{"id":"1d2a99c1-6ba1-4ec0-a99d-70a2e7ae6227","arxiv_id":"2608.03629","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"An exact decomposition and an exact double-integral identity reduce cross-layer interaction in weight-space ablation to a per-layer attention Jacobian bound, which is derived in closed form and verified on a real 1.5B-parameter model.","lead":"This paper extends a single-block theory of weight-space ablation to multiple transformer layers, deriving an exact cross-layer interaction identity plus a closed-form bound on the attention Jacobian, and verifies the bound on Qwen2.5-1.5B-Instruct. It also searches for and finds an emergent indirect-object-identification circuit in that model, reporting mixed results for whether the theoretical collapse, dissociation, and interaction pattern appears.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Attention Jacobian bound in Prop. 3 omits query-position derivative and output projection, so it is not a full bound on the attention sub-block as claimed.","rationale":"The reader's weakest assumption concerned sampling coverage of the finite-difference verification; that is a legitimate concern about the empirical claim, but it is secondary to a more structural issue: Proposition 3's bound is derived for the pre-output-projection attention output a and only for key/value tokens j<τ. The cross-layer chain of Section 5 requires a bound on the full attention sub-block's Jacobian with respect to its normalized input, which includes the output projection W_O and the query-position derivative. Since neither is present in (5), the central claim that Proposition 3 supplies the one missing closed-form ingredient for bounding R×(x) is overstated. This does not invalidate the algebraic identity (4), which appears correct, nor the paper's honest scoping of what remains open; it changes the nature of the condition under which the paper should be accepted. The conditional verdict remains appropriate, but the condition should require either extending the bound to the full head output and query token or narrowing the claim accordingly. I therefore leave the reader's CONDITIONAL verdict unchanged while flagging the missing terms for the authors to address.","tokens_in":18811,"tokens_out":20503,"duration_ms":187804,"concrete_test":"Re-run Remark 4's finite-difference check on the full attention head contribution including W_O: compute ||∂(W_O a)/∂u_j||_op and ||∂(W_O a)/∂u_τ||_op at the same 12 Qwen sites. If any empirical norm exceeds p_j ||W_V||_op (1 + 2 d ||γ||∞^2 ||W_Q||_op ||W_K||_op / √d_h), then (5) is not a bound on the sub-block Jacobian used in the cross-layer chain. Alternatively, re-derive the bound for the full Jacobian and show the missing ||W_O||_op factor and the query-position term.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Proposition 3's central quantity a is the pre-output-projection head output (Section 3's a(x) in Remark 1), yet the paper presents (5) as the 'Jacobian bound for the attention sub-block' needed to chain across layers. The actual contribution of the head to the residual stream is W_O a; its Jacobian with respect to u_j is W_O ∂a/∂u_j, whose operator norm is bounded by ||W_O||_op times (5), not by (5) alone. No such factor appears, so (5) does not bound the attention half of a block's Jacobian as it enters Proposition 2's cross-layer remainder. Furthermore, Proposition 3 covers only j<τ (key/value tokens); the derivative with respect to the query token u_τ is nonzero (it enters through W_Q and through v_τ and k_τ) and is not bounded anywhere. Remark 5's per-layer bound, summing over key/value positions, therefore omits an entire column of the Jacobian. The paper's claim to have 'named the one missing ingredient' and supplied it in closed form is overstated: the ingredient supplied is a partial bound on a different object. This is independent of the empirical sampling concern raised by the reader.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper extends a companion's single-block interaction result for weight-space ablation to the multi-layer setting. It proves an exact decomposition of multi-layer interaction into same-block terms plus a cross-layer remainder (Proposition 1), isolates the two-layer remainder as a double integral of a mixed second derivative (Proposition 2), derives a local attention Jacobian bound in closed form and checks it by finite differences on Qwen2.5-1.5B-Instruct (Proposition 3, Remark 4), and gives a closed-form curvature constant for the companion paper's second-order remainder (Proposition 4). It also reports a real-model case study: a greedy activation-patching search finds an indirect-object-identification circuit in Qwen2.5-1.5B-Instruct, and measurements of collapse, dissociation, and interaction across five instances are reported as mixed. The paper is explicit about what it does not close, especially the chaining of the per-layer bound across many layers.","tokens_in":19223,"tokens_out":9336,"duration_ms":97356,"significance":"If Proposition 3 supplied the attention Jacobian bound needed to bound the cross-layer remainder, the paper would provide a genuinely useful closed-form ingredient for a problem that is usually left to empirical heuristics. The exact identities in Propositions 1, 2, and 4 appear to be proven cleanly, and the finite-difference checks are honest refutation tests rather than curve-fitting confirmations. The reproducible Julia