PaperlayerView exact revision on arXiv

Source-linked AI summary

Many Perturbations, Shared Failure Dynamics: Tracing Direction-Sensitive Perturbation Influence in Language Models

Zhibo Hu, Chen Wang, Yanfeng Shu, Liming Dong, Hye-young Paik, Liming Zhu

arXiv:2610.32309v1cs.CL

TL;DR

The paper asks what makes an input-induced representation difference consequential for a behavioral readout. It combines reserve, transformation, and response-alignment analyses with directional interventions, finding shared predictive patterns alongside context-dependent causal effects.

  • Problem

    The paper asks what determines whether an input-induced representation difference changes a specified behavioral readout, a question spanning linguistic robustness and chain-of-thought monitorability.

    Source: §1 · pp. 1–2

  • Method

    The paper analyzes clean reserve, representation displacement, and response alignment, using directional interventions to test information omitted by scalar summaries.

    Source: §11 · p. 35

  • Results

    Shared descriptions rank semantic failures across families, while matched interventions show scalar summaries omit consequential orientation and expanded controls favor the natural paired direction over tested alternatives.

    Source: §1 · p. 3, §11 · p. 35

  • Takeaways & Limitations

    The findings support shared predictive relations among reserve, transformation, and response without implying a universal causal direction.

    Source: §11 · p. 35

    The disjoint component-rule cohort contains 21 failure items, and per-family failure counts remain below the frozen twenty-item interpretive threshold.

    Source: §10 · p. 34

Abstract

from arXiv · show

Why can a task-preserving rewrite turn a correct answer into a failure while a larger internal change leaves the answer intact? We develop a direction-sensitive, readout-relative account of semantic fragility: heterogeneous language changes can share geometric and readout relationships without sharing an input-independent failure direction. Clean decision reserve, representation transformation, and response alignment provide complementary descriptions of this process. An exact longitudinal-transverse decomposition identifies directional information discarded by scalar transmission. A compact reserve-and-transmission model predicts failures across held-out families and items in Qwen3-32B and Gemma 4 31B, with useful but parameterization-dependent transfer to ReClor. Matched interventions show that orientation carries causal information beyond scalar geometry. Among naturally failed rewrites, attention-component tests on disjoint original items and subsequent answer-order controls favor the natural paired direction over tested random and same-answer-letter donor directions. Yet failures rarely persist across option orders, and current-order corrections use recomputed clean references. Shared predictive regularity thus coexists with context-dependent directional effects. Numerical path integration reduces, but does not eliminate, finite-patch approximation error within a fixed context; a larger discrepancy from the natural rewrite effect remains. A complementary fixed-CoT cue study extends this account to influence unacknowledged in recorded reasoning: readout associations transfer across domains, although the positive-mean causal criterion fails and signed-effect prediction remains post hoc. Together, these results support shared relations among reserve, transformation, and response while distinguishing local causal sensitivity from a complete explanation of natural failure.

1 Introduction

The introduction asks when internal changes become consequential for a response, distinguishing representation displacement, its transformation, and its readout alignment. It previews shared predictive relationships alongside context-specific directional effects, including limits on explaining natural failures.

1 Introduction

  • Clean answer margin, incoming displacement, and local gain predict correct-to-incorrect changes across held-out RUPBench families and items, with AUROC 0.953 for Qwen3-32B and 0.910 for Gemma 4 31B.Frozen scorers retain useful ranking performance on independently constructed ReClor rewrites; the shared relationship concerns reserve and transmission, not a shared trigger or hidden-state vector.Source: §1 · p. 2
  • Transverse orientation can alter behavior while preserving scalar decomposition, establishing direction sensitivity under tested controls but not a universal restoring direction.The exact longitudinal-transverse identity exposes information discarded by scalar gain; Gemma entry interventions and mirror controls also evolve differently.Source: §1 · p. 3
  • On 250 disjoint ReClor items, the revised Qwen L54 attention rule strictly repaired 13/27 failures versus 0/108 matched random-direction draws, after an initial validation showed no clear all-cohort benefit.The result supports a localized directional effect after refinement; it does not replace the preceding negative all-cohort result.Source: §1 · p. 3
  • Numerical path integration better describes a finite patch than a single-point gradient, but a larger discrepancy from the full natural input effect remains.A quantitative local effect therefore cannot by itself explain the complete natural rewrite effect.Source: §1 · p. 3
  • Across 37 failure conditions, the paired direction strictly repaired 16/37, versus 10/148 same-letter donor and 0/148 random draws; 28/32 affected rewrites failed in only one option order.Each order uses its own clean reference, so unchanged-vector transfer across layouts remains untested.Source: §1 · p. 3
  • In fixed-CoT replay, readout-aligned transverse attribution transfers observationally across held-out math and health domains, while the positive-mean causal criterion fails and signed patch-effect prediction remains post hoc.The signed analysis is correct on 73/82 bases (89.02%); these results concern fixed-CoT replay, not recovery of hidden reasoning or a validated detector.Source: §1 · pp. 3–4

2 Shared Geometry, Distinct Behavioral Questions

The paper separates changes in representation from their effects on a chosen response: shared scalar geometry can support prediction without determining a shared failure direction. It connects clean decision reserve, transformations through an internal window, and signed readout alignment while distinguishing semantic-rewrite failures from fixed-CoT cue effects.

