Putting an AI Scientist in a Cryptographic Straitjacket

• Residual stream. The “column of numbers” is the residual stream at one token position. Each layer's attention heads and MLP read it and add their outputs back into it, and the last position's stream is read out into next-token logits.
• QK and OV. A head's query–key (QK) circuit sets its attention pattern, where it looks; its output–value (OV) circuit sets what it writes back, what gets copied. The framing follows Elhage et al. 2021, A Mathematical Framework for Transformer Circuits, and Olsson et al. 2022, In-context Learning and Induction Heads.
• GQA. Qwen3-0.6B's 16 query heads per layer share 8 key/value heads, so query head h uses KV head ⌊h/2⌋. d_h = 128, and the SwiGLU MLP width is 3,072. Qwen3-1.7B has the same head layout (16 query heads sharing 8 KV heads, d_h = 128), with residual width 2,048 and MLP width 6,144. Because two query heads share each K/V head, head-level interventions at the final position T are applied as anchored float32 deltas on that one query head's output, without editing the shared K/V projections (T2 §2.2). So a “K” or “V” patch recomputes this head's attention at the last word with the donor's keys or values and changes only this head's output. The other query head on the same K/V head is left as it was.
• The question span. Six heads in layers 11–14 (13:6, 12:6, 13:14, 14:12, 11:9, 13:15) act at positions p_query..T−1, the question and the words after it, before the last token T. The router heads at T read what they write there through their values. Finding 3 traces it.
• Margin. m(x) = ℓ(x)·(logit_y0 − logit_y1), signed so that m > 0 when the model prefers the correct (bound) color. The effect of a patch is Δm = m_clean − m_patched, and Δm > 0 means it pushed toward the twin's answer. Direction % is the share of prompts with Δm > 0. It is neither accuracy nor a flip rate. The preference is always between two specified answer words at the next token; free-form generation was not tested.
• Points. One point (logit) of two-way lead multiplies the odds between the two words by e ≈ 2.7. This follows from softmax: the ratio of two words' probabilities is e raised to their logit difference; this page never turns a specific result into odds.

What each switch keeps. Switches A and C keep the same multiset of tokens (the same tokens, rearranged), the length and the color positions (p1, p2); switch C also keeps the last 8 tokens. Under switch B every earlier context token is identical and only the asked-for name (the queried key) changes, so switch B makes no claim about keeping the same tokens.

Notation. A prompt is x = (k_order, c_order, q_key). Switch A is Axis A, the value-color swap (k_order, 1−c_order, q_key). Switch B is Axis B, the query swap (k_order, c_order, ¬q_key). Switch C is Axis C, the context-key swap under a fixed query (1−k_order, c_order, q_key). Each prompt has three matched opposite-answer donors inside its group of eight.

What each donor is used for. Axis A donors separate values from routing (A_ov_color, A_ov_other, A_qk). Axis B donors test the final query (B_q_final, and B_upstream_Q through the upstream heads). Axis C donors test keys against the query (C_k_color, C_q_final, C_ov_color, C_upstream_Q). Every effect is the drop in the signed margin, Δm = m_clean − m_patched, so Δm > 0 means the patch pushed toward the donor's answer. "Direction %" is the share of prompts with Δm > 0; it is not answer accuracy.

What each switch can rule out.

• Switch A keeps the answer's position, so it isolates what the copiers carry (OV). A_qk should sit near 0 by design, as a signed median; single prompts can still move, and the effects cancel on average (v7 Primary / Vocabulary: +0.0050 / −0.0199 logits signed, 0.5150 / 0.2642 absolute). A tiny A_ov_other shows the copied value comes from the two color positions.
• Switch B keeps every earlier context token, so B_k_context and B_ov_context must be exactly 0 by causality; that zero is a sanity check. It isolates the final query, but it cannot tell a copy of the question apart from a match already made against the facts.
• Switch C keeps the question and the color tokens, so a context-free copy of the question (the planted literal_query_only_control) scores 0.0 through the router heads. A nonzero C_upstream_Q shows the final query depends on the facts, and C_q_final against C_k_color weighs the query against key stamps.

At the last word, none of the three shows where the question is first compared with the facts. Applied with patches across the question span [p_query..T−1] instead, switch C is how the later runs (v9, v11, v12) traced the match back to the question heads; Finding 3 has the numbers.

Datasets per run (v4–v7, v10–v12).

