Imprint Reader: From Weight-Update Readout to Behavioral Intervention

1 INTRODUCTION

• Existing weight-space methods mainly predict coarse properties, while prior verbalization work is narrow-domain and can fabricate descriptions for information-free updates.The paper identifies decoding updates into explicit accounts of learned knowledge or behavioral change as the unmet capability.Source: §1 · pp. 1–2
• SMaRT trains one Imprint Reader to describe frozen updates under anchor-free meta-queries, with empty and random-update controls discouraging unsupported claims.The Reader mounts updates onto its own parameters, whose coordinate-aligned gradients provide an interface for intervention.Source: §1 · p. 2
• On held-out updates, judge-based Pass@100 reaches 2% for knowledge and 16% for behavior, showing feasible but not yet reliable natural-language readout.The joint Reader is trained on Qwen3-14B and prompted with anchor-free meta-queries.Source: §1 · p. 2
• At a 0.5% pruning rate, Reader-guided selection raises harmful-prompt refusal from 57.9% to 64.1% under safety maintenance and BFCL Overall from 41.69% to 44.60%.For mathematics, sparse updates also increase backtracking and sub-goal expressions; the BFCL improvement uses behavior descriptions without target-task training examples.Source: §1 · p. 2

Reading Neural Network Weights

• This work focuses on natural-language descriptions of specific factual and behavioral changes from held-out weight updates, rather than coarse weight-property prediction.Prior weight-space work predicts properties such as accuracy, training hyperparameters, or fine-tuning tasks; Haim et al. (2022) reconstruct training samples from weights.Source: §2 · p. 2

Model Introspection and Self-Description

• Related update-readout studies examine behavioral effects, while this setting also tests specific factual propositions, abstention controls, and coordinate-aligned intervention.The cited work includes Goel et al. (2026) and Shenoy et al. (2026).Source: §2 · p. 3

Self-Improving Models

• Self-improving systems often assess downstream outcomes; this work instead studies how factual and behavioral changes are recorded in updates and can guide intervention.Related approaches revise outputs, rewrite improver programs, edit agent code, automate agent design, evolve training algorithms, or run research pipelines.Source: §2 · p. 3

3.1 PROBLEM FORMULATION

• Each target is represented by QA pairs that induce factual knowledge or a behavioral tendency, and its resulting update is the Reader’s only episode-specific information about k.Source: §3.1 · p. 3
• An anchor-free meta-query asks the Reader to state target k without revealing its topic, entity, original question, or answer.Source: §3.1 · p. 4

3.2 DESIGN OF SEMANTIC MOUNT-AND-READ TUNING

• SMaRT constructs an update by training a temporary model on target QA data, then mounts the frozen update for readout and removes it before updating the Reader.Source: §3.2 · pp. 4–5
• Only θR is optimized; independently constructed updates train general reading ability, while no-change and random-perturbation episodes teach the Reader to abstain.Source: §3.2 · p. 5
• Because Reader and original-model coordinates align, readout-loss gradients provide an intervention signal for candidate weight updates.Source: §3.2 · p. 5

4 EXPERIMENTS

• A single Reader is trained jointly on knowledge-bearing and behavior-inducing updates, alongside no-change and random-perturbation controls, then evaluated on unseen updates with anchor-free queries.The Reader is not given the examples used to construct the updates; the controls discourage attributing specific content to uninformative updates.Source: §4 · pp. 5–6
• At step 2,800, judge-based Pass@100 on unseen updates reaches 2% for knowledge and 16% for behavior, with free-form success remaining uneven and unreliable.The evaluation figure tracks free-generation readout across Reader checkpoints, separately for knowledge and behavior.Source: §4 · p. 6, Figure 2 · p. 6
• Figure 3 illustrates knowledge and behavior readouts elicited without the builder’s training examples, but relevant descriptions can still misstate details or characterize behavior too broadly.The examples illustrate the two readout targets rather than overall success rates.Source: §4 · pp. 6–7, Figure 3 · p. 6
• The Reader’s target-conditioned likelihood gradients provide a differentiable signal for intervention on the original model, motivating MetaEdit.The Reader shares parameter coordinates with its parent, so the gradients lie in the parent’s parameter space.Source: §4 · p. 7, Figure 4 · p. 7