2.1 Paired computations and response-specific outcomes

  • The two axes share a paired-computation decomposition but measure different outcomes: answer-margin failures for rewrites and target-score contrasts and intervention effects for fixed-CoT cues.A positive cue-score effect is not inherently an error, and the rewrite failure classifier is not used as a hidden-CoT detector.Source: §2.1 · p. 4

2.2 Clean reserve and the unsuccessful first-order boundary account

  • At 50% depth in Qwen, the first-order boundary score reached AUROC 0.683, below clean margin alone (0.869); adding observed displacement gain raised AUROC to 0.907.These results reject this particular mid-layer approximation, not local derivatives in general, and motivate measuring the intervening trajectory.Source: §2.2 · p. 4

2.3 Historical scalar coordinates and the fitted risk score

  • The compact risk score combines clean margin, incoming displacement, and stabilized window gain; fitted associations link greater reserve with lower risk and larger displacement and transmission with higher risk.The observed gain ratio is not an operator norm or robustness certificate, and safe rewrites need not contract.Source: §2.3 · p. 5

2.4 Exact decomposition of the window update

  • An exact longitudinal-transverse decomposition exposes directional information discarded by scalar gain; transverse magnitude and orientation are undefined when their normalizing displacement is zero.An opposing update component or negative longitudinal coefficient alone does not establish behavioral stabilization or contraction.Source: §2.4 · p. 5

2.5 Why equal gain need not imply equal behavioral effect

  • Endpoints with the same incoming displacement, longitudinal coefficient, and transverse magnitude can have the same gain yet produce different values under a readout with a transverse component.This proposition establishes a mathematical possibility; orientation-swap experiments test whether it matters in the studied models and cohorts.Source: §2.5 · p. 6

2.6 From orientation to signed readout alignment

  • Signed readout alignment describes a direction’s local, response-specific consequence, but differentiability and local smoothness do not guarantee finite-patch agreement or an average positive effect.The fixed-CoT local model does not identify a special semantic circuit or establish that a restricted patch equals changing the full prompt.Source: §2.6 · p. 6

2.7 What is shared, and what is not

  • Held-family prediction and small incremental value of family indicators support shared measurement coordinates empirically, not conditional independence, scalar sufficiency, or common underlying circuits.The refined account allows family-specific trajectories, model-specific windows, and example-specific directions.Source: §2.7 · p. 7

3 Experimental Design and Evidence Chronology

The experimental program combines paired MMLU rewrites, ReClor transfer and intervention studies, and a fixed-CoT cue study, with cohorts and analysis stages kept distinct. Its evidence includes held-family/item prediction, inherited or reused stimuli and rules, and later experiments that separate frozen tests from exploratory or post hoc analyses.

3.1 Historical paired MMLU cohort

  • The historical cohort pairs 500 MMLU questions with six RUPBench transformations; Qwen has 2,394 variant rows and 193 failures, while Gemma has 2,568 rows and 185 failures.Only clean-correct items enter these counts; the passage flags a separate task-validity sensitivity analysis.Source: §3.1 · p. 7

3.2 Predictive evaluation and window selection

  • Held-family and held-item splits exclude test-item variants and the held-out family from training, but the depth-selected windows were not independently nested within every prediction fold.Thus the splits control score fitting, not window-selection externality; bootstrap resampling preserves dependence among variants.Source: §3.2 · p. 7

3.3 Original ReClor construction and transfer studies

  • ReClor contains 707 AI-screen-approved rewrites of 250 questions, not certified semantic equivalents; later fixed-rule replication reuses this cohort and inherits MMLU choices.The text was frozen before initial target evaluation, but the later replication is not a fresh, untouched-cohort confirmation.Source: §3.3 · pp. 7–8

3.4 Intervention eligibility, controls, and analysis units

  • Intervention eligibility is determined from natural states and requested edits before edited logits, with matched feasibility rules and prespecified ReClor contrasts.The ReClor replication’s small sample and feasibility selection limit precision; its protocol does not rescue infeasible experiments by relaxing tolerances or replacing seeds.Source: §3.4 · p. 8

3.5 New finite-effect and component experiments

  • The new Qwen experiments use 601 clean-correct pairs from 213 old ReClor items, while the separate acquisition excludes all 250 old items and provides 702 approved rewrites.Option-order tests reuse the new rewrites with clean references recomputed per layout; none of the new failure cohorts meets the frozen 20-item-per-family interpretive threshold.Source: §3.5 · p. 8