• Calibration: 8 groups, n=64, red/blue.
• Primary: 16 groups, n=128, red/blue, split across held-out templates H1 and H2.
• Vocabulary: 8 groups, n=64, green/yellow, split across H1 and H2.

Sign test. An exact one-sided binomial test over group means. Floors: 2⁻¹⁶ = 1.5259×10⁻⁵ (16 groups) and 2⁻⁸ = 0.00390625 (8 groups). A p at its floor means every group mean moved the predicted way; it is the smallest value this test can give. A floor p is a statement about group means and says nothing about size. A row can sit at the floor while some single prompts move the other way (v7 A_ov_color on green/yellow: 78.13% direction, which is 50 of 64 prompts Arithmetic, with p at the 8-group floor). With 8 groups, a p ≤ .01 bar can be met only at the floor, so it requires every group mean to move the predicted way Arithmetic.

Keys (the names). Fresh single-token words from a response-blind whitelist, with a new seed each run (v7: 64 keys, seed 20261023; v10: seed 20261026; v11: seed 20261027; v12: seed 20261028, from an expanded 4–9 letter whitelist). “Rowan” and “Lumen” on this page are illustrative: the write-up never lists a real key word.

Why build this? In October 2026, an essay by Nick Cammarata, "Neural Networks Are Already Clean", argued that neural networks are more legible than many assumed and that automated AI scientists could speed up interpretability research. Other researchers pushed back, calling for rigorous evaluation and for explanations of whole circuits (MIT Technology Review, Oct 19, 2026). This project tried the automated approach under strict, sealed rules.

Who did what. The agents were Codex CLI calls running gpt-6-luna, which proposed and reviewed explanations. Frozen, executable tests decided which ones survived.

Lock 1 · sealed plan (H01). manifest.json records SHA-256 digests of source modules, tests, lockfiles, prompt strings, token-ID arrays, donor indices, frozen head coordinates and comparators before the first target forward pass. v7 manifest: data/bounded-poc-v7-capstone/manifest.json, SHA-256 a59566919a93607e7eff114aa4342807978294ce2b75577cd097fbb55ab9a899, pre-inference commit ff46c4b. This is hash-locked pre-registration (SHA-256 fingerprints committed before inference). It gives tamper-evidence; it keeps nothing secret, and the write-up describes no third-party timestamp.

The demo. The box is hashed as UTF-8 with the browser's built-in SHA-256. The demo rule is v1's base-accuracy prerequisite. Precomputed fallbacks: the 90.0% rule gives b24c6268…60e1 and the 89.8% rule gives 7ff57e8e…3e01; 60 of 64 characters differ.

Lock 2 · retired test sets (H02). Once a held-out split is evaluated or inspected, its files join a protected inventory checked before and after every later run: 1,053 protected files by the capstone (v7), 1,416 after v8-repair, and 21,073 protected file references verified by v12. New keys come from a response-blind whitelist with a fresh seed per run, from 20261023 (v7) through 20261028 (v12); v10’s 64 keys excluded 1,229 retired keys. During v9’s preflight, the harness caught and quarantined a worktree glob bug that would have reused 26 retired keys, before any held-out forward pass ran.

Lock 3 · planted models (H03). Executable synthetic models in float64:

• planted_pointer_model (the right mechanism): must pass every gate.
• literal_query_only_control (copies the literal question word into the final query, without resolving which row holds it): must fail Subgate 2C.
• direct_k_color_only_control (stamps keys onto the answer words, with no pointer in the query): must fail Gate 1C and Subgate 2C.
• nuisance_control and reversed_control: must fail.
• final_token_hop0_only: a planted negative control added for the three-stage work. The Report lists it by name only; the plain description above is our reading of the name.

Tests: 202+ unit and planted-control tests (Report). The earlier manuscript appendix reported 103 unit tests and 66 Metal hardware regressions passed.

Lock 4 · two runs, separate audits (H04, H05).

• Two fresh OS processes per confirmation; bfloat16 weights; float32 deltas; a single FIFO MPSBatchWorker; batch ≤ 64. Bit-identical saved arrays: 655 across 71 file pairs in v5–v7, 612 across 66 pairs in v10 (Qwen3-1.7B), and 1,212 across 84 pairs in v12 (Qwen3-1.7B), with a maximum delta audit error of 0.00000000 in v10 and v12.
• Anchored delta: H^patched = BF16(H^meas,clean + [H̃^rec,patched − H^rec,clean]_FP32). Fused BF16 attention and explicit FP32 reconstruction differ by ≤ 0.045, and the self-patch identity error is 0.00000000.
• The two fresh runs per confirmation show the numbers repeat exactly; they are not extra samples. Generalization comes from the disjoint key pools and template variations (T2 §7).
• The audits recompute the attention probabilities (after position encoding), masked value deltas, group sign tests and gate booleans from the saved arrays. The manuscript reports agreement to ≤ 1.53×10⁻⁵ against a 3.0×10⁻⁵ tolerance. They reuse some of the same NumPy arithmetic as the production code.

