REVIEW 4 major objections 6 minor 4 cited by
Spurious Rewards Paradox: Mechanistically Understanding How RLVR Activates Memorization Shortcuts in LLMs
T0 review · 4 major / 6 minor · reviewed 2026-08-03 · deepseek-v4-flash
Pith's one-line read Spurious RLVR works by flipping on a memorization circuit already latent in the model, not by improving reasoning.
desk verdict Perplexity Paradox is new and useful, but the L18-20 'Anchor' may be an artifact of the wrong→right vs stable contrast. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
Anchor-Adapter circuit: the division of the model's depth into a Functional Anchor (layers 18–20), where the decision to retrieve a memorized answer is causally made and a high-probability trigger token is injected, and Structural Adapters (layers 21+), which perform representational rotation rather than storing new knowledge. The detection toolbox includes path patching (swapping activations between 'leakage' and 'stable' samples to find causal edges), counterfactual JSD on MLP sub-components to locate weight-reorganization peaks, Logit Lens to trace token emergence, and a Neural ODE fit to residual updates whose 'separation force' metric pinpoints trajectory bifurcation.
What would settle it
Run path-patching and NDE separation-force analyses on a leakage/stable split where each pair shares the same problem stem and differs only in the memorized answer; if the L18–20 peak and L21–22 JSD peak disappear, the Anchor-Adapter circuit is an artifact of question confounds rather than a memorization trigger.
Extended reading notes
Core claim
Spurious RLVR tunes a two-part circuit in Qwen2.5-Math-7B: a Functional Anchor at layers 18–20 causally decides to retrieve a memorized answer and injects a high-probability trigger token, while Structural Adapters at layers 21+ rotate the feature space to carry that signal. Evidence: path patching recovers accuracy only when anchor layers are patched; counterfactual JSD peaks at L21–22; Logit Lens shows Layer 19 priming and Layer 23 injection; NDE separation force peaks at L18–20; ablations resetting the anchor drop leakage accuracy >10% while stable accuracy is unchanged; scaling top MLP keys bidirectionally steers contamination-driven accuracy.
Load-bearing premise
The entire localization rests on the claim that 'leakage' and 'stable' question sets are matched in difficulty, domain, and length; the paper states they are matched but never specifies the matching procedure, so content differences could confound the circuit attribution.
Editorial extensions
If this is right
- Accuracy on a benchmark that can be gamed by this circuit is not evidence of reasoning; evaluation suites must screen for contamination.
- The divergence of answer vs prompt perplexity can serve as a cheap, training-time fingerprint for shortcut formation.
- Resetting or steering anchor-layer weights offers a post-hoc decontamination method that reveals baseline performance without retraining.
- The circuit is dataset-specific, so layer manipulation can identify which benchmark items are leaked and which are genuinely solved.
- The effect appears in Qwen-family models but not in the tested control models, suggesting architecture-dependent susceptibility to spurious RLVR.
Reading between the lines
- If the Anchor-Adapter circuit is a general property of pretrained models that have seen the test data, then contamination detection could be done by probing for a middle-layer trigger, complementing corpus-level string matching.
- The same steering mechanism could be used adversarially to inflate benchmark scores, so releasing steering weights calls for safeguards.
- The Perplexity Paradox might be exploited as an early-stopping or reward-shaping signal during RLVR to prevent memorization from dominating.
- The NDE separation-force metric could be applied to any residual-stream model to locate the decision point for behaviors other than memorization.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper studies Qwen2.5-Math-7B before and after RLVR with incorrect/spurious rewards. It reports a 'Perplexity Paradox' (answer-token perplexity falls while prompt/full-text perplexity rises), and uses path patching, counterfactual JSD, logit-lens heatmaps, NDE trajectory analysis, layer ablations, and MLP-key scaling to localize the memorization shortcut. The central claim is that middle layers L18–L20 act as a 'Functional Anchor' that injects a high-probability trigger token for a memorized answer, while layers L21+ act as 'Structural Adapters' that rotate representations; scaling specific MLP keys in these layers is claimed to bidirectionally amplify or suppress contamination-driven accuracy. Comparisons against LLaMA-3.1-8B and OLMo-2-1124-7B (and Qwen3-8B) are used to argue the effect is contamination-specific.
