The manuscript presents a method for inserting facts about a name into DeepSeek-V4.1-Flash without changing trained weights. The model already contains an Engram n-gram lookup memory at encoder layers 2 and 15. An entry is a pair (kappa, U) in R^{4 x 5120}, keyed by the exact token sequence of the name (with and without leading space). When the name ends at a position, the entry is scored by the same normalized match used for the table key (Eq. 2) and becomes a third alternative in a three-way softmax gate (Eq. 3): (pi^0, pi^M, pi^E) = softmax(0, x_c, y_c), with residual update h_c <- h_c + pi^M v + pi^E U_c. Proposition 1 proves the algebraic properties of this gate under exact arithmetic: with no entry the gate reduces to the released two-way logistic of Eq. 1; the entry share is taken from both original alternatives; and the update is affine in U_c for fixed scores. Proposition 2 then gives a conditional non-interference theorem: under exact token keys, no suffix conflicts, at most one fire per position, and fixed probes independent of entries, any prompt that uses no entry is computed exactly as the released model, and unused entries cannot affect a prompt. The proof is by induction over layers: the only difference from the released path is the fifteenth-layer memory update at used positions. The theorem does not cover prompts that admit an entry, multi-name interactions above the memory, or probe errors; the paper states these exclusions explicitly (p. 7 and Section 6). The construction is therefore a genuine advantage over shared-weight editors such as ROME and MEMIT, provided the implementation follows the released code path operation-for-operation wherever nothing fires. That implementation claim is plausible from the text but not independently verified from the manuscript alone.
The value U is obtained by a damped minimum-norm Gauss-Newton solve (Section 3.3). Conditions are built solely from the model's own replies: for each told value the model lists confirmed examples, and the solve requires the made-up name to produce the same first tokens under direct and possessive wordings (told rows), the first two tokens of written one-step consequences of the value alone, and (optionally) yes/no assent. Holds keep the lead of the no-entry reply on untold attributes up to one nat. Residuals are defined in Eq. 4; the Jacobian G is obtained by backward passes above layer 15; each step is the dual ridge solution delta = G^T (G G^T + lambda I)^{-1} r of Eq. 5. Proposition 3 correctly establishes that this delta uniquely minimises the damped least-squares objective and is the shortest vector among all vectors with the same linearised effect; the lambda -> 0 full-rank case recovers the Moore-Penrose minimum-norm solution with the Pythagorean identity. The paper is careful that the claim is per linearised step only: the conditions are nonlinear, repeated steps are not proved to converge to a global nearest point, and a met hold still freezes its lead to first order rather than solving a quadratic program. The start p_0 is a fitted combination of class means and a ridge prediction over 358 known people (factor 2/3 chosen on 30 development names); U_0 = (p_0 - kappa)/pi^E. Lemma 1 and Propositions 4-5 justify Euclidean norm within one stream copy by orthogonal invariance of read-write stages, while correctly noting that a simultaneous turn of all four copies fixes nothing about cross-copy weights. Table 5 shows that three natural weightings (entry value, stream change, relative size) tie on eight names, so the paper's choice of least change in U is empirically harmless on the measured legs but is not forced by symmetry.
Admission is decided by four linear ridge probes (birthplace, university, occupation, person-in-general) read at the assistant marker after the full question (Section 3.4, Figure 4). Read at the name's last token the same probes make 102 mistakes in 384 held-out wordings; at the end of the question they make zero. This look-ahead is disclosed: the memory update at the name depends on a later state. It is feasible under full-prompt layer-wise prefill, but it departs from strict left-to-right causal computation and interacts with KV caching, chunked prefill, multi-turn reuse of a previously cached name, and names that first appear in generated text (fallback to a weaker name-position read). The paper notes the departure but does not quantify invariance under caching or serving regimes. Without any read the entry answers 70 of 300 open questions that the untouched model declines; the probes reduce that to zero on the 1,920 open forms of the main evaluation.