Lock 5 · reference-bound review (M03, M04). In v4-confirm, 55 of 56 floating-point claims matched the saved arrays; one drifted by 4.88×10⁻¹³ (0.03109455108691406 vs 0.03109455108642578). From v5 on, the reviewer picks metric keys (metric_refs) and code binds the float64 values: 83/83 in v7, 109/109 in v10 and 31/31 in v12. Narrative interpretation stays advisory. In the gold/silver run the reviewer read a table showing that "zeroing 19:5 resulted in 0 errors rescued" as evidence that 19:5 was not helping; the inversion was caught during adjudication.

The first run's bar (M05). v1 sealed a global prerequisite of unassisted ≥ 90.0% (116/128). The model scored 115/128 (89.84375%), so the verdict was INCONCLUSIVE, even though 19:5 passed every head-level gate (read-out 126/128, 98.4375%). Bars differed between runs: v4 was rejected partly at 88.3% / 85.9% against 90%, and the capstone’s Gate 0 required ≥ 80.0% on every split after its accuracy threshold was revised from 85% before the run, using earlier outcomes. Earlier failed studies were not regraded.

Limits. Cheat-resistant: it blocks the shortcuts listed. Bars for a new run can still be chosen with knowledge of retired runs, as v7’s revised thresholds show. Everything here is self-reported, and no one outside the project has reviewed the work. The source code is public under Apache-2.0 in scasella/qwen3-auto-interp, with the harness and its mathematics documented. The frozen reports, prompt sets and saved arrays are private, so a public clone cannot rerun the audits.

The map (Fig 5.1). Stage 0, H0 = {13:6, 12:6, 13:14, 14:12, 11:9, 13:15}, works across the question span [p_query..T−1]. Stage 1, U = {17:1, 16:4, 15:4} in Qwen3-0.6B and {16:4, 17:1, 18:7} in Qwen3-1.7B, sits at the final token T and reads the question span through its values V_u. Stage 2, D = {19:5, 21:13, 22:9} in both models, takes the pointer in its final-token query Q_T, attends to the matching color and copies it (OV). In v11 the three-stage route (B_hop0_qspan 3.50–4.45 logits, C_hop0_qspan 2.91–3.50) moved the preference the predicted way on all 192 held-out prompts and on the 64 calibration prompts used for selection; v11 failed its overall verdict on Gate 0 (101 of 128 against a required 103, 78.91% against 80%). Full detail in Finding 3 and the run history for v11.

19:5 is a direct value mover (v2, F03). At the final token, 19:5 puts 0.7688 of its attention on the bound value token, 0.1359 on the distractor value, 0.0332 on keys and 0.0041 on delimiters. Under switch A (Axis A), patching only from the color positions (source_color) carried 2.7489 of 2.7601 logits; all other positions (source_other) carried −0.0021 logits (46.88% direction). ov_color = 2.6470 logits (96.09% direction); qk = −0.0080 logits. QK near zero is expected here, because the target stays at the same position.

The coalition (v2, v3, F04). A dense screen of all 128 heads in L15–22 found 21:13 (100.0% readout, 100.0% patch direction, 1.69 logits) and 22:9 (100.0%, 100.0%, 2.55 logits). Patching 19:5 + 21:13 + 22:9 from the opposite-assignment donor moved 5.56 logits, 61.62% of the clean-to-counterfactual gap, 128/128 (sign-test p = 2.33 × 10⁻¹⁰, the floor of that test: every group moved the predicted way), and transferred to green/yellow without refitting (64/64, 5.9788 logits). On four-row prompts (v3) the coalition still carried 73.48% of the median gap (2.17 logits). These are sizes of a controlled contrast, not shares of the model's whole decision (T2 §7). The single-head effects (2.7601, 1.69, 2.55) do not add up to the joint one.

Double dissociation (upstream, F05). Axis A: coalition OV-color 5.3156 logits (100.00%) on red/blue, 6.1556 (100.00%) on green/yellow; coalition QK −0.0178 / −0.0578. Axis B: coalition QK 5.5546 (100.00%) / 6.1784 (100.00%); context OV 0.000000 (exact).