3.6 CoT-monitorability cohorts and frozen chronology

  • The MonitorBench cross-domain cohort contains 348 continuations from 82 math and health bases; the frozen positive-mean causal criterion fails, while signed patch-effect accuracy was selected post hoc.The studies were staged rather than jointly preregistered, and CoT outcomes are not pooled with semantic-rewrite failures.Source: §3.6 · p. 9, Table 1 · p. 9

4 Axis I: Predicting Semantic Fragility

A compact score combining clean margin, incoming displacement, and local gain predicts rewrite failures across held-out Qwen families and items, with related but model-specific behavior in Gemma and ReClor. Direction-sensitive trajectories and prospective screening further qualify the scalar account: they reveal informative within-item structure, but do not establish a universal layer location or complete explanation of natural failures.

4.1 A late predictive transition in Qwen

  • At L54, the compact Qwen score reaches AUROC 0.953; grouped item-disjoint out-of-fold AUROC is 0.952.Family intercepts and interactions change the grouped score to 0.951 and slightly worsen log loss, from 0.1493 to 0.1499.Source: §4.1 · p. 10
  • The historical depth scan selected Qwen’s later intervention window, but it was not a separately nested window-selection test.Held-family/item prediction controls score fitting, not the historical window selection itself.Source: Figure 2 · p. 10

4.2 Within-question discrimination beyond clean difficulty

  • Within 625 failed–successful pairs from the same question, incoming displacement, local gain, and their standardized sum have concordances of 0.680, 0.778, and 0.814.Conditional logistic odds ratios are 2.54 for log incoming displacement and 5.46 for log gain; both associations remain large with family indicators.Source: §4.2 · p. 11

4.3 Retrospective semantic-validity sensitivity analysis

  • After preliminary screening, 221 retained rows contain 19 failures, and discrimination changes little; screening rejects compound, it-cleft, and wh-cleft examples.For checklist and stress, the failure-rate Wilson 95% interval is [5.95%, 14.91%], while mean predicted risk is 7.96% versus 9.52% observed.Source: §4.3 · p. 11

4.4 Replication at a different depth in Gemma

  • Gemma’s compact L38–45 score reaches approximately 0.910, matching its best trajectory model; its useful transition occurs earlier than Qwen’s.Adding family identity reduces item-disjoint AUROC from 0.910 to 0.905, supporting portability of the measurement structure rather than a universal layer fraction.Source: §4.4 · pp. 11–12, Figure 3 · p. 12

4.5 Frozen MMLU-to-ReClor prediction

  • On ReClor, Qwen’s ratio score has AUROC 0.926089 versus 0.956140 for clean margin, while its endpoint form reaches AUROC 0.978155.Gemma’s ratio and endpoint AUROCs are 0.934041 and 0.968897; transfer is useful but parameterization-dependent, and both ratio scorers overestimate mean risk.Source: §4.5 · pp. 12–13

4.6 Natural trajectories: what the gain association contains

  • At L52–54, within-item transverse energy differs by 0.3843 between failed and safe rewrites, versus 0.4408 for squared gain; their ratio is descriptive, not mediation.A displacement- and length-matched comparison retains 32 items and 38 pairs, with differences of 0.3098 and 0.3519; the pattern reverses at L54–56.Source: §4.6 · p. 13

4.7 Prospective use without candidate-answer feedback

  • Behavior-blind search on 241 unused clean-correct items yields 20.02% failures versus 2.49% in frozen low-risk controls, an 8.04-fold enrichment.The final beam’s AUROC is 0.886; no reusable new linguistic family was frozen or discovered.Source: §4.7 · p. 14

5 Axis I: Directional Causal Tests

This section tests whether perturbation direction affects behavior beyond scalar geometry, using endpoint patches, naturally propagated entry interventions, and finite-readout analyses. Natural paired directions carry local causal information beyond tested random and same-letter controls in selected cohorts, especially among failures, but the effects are context-dependent rather than layout-invariant.

5.1.2 Equal-norm direction controls

  • Clean-directed endpoint correction improved Qwen gold margin by 2.153 and rescued 51.4% of failures; absolute-norm-matched correction had its largest mean improvement at L54, 0.465.Random and orthogonal updates improved margin by 0.013 and −0.005, respectively. Historical contraction slopes were positive in all six families, but direct endpoint patching does not establish that the natural window implements the correction; the L54 result localizes sensitivity only for the tested intervention.Source: §5.1.1 · pp. 14–15, §5.1.2 · p. 15, §5.1.3 · p. 15

