{"id":"87820130-31aa-43e7-b875-2d6c9f76a522","arxiv_id":"2607.25532","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"In-context learners route predictions through a spurious component inside a composite feature whenever that component correlates with the label, and the routing persists as context grows.","lead":"This paper shows that in-context learning models, including TabPFN, lean on a spurious signal hidden inside a measured feature when that signal correlates with the outcome in the training context, even though the signal is not causal. It proves the effect for linear ridge in-context learners, measures it with a new sensitivity ratio, and proposes context-construction fixes.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The core impossibility result is proven only for ridge ICL under A2; the general claim about in-context learners rests on a single TabPFN demonstration, and the paper's own S-swap shows routing is avoidable with context changes.","rationale":"The reader identified A2 (orthogonality) as the weakest assumption; I partially agree, since without A2 the closed-form weights and the impossibility proof do not follow, and the paper's real-world applicability depends on estimating the C/S split. However, the more load-bearing gap is the leap from ridge ICL to general in-context learners. The theorem is sound in its stated scope, but the paper's broad language ('in-context learners cannot avoid') is supported only by TabPFN, a single model with no reported uncertainty in the key tables. The paper's own S-swap result directly shows that a change in context construction makes TabPFN avoid S, so the impossibility is not a fundamental property of in-context learning. Additionally, the introduction's OOD-recovery claim is internally contradicted by TabPFN results, which weakens confidence in the paper's framing. These issues justify keeping the conditional verdict: the theoretical core is correct, but broader claims and the OOD narrative need revision.","tokens_in":21462,"tokens_out":19427,"duration_ms":195473,"concrete_test":"Run TabPFN on the high-spurious corner (ρS=0.7, ρC=0.3, α=1) for 10 independent seeds and report mean±std CSR and OOD RMSE for standard, env-stratified, and S-swap contexts; check whether the reported numbers (5.777 / 3.539) are within noise. Separately, train a small transformer from scratch on tasks drawn from the same DGP but with the spurious correlation sign flipping across training environments, and measure CSR on a held-out task; if the transformer can learn to ignore S (CSR<1) when the context supports such inference, the 'unavoidable' claim is false for general ICL.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The central theorem (Prop. 2 / Cor. 2) is a correct statement about population ridge regression under A1–A3: with orthogonal C and S, w*_S = αρ_S/(α²+λ) ≠ 0. But this is a statement about a specific linear estimator, not about 'in-context learners' broadly. The paper's own Limitations (§7) concede that the closed form does not extend to TabPFN and that a nonlinear estimator could in principle recover identifiability. The empirical bridge is a single pretrained TabPFN, and the main tables (Tables 1–3, 6) report no error bars, so we cannot assess whether r=0.979 is statistically robust. The introduction's claim that S-swap 'recovers out-of-distribution accuracy' is contradicted by the paper's own Table 6 (TabPFN OOD RMSE 3.539 under S-swap vs 3.486 standard) and Table 9 (S-swap OOD worse than env-stratified in all settings). Finally, the S-swap result (CSR 0.067) itself shows that routing is avoidable when the context is designed to break the S–Y correlation; 'unavoidable' holds only for the specific standard-context setting. Thus the broad conclusion that ICL fundamentally cannot avoid spurious routing is under-supported.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper studies a failure mode it calls spurious routing in composite representations: an observed feature X=[C; alpha S; eta] bundles a causal signal C and a spurious signal S in distinct subspaces, and an in-context learner (ICL) trained on a confounded environment may predict through S rather than C. The main theoretical result, Proposition 2, derives a closed-form expression for the Causal Sensitivity Ratio (CSR) under population ridge ICL with orthogonal C and S (Assumptions A1–A3): CSR_pop = alpha^2/(alpha^2+lambda) * (rho_S/rho_C) * (1+lambda) kappa(delta), and Corollaries 1–3 conclude monotonicity, impossibility of avoiding spurious weight for any lambda>0, and persistence as n grows. The paper then reports empirical agreement with this formula for linear ICL (r=0.997) and for the pretrained TabPFN (r=0.979), studies amplification with context size and entanglement, and proposes two context-level mitigations, environment-stratified sampling and S-swap augmentation, reporting large CSR reductions especially for TabPFN. A semi-synthetic scIB pancreas experiment with an estimated spurious subspace is also presented.","tokens_in":21800,"tokens_out":7470,"duration_ms":76670,"significance":"If the result holds, the paper makes