The routers (upstream, F06). A two-pass, pure-QK mediation screen of all 304 heads in L0–18 at the final token found 17:1, 16:4 and 15:4. Through the copiers' final-position queries they mediated 5.1613 logits, 92.9% of the Axis B QK effect (100.00% direction); 5.30 logits (85.8%) on green/yellow (T1 P6).

The capstone (v7, T2 Table 2). It passed after three of its thresholds were revised before the run, using earlier outcomes: accuracy from 85% to 80%, and two attention-shift bars. Earlier failed studies were not regraded.

• A_ov_color 4.1389 / 94.53% / p 1.53e-5 (Primary) and 4.7189 / 78.13% / 0.00391 (Vocabulary). Both p-values are the smallest their sign tests can give (16 and 8 groups): every group moved the predicted way. The Vocabulary direction is 78.13% against a ≥ 78% bar, i.e. 50 of 64, the minimum passing count Arithmetic.
• A_ov_other median absolute 0.0209 logits (198.2×) and 0.0313 (150.7×): copying from any other position does almost nothing. The write-up rounds this pair to 4.14 against 0.02.
• A_qk signed median +0.0050 logits (abs 0.5150) and −0.0199 (abs 0.2642). On average, swapping where the heads look had no net effect on the color-swap test; single prompts do move, in both directions.
• B_k_context and B_ov_context 0.000000, which "must equal 0.000000 by autoregressive causality". That zero is a sanity check.
• Swapping just the copied color values moves the answer margin by about 4.1–4.7 logits (median). These are patch effects; they are not the model's own preference.

The copiers in Qwen3-1.7B (v10, §5.4). A blind screen over all 176 heads in layers 15–25, with no coordinate prior, selected {22:9, 19:5, 21:13}. A_ov_color: Primary 18.33 logits, 68.85% of the clean-to-counterfactual median gap, 91.41% direction, 265.4× A_ov_other (0.0691 logits); Vocabulary 14.09 logits, 70.06% of the gap, 96.88%, 192.9×. Calibration, which is selection evidence: 17.78 logits, 67.8%, 382.5×. Logit scales in 1.7B are much larger than in 0.6B, so compare directions and shares across the models, never raw sizes. v10 passed every gate (108/108 criteria).

Selection. Heads were selected on calibration prompts, so calibration results are selection evidence, not confirmation. The selected heads are not shown to be unique or exclusive, and this is not a complete account of how the model does lookup.

Run verdicts. v2 failed its gate3_rescue for a ceiling reason: the model scored 128/128 on held-out prompts, leaving no errors to rescue. Upstream failed a uniform 30 pp per-head attention gate on the deeper heads. See the run history for v2, upstream and v10.

Scope. "A verified, high-leverage causal subgraph, not an exhaustive or exclusive circuit" (T2 §7). “Answer preference” is the preference between two specified answer words at the next token; free-form generation was not tested.

The guess that failed (v4-confirm, F07). Gate 1C pre-registered the intuitive hypothesis that keys get stamped onto the answer words: under switch C (Axis C), patching K at the two color positions (C_k_color) should carry the ~4.5-logit routing effect. It reduced the margin by 0.7706 logits (71.88% direction; 0.3746 on green/yellow). The copiers' attention gained 1.5 points on the swapped target and lost 4.4 on the original (+1.47 / −4.39 pp). Name stamps are a minor route: about 17% in this test.

The bookkeeping (F08). A head's final-token output depends only on (Q_T, K_1..T, V_1..T). C_ov_color = 0.0472 logits (58.59% direction) and C_k_color = 0.770555, so the rest of the 4.560079-logit B_q_final effect should sit in Q_T: 4.560079 − 0.770555 = 3.789524, quoted as 3.7895. Pure-Q_T replay from the switch-C donor onto clean K and V measured C_q_final = 3.797235 logits (100.00% direction, 128/128). Sum check: 3.797235 + 0.770555 = 4.567790 against 4.560079.

B_q_final 4.560079 · C_k_color 0.770555 (71.88% direction) · C_ov_color 0.0472 (58.59%) · predicted C_q_final 3.7895 · measured 3.797235 (128/128) · C_q + C_k = 4.567790 vs 4.560079. Counting the 0.0472 value term too, the prediction would be 3.7423, 0.055 from the measurement. Medians need not add through softmax and RMSNorm, so this is a conservation-based prediction.