5.2.2 MMLU direction sensitivity

  • At L52–54, Qwen orientation swaps yielded a +1.702 signed bidirectional effect and rescued 33 of 44 failed receivers, versus approximately 38.6% rescue for matched random controls.Swapping failed-donor directions into safe receivers induced failure in 34.1%, versus approximately 1.1% for matched random controls. These eligible, within-item swaps show sensitivity beyond matched scalar coordinates, not a global safe direction or a naturally computed mechanism.Source: §5.2.2 · p. 17

5.2.3 Fixed-rule ReClor replication

  • On seven eligible ReClor items, the fixed-rule orientation swap signed bidirectional effect was +1.161, positive on all seven items.Actual swaps rescued five of seven failed receivers and caused two of seven safe receivers to fail; the small, previously used cohort does not establish precise population effects or broad task universality.Source: §5.2.3 · p. 17

5.2.4 Longitudinal–transverse magnitude interventions

  • In the 17-item MMLU magnitude comparison, the transverse-minus-longitudinal contrast was +0.2243, with the relative transverse advantage primarily visible on failed receivers.The ReClor magnitude comparison was unavailable because no groups met frozen feasibility rules; it is not a zero effect. The MMLU responses are finite responses, not rescue rates or proof that longitudinal magnitude has no causal role.Source: §5.2.4 · p. 18, §5.2.5 · p. 18

5.3.1 Changing the entry changes the unpatched downstream state

  • In Gemma, full L38 entry replacement reduced mean downstream D45 by 11.924738 and rescued four of 24 failures, while same-family correction directions were more aligned than cross-family directions.Mean within-family cosine was 0.472478 versus 0.335542 cross-family, indicating shared and family-specific structure—not a universal restoring vector. The entry intervention changes downstream representation and behavior, but does not identify a unique pathway or mediator.Source: §5.3.1 · p. 18, §5.3.2 · p. 18

5.3.4 Downstream suppression does not imply categorical recovery

  • With matched Gemma entry geometry, the cross-family empirical-minus-mirror contrast in D45 reduction was −1.502431, and mirrors suppressed D45 more on 38 of 48 targets.Discrete recovery did not follow the same ordering: cross-family empirical conditions rescued 5/96 donor-conditioned trials and mirrors 3/96. Thus donor directions were not privileged stabilizers under this match, and displacement suppression did not imply categorical recovery.Source: §5.3.4 · p. 19, §5.3.3 · p. 19

5.4 Finite Readout Effects and the Limits of a Single-Position Replay

  • On ReClor, path integration reduced mean absolute local-patch approximation error by 0.0453 margin units, but the remaining defect was 0.1300 and natural-prompt discrepancy exceeded one-point local error by 0.2188.The analyses use a fixed clean-worst-competitor margin; the local-patch and natural-prompt contrasts are distinct comparisons, not uniquely identified neural pathways. Reference-assisted failure ranking improved, but requires clean references, paired activations, and clean readout gradients.Source: §5.4 · pp. 20–21, Table 9 · p. 20

5.5 Natural Window Propagation and an Initially Negative Component Test

  • Across 601 ReClor pairs, exchanging the L52 entry vector left a 0.4774 mean relative gap from the natural endpoint difference, and context-arm margin response exceeded entry-arm response by 0.2441.L54 was measured without patching; the single entry vector therefore left substantial endpoint information unspecified. The subsequent component scan recomputed the suffix and matched update norm and component norm, but did not hold endpoint displacement, window gain, or full residual-state norm fixed.Source: §5.5 · p. 21
  • Component restoration reduced exit displacement by 5.7189 [5.2490, 6.2460] (10.49% [9.87%, 11.18%] relative), but all primary intervals included zero and no untreated failure was strictly rescued.The reduction in displacement was therefore not sufficient to establish an average answer benefit in this cohort.Source: §5.5 · pp. 21–22

5.6 A Failure-Conditioned Follow-Up Rule

  • The failure-conditioned rule selected components for positive repair and damage effects in both source families, abstaining when coverage gates failed.The discovery scan found L54.attn’s bidirectional score was 1.1797 [0.8125, 1.5469] among untreated failures, versus 0.0452 over the full cohort; its repair edit strictly rescued two of eleven failures. Correct rewrites with decreasing versus increasing margins had descriptive scores of 0.3751 [0.2952, 0.4591] and −0.4000 [−0.5114, −0.2972], respectively.Source: §5.6 · p. 22

5.7 Frozen component validation on disjoint original items

  • Own paired corrections strictly rescued 13/27 natural failures, while 108 matched random draws rescued none; the positive failure-conditioned result supports a local effect, not a generally beneficial intervention.The all-clean-correct family scores were −0.017, 0.106, and 0.091 for grammar, irrelevant insertion, and lexical paraphrase, with all adjusted intervals including zero; each family had only six to eleven failure items.Source: §5.7 · p. 23