notebooks and the explicit reporting of negative or mixed results are genuine strengths. However, the central use of Proposition 3 is currently overstated: the bound is for the pre-output-projection context vector, not for the contribution of the attention head to the residual stream, and it omits the query-position derivative. These are fixable within the paper's scope, but they are load-bearing because the paper explicitly names this bound as the 'one missing ingredient' for the cross-layer remainder.","major_comments":[{"comment":"The bound in Eq. (5) is a bound on ∂a/∂u_j where a = Σ_i p_i v_i is the pre-output-projection context vector, consistent with Remark 1's notation a(x). The quantity that is written into the residual stream is W_O a, so the attention half of a residual block's Jacobian with respect to its input is W_O ∂a/∂u_j, whose operator norm is controlled by ||W_O||_op times the right-hand side of (5), not by (5) alone. No such factor appears anywhere in Proposition 3 or in Remark 5's summary of what Proposition 3 supplies. Since the paper presents Proposition 3 as the closed-form ingredient needed to bound the cross-layer remainder R×(x), this is a load-bearing gap: the derived bound is for a different object than the one required for the proposed chaining argument.","section":"Section 5, Proposition 3, Eq. (5) and Remark 5"},{"comment":"Proposition 3 covers only j<τ, i.e. perturbations of key/value tokens strictly before the query position. The derivative with respect to the query token u_τ is nonzero: q = W_Q u_τ enters every attention logit, and v_τ enters through the causal i=τ term. The per-layer bound described in Remark 5, obtained by summing (5) over key/value positions, therefore omits an entire column of the per-token Jacobian. Before the paper can claim to have named and supplied the full 'attention sub-block Jacobian bound,' it needs either a closed-form bound for the query-position column or an explicit argument that this column is not needed for the specific double-integral remainder in Proposition 2. As written, the claim that Proposition 3 'supplies the attention half' of the relevant Jacobian is stronger than what Eq. (4)-(5) establish.","section":"Section 5, Proposition 3, j<τ restriction and Remark 5"}],"minor_comments":[{"comment":"The phrase 'without a single violation' appears in the abstract and conclusion, but the verification in Remark 4 covers only 12 probed (layer, head, position) sites with 24 random unit perturbations per site. The paper itself correctly frames this as a refutation test, so the abstract and conclusion should carry the same explicit qualification, e.g. 'without a single violation on the twelve probed sites,' to avoid overstating the empirical coverage.","section":"Abstract, Remark 4, Conclusion"},{"comment":"The joint zero-ablation of several sites is said to follow from the same argument as Fact 2, but the paper also states that this joint extension was not independently verified. Since the collapse ratio column of Table 1 relies on jointly zeroing all five or six sites, the table or the method paragraph should clearly mark this probe as depending on the unproven joint extension, or the extension should be proved in one paragraph.","section":"Section 7.1, Collapse paragraph"},{"comment":"The notation 'the head's output at τ' for a = Σ_i p_i v_i is ambiguous because the actual head output written to the residual stream is W_O a. Renaming a as the 'pre-output-projection context vector' would prevent the reader from misreading Eq. (5) as a bound on the residual-stream contribution.","section":"Section 5, Proposition 3 and Remark 1"},{"comment":"The five recovery curves in Figure 2 are not individually labeled; adding a legend or per-instance labels would make the Lucy/Sam plateau at 0.673 easier to read directly from the figure.","section":"Figure 2"}],"recommendation":"major_revision","confidential_remarks":"The paper leans heavily on an unpublished companion paper by the same author for Facts 1-5 and for the marker-task checkpoints. The new propositions are self-contained enough that I do not see circularity, but the editor should ensure the companion paper is available to referees and readers, since several claims in Section 7 are interpreted through it. The main technical gap I found is in the use of Proposition 3, not in its algebraic derivation; that gap is fixable and should be addressed before publication."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Dear colleague,\n\nThe headline: this paper has a genuinely new closed-form result in Proposition 3, and it is mostly honest about what it does not close. But the way it presents that result as \"the Jacobian bound for the attention sub-block\" is overstated. The quantity a in Proposition 3 is the head's pre-output-projection activation, not its contribution to the residual stream. The object that enters a block's Jacobian is W_O a, so the operator norm you need is bounded by ||W_O|| times (5), not by (5). No such factor appears. Also, Proposition 3 bounds only j < τ. The derivative with respect to the query token u_τ is nonzero, through q, v_τ, and k_τ, and it is not bounded anywhere. Remark 5's per-layer bound, summing over key/value positions, therefore misses an entire column of the Jacobian. This is a scope/application gap, not an algebraic error in (4)-(5): the derivative formula is correct, and the bound proof is clean.