{"id":"b4267642-cb45-4bfd-aafa-5d256e71d739","arxiv_id":"2608.03294","paper_version":2,"verdict":"ACCEPT","confidence":"MODERATE","novelty_score":7.0,"correctness_risk":"low","formal_verification":"none","parameter_count":1,"one_line_summary":"Multi-head softmax attention can be provably recovered from black-box scalar value queries in O(H d^2) queries without orthogonal-subspace assumptions, using rational interpolation followed by head matching.","lead":"An algorithm can recover the inner parameters of a multi-head attention layer by sending crafted token sequences and observing only the final scalar output. Recovered parameters are guaranteed to match the original model up to reordering, which matters for model extraction, auditing, and interpretability.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"No significant objection identified; the exact-arithmetic idealization is a stated scope limitation, not an internal flaw.","rationale":"I examined the central claim closely: the derivation of the repeated-token rational function (Lemma 4.1), the interpolation uniqueness (Lemma 4.2), the head-matching via additive identities (Lemma 4.3), and the probability-one nondegeneracy of the random query directions (Appendix B) are all consistent. The query count 4Hd^2 - 2H + 1 follows from 2d^2 - 1 local decoders each using 2H repeated-token queries plus one one-token query, and the maximum length 2H + 1 is correct. The canonical identifiability result (Proposition 3.1) is supported by a clean linear-independence argument for the p_s(t) functions. The finite-precision fragility is real but explicitly scoped: the theorem assumes exact arithmetic, and the paper transparently reports the binary64 collapse. This is a limitation of the application domain, not a defect in the mathematical claim. The reader's weakest assumption identifies the same point, but I do not view it as a reason to alter an ACCEPT verdict, because the theorem is accurate as stated and the paper's own experiments confirm the idealization boundary.","tokens_in":41752,"tokens_out":16803,"duration_ms":168391,"concrete_test":"For a family of models with controlled separation delta = min_{h != g} ||W_h - W_g||_F, compute the condition numbers of the interpolation matrix A(y) in Appendix D and the basis matrices U,Q, then determine the smallest multiprecision working precision needed to achieve E_param < 1e-6; if the required precision diverges as delta -> 0, the exact-arithmetic theorem has no uniform finite-precision counterpart, confirming that the idealization is essential rather than a formality.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central recovery guarantee in Theorem 5.1 rests on the computational assumption of exact real arithmetic, including exact polynomial factorization. This is genuinely load-bearing: the paper's own experiments show that rounding only the oracle responses to IEEE 754 binary64 collapses success from 100/100 to 0/100 for (3,8) and (8,4), even with 180-digit offline arithmetic. However, the assumption is stated explicitly in Section 3, and the theorem makes no finite-precision claim. The high-precision experiments (Table 2) corroborate the exact statement, and I find no internal inconsistency in the rational-interpolation recovery (Lemma 4.2), the head-matching construction (Lemma 4.3), or the probability-one argument in Appendix B. The exact-arithmetic caveat is a scope limitation, not a flaw in the proof of Theorem 5.1.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper studies exact recovery of the parameters of a multi-head softmax attention model from black-box value queries that return only the scalar output at the final token. It defines a canonical representation obtained by merging heads with the same query-key matrix W_h, summing their value vectors, and discarding zero aggregates. It proves (Proposition 3.1) that this canonical representation is identifiable from outputs on length-three inputs, and presents a randomized, nonadaptive algorithm (Algorithm 1) that, under exact oracle responses and exact real arithmetic, recovers every canonical pair (W_h, v_h) up to permutation with probability one, using exactly 4H d^2 - 2H + 1 value queries of maximum length 2H+1 (Theorem 5.1). The algorithm uses repeated-token queries to observe samples of a rational function whose poles and residues encode the per-head contributions, then uses additive identities from summed query directions to assign a common