Significance. Mechanistic localization of RLVR contamination effects would be valuable: it could explain why spurious rewards produce benchmark gains and suggest post-hoc mitigation. The paper has strengths: it combines several complementary probes, uses multiple control models, ships code, and its partial-prompt evaluation (Appendix A) is an independent behavioral label for memorization. However, the central evidence is currently undercut by an unspecified 'matched questions' design, a partly circular NDE analysis, and a steering-neuron selection rule that uses the ground-truth answer. With these fixed, the paper could be a useful contribution; in the current form the claims outrun the evidence.
major comments (4)
- [§4.1] Section 4.1 says every mechanistic probe 'is executed by contrasting the internal activations of these two groups on matched questions,' and that this 'cancels out difficulty, domain, and length confounds.' No matching procedure is described, and no balance table appears in the main text or appendices. This is load-bearing: leakage (wrong→right) and stable (always-right) groups are defined by base-model correctness, so they are not matched on the model's own difficulty axis. Path Patching (§4.3) is also biased because stable questions are at ceiling for base accuracy, so accuracy recovery can only be large for previously-wrong questions. The JSD, NDE, linear-probing, and ablation results inherit the same contrast. Please specify the matching algorithm and report covariate balance; alternatively, define groups using the Partial Prompt Evaluation label from Appendix A, which is an independ
- [§4.4] Section 4.4 models discrete residual updates with f_phi and then defines Separation Force as ||dh_leak/dt − dh_gen/dt||. Since the same fitted f_phi is a function of the observed layer-wise activations, the peak at L18–L20 is a smoothed restatement of the raw update differences, not an independent confirmation. The claim that NDE 'mathematically confirms' the causal anchor is overstated. Please show that the NDE fits are validated (e.g., prediction of held-out intermediate states), compare the separation force against raw Δx differences, and provide a null/permutation baseline to establish that the peak is not an artifact of the MLP fit. Also report training/regularization details for the two-layer MLP on 28 discrete steps.
- [§5, Appendix E] Section 5 and Figure 9 report that stable samples are robust to anchor/adapter reset. This is largely by construction: stable samples are correct in the base model, so replacing tuned weights with base weights should not destroy their accuracy. Therefore the asymmetry between leakage and stable sensitivity does not by itself show that L18–L20 are specialized memorization layers. Appendix E additionally states that on LiveMathBench the same leakage/stable partition produces an inverted pattern, 'attributed to distributional differences between the two subsets rather than memorization effects.' This admission undercuts the interpretation of the same partition on contaminated datasets. Please provide a group definition not based on base-model correctness, or at minimum demonstrate that the LiveMathBench inversion does not also apply to MATH-500/MinervaMath.
- [§6, Eq. (3)] Eq. (3) selects the top-k neurons using |Top-10(v_i) ∩ Tokens(y)|, where y is the ground-truth answer. Thus the 'task-relevant' neurons are chosen precisely because their output overlaps the answer token; scaling them by α will mechanically change the answer probability. Figures 13 and 14 therefore demonstrate that the selected neurons can modulate the answer, but do not independently confirm that the Anchor-Adapter circuit is the contamination mechanism. Please select neurons using leakage-vs-stable activation differences without access to y (or on a held-out answer set), and report sensitivity to k and λ.
minor comments (6)
- [Appendix A] Appendix A refers to Section 3.1 but the partial-prompt evaluation is described in Section 4.1; the cross-reference should be corrected.
- [§4.3, Figure 7] The Logit Lens conclusion is based on two stochastic trajectories of a single sample. Please add aggregate evidence across many leakage samples, ideally with confidence intervals, because the 'weaker precursor signal' in the failed run could be decoding stochasticity.
- [§4.1, Figure 1] The choice of MATH-500 and MinervaMath as the primary contaminated datasets is made after observing the accuracy gaps. Please state prespecified inclusion criteria or report all six datasets in every mechanistic probe to reduce post hoc selection concerns.
- [§6.1–6.2] Several hyperparameters are free: λ in Eq. (3), k=10, and the scaling factor α. Please include sensitivity analyses and clarify whether α is applied uniformly to all selected neurons at all generation steps.
- [§4.2, Figure 3] Define 'full-text' vs 'answer-only' perplexity precisely, including tokenization and whether the prompt is scored in full-text PPL. A declining answer-only PPL could partly reflect shorter or more templated answers, so a length-controlled comparison would strengthen the Perplexity Paradox.
- [Appendix F] Appendix F describes 'ablating (zeroing out)' factors at layers 22/23, but Section 6.2 defines only multiplicative scaling. Please clarify whether zeroing is α=0 and whether it is applied to selected neurons or all neurons.
