{"id":"f238748c-58e7-4954-9714-3601e6e82cc8","arxiv_id":"2608.03411","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"DUD decouples Attention and FFN contributions via noise-induced causal patching and trains a probe on the dual-stream restoration scores, reporting state-of-the-art hallucination detection.","lead":"The paper proposes DUD, a method that estimates LLM uncertainty by separately measuring how much Attention and Feed-Forward modules can restore a prediction after noise is injected into the input. It reports large AUROC gains over baselines and strong cross-dataset transfer, but ships no code and its core restoration scores may inherit surface confidence effects.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Eq. 4's normalization by TE can amplify small restoration shifts into large |S|, so DUD-Probe may be learning surface confidence or noise robustness rather than decoupled mechanistic conflict.","rationale":"The paper makes a serious, testable proposal: it defines a causal-intervention pipeline, evaluates on three LLMs and four datasets, and includes useful ablations of module streams, layer groups, and labeling thresholds. The central empirical claim—that DUD-Probe significantly outperforms baselines—is not internally inconsistent. However, the feature fed to the probe is a normalized ratio whose denominator is smallest in exactly the cases the paper wants to diagnose: low-confidence tokens and noise-robust predictions. In those cases, |S| is inflated by normalization, not by evidence of module conflict. The paper's observation that S is 'predominantly negative' is consistent with this artifact. Without a control for the denominator or a confidence-only probe, the strong interpretation of the results is conditional: DUD-Probe may be rediscovering surface probability or noise sensitivity in a more complex form. This is the same soft spot the reader identified, and the proposed check is cheap and decisive. Therefore the reader's CONDITIONAL verdict remains appropriate; no change is needed.","tokens_in":20988,"tokens_out":5368,"duration_ms":73591,"concrete_test":"Retrain the DUD-Probe on the same Table 1 splits using: (i) raw unnormalized deltas Δ_phi^(l) = P_restored^(l,phi) - P_corr, and (ii) only P_clean (with P_corr as a control). If the P_clean-only probe matches DUD's AUROC within a few points, or if the raw-delta probe changes by more than ~10%, then Eq. 4's normalization is the driver and the decoupling claim is unsubstantiated. Also report the Spearman correlation between S and P_clean on the same generations.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim that decoupled restoration scores measure module-specific fragility rests on Eq. 4: S_phi^(l) = (1/T) Σ_t [P_restored^(l,phi)(y_t) - P_corr(y_t)] / TE, with TE = (1/T) Σ_t [P_clean(y_t) - P_corr(y_t)] from Eq. 3. The denominator TE is small precisely for low-confidence tokens (P_clean small) or for sequences whose predictions are robust to embedding noise (P_corr ≈ P_clean). In that regime, the normalized score is a ratio of two small numbers, and even a tiny restoration-induced shift is amplified into a large negative |S|—which §3.2 labels 'mechanistic fragility.' The paper reports that scores are 'predominantly negative' but never separates the low-TE regime from genuine FFN/MHSA conflict. Because the DUD-Probe is trained on these rescaled features, the reported AUROC gains may reflect the model's confidence or noise sensitivity rather than the dual-stream decoupling. The ablation in Table 3 shows that FFN and Attention streams help, but it does not control for this normalization confound.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes DUD (Decoupled Update Dynamics), a white-box uncertainty quantification method for LLMs. DUD computes layer-wise restoration scores by (i) running a clean forward pass, (ii) corrupting input embeddings with Gaussian noise, and (iii) separately patching clean FFN or MHSA activations back into the corrupted forward pass. The normalized probability shift (Eq. 4) is used as a feature, and a small MLP probe is trained on these features with ROUGE-L-derived correctness labels. The authors report AUROC gains over baselines on three LLMs and four QA datasets, cross-dataset transfer results, ablations, and calibration/rejection metrics. The central claim is that uncertainty manifests as module-specific fragility (early-layer MHSA routing instability, late-layer FFN collapse) and that the dual-stream decoupled profile is a robust proxy for the model's epistemic state.","tokens_in":21305,"tokens_out":4514,"duration_ms":51993,"significance":"If the central claim holds, the paper makes a useful contribution: it moves beyond aggregated residual-stream probes and explicitly separates mnemonic and contextual pathways, with a reasonably broad evaluation across architectures and datasets. The cross-dataset transfer experiments (Fig. 5, Appendix I) and the calibration/rejection analyses (Appendix F) are valuable positives. However, the paper currently ships no code and the main tables lack confidence intervals or significance tests. More importantly, the load-bearing normalization in Eq. (4) has a plausible confound with token confidence, and the mechanistic interpretation