The principal evaluation (Section 4) tells 120 made-up names three facts each (8 cities, 5 universities, 4 occupations) on the released DeepSeek-V4.1-Flash-1017 checkpoint. Every question is asked in one greedy pass with reasoning off and no fact in the prompt. Definition 1 cleanly separates stored rows, written consequences, unwritten consequences, and untold questions. Table 2 and Figure 5 report 360/360 direct told facts (solve conditions), 587/600 on five non-condition wordings, 329/330 written consequences, and 481/600 unwritten one-step consequences (untouched 102). With a per-kind value chosen by the same read the unwritten count rises to 582/600 and cross-fact confusions disappear; the entry then stores 102,400 numbers rather than 40,960. All 2,520 untold replies and 500 real-person replies are string-identical to the untouched model; by Proposition 2 this is primarily a probe-refusal result on 21 fixed forms, not evidence that an admitted entry preserves every other attribute. The paper is unusually candid that every question form was seen during development, that four of six unwritten forms appeared in probe fitting, that several consequences are closed-choice, that some university-city answers are recoverable from the surface name, and that the evaluation is therefore a replication on the public checkpoint rather than a blind test. The sharpest internal reading is the disagreeing-fact subset: 147/225 (65 %) when birthplace and university point to different continents or languages. Most of the 119 one-value misses (73) route through the wrong told fact, which the per-kind repair eliminates. Yes/no rows raise assent but cost never-written consequences (Table 4) and were not adopted. Open descriptions still invent details in more than a quarter of replies. These qualifications are already present in the text; they must remain attached to every headline count.
Section 6 reports limited real-entity diagnostics. On the 151 first-hop two-hop MQuAKE-CF cases the method can attempt without a relation-specific read, the two-hop question is answered for 57/151 (untouched 7) while other answers are disturbed (198/453 identical on non-held questions). When a read is fitted on the spot from the model's own examples of the new value and the benchmark's own wordings, the same cases reach 116/151 and leave 440/453 non-read questions unchanged. CounterFact (first 500 records, generated-reply scoring) yields 320/500 taught completions and only 136/1,000 rewordings, with other-subject sentences almost perfectly preserved except where another edited subject is named. These runs are useful diagnostics of scope and second-hop failure; they are not standard benchmark comparisons, and the paper correctly refuses to set its numbers beside published ROME/MEMIT/LEAP figures. The relation to concurrent n-gram-memory editors (EngramEdit, Delta N-gram, User as Engram, ENGRAFT) is stated accurately: the four novelties claimed are the third-alternative gate, the model-own-reply least-change solve, one entry for all of a name's facts, and the kind read. Several 2026 references lack stable DOIs in the audit; that is an availability issue, not evidence of fabrication.
The mathematical core (Propositions 1-5, Lemma 1, Eqs. 1-5) is sound under the stated hypotheses. The empirical claims are carefully separated from the proved construction and are limited by non-blind development exposure, a small closed value set, fitted probes that have seen several consequence forms, a look-ahead admission read, and incomplete public artifacts (saved replies are promised; code, entry files, probes, exact chat templates, scoring aliases, and benchmark filters are not supplied with the manuscript). Confirmed revision needs are: release or fully specify the Engram hook, solve/probe code, entry files, scoring aliases, chat templates, checkpoint hashes, and regeneration scripts; operationalize look-ahead under KV cache, multi-turn, streaming, and generated-name fallback; keep single-value (40,960; 481/600) and per-kind (102,400; 582/600) variants visually and terminologically separate; qualify non-interference so that 2520/2520 and 500/500 are not overread as admitted-entry preservation; and fully specify Section 6 diagnostics with case IDs or scripts while labeling them as ablations. Non-blind scope is already stated repeatedly and needs no new correction beyond keeping it attached to headline counts. The strongest defensible reading is a promising, transparent prototype of a non-weight, memory-side edit that achieves exact unused-entry invariance and non-trivial one-step answer transfer on a fixed three-relation domain, not a general demonstration that the model has come to know arbitrary new facts.
preprint published 2026-11-14 22:08 UTC by preprint-admission
Preprint record published. Integrity screen clean; desk screen PASS. The review summary and available scorecard are attached as public metadata.