Circularity Check
The NDE 'confirmation' is a re-expression of the same layer-wise updates, and the steering neurons are selected by ground-truth answer overlap, so two pieces of 'validation' reduce partly to their inputs.
-
renaming known result
[Section 4.4 (Dynamic Analysis), NDE implementation and Separation Force definition]
"In our implementation, we approximate Fθ using a two-layer MLP fitted to the discrete layer-wise updates ∆xℓ = xℓ+1 − xℓ. ... Separation Force: Defined as || dh_leak/dt − dh_gen/dt ||, measuring the instantaneous divergence in update directions between leakage and stable samples; ... Figure 10 (Left) shows that the Separation Force peaks precisely at Layers 18, 19, and 20. This mathematically confirms that these layers exert the strongest directional influence to steer leakage samples onto the memorization trajectory."
The NDE vector field is fitted to the observed layer updates ∆xℓ, so the 'separation force' at layer ℓ is approximately ||∆x_leak,ℓ − ∆x_gen,ℓ||. The peak at L18–L20 is therefore inherited from the same leakage-vs-stable activation differences used in the rest of the paper; it is a re-description of the input, not an independent mathematical confirmation of the Functional Anchor.
-
self definitional
[Section 6.1, Eq. (3) and Section 6.3, Figure 13]
"We then compute a relevance score combining key activation magnitude and semantic overlap with answer tokens: s_i = |k^(i)_ℓ| · (1 + λ· |Top-10(vi)∩Tokens(y)| / |Tokens(y)|), (3) ... We select the top-k neurons (k=10) ranked by these scores as the intervention target set N^task_ℓ. ... Figure 13 presents the accuracy change when applying neuron-level steering ... Layer 18 exhibits maximal sensitivity (−3.8% under suppression, +4.4% under amplification), consistent with its role as the Functional Anchor."
The 'task-relevant' neurons are selected partly by how strongly their unembedding projection overlaps the ground-truth answer tokens y. Scaling those same neurons and then reporting changes in answer accuracy is partly a restatement of the selection criterion: neurons are deemed relevant because they decode to the answer, and intervening on them moves the answer. The layer specificity retains some independent content, but the steering 'prediction' is substantially built into Eq. (3).
full rationale
The paper's central localization claim (L18–L20 Functional Anchor) is not wholly circular: Path Patching (Section 4.3) is a causal swap experiment, and the Ablation Study (Section 5) directly resets L18–20 and observes accuracy drops, which are external, falsifiable interventions. The self-citations (Li et al. 2025a/b) are methodological and not load-bearing uniqueness claims. However, two pieces of 'confirmation' reduce partly to their inputs. First, the NDE analysis fits a neural ODE to the exact layer-wise differences and then presents the resulting 'separation force' peak at L18–20 as a mathematical confirmation; this is essentially the same information re-expressed in continuous coordinates. Second, the causal-steering neurons are selected using ground-truth answer-token overlap (Eq. 3), so demonstrating that they modulate answer accuracy is partially tautological. The unspecified 'matched questions' protocol (Section 4.1) is a real confound risk but is a correctness/design concern rather than circularity. Overall, the independent causal evidence keeps the paper from being fully circular, but the NDE and steering validations inflate the support for the central claim, warranting a moderate score.
Assumptions & free parameters
free parameters (4)
- λ (semantic alignment weight) =
not reported
- top-k neurons per layer =
k=10
- steering scaling factors α =
3.0 (amplify), 0.2 (suppress)
- NDE MLP hyperparameters =
not specified
assumptions (5)
- domain assumption Transformer MLP layers act as key-value memories that store and retrieve parametric knowledge.
- ad hoc to paper The residual stream can be modeled as a continuous ODE whose vector field is well-approximated by a two-layer MLP trained on discrete layer updates.
- domain assumption Logit Lens projection of intermediate hidden states via the unembedding matrix gives a faithful readout of the model's evolving distribution.
- domain assumption Questions that flip from wrong-before to right-after RLVR ('leakage') activate memorization, while questions right-before and right-after ('stable') reflect genuine reasoning.