is imposed post hoc without a sham-patch control. The empirical gains may still be real, but the paper's central interpretive claim is not yet established.","major_comments":[{"comment":"The restoration score is S = (P_restored - P_corr)/TE, with TE = mean(P_clean - P_corr). For low-confidence tokens P_clean is small, so TE is small; any restoration-induced shift is amplified into a large |S|. The paper observes that scores are 'predominantly negative' and interprets this as mechanistic fragility, but it never separates the low-TE regime from genuine module conflict. Because the DUD-Probe is trained on these normalized scores, the AUROC gains in Table 1 may reflect the model's confidence or noise sensitivity rather than decoupled dynamics. Please add controls: include P_clean and TE as probe features, stratify AUROC by TE quintiles, or use the unnormalized difference P_restored - P_corr. Without this, the central mechanistic claim is not supported.","section":"Eq. (4), §3.2"},{"comment":"The causal interpretation that a negative restoration score equals 'fragility' is imposed post hoc. Patching a single clean module activation into an otherwise corrupted forward pass creates an inconsistent internal state; the resulting probability drop could occur for any token, independent of the target module's causal role. The paper lacks a sham-patch control (e.g., restoring a clean activation from a different layer or token, or patching a randomly selected module). Without such a control, the observed early-layer Attention and late-layer FFN patterns cannot be attributed to module-specific memory-context conflict.","section":"§3.2, Figure 2"},{"comment":"The claim that DUD 'significantly outperforms' baselines is not supported by confidence intervals or significance tests. The main table reports only point estimates, despite the 5-fold cross-validation described in §5.1. Several cells are very close (e.g., Gemma-2-9B SQuAD: DUD 0.8218 vs ICR 0.8204; LLaMA-3.1-8B TriviaQA: DUD 0.8031 vs ICR 0.7557, but with unknown variance). Please report mean ± std over folds and paired significance tests for the key comparisons, especially against the ICR Probe.","section":"§5.1, Table 1"},{"comment":"The noise level ν is a free parameter of the method, but no sensitivity analysis is reported. The restoration scores, and therefore the probe features, are defined relative to a specific corruption strength ν=0.15. If the method's advantage depends on this particular value, the claim of a general mechanistic proxy is weakened. Please include a sweep over ν (e.g., 0.05, 0.1, 0.15, 0.2, 0.3) and report AUROC, at least for one model and dataset, to show the results are not artifacts of this choice.","section":"§3.2, Appendix C.2.3"}],"minor_comments":[{"comment":"The feature order is inconsistent: Eq. (5) concatenates [S_attn, S_ffn], Appendix D Eq. (7) and Algorithm 1 use [S_ffn, S_attn]. Please align the notation.","section":"Eq. (5) vs Eq. (7), Algorithm 1"},{"comment":"Line 6 sets TE ← P_clean - P_corr, which is a vector, while Eq. (3) defines TE as the sequence-averaged scalar. Clarify whether the division in Eq. (4) is performed token-wise before averaging or after averaging; this affects the numerical values.","section":"Algorithm 1"},{"comment":"The model name is given as 'Llama-3-8B-Instruct' in the setup but 'LLaMA-3.1-8B' in the table. Please use a single consistent name.","section":"§5.1 and Table 1"},{"comment":"The default value of the ROUGE-L threshold τ is not given in the main text; it first appears as 0.5 in Appendix D. State the default in §3.3.","section":"Eq. (6)"},{"comment":"The two subplots use different y-axis ranges and scales, which makes the 'sharp decline in FFN scores' visually misleading. Use a common scale or clearly annotate the difference.","section":"Figure 2"},{"comment":"The LLM-Check baseline is attributed to 'Zhang et al. 2025a', but the cited reference is a survey ('Siren's Song in the AI Ocean'). If LLM-Check is from another paper, please cite the correct source.","section":"References"}],"recommendation":"major_revision","confidential_remarks":"The stress-test concern about Eq. (4) is well-founded and aligns with my reading: the normalization can turn confidence into fragility. I would require the TE-control analysis before publication, not just additional discussion. The cross-dataset and calibration results are promising enough that rejection would be premature."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick read on arXiv:2608.03411 (DUD). The headline is that they get real AUROC gains for detecting hallucinated/uncertain generations across three open LLMs and four datasets, and the cross-dataset transfer is noticeably better than the ICR probe. That part looks solid.\n\nWhat's new: the feature construction is genuinely new—they inject embedding noise, then patch in the clean FFN or attention output one layer at a time, and use the normalized probability shift (restoration score) as a 2L-dimensional input to a small MLP probe. That's not in ICR, which already separates attention/FFN contribution ratios but doesn't do noise-induced causal patching or a dual-stream probe. So the \"first\" framing is too strong, but the pipeline is a real delta.