementation checks cover all three architectures; a random neuron permutation check is reported for ResNet-152.Source: §11 · p. 33

Study 2

• Across three pretrained ImageNet networks, adversarial attacks have median coherence A ≤ 0.23, and attack-family ordering is concordant across six rater architectures (Kendall W = 0.921).The population-matched full-scale panel reproduces the family-level grouping on all three architectures.Source: §11 · p. 34

Studies 3 and 4

• The fixed-shape knowledge matrix enables alignment-free per-sample comparison across architectures, whereas the detector bake-off favors penultimate features and the LP counterfactual fails on ImageNet.On AlexNet/CIFAR-10, penultimate features win 5 of 6 detectors and all 16 attacks; the LP reports region_ok = 0/54.Source: §11 · p. 34

Characterization

• Under (LCS), the knowledge matrix is a function-germ invariant and its displacement splits exactly into logit-visible and logit-invisible parts.For the ReLU networks studied, these properties are shared with per-class gradient×input plus an aggregate bias attribution.Source: §11 · p. 34

Future work

• The paper identifies same-function, different-architecture tests and multi-region counterfactuals as follow-ups, alongside application studies and broader similarity benchmarking.It makes no application claim; attention-layer support is also left to future library work.Source: §11 · p. 34

• The work studies a per-sample representation of fixed pretrained image classifiers; it trains no model, collects no data, and proposes no deployment.Source: Broader Impact Statement · p. 34
• The paper does not claim the proposed adversarial-detection use, and describes the knowledge matrix as an analysis tool equivalent to per-class gradient×input for the studied networks.It reports a detector bake-off as a negative result and foresees no direct societal risk.Source: Broader Impact Statement · pp. 34–35

• Nearly every printed number is traced to a stored artifact and script, with the supplementary guide mapping numbers to artifacts, scripts, and runtimes.The detector bake-off and LP-counterfactual are the exceptions because their underlying per-detector AUROC files and per-program dumps were not preserved.Source: Reproducibility Statement · p. 35
• Experiments use specified pretrained torchvision ResNet-152, DenseNet-121, and GoogLeNet weights in evaluation mode, with attack budgets documented in Appendix G.Source: Reproducibility Statement · p. 35
• Theory audits run on CPU in seconds, teleportation checks in minutes, and ImageNet-scale studies on H100 GPUs; reductions and scripts regenerate reported tables and figures.The code pins the knowledge-matrix library by commit, and unit tests pass in a fresh environment.Source: Reproducibility Statement · p. 35

A.1 Proof of Proposition 3.2 (what (LCS) is)

• Under the stated conditions, the network is affine on a neighborhood with linear part J(W, f)(x) and offset c(W, f)(x), but Xnz is necessary when f(0) is nonzero.A unit whose pre-activation vanishes throughout the neighborhood contributes f(0) to Ψ but nothing to J(W, f)x′ + c(W, f).Source: §A.1 · p. 35
• For continuous activations whose slope ratio is locally constant off a discrete set, continuity forces the two-slope form through the origin; a merely null exceptional set does not suffice.The proof shows nonzero points of the discrete exceptional set are removable; the appendix notes a Cantor-set counterexample to the null-set version.Source: §A.1 · p. 36

A.2 Preliminaries

• A pattern records each hidden unit’s activation side, and for max-pooling also each window’s selected entry; under (LCS), slope changes occur when a pre-activation crosses zero.For ReLU, the pattern is the familiar 0/1 mask.Source: §A.2 · p. 36
• With a candidate lower-layer pattern fixed, each pre-activation is affine in the input, making its zero set an affine hyperplane, empty, or all of the input space.The all-space case occurs when the affine coefficient and offset both vanish.Source: §A.2 · p. 36

A Proofs

• The appendix defines the pattern’s non-local-constancy set by failure of local constancy in every neighborhood and reports numerical verification of identities using two independent implementations.The scripts include checks of Section 3 hypotheses and finite-dimensional witnesses for statements in Sections 3–4.Source: A Proofs · p. 35, §A.2 · p. 37