5.8 Option-order and answer-letter controls

  • Own corrections strictly rescued 16/37 failure conditions (43.2%), versus 0/148 random, 10/148 same-letter, and 4/148 different-letter draws; all six planned contrasts were positive.The intervention used the current order’s paired clean reference, and the family event counts remained below the prespecified interpretive threshold of twenty.Source: Table 12 · p. 24, §5.8 · p. 25
  • Among the 32 rewrites that failed in any option order, 28 failed in exactly one, so failure-conditioned advantages do not establish a universal mean benefit.All-common-clean own-minus-same-letter scores were −0.038 for grammar, 0.123 for irrelevant insertion, and 0.103 for lexical paraphrase; the grammar interval included zero. A stale original-order reference selected the old gold letter in 400/1,614 changed-order conditions, but its update norm was a median 5.15 times the matched own update.Source: §5.8 · p. 25

5.9 Bridge to the monitorability axis: consequential relative to what?

  • The monitorability axis measures both direction and alignment with an explicit readout, asking what directional changes are consequential relative to.Its reference is a matched lexical prompt and its intervention is additive and transverse; the decomposition transfers, not the original classifier or an assumption that all transverse changes are harmful.Source: §5.9 · p. 25

6 Axis II: Measuring Influence Not Disclosed in CoT

The second axis measures cue influence on fixed recorded reasoning rather than answer fragility, separating text disclosure, prompt-score contrast, and localized causal effects. Its results are conditional on the chosen lexical reference and do not recover private reasoning.

6.1 Nondisclosure is an observation, not an intent label

  • 348 of 690 reviewed continuations were labeled not disclosed, forming the reported fixed-CoT cohort rather than an estimate of hidden-reasoning prevalence.The label describes recorded text and does not establish covert reliance, intent, or an internal reasoning process.Source: §6.1 · p. 26

6.2 Fixed reasoning and exact-target lexical control

  • The fixed-CoT comparison replays the same recorded reasoning and target prefix under a standard cue versus an exact-target lexical control.The historical name Usemantic denotes this specified contrast, not a purified estimate of all semantic influence.Source: §6.2 · p. 26

6.3 Target-position geometry and signed sequence attribution

  • Target-position alignment defines the sequence attribution: it projects a paired transverse representation difference onto the gradient of the mean target-sequence response.The gradient is evaluated at the lexical-reference computation; target-length normalization is already included.Source: §6.3 · pp. 26–27

6.4 Localized causal intervention and controls

  • The localized intervention patches selected endpoint positions while holding the lexical prompt, recorded CoT, target prefix, and unpatched layer-b states fixed.The idealized derivative at α = 0 equals Jtrans,seq; finite-dose effects are measured rather than assumed, and α = 0 is a no-op.Source: §6.4 · p. 27

6.5 Analysis unit and four noninterchangeable quantities

  • The analysis asks whether prompt contrast covaries with internal attribution, whether attribution predicts a finite patch response, and whether that response has a common population sign.These are distinct tests, not interchangeable evidence.Source: §6.5 · pp. 27–28
  • The design treats attribution–contrast association, attribution–patch agreement, and population effect sign as separate quantities, with repeated continuations averaged by base.Math and health receive equal weight in macro estimates, and bootstrap resampling uses bases rather than continuations.Source: §6.5 · pp. 27–28

7 Axis II: Causal Effects and Cross-Domain Tests

The fixed-CoT cue study finds cross-domain associations between response-aligned attribution and prompt contrast, but its frozen positive-mean causal criterion fails. A post hoc signed analysis predicts patch-effect direction, while remaining distinct from the original confirmatory test.

7.1 Logic development: a positive response, with incomplete specificity

  • In logic development, the transverse α = 1 patch changed mean target-token log probability by +0.007032, while the transverse-minus-random interval included zero.The development evidence supports a graded response but not every desired specificity comparison.Source: §7.1 · p. 29

7.2 Frozen math/health association with the prompt contrast

  • 0.433554 was the equal-domain Fisher aggregate correlation between Jtrans,seq and Usemantic across math and health, with a positive direction in both domains.The frozen observational gate passed, but the causal criteria did not.Source: §7.2 · p. 29

7.3 The original positive-mean causal criteria fail

  • The frozen positive-mean causal criteria failed: both core and full confirmatory flags remained false.At α = 1, the point effect was −0.004399 on math and +0.0000428 on health, so the failure was not merely an aggregate interval around two positive domain means.Source: §7.3 · p. 29, Table 14 · p. 30

7.4 Signed attribution and finite-step patch effects

  • 0.979806 was the equal-domain Fisher aggregate correlation between Jtrans,seq and actual transverse α = 1 patch effects in math and health.This close derivative-to-intervention relation is distinct from the more moderate association with Usemantic.Source: §7.4 · p. 30
  • 89.02% accuracy (73/82 bases) was achieved by the post hoc signed rule predicting finite transverse patch-effect signs.The zero-threshold rule correctly predicted 19/20 math-base signs and 54/62 health-base signs; this refinement does not retroactively pass the frozen test.Source: §7.4 · pp. 30–31, Table 15 · p. 31

7.5 What the second axis adds to the paper

  • The fixed-CoT axis measures localized signed readout influence in a nondisclosed-text cohort, not a universal increase in target probability or proof of covert cue use.The conclusion is conditional on fixed-CoT replay and the selected lexical reference.Source: §7.2 · p. 29, §7.5 · p. 31

8 Related Work

The related work situates semantic fragility, cue monitorability, causal localization, and local sensitivity while distinguishing this paper’s measurements from established bounds, monitor scores, and steering methods.