The prediction and the measurement are 0.0077 logits (0.2%) apart when the 0.047-logit value term is treated as zero; including it, the prediction is 3.7423, 0.055 away Arithmetic. It rests on four assumptions: (a) the switch-C total equals the switch-B query effect, because 4.5601 was measured with switch B; (b) keys and values at non-color positions contribute about 0; (c) the query and key effects add; (d) the value term at the color positions is 0.

Provenance. The measurement came from a read-only, post-hoc script (diagnose_bounded_poc_v4_axis_c_q.py) on the frozen v4 dataset. The prediction is narrated in the write-up; it was not hash-registered. The query pathway was then tested prospectively in v5, v6 and the capstone.

The routers carry most of it (F09). C_upstream_Q patches only 17:1, 16:4 and 15:4 at the last word from the switch-C donor, then replays only the copiers' Q_T onto clean K and V: 3.3601 logits, 88.5% of C_q_final Arithmetic, with 128/128 Primary and 64/64 Vocabulary in the predicted direction. In v5 and v6, all four query paths (B_q_final, C_q_final, B_upstream_Q, C_upstream_Q) were 192/192 in each run. In the capstone, C_upstream_Q was 3.6125 (Primary) and 2.4117 (Vocabulary), 91.7% and 85.0% of C_q_final Arithmetic.

Most of the routing (about 83% in the first test) travels in the final word's query, and patching just the three upstream heads reproduces most of that (88.5%). The 83% comes from v4 only.

The planted decoy. literal_query_only_control copies only the queried key token. It passes B_upstream_Q, scores 0.0 on C_upstream_Q, and Subgate 2C rejects it automatically.

Capstone rows (v7, T2 Table 2). C_q_final 3.9396 / 100.00% / 1.53e-5 and 2.8361 / 100.00% / 0.00391 (bar ≥ 1.50 logits; both p-values are the smallest their sign tests can give, 16 and 8 groups, so every group moved the predicted way); C_k_color 0.5777 (6.82×) and 0.4797 (5.91×) (bar: C_q_final ≥ 2.5× C_k_color); per-prompt dominance 96.88% (124/128) and 92.19% (59/64) (bar ≥ 75%); B_upstream_Q 3.9876 and 3.2122 (bar ≥ 1.40); C_upstream_Q 3.6125 and 2.4117 (bar ≥ 1.00). Every row PASS. The capstone passed after three of its thresholds were revised before the run, using earlier outcomes: accuracy from 85% to 80%, and two attention-shift bars. Earlier failed studies were not regraded.

The larger model (v10, Qwen3-1.7B, §5.4). With its own router heads (16:4, 17:1, 18:7, found by a blind search of 144 heads in layers 10–18) and the same three copiers: C_q_final 11.36 / 9.56 logits (Primary / Vocabulary, 100.00% direction) against signed C_k_color 3.2429 / 1.8379, so 3.50× and 5.20×, with the query dominating on 89.84% and 98.44% of prompts. B_q_final 18.17 / 11.89, B_upstream_Q 13.12 / 9.77 and C_upstream_Q 7.50 / 6.99 logits, all 100.00%. v10 passed every gate (108/108 criteria). Logit scales in 1.7B are much larger than in 0.6B, so only ratios and directions compare across the two models.

Scope (T2 §7). This supports pointer-like routing on two-record tasks. It does not show that the model stores discrete symbolic slot variables. Heads were selected on calibration prompts, so calibration results are selection evidence, not confirmation. Where the router heads pick up the match is traced in the next finding, It starts at the question.

The decomposition (bounded-poc-v9-json-hop0, Qwen3-0.6B, seed 20261025). Under Axis C (fixed surface question, swapped context keys), v9 decomposed the attention inputs of U = {17:1, 16:4, 15:4} at the final token T, then replayed only the copiers' pure Q_T. Full reconstruction from the donor's (Q_u(T), K_u(1..T), V_u(1..T)) gave B_U_full 0.3329 and C_U_full 0.3018 logits on Primary, matching direct U-output mediation within ≤ 0.0193 logits on both splits (conservation check passed).