A.2 Preliminaries

• The switching set is closed and contained in finitely many affine hyperplanes, so regular inputs form an open, dense, full-measure set.This applies to slope diagonals and, with max-pooling, selection matrices.Source: §A.2 · p. 37

A.3 Proof of Lemma A.1 (null switching set)

• The switching set is closed, contained in finitely many hyperplanes, and therefore null, making the regular set open, dense, and full measure under (LCS).For strictly nonlinear smooth activations such as tanh, locally constant patterns are generically absent; the matrix need not be a function of the germ, and weaker function-determination is left open.Source: §A.3 · pp. 37–38

A.4 Proof of Theorem 3.4 (germ identity)

• On a regular input under (LCS), the knowledge matrix equals [DΨ(x) diag(x) | Ψ(x) − DΨ(x)x], which recovers the local affine germ and has row sums equal to the logits.At pattern boundaries the row-sum identity still holds, but the germ-selection interpretation is ReLU-specific; for general (LCS) activations only the row-sum claim survives there.Source: §A.4 · p. 38, §A.7 · p. 39

A.6 Proof of Lemma 3.5 (quiver-isomorphism invariance) and Corollary 3.7 (permutation scope)

• Neuron permutations and nonzero diagonal rescalings preserve the knowledge matrix, while permutation invariance requires elementwise activations; negative ReLU rescaling changes the carried activation and leaves the ReLU class.The permutation result remains valid at exact-zero pre-activations even when the row-sum identity has a shared shortfall, but non-equivariant vector activations are excluded.Source: §A.6 · p. 39

A.8 Proof of Corollary 3.9 (the two stabilizers coincide)

• At inputs with no zero coordinates, two regular encodings have the same knowledge matrix exactly when they have the same germ, so their matrix and germ stabilizers coincide.The converse uses J:,i = M:,i/xi and c = M:,d+1; at zero coordinates, a matrix column vanishes and germ information can be lost.Source: §A.5 · p. 38, §A.8 · p. 40

A.9 Proof of Theorem 3.10 (gradient×input ⊕bias; route equivalence)

• The first d matrix columns are per-class gradient×input and the last is aggregate bias attribution; masked products, probes, and autograd agree in evaluation mode.The identity is the classwise FullGrad decomposition (Srinivas & Fleuret, 2019), with gradient×input identified by Shrikumar et al. (2016) and Ancona et al. (2018); the bias-by-subtraction route also appears in Balestriero & Baraniuk (2018).Source: §A.9 · pp. 40–41

A.10 Proof of Proposition E.1 (input-symmetry transformation law)

• For input symmetries, the germ transforms by the output action and the matrix’s first block obeys the corresponding law only for input permutations in the full-column-rank witness class.The witness is the identity map with C = d; the experiments’ Jacobians cannot have full column rank because C = 1000 < d = 150,529.Source: §A.10 · p. 41

A.11 Proof of Proposition 3.11 (contraction gap)

• A 1–2–1 example shows that distinct induced representations can contract to the same knowledge matrix everywhere, while identifiability follows on the stated non-increasing-width network class.The example’s representations differ for x > 0 and agree for x ≤ 0; its increasing widths place it outside the identifiability class.Source: §A.11 · p. 41

A.12–A.14 Proofs on displacement geometry

• The displacement decomposition projects onto a minimum-norm visible component orthogonal to the invisible component; within-region support of at most k nonzero columns gives A ≤ k, and a transversal single flip produces a rank-one update.Source: §A.12 · p. 42, §A.13 · p. 42, §A.14 · p. 42

A.14 Proof of Theorem 4.4 (smooth + crossing)