- ad hoc to paper The leakage and stable question sets are matched on difficulty, domain, and length so that activation contrasts isolate mechanism rather than content.
invented entities (2)
-
Functional Anchor (L18-L20)
-
Structural Adapters (L21+)
Cite this review
Pith. "Pith review of Spurious Rewards Paradox: Mechanistically Understanding How RLVR Activates Memorization Shortcuts in LLMs." pith.science (2026). https://pith.science/paper/5BBE4O53
@misc{pith2026260111061,
author = {Pith},
title = {Pith review of: Spurious Rewards Paradox: Mechanistically Understanding How RLVR Activates Memorization Shortcuts in LLMs},
year = {2026},
howpublished = {\url{https://pith.science/paper/5BBE4O53}},
note = {Machine review of arXiv:2601.11061}
}
read the original abstract
Reinforcement Learning with Verifiable Rewards (RLVR) is highly effective for enhancing LLM reasoning, yet recent evidence shows models like Qwen 2.5 achieve significant gains even with spurious or incorrect rewards. We investigate this phenomenon and identify a "Perplexity Paradox": spurious RLVR triggers a divergence where answer-token perplexity drops while prompt-side coherence degrades, suggesting the model is bypassing reasoning in favor of memorization. Using Path Patching, Logit Lens, JSD analysis, and Neural Differential Equations, we uncover a hidden Anchor-Adapter circuit that facilitates this shortcut. We localize a Functional Anchor in the middle layers (L18-20) that triggers the retrieval of memorized solutions, followed by Structural Adapters in later layers (L21+) that transform representations to accommodate the shortcut signal. Finally, we demonstrate that scaling specific MLP keys within this circuit allows for bidirectional causal steering-artificially amplifying or suppressing contamination-driven performance. Our results provide a mechanistic roadmap for identifying and mitigating data contamination in RLVR-tuned models. Code is available at https://github.com/idwts/How-RLVR-Activates-Memorization-Shortcuts.
Figures
Figures from the paper (20 more)
Forward citations
Cited by 4 Pith papers
-
Predictable GRPO: A Closed-Form Model of Training Dynamics
GRPO updates reduce to a damped oscillator whose mass, damping, and stiffness are fixed by optimizer hyperparameters plus one measured curvature scale, subsuming single-exponential saturation while adding inertial slo...
-
Bridging Physical Reasoning and Task Generalization via Visual Action Outcome Reasoning Alignment
VAORA aligns VLM chain-of-thought reasoning with visual scene observations and post-action outcomes via structured symbolic rewards, achieving cross-task and cross-environment generalization on physical reasoning benchmarks.
-
When Does a Video-Language Model Stop Watching? Reward Strength Controls the Formation and Reversal of Visual Shortcuts in Multimodal RLVR
Visual shortcut reliance in multimodal RLVR emerges abruptly, shows monotone response to penalty strength lambda, exhibits hysteresis in reversal, and has a critical early intervention window on an out-of-distribution...
-
VeriGate: Verifier-Gated Step-Level Supervision for GRPO
VeriGate adds verifier-gated step-level supervision to GRPO via cumulated PRM rewards and group-normalized token advantages, raising accuracy 20% and 12% on 1.5B and 7B models on MATH and six benchmarks.
Reference graph
Works this paper leans on
-
[1]
Alam, M. T. and Rastogi, N. Limits of generalization in rlvr: Two case studies in mathematical reasoning.arXiv preprint arXiv:2510.27044,
-
[4]
Guo, D., Yang, D., Zhang, H., Song, J., Zhang, R., Xu, R., Zhu, Q., Ma, S., Wang, P., Bi, X., et al. Deepseek-r1: In- centivizing reasoning capability in llms via reinforcement learning.arXiv preprint arXiv:2501.12948,
-
[5]
The reasoning-memorization interplay in language models is mediated by a single direction
Hong, Y ., Cao, M., Zhou, D., Yu, L., and Jin, Z. The reasoning-memorization interplay in language models is mediated by a single direction. InFindings of the Association for Computational Linguistics: ACL 2025, pp. 21565–21585,
2025
-
[6]
Kim, J., Lee, H., Cho, H., Jang, J., Hwang, H., Won, S., Ahn, Y ., Lee, D., and Seo, M. Knowledge entropy decay dur- ing language model pretraining hinders new knowledge acquisition.arXiv preprint arXiv:2410.01380,
-
[9]
Li, Q., Geng, J., Chen, Z., Zhu, D., Wang, Y ., Ma, C., Lyu, C., and Karray, F. Hd-ndes: Neural differential equa- tions for hallucination detection in llms.arXiv preprint arXiv:2506.00088, 2025a. Li, R., Chen, C., Hu, Y ., Gao, Y ., Wang, X., and Yilmaz, E. Attributing response to context: A jensen-shannon divergence driven mechanistic study of context a...