5 APPLICATIONS: FROM READOUT TO BEHAVIORAL INTERVENTION

• MetaEdit transfers target-conditioned Reader gradients to the original model, using row selection for pruning or sparse signed gradients for behavioral edits.Source: §5 · p. 7

5.1 GRADIENT-BASED SAFETY LOCALIZATION AND PRUNING

• At 0.5% pruning, MetaEdit (Reader) shifts harmful-prompt refusal from 57.9% to 64.1% under safety maintenance and to 55.4% under refusal relaxation, with near-zero garbling.Source: §5.1 · p. 8, Figure 5 · p. 8

5.2 VIBE ALIGNMENT FOR REASONING AND AGENTIC TASKS

• MetaEdit uses procedure-level self-reports specifying concrete behavior changes, while its Broad variant uses an outcome-level target and a norm-matched patch.Source: §5.2 · p. 9
• 95.00% versus 94.77% on GSM8K, 83.0% versus 82.8% on MATH-500, and 44.60% versus 41.69% on BFCL Overall for MetaEdit versus unedited Qwen3-14B.Source: §5.2 · p. 9, Table 2 · p. 9, Table 1 · p. 9
• MetaEdit raises backtracking from 0.327 to 0.687 and sub-goal expressions from 5.390 to 6.015 per 1,000 generated tokens.Source: §5.2 · p. 9

• The Reader interprets factual and behavioral changes encoded in updates, and MetaEdit uses its gradients to study targeted interventions.Source: §6 · pp. 9–10
• The target behavior can be specified in words for intervention without training examples from the target task or inference-time behavioral instructions.Source: §6 · pp. 9–10

• Generative AI tools assisted with manuscript writing and polishing, literature discovery, and code development.Source: AI USE STATEMENT · p. 11
• Language-model assistance supported candidate knowledge extraction, question–answer rewrites, and behavior-data synthesis, with details in Appendix A.1.Source: AI USE STATEMENT · p. 11
• The authors state that they take full responsibility for the research, reported results, and AI-assisted content.Source: AI USE STATEMENT · p. 11

• The work trains a Reader to interpret factual and behavioral changes encoded in model updates and uses its gradients to study targeted interventions.Source: ETHICS STATEMENT · p. 11
• The authors suggest that making learned changes more inspectable could help models monitor and adjust their learning in a closed-loop AI-for-AI process.Source: ETHICS STATEMENT · p. 11
• Evaluation covers controlled updates associated with a single knowledge item or behavioral tendency, not reconstruction of training examples, so the results do not demonstrate training-data extraction.Source: ETHICS STATEMENT · p. 11

A.1 DATA PREPARATION.

• The knowledge pipeline draws from eight benchmarks and converts extracted propositions into question–answer items with eight semantically equivalent rewrites each.The initial collection contains 14,851 candidate items; 9,148 remain after auditing.Source: §A.1 · p. 16
• Behavior data comprise 10,000 audited specifications across seven categories, each paired with eight demonstrations designed to show the intended tendency without cueing it in the request.The process yields 9,973 accepted behavior items and 79,784 demonstrations.Source: §A.1 · p. 16
• After screening, 8,697 knowledge and 9,478 behavior items remain; 100 of each type form held-out test sets and 8,592 of each type are selected for balanced training.The remaining 5 knowledge and 786 behavior items are reserved and unused in this run.Source: §A.1 · p. 16