• The crossing decomposition separates smooth Jacobian motion from rank-one jumps, whose row sums vanish, preserving the exact row-sum identity.For unit flips, the bias-column formula has measured error ≤8.2 × 10^-13, and the full decomposition error is ≤2.6 × 10^-16 over >1,000 crossings. Hamming distance is bounded by the crossing count, with parity equality only without max-pooling; equality requires no unit or window to switch twice.Source: §A.14 · p. 43

A.15 Proof of Proposition 4.5 (no hidden-activation accounting)

• The knowledge matrix cannot be accounted for by hidden-activation distance alone: layer rescaling leaves Ψ, dΨ, and dM unchanged while changing dh.Rescaling an entire layer by any λ > 0 makes any invariant function of (dh, dΨ, dM) independent of dh when dh > 0; the conclusion does not cover statistics using other stored quantities.Source: §A.15 · p. 43

A.16 Proof of Theorem 4.6 and Proposition E.14

• At any fixed nonzero input, networks within ε in function value can have knowledge-matrix drift growing without bound, while at x = 0 no pair exceeds ε.The construction’s measured drift is 99, 9.9 × 10^3, and 9.9 × 10^5 for K = 10^2, 10^4, and 10^6 at ε = 10^-2; visible drift equals the gate ε by the row-sum identity.Source: §A.16 · p. 43

B.1 Three equivalent computations

• The autograd route computes the slope with C vector–Jacobian products plus one forward pass, replacing d+1 probe passes at regular points under (LCS).The slope is the input-output Jacobian; the bias column is Ψ(W, f)(x) − Jx, an aggregate bias attribution. The three routes coincide at regular points, but the Jacobian need not equal the slope product outside (LCS).Source: §B.1 · p. 44

B.2 Cost and speed-up

• At ImageNet scale, autograd is predicted to save 50–150× over probing (C = 1000, d+1 = 150,529); the demo reports an extrapolated CPU compute-cost ratio of ≈296×.The demo compares probe ≈8475 s with VJP ≈29 s per sample, both extrapolated from measured slices; probe passes were emulated by batched forward evaluations on a double-precision CPU.Source: §B.3 · p. 45

B.4 Implementation requirements

• Computing M(x) in software requires evaluation mode; active Dropout can desynchronize passes and make the row-sum identity appear to fail.The implementation expects a 3D (Cin, H, W) input, and ImageNet-scale matrices are computed in chunks and bundled rather than saved as many individual files.Source: §B.4 · p. 46

C.1 Why the transform is exact, batch normalization included

• Neural teleportation remains function-exact for batch-normalized networks in evaluation mode without migrating running statistics or rescaling ε.Evaluation-mode running statistics are ordinary weights, and the transformation restores the original pre-normalization activation before applying the unchanged normalization; the framework’s activation action carries the outgoing basis on affine parameters.Source: §C.1 · pp. 46–47

C.2 The closed forms behind Section 6.1; C.4 Permutation

• Teleportation rescales penultimate features coordinatewise, so their drift tracks feature norms, while the permutation check licenses only implementation-level invariance and not superiority.The permutation check measures knowledge-matrix noise at the pipeline’s resolution; permuted penultimate features move on the order of the adversarial signal. The passage cautions that permutation-equivariant penultimate statistics could also be invariant and gradient×input shares this invariance.Source: §C.2 · p. 47, §C.4 · p. 48

C.4 Permutation

• 0.10–0.14%: the knowledge-matrix permutation residual is this fraction of adversarial signal in the mean on ResNet-152, while penultimate drift is of the same order as its signal.Penultimate drift is at most 3.05× below its signal and exceeds it in 16 of 24 cells; the worst-case ResNet-152 tail ratio reaches 1.14× for DeepFool.Source: §C.4 · p. 48
• DenseNet-121 and GoogLeNet have no in-place channel permutation because of their concatenation topologies, so permutation coverage uses teleportation instead.The knowledge-matrix residual is described as pipeline resolution, not a violation of the theorem.Source: §C.4 · p. 48
• The result confirms the predicted invariance only where permutation is realizable in place; it does not show that this invariance is unique to knowledge matrices or that they are better representations.The supplied reading limits this conclusion to one of the three networks.Source: §C.4 · p. 49