Linguistic robustness and representation change

  • Semantic fragility asks why some language-induced representation movement changes an answer while other movement is tolerated, beyond scalar gain.The analyses do not replace semantic validation of input pairs.Source: §8 · p. 32

CoT monitorability and nondisclosed influences

  • The fixed-continuation cue contrast and localized patch distinguish recorded disclosure from measured influence, rather than scoring monitorability or recovering private reasoning.This builds on the MonitorBench cue-answer setting [9].Source: §8 · p. 32

Causal localization and activation steering

  • The paper separates fixed-scalar orientation swaps, entry-geometry-matched mirrors, and signed target-position patches as distinct diagnostic interventions.Prior work covers causal tracing [5], activation-patching design [14], and activation steering [7]; these experiments are not one interchangeable steering method.Source: §8 · p. 32

Margins and local sensitivity

  • The observed gain ratio is not a Lipschitz bound, and the directional-derivative identity is elementary calculus rather than a new transformer theorem.Finite-replay path integration tests local patch approximation, while the larger natural-prompt discrepancy remains.Source: §8 · p. 32

9 Discussion: What Connects Fragility and Monitorability?

The discussion links answer fragility and fixed-CoT influence through shared measurement questions, not a shared error label or universal failure mechanism. Predictive relations and local directional effects support a bounded account whose signed refinement and practical use remain limited.

9.1 A common sequence of questions, not a common error label

  • The two axes share questions about paired representations, transformations through a window, and consequences for a chosen response, but not assumptions, prompts, responses, or labels.The hidden-CoT axis measures controlled internal influence rather than substituting answer labels or rationales for it.Source: §9.1 · pp. 32–33

9.2 Why the sign refinement matters for both axes

  • A transverse component can raise or lower a target score, so magnitude alone cannot encode whether the change is desirable or crosses a gold-answer boundary.This sign refinement does not erase the failed positive-mean criterion; its target was adopted after that failure and awaits independent replication.Source: §9.2 · p. 33

9.3 What is shared across tasks and models

  • Held-family prediction and frozen ReClor evaluation support useful predictive relationships, while matched interventions support sensitivity to specified directions.These convergence levels do not identify the same circuit, learned operator, or hidden-state basis across architectures.Source: §9.3 · p. 33

9.4 Local directional information is not an invariant failure vector

  • Same-answer-letter donors have weaker effects than the paired direction under tested component geometry, supporting local input-specific directional information.Most affected rewrites fail in only one option layout, and each intervention recomputes the clean reference for its current layout; an invariant failure direction remains unestablished.Source: §9.4 · p. 33

9.5 From a diagnostic to a monitor

  • The sign task predicts patch-effect direction on a selected nondisclosed cohort; it is not hidden-reasoning detection accuracy or evidence of superiority to text monitoring.A usable monitor would require a defined detection target, suitable negative cases, a threshold, and false-positive and false-negative evaluation.Source: §9.5 · p. 34
  • These methods require paired references, internal activations, and readout gradients, making them controlled diagnostics rather than a deployable system.The semantic analysis also uses gold-defined readout gradients, while the CoT axis uses fixed continuations.Source: §9.5 · p. 34

10 Limitations

The evidence is concentrated in multiple-choice rewrite analyses and specific intervention settings, with several selection, measurement, and audit constraints. The fixed-CoT study measures prompt effects on recorded reasoning, not hidden-reasoning recovery.

Stimulus validity and different tasks

  • Rewrite analyses focus on MMLU and ReClor multiple-choice tasks, and semantic preservation is not independently established across the completed results.The new acquisition uses a generator and reviewer sharing a checkpoint, without an independent blinded semantic audit; CoT cue conditions are not semantic-equivalence interventions.Source: §10 · p. 34

Chronology, selection, and precision

  • Historical window selection was not nested within prediction folds, and small failure cohorts and reused items limit precision and independent confirmation.The new component rule was frozen for a disjoint 250-item cohort, but that cohort has 21 failure items; cyclic orders and donor draws do not create independent original items.Source: §10 · p. 34

Fixed-CoT inference

  • Fixed-CoT inference does not recover hidden reasoning or establish what caused the original rationale, free-running answer changes, or monitor deception.Only localized patch-effect sign prediction is quantified; no hidden-CoT detector is evaluated.Source: §10 · p. 34