-
[11]
Lu, Y ., Li, Z., He, D., Sun, Z., Dong, B., Qin, T., Wang, L., and Liu, T.-Y . Understanding and improving transformer from a multi-particle dynamic system point of view.arXiv preprint arXiv:1906.02762,
arXiv 1906
-
[13]
URL https://arxiv. org/abs/2501.00656. Ruan, Z., Chen, Y ., Hou, Y ., Li, P., Liu, Y ., and Chen, G. Unveiling over-memorization in finetuning llms for reasoning tasks.arXiv preprint arXiv:2508.04117,
-
[14]
S., Xin, R., Geng, S., Wang, Y ., Oh, S., Du, S
Shao, R., Li, S. S., Xin, R., Geng, S., Wang, Y ., Oh, S., Du, S. S., Lambert, N., Min, S., Krishna, R., et al. Spu- rious rewards: Rethinking training signals in rlvr.arXiv preprint arXiv:2506.10947,
Show all 18 references
-
[15]
Detecting memorization in large language mod- els.arXiv preprint arXiv:2412.01014,
Slonski, E. Detecting memorization in large language mod- els.arXiv preprint arXiv:2412.01014,
-
[16]
Mirage or method? how model-task alignment induces divergent rl conclu- sions.arXiv preprint arXiv:2508.21188, 2025a
Wu, H., Wang, C., Zhao, W., and He, J. Mirage or method? how model-task alignment induces divergent rl conclu- sions.arXiv preprint arXiv:2508.21188, 2025a. Wu, M., Zhang, Z., Dong, Q., Xi, Z., Zhao, J., Jin, S., Fan, X., Zhou, Y ., Lv, H., Zhang, M., et al. Reason- ing or mem...
-
[17]
Qwen3 technical report.arXiv preprint arXiv:2505.09388,
Yang, A., Li, A., Yang, B., Zhang, B., Hui, B., Zheng, B., Yu, B., Gao, C., Huang, C., Lv, C., et al. Qwen3 technical report.arXiv preprint arXiv:2505.09388,
-
[18]
Does reinforcement learning really incentivize reasoning capacity in llms beyond the base model?arXiv preprint arXiv:2504.13837,
Yue, Y ., Chen, Z., Lu, R., Zhao, A., Wang, Z., Song, S., and Huang, G. Does reinforcement learning really incentivize reasoning capacity in llms beyond the base model?arXiv preprint arXiv:2504.13837,
-
[2020]
Oh, Y ., Lim, D.-Y ., and Kim, S
https://www.lesswrong.com/posts/AcKRB8wDpdaN6v6r u/interpreting-gpt-the-logit-lens. Oh, Y ., Lim, D.-Y ., and Kim, S. Stable neural stochastic differential equations in analyzing irregular time series data.arXiv preprint arXiv:2402.14989,
-
[2021]
Transformer feed-forward layers are key-value memories
Geva, M., Schuster, R., Berant, J., and Levy, O. Transformer feed-forward layers are key-value memories. InProceed- ings of the 2021 Conference on Empirical Methods in Natural Language Processing, pp. 5484–5495,
2021
-
[2022]
URL https://arxiv.org/abs/2206.14858. 11 Spurious Rewards Paradox: Mechanistically Understanding How RLVR Activates Memorization Shortcuts in LLMs Li, J., Beeching, E., Tunstall, L., Lipkin, B., Soletskyi, R., Huang, S., Rasul, K., Yu, L., Jiang, A. Q., Shen, Z., et al. Numina...
-
[2023]
Are your llms capable of stable reasoning?arXiv preprint arXiv:2412.13147,
Liu, J., Liu, H., Xiao, L., Wang, Z., Liu, K., Gao, S., Zhang, W., Zhang, S., and Chen, K. Are your llms capable of stable reasoning?arXiv preprint arXiv:2412.13147,
-
[2024]
Lambert, N., Morrison, J., Pyatkin, V ., Huang, S., Ivison, H., Brahman, F., Miranda, L. J. V ., Liu, A., Dziri, N., Lyu, S., et al. Tulu 3: Pushing frontiers in open language model post-training.arXiv preprint arXiv:2411.15124,
-
[2025]
Exploration vs exploitation: Rethinking rlvr through clipping, entropy, and spurious reward.arXiv preprint arXiv:2512.16912,
Chen, P., Li, X., Li, Z., Yin, W., Chen, X., and Lin, T. Exploration vs exploitation: Rethinking rlvr through clipping, entropy, and spurious reward.arXiv preprint arXiv:2512.16912,
Reviewed August 3, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.