A.2 READER TRAINING AND EVALUATION DETAILS

• Each item-specific LoRA update is built from the base model, frozen, mounted onto the Reader, and removed after the readout loss updates only Reader parameters.The builder runs 64 BF16 steps; LoRA rank is selected from 16, 32, 64, 128, and 256 using an item-identifier hash and fixed seed.Source: §A.2 · p. 16
• Training uses eight GPUs and balanced batches of 24 knowledge, 24 behavior, 8 no-change, and 8 random-perturbation episodes, with control-loss weights ramped up over 1,432 steps.The schedule is designed for two epochs; application gradients use the checkpoint after 2,800 Reader updates.Source: §A.2 · p. 17
• Held-out readout evaluation tests 100 knowledge and 100 behavior updates with 100 stochastic generations per update and reports Pass@100 using a semantic judge.A pass requires the response itself to communicate the complete target; topical overlap, partial facts, contradictions, and unsupported additions do not count.Source: §A.2 · p. 17

A.3 SAFETY PRUNING PROTOCOL

• Safety evaluation aggregates refusal outcomes over 1,253 harmful prompts and selects rows from output projections using contrastive gradient rankings before zeroing selected rows.Pruning rates are 0.01%, 0.05%, 0.1%, and 0.5%; target descriptions request safety maintenance or refusal relaxation.Source: §A.3 · p. 17

A.4 REASONING AND AGENTIC EVALUATION DETAILS

• MetaEdit targets post-trained Qwen3-14B and selects 2,089 rows, or 0.1%, for mathematical and BFCL evaluation using fixed intervention coefficients.The coefficients were fixed before evaluation on GSM8K, MATH-500, and BFCL; BFCL evaluation covers 5,106 cases across 22 subsets.Source: §A.4 · p. 18

A.5 SUB-GOAL-AWARE ROW SELECTION FOR MATHEMATICAL VIBE ALIGNMENT

• For mathematical alignment, the target combines a primary plan-and-verify description with an auxiliary sub-goal organization description, and the sub-goal term affects row selection.The auxiliary term does not change the signed direction applied to selected rows.Source: §A.5 · p. 18
• Mathematical row selection takes the top 0.1% under an extended contrastive gradient-magnitude score, omitting the over-refusal control and adding a sub-goal bonus.Unlike safety pruning, it skips the final signed-inner-product ranking; the primary target gradient is applied to the selected rows.Source: §A.5 · p. 18

A.6 ADAPTER-SWAP CONTROL FOR UPDATE-SPECIFIC READOUT

• The control holds each query and target fixed while comparing a matching update, no update, and a genuine same-type update assigned to another item.Assignments use fixed type-preserving permutations without self-matches, and remain fixed across Reader checkpoints.Source: §A.6 · p. 18
• 0.2227 nats per token: at step 2,800, the matching update reduces target loss by this amount relative to no update, and by 0.1255 relative to a mismatched update.Both paired differences are positive at all 12 evaluated checkpoints from step 600 to step 2,800; the mismatched update also lowers loss by 0.0972 relative to no update.Source: Figure 6 · p. 19, §A.6 · p. 19
• The plotted red and blue lines show no-update and mismatched-update loss differences from the matching-update loss across Reader training steps.The vertical axis is mean paired difference in nats per target token over 800 queries, and positive values favor the matching update.Source: Figure 6 · p. 19, §A.6 · p. 19

B EVALUATION PROMPTS AND INTERVENTION TARGETS

• The scoring prompt requires the model reply itself to communicate the complete requested target, accepting faithful paraphrases but rejecting missing propositions or material contradictions.The judge must not infer missing content from target text or QA context.Source: B EVALUATION PROMPTS AND INTERVENTION… · p. 20
• The evaluation prompts define safety maintenance as refusing unsafe requests while answering benign ones, and refusal relaxation as greater willingness to comply with unsafe requests.The mathematical targets emphasize intermediate goals, derivation, and checking results against problem conditions.Source: B EVALUATION PROMPTS AND INTERVENTION… · p. 21
• The tool-use target asks for appropriate tool decisions, exact function selection, schema-grounded arguments, clarification, and correctly sequenced calls without needless calls.A broad version targets better use of available tools to complete user requests.Source: B EVALUATION PROMPTS AND INTERVENTION… · p. 21