Partial states, nonlinear response, and numerical precision

  • Single-position prompt-token patches and specified target-prediction-position patches do not isolate a unique mediator of the whole prompt effect.Finite-dose longitudinal and transverse effects need not add, and numerical matching is approximate; zero feasible ReClor magnitude groups make that comparison unavailable, not null.Source: §10 · pp. 34–35

Cross-model coverage and applications

  • Gemma does not replicate every Qwen intervention, while the additional applications do not independently confirm the second axis.Behavior-blind search is Qwen-specific and uses an automatic semantic gate; Gemma's separate CoT signed-effect study has no completed result included here.Source: §10 · p. 35

Evidence recovery

  • The revision integrates completed records but does not resolve raw-data audit requirements for some inherited historical values.Some historical intervention values remain in prior summaries because their original archives were not re-openable.Source: §10 · p. 35

11 Conclusion

The paper concludes that heterogeneous input changes can share useful predictive relationships without sharing a universal causal direction. Historical family and depth statistics are summarized in tables, whose captions specify scope but not outcome values.

11 Conclusion

  • Shared reserve, displacement, and gain relationships predict semantic failures, while matched interventions show that scalar summaries omit consequential orientation.Path integration improves local finite-patch description but leaves a substantial gap to the full natural input effect; a frozen component rule repairs a subset, and own-direction controls outperform tested random and same-letter donors.Source: §11 · p. 35
  • Most failing rewrites fail in only one tested option order, and current-order repair requires a newly computed clean reference.The results do not establish an order-invariant failure vector, clean-free detector, or general repair method; the fixed-CoT positive-mean causal criterion fails and signed-effect prediction remains post hoc.Source: §11 · p. 35

A Historical Family and Depth Statistics

  • Table 16 summarizes historical failure rates by family on model-specific clean-correct items, while Table 17 reports strict mean LOFO AUROC by probe endpoint.Table 16 notes that published transformations are not all independently verified semantic equivalents; Table 17 defines the compact probe as clean margin, preceding displacement, and local gain.Source: Table 16 · p. 37, Table 17 · p. 37

B Earlier Trajectory Diagnostics and Causal Details

Earlier diagnostics test trajectory-based prediction and clarify limits of single-position and finite-intervention interpretations. A separate behavior-blind search tests whether a frozen score can prioritize fragile rewrites before candidate outcomes are known.

B Earlier Trajectory Diagnostics and Causal Details

  • At 50% Qwen depth, adding observed mid-to-final displacement gain to clean margin and mid-layer displacement raises AUROC to 0.907, while the boundary ratio reaches 0.683.The pre-final trajectory score reaches 0.937 AUROC, but these are theory-development diagnostics rather than independent confirmations of the final selected window.Source: B Earlier Trajectory Diagnostics and… · p. 37

C Context Dependence of a Single-Position Probe

  • The exact decomposition separates a single-position intervention contrast from a remaining-context contrast, and neither the context term nor nonlinear remainder is assumed to vanish.The decomposition formalizes why replacing one position may not recover the clean answer; it does not empirically attribute residual effects to a named pathway.Source: C Context Dependence of a… · p. 38

D Magnitude Factorial Estimands

  • The magnitude factorial defines finite-intervention contrasts with receiver orientation fixed, not intrinsic model derivatives or a decomposition of natural causal responsibility.The reported 17-item equal-dose result does not establish valid natural-dose factorial cells, and zero feasible ReClor magnitude groups yield no corresponding effects.Source: D Magnitude Factorial Estimands · pp. 38–39

E MonitorBench Outcome and Estimand Checklist

  • The fixed-CoT outcome checklist reports signed-classifier confusion counts, while its table distinguishes aggregate correlation quantities that must not be interchanged.A zero sign threshold does not remove post hoc choice of the analysis target, and near-zero values raise numerical-stability concerns.Source: E MonitorBench Outcome and Estimand… · p. 39, Table 19 · p. 39

F Prospective Search Beyond a Fixed Perturbation Taxonomy

  • The prospective Qwen search tests instance-level enrichment before revealing candidate outcomes, but does not discover a reusable new linguistic family.The candidate-behavior-blind protocol freezes the score and search decisions before reveal; 241 clean-correct MMLU questions were absent from historical fitting data.Source: F Prospective Search Beyond a Fixed… · p. 39, §F.1 · pp. 39–40

F.1 Candidate-behavior-blind protocol

  • The blind protocol gates and recursively ranks natural rewrites without using candidate behavior or geometry, retaining four candidates per item at each beam stage.Two low-risk initial candidates per item are frozen as controls, and the completed archive contains 25,691 scored candidates.Source: §F.1 · p. 40

F.2 Failure enrichment after frozen reveal

After the search was frozen, the final beam showed higher failure rates than low-risk controls, and the frozen score remained informative within the beam. The search did not yield a reusable new perturbation family.