\n\nWhere it gets soft: Eq. 4 is the load-bearing piece and it has a confound. S is normalized by total effect (P_clean - P_corr). When P_clean is low—exactly the low-confidence tokens—the denominator is small, and a tiny restoration shift blows up into a large negative score. The paper calls that \"mechanistic fragility,\" but it might just be surface confidence (or noise sensitivity) wearing a mechanistic costume. They report scores are \"predominantly negative\" but never separate the low-TE regime from genuine module conflict. The DUD-Probe is trained on these rescaled features, so the AUROC gains could come from the model's own confidence rather than from decoupling. The ablation shows both streams help, but it doesn't control for this normalization artifact.\n\nOther soft spots: no released code, no confidence intervals or significance tests in the main tables, and the mechanistic narrative (early-layer MHSA routing instability, late-layer FFN collapse) is consistent with the figures but presented post hoc. They also use 10,000 instances per dataset but don't show variance across folds in Table 1.\n\nIs it fatal? Not necessarily. Cross-dataset transfer is a genuine external check, and the dual-stream ablation suggests the features carry something beyond raw confidence. But the paper needs to directly address the TE confound—e.g., train a probe on P_clean alone, or on TE alone, and show DUD adds value on top; and stratify results by confidence bins. Until that's done, the central mechanistic claim is under-supported.\n\nAll that said, this deserves a serious referee. The empirical work is broad, the limitations are acknowledged, and the confound is fixable with targeted experiments. I'd send it to review, with a request for code and the P_clean/TE controls.","headline":"DUD reports solid empirical gains for white-box UQ, but the mechanistic claim is partly confounded by the TE normalization in Eq. 4, and the novelty vs. ICR is overstated.","tokens_in":21763,"tokens_out":3091,"would_cite":true,"duration_ms":34143,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A language model's uncertainty reveals itself only when its memory and attention streams are measured separately, not in its output probabilities.","keywords":["uncertainty quantification","hallucination detection","mechanistic interpretability","causal tracing","feed-forward networks","attention","calibration","large language models"],"falsifier":"Take correct and incorrect generations matched on $P_{\\text{clean}}$ and $P_{\\text{corr}}$, and recompute restoration scores with the denominator $TE$ replaced by $P_{\\text{clean}}$ alone; if the AUROC separation between correct and incorrect collapses, the reported signal is a confidence rescaling rather than mechanistic fragility. A concrete place to look is the late-layer FFN collapse claimed for LLaMA-3.1 on HaluEval.","tokens_in":20908,"feed_emoji":"🧠","tokens_out":9164,"duration_ms":98899,"temperature":0.7,"pith_summary":"This paper sets out to show that a language model's reliability can be read from the internal tug-of-war between its two update streams—feed-forward networks, which store parametric memory, and multi-head self-attention, which routes context—rather than from the final probability it prints. The proposed method, DUD, injects noise into the input embeddings, then restores one clean module activation at a time; the magnitude of the resulting probability drop is interpreted as mechanistic fragility. The paper reports that incorrect generations show a characteristic pattern, instability in early-layer attention and a collapse in late-layer FFNs, and that an MLP probe trained on the resulting dual-stream profiles outperforms logit-based and aggregated hidden-state baselines on uncertainty estimation and calibration. If correct, this gives a principled, white-box diagnostic for detecting confidently wrong answers and for knowing when a language model is internally divided about what it is saying.","feed_headline":"Decoupling memory and attention spots wrong-but-confident answers","feed_subtitle":"A probe over causal restoration scores beats logits and aggregated hidden states at detecting language-model errors.","key_machinery":"The central object is the restoration score for module $\\phi \\in \\{\\text{MHSA}, \\text{FFN}\\}$ at layer $l$: $S_{\\phi}^{(l)} = \\frac{1}{T}\\sum_{t=1}^{T}\\frac{P_{\\text{restored}}^{(l,\\phi)}(y_t) - P_{\\text{corr}}(y_t)}{TE}$, where $TE$ is the average probability drop caused by embedding noise. It quantifies how much reinstating one clean module into an otherwise corrupted pass perturbs the prediction, relative to the total corruption effect. The dual-stream profile concatenates these scores over all layers, attention first then FFN, into $v \\in \\mathbb{R}^{2L}$; a four-layer multilayer perceptron maps $v$ to a binary uncertainty estimate. The machinery works by converting passive observation i","core_discovery":"The central discovery is that uncertainty is not a uniform degradation but a spatiotemporal fragility signature. By running a clean forward pass, a noise-corrupted pass, and decoupled patch runs that restore either the attention or the FFN activation at one layer, DUD computes per-module restoration scores. The paper