C.5 Teleportation: the same check on all three architectures

• Across all three architectures, teleportation preserves logits and the knowledge matrix to arithmetic resolution, while penultimate features drift substantially.The visible and invisible components of matrix drift also vanish to that resolution; teleportation confirms implementation of an invariance that holds by construction.Source: §C.5 · pp. 49–50

C.6 Linear-invariant measures and the Procrustes scale

• Raw CCA and PWCCA quotient out teleportation’s feature-space change, whereas none of the eight evaluated panel measures does.SVCCA returns 0.97–0.99 rather than 1 on the tested synthetic rescalings because its 99%-energy truncation precedes CCA.Source: §C.6 · p. 51

C.7 The controls in full

• The shuffled-pair controls return zero for three measures, while Bures remains nonzero and limits interpretation of cross-architecture Bures values.The controls use 2,048 inputs rather than the panel’s 25,000 and report point estimates without confidence intervals or permutation-null p-values.Source: §C.7 · pp. 51–52, Table 8 · p. 52

D Geometric structure of class regions in matrix space

• On the three networks at full scale, attack-family ordering has Kendall W = 0.97 and reproduces the grouping {DeepFool, CW, Square} > FGSM > {PGD, APGD}.This cross-check uses matched image populations and attack-success-filtered pairs.Source: Table 10 · p. 53
• Theorem D.1 states that each class region in knowledge-matrix space is convex; strict row-sum and argmax conditions connect region membership to classification.The stated equivalence requires inputs with nonzero coordinates when the activation has f(0) ≠ 0.Source: D Geometric structure of class regions… · pp. 52–53

D.1 Proof of Theorem D.1 (convexity of class regions)

• Theorem D.1 makes each strict-argmax matrix region convex because row sums preserve strict argmaxes under convex combinations.This permits centroid-based k-NN without representation alignment and suggests federated averaging: matrix regions are shared across clients, unlike feature-space regions cut by client-specific weights; neither direction is experimentally tested here.Source: §D.1 · pp. 54–55

E.1 Input symmetries: how the knowledge matrix transforms

• When both x and π(g)x are regular, the germ intertwines the input and output actions, the bias column transforms by the output action, and M is equivariant for input permutations.The paper adds the bias-column law, a converse requiring permutation matrices under a universal equivariance condition, and the Weff law for any invertible linear input action.Source: §E.1 · p. 56
• The tensor law requires input-coordinate permutations; continuous rotations break equivariance of M’s input columns, E(n) is outside the linear-action setup, and coherence is permutation-invariant only with an orthogonal output action.The variant Weff = [J | c] is equivariant for any linear input action.Source: §E.1 · pp. 56–57

E.2 Further remarks on Section 3

• The secant slope f(z)/z makes the row-sum identity exact on Xnz for arbitrary activations, but when f(0) ≠ 0 no finite guard repairs a zero pre-activation.For real-analytic activations, Xnz is dense and full measure if no unit’s pre-activation vanishes identically; near excluded zeros, the secant can be unbounded.Source: §E.2 · pp. 57, 59
• LCS is stricter than piecewise linearity: hard-tanh and shifted units violate the germ identity despite retaining the row-sum identity.The bridge from network-wide LCS to the activation classification yields the leaky-ReLU family; the condition requires linear pieces through the origin.Source: §E.2 · pp. 57–58
• M cannot recover germ columns where the corresponding input coordinate is zero, whereas Weff = [J | c] recovers the germ without an input condition.The boundary row-sum identity holds for every activation, but the germ-selection clause is ReLU-specific.Source: §E.2 · pp. 58–59
• The knowledge-matrix penalty is input-scaled, class-resolved logit-gradient regularization; it bounds logit displacement by √(d+1) times matrix displacement but is blind where xi = 0.The paper reports no training experiment demonstrating that this penalty helps; Weff is suggested as a less input-blind object to penalize.Source: §E.2 · pp. 59–60
• At max-pooling ties, the masked-product Jacobian and knowledge matrix depend on the tie-breaking rule, so the no-ties condition excludes function-independent values at those boundaries.The implementation reuses PyTorch’s lowest-index argmax across the forward pass, masked product, probe, and autograd; ties are a Lebesgue-null event.Source: §E.2 · p. 60