labeling across local decoders, after which linear systems recover the parameter pairs. The paper also proves a conditional stability bound for approximate oracle outputs (Theorem 5.2), shows that no model-independent stability constant exists, extends the recovery to a one-layer ReLU Transformer (Theorem 5.3), and provides variants for a known upper bound on the head count, low-rank W_h, and binary membership queries.","tokens_in":41987,"tokens_out":18431,"duration_ms":176715,"significance":"The result is a substantial advance over the prior art of Bhattamishra et al. (2026), which required pairwise orthogonal head subspaces and known orthonormal bases for those subspaces. The rational-interpolation technique is elegant and the proof chain, including the probability-one nondegeneracy argument in Appendix B and the rational-interpolation uniqueness lemma, appears sound. The paper is unusually honest about its computational model: it explicitly assumes exact real arithmetic and reports its own negative binary64 results. The conditional stability theorem and the lower bound showing that no uniform stability constant follows from the qualitative identifiability assumptions are valuable. The extension to a one-layer ReLU Transformer, while more involved and conditional, broadens the applicability of the query-based recovery approach.","major_comments":[],"minor_comments":[{"comment":"The paper reports that rounding oracle responses to IEEE 754 binary64 collapses the success rate from 100/100 to 0/100 for (d,H)=(3,8) and (8,4) even when offline arithmetic is 180-digit. A brief statement in the main text, rather than only in the appendix, that Theorem 5.1 is an exact-arithmetic statement and that the binary64 results are outside its scope would help calibrate reader expectations.","section":"Section 6 / G.4"},{"comment":"The symbol A is used both for the set of query pairs in (29) and for the interpolation matrix A(y) in (38). This dual use makes the stability proof harder to follow; a different symbol for one of the two objects is advisable.","section":"Appendix D"},{"comment":"The statement assumes exact subsequent computations, but the experiments use 180-digit arithmetic. The paper could note explicitly that the stability bound is a property of the exact algebraic reconstruction and does not by itself account for offline rounding errors.","section":"Section 5, Theorem 5.2"}],"recommendation":"accept","confidential_remarks":"This is a well-executed theoretical paper. The central recovery theorem is proven by a coherent chain of lemmas, and the experiments are honest, including the negative binary64 results. The exact-arithmetic idealization is a clear limitation but is stated explicitly and is standard in this line of work. I see no load-bearing flaw. The paper is a good fit for the journal; I recommend acceptance."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Dear colleague,\n\nHere is my read on arXiv:2608.03294. The headline: this is a genuinely nontrivial advance over the prior single-head recovery framework. It removes the orthogonal-subspace and known-basis assumptions, recovers a canonical merged representation, and gives a clean nonadaptive query bound: 4Hd^2-2H+1 value queries, length at most 2H+1, probability one for the exact-arithmetic oracle. The repeated-token rational interpolation plus additive-identity matching across random bases is the real work, and it holds together.\n\nWhat I like best: the proof is self-contained, and the central chain is coherent. Lemma 4.1's rational-function identity is simple and correct. Lemma 4.2's interpolation uniqueness is exactly right. Lemma 4.3's head-matching argument is sound. Appendix B's probability-one nondegeneracy argument handles the finite family of bad events cleanly. The experiments go beyond a token check: 180-digit arithmetic recovers to error below 10^-100 on all 800 sampled targets, and the controlled-perturbation slopes confirm the linear-in-tau claim. That is real supporting evidence.\n\nThe soft spots, in proportion: the exact-arithmetic assumption is genuinely load-bearing. The paper says so, and its own binary64 experiments show recovery collapsing from 100/100 to 0/100 for (3,8) and (8,4) even with 180-digit offline arithmetic. That makes the title's 'provably' more fragile in practice than a finite-precision reader might hope. But it is not an internal flaw: Theorem 5.1 states its premise exactly, and the approximate-output Theorem 5.2 is an honest local stability result with no uniform constant, which the two-head impossibility construction backs up. The ReLU Transformer extension is more speculative; it requires additional conditions, and the algorithm's termination has no uniform bound. I read these as scope limitations, not contradictions.