F.2 Failure enrichment after frozen reveal

  • 20.02% of final-beam candidates failed versus 2.49% of low-risk controls, an 8.04-times relative enrichment after outcome reveal.The item-cluster interval for the absolute difference is approximately [13.5, 21.7] percentage points; counts are selection memberships, not independent observations.Source: §F.2 · p. 40, Table 20 · p. 40
  • Failure rates rise from 0.36% in the lowest frozen-risk bin to 57.40% in the highest, but these selected-bin rates are not population prevalence estimates.Selection intentionally enriches both risk extremes.Source: §F.2 · p. 40
  • Within the final beam, failures have lower mean clean margin, larger incoming displacement, and higher local gain than non-failures.These associations support the frozen search criterion but do not establish scalar-score causal sufficiency.Source: Table 21 · p. 40, §F.2 · p. 41

F.3 No new perturbation family was discovered

  • Blind lineage analysis finds no clean cross-item rule, so no new family was frozen before reveal.The experiment cannot distinguish a failure boundary crossing linguistic forms from limits of the proposal distribution or surface clustering; it is Qwen-specific and uses automatic semantic gating.Source: §F.3 · p. 41

G Exploratory Procedure Steering in Code Generation

The exploratory code-generation study uses saved Gemma 4 31B generations to examine whether a benign metaphorical skill shifts procedure choice. Gain and a fixed reserve-and-transmission model show predictive signal, but the evidence is small and suggestive.

G Exploratory Procedure Steering in Code Generation

  • AUROC 0.668 for gain alone (one-sided Mann–Whitney p = 0.013); the fixed reserve-and-transmission model reaches 0.591 versus 0.386 for reserve alone.The fixed model uses procedure reserve, displacement, and gain across the L38–45 window.Source: G Exploratory Procedure Steering in… · p. 41
  • The dataset contains 77 records, with 20 positive under the broad procedure-shift label.Five no-skill generations define the procedure reserve.Source: G Exploratory Procedure Steering in… · p. 41
  • The sample is small, calibration is poor, and labels rely on offline static LLM judging rather than program execution or replay of the original judge.The evidence does not establish program correctness, runtime increases, or unqualified transfer of the MMLU scalar law.Source: G Exploratory Procedure Steering in… · p. 41

H Reproducibility and Evidence Status

The revision distinguishes archived or retained evidence from newly recomputed results and records limits on historical reconciliation. Supplementary readout checks find strong aligned-versus-orthogonal sensitivity within a numerically feasible cohort, but their reference access and coverage constrain interpretation.

H Reproducibility and Evidence Status

  • The revision incorporates completed semantic-fragility experiments into the manuscript but performs no new target-model inference; evidence checks draw on archived outputs and saved-logit reanalyses.The new-item and option-order controls use independent saved-logit reanalyses.Source: H Reproducibility and Evidence Status · pp. 41–42
  • The archive includes saved outputs and analyses, but large activation caches are omitted, so vector-level acceptance checks are not all independently remeasured.The direction-transport implementation has no completed target-model result in this revision.Source: H Reproducibility and Evidence Status · p. 42
  • Historical results are retained rather than presented as newly recomputed; some older intervention figures came from summaries, and records remain subject to reconciliation.Older bootstrap contrasts are kept distinct from mean-LOFO differences because their aggregation mapping is not established.Source: H Reproducibility and Evidence Status · p. 42
  • The fixed-CoT positive-mean criterion remains failed and its 73/82 signed-effect result remains post hoc; prospective search found instance-level enrichment without a reusable linguistic family.The unavailable original ReClor magnitude comparison remains unavailable rather than null.Source: H Reproducibility and Evidence Status · p. 42

I Supplementary Reference-Assisted Readout Checks

  • Only 65 of 601 requested groups passed numerical eligibility, from 56 original items; the directions were constructed from the readout gradient, not natural rewrites.No dose enlargement or outcome-based seed replacement was used.Source: I Supplementary Reference-Assisted… · pp. 42–43
  • 2.3828 aligned signed central response versus 0.0123 orthogonal response; the aligned-minus-absolute-orthogonal contrast is 2.3292 in the feasible cohort.The aligned response interval is [2.2466,2.5352], the orthogonal interval is [−0.0067,0.0318], and the contrast interval is [2.1886,2.4710].Source: I Supplementary Reference-Assisted… · p. 43
  • Reference-assisted ranking retains inference-time access to clean computation, gold-defined margins, and gradients, so it is a controlled diagnostic rather than a detector evaluated without clean references.The held-out-family and original-item exclusion applies to score fitting, not inference-time access.Source: I Supplementary Reference-Assisted… · p. 43

Related papers

Loading 2610.32309v1…