a useful conceptual contribution: it identifies a distinct failure mode for in-context learners, gives a parameter-free closed-form diagnostic in a minimal identifiable setting, and proposes model-agnostic interventions that require only weak environment labels. The strengths are the explicitly stated assumptions, the transparent derivation of Eq. (3), the falsifiable predictions tested on a controlled SCM, and the inclusion of a real-data validation with an estimated spurious subspace. The weaknesses are that the impossibility result is proven only for ridge ICL, the empirical bridge to TabPFN rests on a single pretrained model without repeated-seed statistics, and one headline claim about out-of-distribution recovery is contradicted by the paper's own tables. With appropriate scoping and additional empirical support, the paper could be a solid contribution to the ICL and invariant-learning literature.","major_comments":[{"comment":"The introduction bullet and §6 state that S-swap 'recover[s] out-of-distribution accuracy' without knowledge of the causal partition. This is not supported for TabPFN: Table 6 reports TabPFN OOD RMSE 3.539 under S-swap versus 3.486 for standard ICL, i.e. worse, and Table 9 shows S-swap OOD RMSE worse than env-stratified in all five TabPFN settings. Only the linear-ICL results (Table 8) show OOD improvement. The OOD-recovery claim must be scoped to linear ICL or revised, and the text should explicitly address the CSR/OOD divergence for TabPFN.","section":"§6, Tables 6 and 9"},{"comment":"The main empirical tables report no error bars, no number of seeds, and no confidence intervals. The NeurIPS checklist (item 7) says error bars are provided in Section 5, but none appear there; only the scIB table (Table 7/14) includes ± values. Because the paper's quantitative claims — r=0.979 for TabPFN, the 1.74× context-size amplification, and the 98.8% CSR reduction — are single-point estimates, the reader cannot assess their statistical robustness. Please add repeated-seed or bootstrapped intervals for at least the headline numbers and for the context-size sweep in Table 2/10.","section":"§5, Tables 1–3 and 6"},{"comment":"The abstract and introduction state that spurious routing is 'unavoidable regardless of context size' and frame it as a property of in-context learners generally. Corollary 2 and the proof in Appendix A prove this only for ridge ICL under A1–A3, and the paper's own Limitations (§7) concede that the closed form does not extend to TabPFN and that a nonlinear estimator could in principle recover identifiability. Moreover, S-swap itself demonstrates that routing is avoidable when the context construction is changed to break the in-context S–Y correlation. The impossibility claim should be scoped throughout the abstract and introduction to 'the ridge-ICL class with a fixed confounded context distribution.'","section":"Abstract, §1 and §7"}],"minor_comments":[{"comment":"The printed folded-normal formula for E|Z| with Z ~ N(delta, 2) appears to be missing a factor of 2 in the first term: the correct term is 2/sqrt(pi) exp(-delta^2/4), not sqrt(2) phi(delta/sqrt(2)). The numerical value kappa(1.5) ≈ 1.516 cited in the paper is consistent with the correct formula, so this is likely a typographical error, but it should be fixed.","section":"Appendix A.1, Eq. (4)"},{"comment":"Proposition 2 writes X=[C; alpha S] and omits the noise dimensions eta that are present in the Section 3 DGP. The omission is harmless because eta has zero population covariance with Y, but the main text should state this explicitly to avoid an apparent mismatch between the theoretical setup and the experimental setup.","section":"Proposition 2 and §3"},{"comment":"The 'Normalised CSR' column is used in Table 1 for TabPFN but is not defined in the main text; its definition and oracle-ceiling values appear only in Appendix C. A one-sentence definition at first use would help the reader interpret the main result.","section":"Table 1 and Appendix C"},{"comment":"Checklist item 5 answers [Yes] on open access, but the text says only that code 'will be given with the camera ready version'; no code or URL is available at submission. Checklist item 7 answers [Yes] on error bars, but the main tables contain none. The checklist answers should be aligned with the actual submission to avoid overstating reproducibility.","section":"NeurIPS checklist, items 5 and 7"}],"recommendation":"major_revision","confidential_remarks":"The theory in Proposition 2 is correct and clearly presented, but the paper oversells the breadth of the impossibility result and the mitigation's OOD benefit. The empirical support for the TabPFN bridge is thin (no error bars, one model, no released code), and the checklist overstates reproducibility. These issues are fixable within the manuscript's scope, so I recommend major revision rather than rejection."