• C_U_v_all (values at every position, including the question span [p_query..T]): 0.2514 logits, 83.3% of C_U_full, 95.31% direction, p = 1.53e-5 (Primary); 0.2193, 81.7%, 95.31%, p = 0.0039 (Vocabulary). Both p-values are the smallest their sign tests can give (16 and 8 groups). Axis B: B_U_v_all 0.2827 / 0.2730.
• C_U_q_final (the routers' own query at T): 0.0078 (58.59%) / 0.0034 (54.69%).
• C_U_kv_context (keys and values of the record lines, j < p_query): 0.0021 (53.13%) / 0.0048 (51.56%).
• C_U_k_all (keys at every position): 0.0221 (61.72%) / 0.0182 (59.38%).
• §5.5 also reports that screening layers 0–14 only at the final token gave null effects (B_hop0 −0.0013, C_hop0 −0.0023 logits), which fits the match being written at the question span.

The rest of v9. v9 also tested quoted JSON and Markdown-table records. The query still beat the key stamps, 11.53× (Primary) and 7.77× (Vocabulary), but quote padding compressed logit margins about tenfold and quoted-JSON slot-2 accuracy dropped (64.8% overall), so the magnitude gates failed. JSON transfer is partly tested, not shown. v9 failed both of its tracks. During preflight, the harness caught a worktree glob bug that would have reused 26 retired keys, before any held-out forward pass ran. See v9 in the run history.

The screen (bounded-poc-v11-question-hop0, Qwen3-0.6B, seed 20261027). All 240 candidate heads in layers 0–14, patched strictly across the question span [p_query..T−1], with the residual input at T clamped clean through layer 17, in a three-stage pure-mediation pass: H0 at [p_query..T−1] → pure V_u([p_query..T]) of U at T → pure Q_T of D at T → logits. Six greedy calibration rounds, 1,425 candidate coalitions and 8,553 microbatches selected H0 = {13:6, 12:6, 13:14, 14:12, 11:9, 13:15}.

• Ranges across calibration, Primary and Vocabulary: B_U_v_qspan 2.91–3.91, C_U_v_qspan 2.07–2.71, B_hop0_qspan 3.50–4.45, C_hop0_qspan 2.91–3.50 logits. All four routes moved the predicted way on all 192 held-out prompts, and on all 64 calibration prompts, which are selection evidence.
• C_U_v_qspan 2.3648 against C_U_kv_context 0.0089 logits on Primary, about 265×, with 100% per-prompt dominance. This is a different ratio from the copiers' 265.4× in Qwen3-1.7B (Finding 1); the two happen to round alike.
• 63/63 mechanism criteria (Gates 1 and 2) passed. Gate 0 failed: the unmodified model answered 101/128 (78.91%) of the main held-out prompts against a required 80.0% (103/128), on the last 168 unretired whitelist words. The overall verdict is a fail. See v11 in the run history.

Next. v12 froze these six coordinates and applied them to Qwen3-1.7B with zero new stage-0 search, paired with the 1.7B routers {16:4, 17:1, 18:7}; see Finding 5.

Safe summary. Confirmed in pre-registered runs that passed every gate (the capstone, v7, in Qwen3-0.6B: 5/5 gates, 80/80 checks; v10 in Qwen3-1.7B: 108/108 criteria), and directionally consistent on 960/960 prompts pooled across five datasets in two model sizes. Three of those five runs (v4, v5, v6) failed other gates, so the 960 is pooled direction and is separate from the run verdicts.

The capstone (v7). The frozen six heads, the v4 template family, 64 fresh disjoint keys (seed 20261023), 256 prompts: 64 calibration (red/blue), 128 primary (red/blue, two held-out templates) and 64 vocabulary (green/yellow), in independent 8-prompt groups. Manifest SHA-256 a59566919a93607e7eff114aa4342807978294ce2b75577cd097fbb55ab9a899, committed before inference (ff46c4b). It passed after three of its thresholds were revised before the run, using earlier outcomes: accuracy from 85% to 80%, and two attention-shift bars. Earlier failed studies were not regraded.

Pooled v4–v7 and v10. Five disjoint key pools: four in Qwen3-0.6B (v4–v7, 256 keys, three template families; v7 reused the v4 family) and one in Qwen3-1.7B (v10, 64 fresh keys, seed 20261026). 960 = 5 × 192 (128 red/blue + 64 green/yellow per run; calibration excluded) Arithmetic. In v4, the switch-C pointer rows (C_q_final, C_upstream_Q) come from the read-only axis-c-q diagnostic on the frozen v4 data. In v10 the router trio is Qwen3-1.7B's own, {16:4, 17:1, 18:7}.

p-values at their floor. 1.53e-5 = 2⁻¹⁶: every one of 16 groups moved the predicted way, the smallest value this test can give. 0.00391 = 2⁻⁸ for 8 groups.