\n\nThe genuinely new pieces deserve credit. Proposition 2's exact double-integral identity for R_x is a neat technique. Proposition 4's closed-form curvature constant is useful and is computed from trained weights rather than assumed. The numerical checks are refutation tests, not confirmations, and the paper says so. The Qwen experiments are reported with mixed fidelity rather than rounded toward confirmation; that is credible.\n\nSoft spots in proportion. The \"zero violations\" claim rests on twelve probed sites with small perturbations; fine as a sanity check, but not a verification over the input space. The joint zero-ablation extension is asserted, not independently verified. The heavy dependence on the companion paper for Facts 1-5 is stated plainly, but it makes the paper hard to assess in isolation.\n\nBottom line: a serious referee should see this. The algebra is worth publishing, but the claims need rescoping: add the ||W_O|| factor, either handle the query-position column or state explicitly that the bound covers only key/value tokens, and soften \"missing ingredient supplied\" to \"partial ingredient supplied, with the remaining factors identified.\" If those revisions land, this is a solid contribution to the quantitative toolkit of mechanistic interpretability.\n\nRecommendation: send to peer review, but ask the referee to check the scope of Proposition 3 against Remark 5 carefully.","headline":"A real closed-form Jacobian bound, but the paper overstates its reach: without the output projection and the query-position column, (5) is not the attention sub-block bound the cross-layer chaining needs.","tokens_in":19615,"tokens_out":3703,"would_cite":true,"duration_ms":36492,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["68T07","15A60"],"pacs":[],"model":"deepseek-v4-flash","headline":"A closed-form attention Jacobian bound, verified without a violation on a real 1.5B model, turns the open cross-layer interaction problem into an exact identity plus one unverified chain.","keywords":["attention Jacobian bound","cross-layer interaction","weight-space ablation","activation patching","indirect object identification","closed-form bound","curvature constant","residual stream"],"falsifier":"Run the same finite-difference test at many more, or adversarially chosen, (layer, head, position) sites and unit perturbation directions on Qwen2.5-1.5B-Instruct and check whether the measured operator norm of $\\partial a/\\partial u_j$ ever exceeds the Proposition 3 bound; any violation refutes the zero-violation claim for real inputs. A second falsifier targets the open chained statement: compute the product of the per-layer Proposition 3 factors across the blocks between two distant layers and check whether it becomes vacuous within the model's 28-layer depth.","tokens_in":18577,"feed_emoji":"🧮","tokens_out":9671,"duration_ms":80165,"temperature":0.7,"pith_summary":"This paper extends an exact theory of weight-space ablation from a single residual block to the full multi-layer network. It proves that the interaction produced by ablating components spanning several layers decomposes exactly into a sum of same-block terms plus one cross-layer remainder, and that for two touched layers this remainder is exactly the mixed second derivative of a two-parameter interpolation between the clean and edited networks. The missing ingredient needed to turn that identity into a usable bound is a local Jacobian bound for one attention head; the paper derives this bound in closed form and reports zero violations when it is checked against real forward passes on Qwen2.5-1.5B-Instruct. It also computes the curvature constant the companion analysis left unexhibited, and reports a mixed test of the theory's qualitative predictions on an emergent indirect-object-identification circuit in the same real model.","feed_headline":"Zero violations: attention Jacobian bound holds on real 1.5B model","feed_subtitle":"A closed-form attention bound verified on real weights completes the exact two-layer identity.","key_machinery":"The load-bearing object is the two-parameter interpolation $H(t_1,t_2)$, the selector of the network whose block $l_1$ map is $z \\mapsto \\mathrm{Block}_{l_1}(z) - t_1\\mu_{l_1}(z)$ and whose block $l_2$ map is edited analogously with $t_2$; the mixed second derivative of $H$, integrated over the unit square, equals the cross-layer remainder $R_\\times(x)$ exactly. The second load-bearing piece is the local attention Jacobian bound of Proposition 3, evaluated pointwise at real activations rather than through a global Lipschitz constant, since attention's global Lipschitz constant is not bounded in general. Together these reduce the open cross-layer question to one unclosed numeric step: chaining the per-layer Jacobian factors across every block between the two touched layers.","core_discovery":"The central claim is Proposition 3: for a single attention head at query position $\\tau$, with normalized inputs $u_i$, keys and values $k_i = W_K u_i$, $v_i = W_V u_i$, softmax weights $p$, and output $a = \\sum_i p_i v_i$, the output Jacobian with respect to an earlier normalized input $u_j$ is exactly $\\partial a/\\partial u_j = p_j W_V + p_j (v_j-a)(W_K^\\top q)^\\top/\\sqrt{d_h}$, and its operator norm is bounded by $p_j\\|W_V\\|_{\\mathrm{op}}(1 + 2d\\|\\gamma\\|_\\infty^2\\|W_Q\\|_{\\mathrm{op}}\\|W_K\\|_{\\mathrm{op}}/\\sqrt{d_h})$. This is the one closed-form ingredient missing from the exact