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Here's my honest read. The theoretical core is solid: Proposition 2 gives the correct closed-form CSR for ridge ICL under A1–A3, and the corollaries follow. The assumptions are named and they do visible work. That is a real contribution. The new packaging—composite spurious routing, the CSR diagnostic, and S-swap as a context-level intervention—is also genuinely novel and useful for cross-site deployment. The scIB experiment with an estimated spurious subspace gives the phenomenon independent grounding.\n\nBut the paper oversells. The impossibility result is proven for ridge ICL, not for in-context learners generally; the Limitations section admits this. The only empirical bridge to general ICL is one pretrained TabPFN, which is suggestive but not proof. Worse, the abstract claims S-swap 'recovers out-of-distribution accuracy', yet Table 6 shows TabPFN OOD RMSE worsening under S-swap (3.539 vs 3.486), and Table 9 shows S-swap OOD worse than env-stratified in all settings. That overclaim needs correction.\n\nThe empirical reporting is also thinner than it should be: main tables lack error bars, and no code or commit hash is provided. The r=0.997 for linear ICL is close to definitional because the CSR formula is derived from the same ridge weights; it's a consistency check. The r=0.979 for TabPFN is the number that matters, but without error bars or code I can't assess its robustness.\n\nThe mitigation itself is the strongest part: S-swap reduces CSR by 74% on linear ICL and 98.8% on TabPFN, and the raw sensitivity shifts show rerouting through C rather than collapse to agnosticism. That's a useful practical tool. But it has an OOD cost in the high-spurious regime, which the paper acknowledges in scIB and not in the abstract.\n\nI'd send this to peer review. The theory is right, the diagnostic is useful, and the mitigation is practical. A serious referee should push for a corrected abstract, error bars, released code, and a conclusion that says 'ridge ICL, and empirically TabPFN' rather than 'in-context learners'. With those changes it would be a solid paper. I'd engage with it and probably cite the CSR result.","headline":"Correct ridge-ICL theory and a useful S-swap mitigation, but the OOD-recovery claim and the general-ICL conclusion both outrun the evidence.","tokens_in":22305,"tokens_out":3547,"would_cite":true,"duration_ms":35808,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"An in-context learner provably routes predictions through spurious signals whenever those signals correlate with outcomes inside its context, and no amount of context or regularisation can prevent it — only context-level swaps reroute it th","keywords":["in-context learning","spurious correlation","causal sensitivity ratio","composite representations","ridge regression","dataset shift","context augmentation","confounding"],"falsifier":"Train any in-context learner (ridge or transformer) on the paper's exact DGP — orthogonal C and S, an unobserved confounder U making Corr(S,Y)≠0 in context — and measure CSR via swaps; if any model achieves CSR<1 without environment-stratified contexts or S-swap, the 'unavoidable' claim fails. The authors report only linear ridge ICL and TabPFN; a counterexample model, or a theoretical argument showing w*_S=0 under A1–A3, would settle it.","tokens_in":21341,"feed_emoji":"🔀","tokens_out":5309,"duration_ms":55188,"temperature":0.7,"pith_summary":"The paper studies what happens when a single measured feature bundles a true causal signal (C) with a site-specific artefact (S), and an unobserved confounder makes S correlate with the outcome inside the training context. It proves that for linear ridge in-context learning, routing predictions through S rather than C is unavoidable: the optimal ridge weight on S is non-zero for any regularisation strength, and the spurious routing persists as context size grows without bound. The proof yields a closed-form Causal Sensitivity Ratio, CSR_pop proportional to ρ_S/ρ_C, which matches both linear ICL (r=0.997) and the transformer TabPFN (r=0.979) empirically. Because the failure is invisible in-context, the paper introduces two context-construction interventions — environment-stratified contexts and S-swap augmentation — that break the in-context S→Y correlation and reroute the model toward C, cutting spurious routing by up to 98.8% on TabPFN while increasing causal sensitivity 8.4-fold.","feed_headline":"In-context learners can't avoid spurious routing","feed_subtitle":"Proved formula ties routing to spurious/causal signal; S-swap context tricks cut it by 98.8%","key_machinery":"The central object is the composite representation X=[C;αS;η], where the causal signal C and the spurious signal S live in distinct subspaces and α controls how strongly S is represented. The main formula is the Causal Sensitivity Ratio (CSR), defined as the ratio of mean absolute prediction shift under an S-swap to that under a C-swap, which quantifies which signal the model routes through. The proof machinery is ridge in-context regression (Assumption A1) combined with block-diagonal covariance from subspace orthogonality (Assumption A2), which lets the ridge weights decouple into w*_C and w*_S; substituting these into CSR yields the factorised expression of Proposition 2. The S-swap mitig","core_discovery":"Under the