E.3 Further remarks on Section 4

• The squared coherence is an energy share because the visible and invisible components are orthogonal and their squared norms add; the smooth displacement is integrated gradients, while wall crossings add a separate term.Each crossing contributes a rank-one dyad whose row sums vanish at the crossing; the remaining smooth term is the segment-averaged Jacobian times the displacement.Source: §E.3 · p. 61
• Uniform positive rescaling can move hidden activations without changing a ReLU network’s function, so stored-distance invariants cannot depend on hidden-activation distance alone.This conclusion concerns functions of the three stored distances; normalized hidden distance is outside its scope.Source: §E.3 · p. 62
• C0 closeness does not control knowledge-matrix drift because the matrix records first-order germ data; under an exact isomorphism, however, both drift components vanish.For an approximate transform, visible drift equals the measured logit gate exactly, while invisible drift is unbounded by that gate alone; teleportation is an exact-isomorphism case.Source: §E.3 · p. 62

F Further limitations

• The limitations section flags four measurement-convention caveats that apply across multiple studies and are continued in Table 13.Source: F Further limitations · p. 63, Table 13 · p. 63

G Setup details

• Finite-precision computation can leave a measurable row-sum residual, while double precision reduces it to approximately 10^-14; networks must remain in evaluation mode for the identity to hold in implementation.For ResNet-152, the single-precision residual median is 0.007 and the maximum is 0.295; active dropout can make the residual as large as 0.9 of the maximum logit magnitude.Source: G Setup details · p. 64
• Bootstrap intervals quantify variability only over their resampled units, not across different image sets, architectures, or attack budgets.Source: G Setup details · p. 66

G.1 Study 3: the scale confound, and the comparison without alignment

• Penultimate similarity measures use raw unequal feature dimensions, whereas knowledge-matrix distance is a per-sample measure on a uniform C × (d+1) representation with exact logit-visible accounting.The similarity measures return population-level scores in their own metric spaces; the knowledge-matrix distance reports one RMS-per-coordinate Frobenius distance per input.Source: §G.1 · p. 66
• Knowledge-matrix distances compare architectures directly without projection or learned alignment, but the penultimate measures’ agreement is not corroboration because scale confounds their rankings.The reported distances are 0.0169 (RN–DN), 0.0107 (RN–GN), and 0.0180 (DN–GN); the paper treats the decomposition as descriptive geometry, not an architecture quality ranking.Source: §G.1 · pp. 66–67

H The mechanism pilot behind the attack-family ordering

• The size-controlled ρS(H, A | dΨ) is −0.343 (APGD), −0.304 (DeepFool), and −0.341 (Square), matching Conjecture H.1’s predicted sign.A cleaner statistic, ρS(H, dM | dΨ), is +0.335 (APGD), +0.383 (DeepFool), and +0.373 (Square). This VGG pilot tests only rank-correlation consequences, uses dΨ as a proxy for ∥δ∥, and leaves the mechanism conjectural; exact-∥δ∥ replication on the three study networks is future work.Source: Table 14 · p. 68, H The mechanism pilot behind the… · p. 68

I Kendall’s coefficient of concordance W, worked through on the Study 2 panel

• At full scale, W(dM/dΨ) = 0.9746 exceeds W(dΨ) = 0.8222 and W(dM) = 0.7968, making the ratio most concordant across three networks.On the 200-pair panel, however, W(dΨ) = 0.9746 exceeds the ratio’s 0.9206, and W measures agreement rather than whether an ordering is interesting. The appendix also rejects a density-based reading of the ordering: sparse perturbations have coherence 1 within-region, while matched-density attacks show a 3–4× spread on ResNet-152.Source: I Kendall’s coefficient of concordance… · pp. 70–71