cross-layer identity of Proposition 2, which expresses the remainder for two ablated layers as the double integral of the mixed second derivative of the interpolation $H(t_1,t_2)$ between clean and fully edited selectors. The paper claims the bound is verified pointwise, with zero violations in twelve probed sites, on Qwen2.5-1.5B-Instruct's real weights. The same paper establishes an exact multi-layer decomposition (Proposition 1) in which each same-block term is pinned either to zero or to the companion paper's bounded interaction term, and it reports that on a discovered indirect-object-identification circuit the same-block sum and cross-layer remainder often partially cancel.","pith_inferences":["Because the weight-only form of the attention bound is loose by four to six orders of magnitude at a single layer, the chained multi-layer constant is likely vacuous after only a few blocks; testing that product numerically is the direct next step.","If the observed partial cancellation between the same-block sum and the cross-layer remainder carries beyond the five instances, then ablation studies on real circuits should report the net interaction, not a sum of per-layer terms.","A broader empirical check of the attention Jacobian bound across more heads, positions, and a second pretrained model would settle whether the zero-violation claim is a property of attention or an artifact of the twelve probed sites."],"forward_implications":["The interaction of any multi-layer ablated subset is exactly a sum of same-block terms plus one remainder, so a measured interaction can be attributed between the two parts.","For two ablated layers, the remainder is exactly a double integral of a mixed second derivative, turning an open quantity into a named, exact object.","The closed-form attention Jacobian bound holds at all twelve probed sites on a real 1.5B-parameter model, so it is a candidate building block for future depth-chained bounds.","The curvature constant for the companion paper's second-order remainder is computable from the trained weights alone, so the curvature hypothesis is checkable rather than assumed.","On a real pretrained model's emergent IOI circuit, a shared carrier appears across all five tested instances, collapse and dissociation hold on most but not all, and a nonzero cross-layer interaction is measurable on three of five instances outside the companion theorem's same-block scope."],"supporting_citations":[{"why":"Supplies the original activation-patching circuit-search method reused unchanged to find the emergent IOI circuit.","marker":"[1]"},{"why":"Provides the superposition redundancy expectation used to frame the shared-plus-idiosyncratic circuit pattern.","marker":"[2]"},{"why":"Supplies the Hydra-effect self-repair result invoked to interpret why single-site ablation scores may reflect compensation.","marker":"[3]"},{"why":"Derives an interaction term in activation-patching estimands, the concurrent result this paper contrasts with its weight-space bound.","marker":"[4]"}],"fun_headline_variants":["Closed-form attention Jacobian bound verified on 1.5B real model","Zero violations: new attention bound holds on real 1.5B weights","Exact cross-layer identity completed by attention Jacobian bound","Attention bound proven on Qwen2.5-1.5B: zero violations in 12 sites","Closed-form bound for attention Jacobian passes real 1.5B test"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The empirical claim that the bound holds 'without a single violation' rests on twelve probed sites and twenty-four random perturbations per site being representative of all real inputs and perturbation directions; a violation at an unprobed site would not have been detected.","fun_headline_variants_meta":{"raw":{"variants":["Closed-form attention Jacobian bound verified on 1.5B real model","Zero violations: new attention bound holds on real 1.5B weights","Exact cross-layer identity completed by attention Jacobian bound","Attention bound proven on Qwen2.5-1.5B: zero violations in 12 sites","Closed-form bound for attention Jacobian passes real 1.5B test"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000165,"raw_usage":{"total_tokens":1385,"prompt_tokens":1212,"completion_tokens":173,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":828,"completion_tokens_details":{"reasoning_tokens":70}},"tokens_in":828,"tokens_out":173,"duration_ms":2518,"temperature":1.0,"reasoning_tokens":70,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T04:25:29.298013+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the same finite-difference test at many more, or adversarially chosen, (layer, head, position) sites and unit perturbation directions on Qwen2.5-1.5B-Instruct and check whether the measured operator norm of $\\partial a/\\partial u_j$ ever exceeds the Proposition 3 bound; any violation refutes the zero-violation claim for real inputs. A second falsifier targets the open chained statement: compute the product of the per-layer Proposition 3 factors across the blocks between two distant layers and check whether it becomes vacuous within the model's 28-layer depth.","supporting_citations":[{"cited_title":"The Curse of Multiple Mediators: Hidden Interaction Effects in Activation Patching","cited_arxiv_id":"2606.27510","evidence_quote":"Derives an interaction term in activation-patching estimands, the concurrent result this paper contrasts with its weight-space bound."}],"review_version":2}