Where 80/80 comes from. 21 Gate 1 subcriteria + 19 Gate 2 subcriteria = 40 per word pair, ×2 pairs; Gate 3 is their conjunction. This split is our inference from the gate counts Arithmetic.

Green/yellow, pointer paths. v7: B_q_final 3.7078, C_q_final 2.8361, B_upstream_Q 3.2122, C_upstream_Q 2.4117 logits (medians), all 100.00% direction. v10: B_q_final 11.89, C_q_final 9.56, B_upstream_Q 9.77, C_upstream_Q 6.99 logits, all 100%; the larger model's logits run on a bigger scale, so these sizes do not compare across models. Earlier transfer (v2): 100.00% (64/64, 5.9788 logits) without refitting a single parameter.

v10 · Passed every gatev11 · Failed its verdictv12 · Passed every gate

Safe summary. In Qwen3-1.7B, a blind search found the same three copier heads as in Qwen3-0.6B and two of its three router heads, in a run that passed every gate (v10, 108/108 criteria). The six question heads found in Qwen3-0.6B, carried over with no new search, connected into the larger model's pathway as predicted on 92.2% to 100% of held-out prompts, in a run that passed every gate (v12, 63/63 criteria).

The two models. Qwen/Qwen3-0.6B at revision c1899de. Qwen/Qwen3-1.7B at revision 70d244cc86ccca08cf5af4e1e306ecf908b1ad5e: 1.72B parameters, 28 layers, 16 query heads and 8 KV heads per layer, d_h 128, residual width 2,048, MLP width 6,144. Both models have 28 layers of 16 query heads, so layer:head coordinates line up.

v10 (blind search). Seed 20261026; 64 fresh keys, excluding 1,229 retired keys; 256 prompts (64 calibration, 128 Primary red/blue, 64 Vocabulary green/yellow). Before any held-out prompt ran, a 2,134-microbatch calibration screen scored all 176 heads in layers 15–25 as copier candidates and all 144 heads in layers 10–18 as router candidates. It selected {22:9, 19:5, 21:13} and {17:1, 18:7, 16:4}. Gate 0: 62/64 (96.88%) calibration, 120/128 (93.75%) Primary, 62/64 (96.88%) Vocabulary. A_ov_color 18.33 / 14.09 logits (68.85% / 70.06% of the clean-to-counterfactual median gap; 265.4× / 192.9× A_ov_other). B_q_final 18.17 / 11.89; C_q_final 11.36 / 9.56, 3.50× / 5.20× the signed C_k_color (3.2429 / 1.8379) and larger on 89.84% / 98.44% of prompts; B_upstream_Q 13.12 / 9.77; C_upstream_Q 7.50 / 6.99 logits; every pointer path 100% direction. Two fresh processes: 612 bit-identical arrays across 66 NPZ pairs, maximum delta audit error 0.00000000. Review: support, 109/109 numbers bound by code. Run history: v10.

v11 (where the six came from). On Qwen3-0.6B (seed 20261027), a screen of all 240 heads in layers 0–14, patching only across the question and the words after it, ran six greedy calibration rounds over 1,425 candidate coalitions (8,553 microbatches) and selected {13:6, 12:6, 13:14, 14:12, 11:9, 13:15}. It passed all 63 of its mechanism criteria but failed its overall verdict: the unmodified model answered 101 of the 128 main held-out prompts, against a required 103 (78.91% vs 80.0%).

v12 (carry over). Seed 20261028; 64 fresh keys from an expanded 4–9 letter whitelist. The six Stage 0 coordinates were frozen from v11, with no Stage 0 search on Qwen3-1.7B, and paired with v10's routers {16:4, 17:1, 18:7} and the shared copiers. Gate 0: 64/64 calibration, 127/128 (99.22%) Primary, 62/64 (96.88%) Vocabulary. Three-stage routes: B_hop0_qspan 4.34 (99.22%, p 1.53e-5) / 3.78 (100%, p 0.0039); C_hop0_qspan 1.15 (92.19%) / 1.39 (100%) logits. Stage 1 through question-span values: B_U_v_qspan 12.77 / 8.53, 100%, with B_U_kv_context exactly 0.000000; C_U_v_qspan 4.12 / 3.92, 100%, larger than C_U_q_final (0.5865 / 0.5697) on 97.66% / 100% of prompts and than C_U_kv_context (0.2401 / 0.2261) on 98.44% / 100%, about 17.1× on Primary. Two fresh processes: 1,212 bit-identical arrays across 84 NPZ pairs; 21,073 protected file references verified. Review: support, 31/31. Run history: v12.