\n\nThe citation pattern looks appropriate: it builds directly on Bhattamishra et al. 2026 and Tran et al. 2025, and the comparison table is fair.\n\nWho is this for? Researchers in query-based model extraction and attention identifiability. It deserves a serious referee and, in my view, acceptance with revision. The appendix is long, but the main text is readable.\n\nRecommendation: send it to review.","headline":"A genuinely nontrivial theoretical advance in query-based learning of multi-head attention, with an honest exact-arithmetic premise and a sound central proof.","tokens_in":42377,"tokens_out":1804,"would_cite":true,"duration_ms":19923,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Repeated-token trick recovers multi-head attention exactly.","keywords":["multi-head attention","softmax attention","parameter recovery","value queries","rational interpolation","canonical representation","Transformer","query learning"],"falsifier":"Run Algorithm 1 on a fixed canonical model with rational parameters and an exact oracle, and test whether any draw of the random directions $(U,Q)$ with positive probability violates the distinctness or matching conditions of Lemma 4.3; finding such a draw would disprove the probability-one recovery claim, and exhibiting two distinct canonical models with identical scalar outputs on all length-three inputs would disprove Proposition 3.1.","tokens_in":41536,"feed_emoji":"🎯","tokens_out":9068,"duration_ms":85970,"temperature":0.7,"pith_summary":"This paper asks whether the parameters of a multi-head softmax attention layer can be recovered from black-box scalar outputs at the final token, without assuming the heads live in known orthogonal subspaces. It answers yes: by querying sequences that repeat the same token many times, the learner turns the hidden heads into the poles of a rational function, interpolates that function, and then uses additive queries to label the heads consistently. The recovery is exact up to permutation with probability one over randomly chosen query directions, using $4Hd^2-2H+1$ value queries of length at most $2H+1$ when $H$ is known. The paper also extends the construction to a one-layer ReLU Transformer and gives conditional linear stability under approximate outputs.","feed_headline":"Repeated-token trick recovers multi-head attention exactly","feed_subtitle":"A rational-function trick separates hidden heads with 4Hd²−2H+1 queries, no subspace assumptions.","key_machinery":"The load-bearing object is the repeated-token identity $R(m)=\\sum_{h=1}^H c_h r_h/(m+r_h)$, where $r_h=\\exp(t u^\\top W_h q)$ and $c_h=t u^\\top v_h$. Varying the number $m$ of repeated tokens makes each hidden head appear as a simple pole of a rational function; rational interpolation and denominator factorization return the unordered set $\\{(u^\\top W_h q, u^\\top v_h)\\}$ for each direction pair $(u,q)$. Additive queries on sums of direction vectors then exploit bilinearity, for example $s_h(u_1+u_i,q_1)=s_h(u_1,q_1)+s_h(u_i,q_1)$, to match entries across local decoders, after which solving linear systems recovers $W_h$ and $v_h$.","core_discovery":"The central claim is that scalar final-token outputs uniquely determine, and an explicit query algorithm recovers, the canonical representation of a multi-head softmax attention model: heads sharing the same key-query matrix $W_h$ are merged by summing their value vectors $v_h$, and merged heads whose sum is zero are discarded. Equality on length-three inputs already pins down this representation. Algorithmically, a sequence with one perturbed token $q+tu$ followed by $m$ copies of $q$ makes the subtracted response $R(m)=F_M(X)-F_M([q])$ equal a rational function $\\sum_{h=1}^H c_h r_h/(m+r_h)$; sampling $m=1,\\dots,2H$, interpolating to recover the denominator, and factoring it separates the heads as an unordered set. Queries on sums of directions then give each head a consistent label, and linear systems recover every pair $(W_h,v_h)$. Under exact real arithmetic this succeeds with probability one over random orthogonal query directions, at the stated query cost.","pith_inferences":["Going beyond the paper, replacing the exact