finds these scores are mostly negative, and their magnitude separates correct from incorrect generations: near-zero scores mark stable predictions, large negative scores reveal that the generation depends on a precarious internal equilibrium. Across HaluEval, SQuAD, TriviaQA, and HotpotQA on three open language models, the signature is early-layer attention instability when cont","pith_inferences":["Editorial extension: the reported architecture-dependent dominance (LLaMA peaks in FFN, Qwen and Gemma in attention) suggests the dual-stream profile could double as a diagnostic of how a given model distributes knowledge and context, not only as a risk score.","Editorial extension: since the normalization divides by the corruption-induced probability drop, a natural stress test is to control for baseline confidence; if the signal survives matched-confidence pairs, the fragility interpretation is on firmer ground.","Editorial extension: the multi-forward-pass cost points to distillation—training a single forward-pass estimator or a lightweight probe on DUD-derived labels for real-time monitoring of deployed models.","Editorial extension: the same decoupled tracing could be applied to other internal conflicts, such as instruction following or refusal behavior, to see whether fragility patterns generalize beyond factual question answering."],"forward_implications":["Confidently wrong generations can be flagged even when the model assigns high probability to the wrong token, because the fragility signal lives in the decoupled internal streams, not in the output distribution.","A probe trained on one knowledge-intensive task transfers to another with only small AUROC loss, suggesting the mechanistic signature is a model property rather than a dataset artifact.","Uncertainty is localized in specific modules and layers—early attention for context-heavy inputs, late FFN for knowledge retrieval—so monitoring can be focused where failures originate.","Because the dual-stream profile beats the aggregated ICR Probe, merging memory and context contributions discards exactly the conflict that makes uncertainty visible.","DUD-Probe's output is better calibrated than baseline scores, so the profile can serve as a probability-like correctness estimate for downstream decision-making."],"supporting_citations":[{"why":"Establishes attention as a contextual signal router, the role DUD restores as one of two decoupled streams.","marker":"Elhage et al., 2021"},{"why":"Establishes FFN layers as key-value memories, the parametric-memory role DUD restores as the other stream.","marker":"Geva et al., 2021"},{"why":"Supplies causal tracing for FFN-stored factual associations, the intervention pattern DUD extends to both modules.","marker":"Meng et al., 2022"},{"why":"The SAPLMA hidden-state baseline that DUD must exceed on uncertainty estimation.","marker":"Chen et al., 2024"},{"why":"The ICR Probe, an aggregated hidden-state-dynamics baseline whose failure motivates decoupling.","marker":"Zhang et al., 2025b"},{"why":"Semantic Entropy, the main logit-level baseline DUD compares against.","marker":"Kuhn et al., 2023"},{"why":"SEP, a linear hidden-state probe baseline in the training-based comparison.","marker":"Kossen et al., 2024"},{"why":"SAR, an attention-relevance uncertainty baseline in the main comparison table.","marker":"Duan et al., 2024"}],"fun_headline_variants":["Decoupled updates reveal LLM's fragile confidence","Noise-based module rescue detects LLM errors","Separate memory and attention to spot LLM doubt","Restoration scores expose LLM internal instability","Split dynamics: a sharper uncertainty test for LLMs"],"cache_read_input_tokens":2816,"weakest_assumption_plain":"The load-bearing premise is that patching one clean module into an otherwise corrupted forward pass isolates that module's causal contribution and that the normalized magnitude of the restoration score measures fragility, rather than merely rescaling the low clean probability of an already uncertain token.","fun_headline_variants_meta":{"raw":{"variants":["Decoupled updates reveal LLM's fragile confidence","Noise-based module rescue detects LLM errors","Separate memory and attention to spot LLM doubt","Restoration scores expose LLM internal instability","Split dynamics: a sharper uncertainty test for LLMs"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000733,"raw_usage":{"total_tokens":3094,"prompt_tokens":703,"completion_tokens":2391,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":447,"completion_tokens_details":{"reasoning_tokens":2319}},"tokens_in":447,"tokens_out":2391,"duration_ms":21834,"temperature":1.0,"reasoning_tokens":2319,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-05T19:25:21.118861+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take correct and incorrect generations matched on $P_{\\text{clean}}$ and $P_{\\text{corr}}$, and recompute restoration scores with the denominator $TE$ replaced by $P_{\\text{clean}}$ alone; if the AUROC separation between correct and incorrect collapses, the reported signal is a confidence rescaling rather than mechanistic fragility. A concrete place to look is the late-layer FFN collapse claimed for LLaMA-3.1 on HaluEval.","supporting_citations":[],"review_version":1}