I.1 Population and filtering details

• The largest median A among the 18 cells of three networks is 0.228 (GoogLeNet/APGD), and stricter success filtering moves VGG’s median dM/dΨ by −12%, −39%, and −12% on APGD, DeepFool, and Square.The 0.23 headline is the maximum of cell medians, not a pooled median; the filter change moves VGG/APGD across A = 1 (0.84 → 1.09) while leaving the family-level grouping unchanged.Source: §I.1 · p. 71

J.1 The detector bake-off

• On AlexNet/CIFAR-10, penultimate features win 5 of 6 detectors and beat the knowledge matrix on all 16 attacks, while the external Lee et al. baseline beats all three representations.The per-attack best-detector averages are 0.918 for penultimate features, 0.798 for the knowledge matrix, and 0.937 for the external baseline; the bake-off is limited to one architecture and dataset.Source: §J.1 · pp. 72–73, Table 15 · p. 72

J.2 The single-region LP-counterfactual

• The single-region LP counterfactual fails on all 54 trials: region_ok is False on 54/54, and the target logit exceeds the source logit on 0/54.The LP direction leaves the activation-and-pooling region in which it was derived, so its linearized guarantee no longer applies to the actual network; its perturbations are also far outside standard budgets.Source: §J.2 · pp. 73–74

K Vocabulary for algebraists

• The vocabulary appendix defines each term through four fields: its definition, algebraic reading, computation in the paper, and validation.Its notation includes M(x) and its class-centered form M°, the all-ones vector 1_k, and the Frobenius inner product and norm.Source: K Vocabulary for algebraists · p. 74

Objects of training

• Knowledge matrices remain fixed under hidden-neuron permutations and ReLU positive rescaling, while their fixed C × (d + 1) shape permits comparison across architectures.Under (LCS) at regular inputs, the matrix is determined by the network germ; its rows sum to the logits, unlike hidden activations, which are gauge-covariant and germ-incomplete.Source: Objects of training · p. 75, Knowledge-matrix objects · p. 76

Knowledge-matrix objects

• The knowledge matrix contracts an input-induced quiver representation into a fixed-shape matrix whose row sum exactly recovers the logits on the stated domain.For ReLU, it is [J(x) diag(x) | c(x)]; the row-sum identity applies to any activation when no hidden pre-activation vanishes, and fails at a zero pre-activation by exactly f(0).Source: Knowledge-matrix objects · p. 76

Baselines

• All eight returned measures in the nine-measure panel register some teleportation drift, whereas the knowledge matrix does not move under the tested transformation.Penultimate features outperform knowledge matrices in five of six detector configurations; activation comparisons require a chosen alignment or quotient, and feature scales differ across architectures.Source: Baselines · pp. 77, 79

Interventions and evaluation

• Attack-family coherence compares logit displacement with knowledge-matrix displacement, with medians used to order attack families across architectures.The mechanism pilot uses the stricter success filter dΨ ≥ 1 and dM > 0; the headline ordering uses a different relative division guard, so the filters should not be conflated.Source: Interventions and evaluation · pp. 79–80
• 0/54 matrix-direction counterfactuals flipped the actual logits, and all 54 left the original ReLU region.Each perturbation reached the per-channel saturation cap of about 4.4, illustrating that the local linear guarantee is conditional on remaining within the region.Source: Interventions and evaluation · p. 80
• The two attack-family ordering panels use different images and budgets yet reproduce the same family-level grouping, serving as independent cross-checks.The paper evaluates pretrained networks on ImageNet validation images and trains no network or tunes no hyperparameter.Source: Interventions and evaluation · p. 80