paper's DGP, where each observed feature is X=[C;αS;η] with C and S in orthogonal subspaces and an unmeasured confounder U driving both S and Y, the population ridge ICL weights decouple: w*_C = ρ_C/(1+λ) and w*_S = αρ_S/(α²+λ). This yields the closed-form Causal Sensitivity Ratio CSR_pop = (α²/(α²+λ))·(ρ_S/ρ_C)·(1+λ)κ(δ). The paper's central result is that ρ_S ≠ 0 forces w*_S ≠ 0 for every λ>0 (Corollary 2), and that CSR(ŵ_n) → CSR_pop > 0 as n→∞ (Corollary 3), establishing that spurious routing is provably irreducible by data size or regularisation within the ridge ICL class. Empirically, larger context amplifies routing in the high-spurious regime (up to 1.74×) and more expressi","pith_inferences":["The paper's robustness table suggests a testable extension: batch-harmonisation pipelines that reduce but do not eliminate subspace overlap may intensify routing (mean CSR rises with overlap up to 30–40°), implying that partial artefact removal could be worse than none for in-context learners; full removal would disable the spurious route.","The CSR diagnostic could be inverted into a self-supervised learning objective: parameterise a learned transformation of X into (Ĉ,Ŝ) and minimise CSR over that transformation, turning the metric from an evaluation tool into a training signal that requires only environment labels.","The mechanism should apply beyond tabular ICL: any in-context learner — including large language models given user-supplied examples — should route through spurious cues when a hidden confounder correlates those cues with the label inside the context; a natural test is to construct such a context for an LLM and measure CSR via the same swap protocol.","Because the impossibility result is proven only within ridge ICL (A1), the paper's empirical finding that TabPFN also routes spuriously leaves open whether some non-ridge in-context learner could implicitly model environment structure and avoid routing; if one existed, it would bound the class of learners for which the failure is truly unavoidable."],"forward_implications":["Deployed in-context predictors in multi-site settings (hospitals, sequencing batches) will silently build predictions on site-specific artefacts whenever an unmeasured confounder ties the artefact to the outcome, and collecting more training examples will not fix it.","Regularisation strength is not a remedy: the spurious weight w*_S remains non-zero for all λ>0, and CSR saturates at a positive floor as λ grows, so model designers cannot tune their way out of spurious routing.","The closed-form CSR gives a practical, model-agnostic diagnostic: measuring the ratio of prediction shifts under S- and C-swaps reveals whether a learner routes through spurious or causal signal, and this ranking is robust to decomposition error (Spearman r=0.849 even at 60° estimation error).","Context-level interventions (environment-stratified contexts and S-swap) can recover causal routing without retraining or architectural changes, and S-swap's effect is rerouting rather than agnosticism — TabPFN's causal sensitivity increases 8.4× while spurious sensitivity collapses.","The theory's core prediction — routing magnitude scales with ρ_S/ρ_C — is confirmed with correlation r=0.997 for linear ICL and r=0.979 for TabPFN, and degrades gracefully (r≥0.90) under subspace overlap up to 40°."],"fun_headline_variants":["Spurious routing provably unavoidable in ICL","More context amplifies spurious routing in ICL","S-swap cuts spurious routing by 98.8% in tabular ICL","TabPFN and ridge ICL can't escape spurious signals"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The load-bearing premise is that the causal and spurious signals occupy orthogonal, separately recoverable subspaces within the observed feature (Cov(C,S)=0); if the two overlap in the same coordinates, the closed-form characterisation, the CSR diagnostic, and the S-swap mitigation all lose their footing.","fun_headline_variants_meta":{"raw":{"variants":["Spurious routing provably unavoidable in ICL","More context amplifies spurious routing in ICL","S-swap cuts spurious routing by 98.8% in tabular ICL","TabPFN and ridge ICL can't escape spurious signals"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000237,"raw_usage":{"total_tokens":1466,"prompt_tokens":989,"completion_tokens":477,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":733,"completion_tokens_details":{"reasoning_tokens":404}},"tokens_in":733,"tokens_out":477,"duration_ms":5140,"temperature":1.0,"reasoning_tokens":404,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-01T02:09:03.402370+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train any in-context learner (ridge or transformer) on the paper's exact DGP — orthogonal C and S, an unobserved confounder U making Corr(S,Y)≠0 in context — and measure CSR via swaps; if any model achieves CSR<1 without environment-stratified contexts or S-swap, the 'unavoidable' claim fails. The authors report only linear ridge ICL and TabPFN; a counterexample model, or a theoretical argument showing w*_S=0 under A1–A3, would settle it.","supporting_citations":[],"review_version":1}