polynomial-factorization step with certified numerical root isolation would convert the probability-one guarantee into a finite-precision routine with explicit error bounds.","Going beyond the paper, the same separation-and-matching strategy should apply to any attention kernel whose repeated-token response is a rational function with simple poles; if such kernels satisfy the analogous matching identities, the query count carries over unchanged.","Going beyond the paper, the near-total failure under IEEE 754 binary64 outputs for larger head counts suggests the exact-arithmetic oracle, not the subspace assumption, is the operative boundary; a practical deployment would need either high-precision oracles or a conditioning-aware variant."],"forward_implications":["Multi-head attention can be provably recovered from black-box scalar queries without orthogonal-subspace assumptions or known subspace bases.","The parameter count $H(d^2+d)$ and the query count $4Hd^2-2H+1$ are both order $H d^2$, so the recovery scales polynomially with the token dimension.","When only an upper bound $H_0$ on the raw head count is known, the same algorithm works with $H_0$ replacing $H$ and determines the true canonical head count from the smallest consistent denominator degree.","Under conditions guaranteeing separation and conditioning, an output error $\\tau$ propagates to parameter error at most $C_{\\mathrm{stab}}\\tau$, so small oracle noise does not destroy recovery.","The same queries recover the effective attention heads of a one-layer ReLU Transformer via the odd-component reduction, and under extra conditions a functionally equivalent Transformer is constructed without a separate feed-forward learner."],"supporting_citations":[{"why":"Supplies the single-head $O(d^2)$ value-query algorithm and the known-subspace multi-head baseline that this paper removes, plus the odd-component reduction used in the Transformer extension.","marker":"Bhattamishra et al. 2026"},{"why":"Characterizes functional equivalence of multi-head attention on full outputs, which the paper contrasts with scalar final-token identifiability and sharpens to length-three inputs.","marker":"Tran et al. 2025"},{"why":"Provides the rank-one projection recovery guarantee used in the low-rank variant to recover the $W_h$ matrices.","marker":"Cai and Zhang 2015"},{"why":"Defines IEEE 754 binary64, the precision used in the experiments that expose the exact-arithmetic assumption.","marker":"IEEE 2019"}],"fun_headline_variants":["Rational interpolation separates attention heads exactly","Copy tokens, sample rational function, recover attention","Multi-head attention recoverable from scalar queries alone","Exact multi-head attention learning via token-copy trick","Provable recovery of attention heads without subspace assumptions"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The whole guarantee rests on the oracle returning exact real values and the learner performing exact real arithmetic, including exact polynomial factorization; under ordinary IEEE 754 arithmetic, the authors' own experiments show recovery collapsing from near-perfect to zero for several configurations.","fun_headline_variants_meta":{"raw":{"variants":["Rational interpolation separates attention heads exactly","Copy tokens, sample rational function, recover attention","Multi-head attention recoverable from scalar queries alone","Exact multi-head attention learning via token-copy trick","Provable recovery of attention heads without subspace assumptions"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00079,"raw_usage":{"total_tokens":3568,"prompt_tokens":1115,"completion_tokens":2453,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":731,"completion_tokens_details":{"reasoning_tokens":2393}},"tokens_in":731,"tokens_out":2453,"duration_ms":23924,"temperature":1.0,"reasoning_tokens":2393,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T04:27:08.022460+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run Algorithm 1 on a fixed canonical model with rational parameters and an exact oracle, and test whether any draw of the random directions $(U,Q)$ with positive probability violates the distinctness or matching conditions of Lemma 4.3; finding such a draw would disprove the probability-one recovery claim, and exhibiting two distinct canonical models with identical scalar outputs on all length-three inputs would disprove Proposition 3.1.","supporting_citations":[],"review_version":2}