A side check. A non-gating diagnostic ran the small model's original routers (15:4, 16:4, 17:1) inside Qwen3-1.7B. The three-stage effects were still significant: B 3.03 / 2.70 and C 0.76 / 0.81 logits (Primary / Vocabulary).

Reading these numbers. Heads were selected on calibration prompts, so calibration results are selection evidence, not confirmation. The two fresh runs per confirmation show the numbers repeat exactly; they are not extra samples. A p-value at its floor (1.53e-5 for 16 groups, 0.0039 for 8) means every group moved the predicted way. Logits in the larger model run on a bigger scale, so sizes are not comparable across the two models.

v1 · Inconclusivegold/silver · Failed a prerequisitev8 · Rejected

v1 (red/blue). The model scored 115/128 (89.84375%) on held-out prompts, against a required 116, so the run was inconclusive; head 19:5's read-out scored 126/128 (98.4375%) and was right on 13/13 of the model's errors. Its donor-patch direction was 128/128 over all held-out prompts, errors included. Because the read-out was right on all 13 errors, its 2 misses fell on prompts the model got right Arithmetic. No attention numbers are reported for the v1 errors.

Gold/silver follow-up. The run failed a calibration prerequisite, so its read-outs are descriptive. Calibration accuracy 55/64 (85.94%): gold 32/32, silver 23/32. All 9 calibration errors are among those 64 prompts. On 9/9, 19:5's leave-group-out read-out predicted silver, its attention favored silver over gold, and four ways of removing or swapping it each made the error worse (median changes: −0.5626 zeroing, −0.6498 mean replacement, −1.3487 opposite-donor patching, −1.3048 source-V swap, in logits). The logit lens after layer 19 already favored silver on 5/9 errors.

What overruled it. Later layers added about −1.2 logits against silver on the errors (−1.2074; layer 24 attention −0.9835), led by head 24:7, which leaned toward “gold” on all 192 prompts it was measured on (+0.498 to +1.964 logits) and averaged −1.2421 against silver on the 9 errors. That was with one set of key words; with a fresh set, the lean largely vanished. The −1.2 figure is not 24:7's own number.

Why both fixes backfire (T2 §6.1). If h(x) = s_task(x) + b_prior with E[s_task(x)] = 0, then μ_h = E[h(x)] = b_prior. Replacing h(x) with μ_h leaves the constant lean in place (1 fixed / 3 broken on both splits). Setting h(x) to 0 subtracts b_prior from every prompt, which moves the decision line: 4 fixed / 0 broken on calibration (59/64), 3 fixed / 4 broken on the 128 confirmation prompts. Both rows imply a 120/128 confirmation baseline (118 − 1 + 3; 119 − 3 + 4) Arithmetic.

Fresh key words (v8-repair, Track A). Keys from an expanded 471-word whitelist: calibration rose from 55/64 (85.94%) to 62/64 (96.88%) with silver 32/32, and the mean calibration margin reversed to favor silver by 0.4196 logits. Held-out: 122/128 (95.31%), silver 62/64, so gold 60/64 Arithmetic. 24:7 was not re-measured. The run also tried a “frozen repair (α=2.5, γ=1.0)” that gave 2 fixed / 2 broken; it is not the proposed error flag, so it counts neither for nor against that idea.

A reviewer slip, caught. During the gold/silver test, the project's AI reviewer read a table showing that zeroing 19:5 rescued 0 errors and briefly claimed 19:5 was not helping. The inversion was caught during adjudication: removing a helpful head makes errors worse, and it did on 9 of 9.

The four-row task (v3). Each prompt held 4 key-value bindings (4 queries × 6 balanced assignments) in a value-before-key held-out grammar. Unassisted baselines: 47/64 (73.44%) on discovery and 104/128 (81.25%) on primary held-out. All 17/17 discovery errors and 18/24 primary held-out errors named the last record’s color. With two candidate colors that follows for any mismatched prompt, so the 32/32 vs 15/32 (46.88%) split carries the evidence. Six opposite-assignment pairs failed in both color flips, which rules out a static color preference.

• 19:5’s patch direction fell from about 97% in v2 to 61.72% (53.13% on green/yellow), while 22:9 kept pushing the right way on 83.59% (81.25%). These are patch-direction rates, not accuracy.
• 19:5’s donor effect pointed the wrong way on 14/24 baseline errors, against 5/104 correct prompts.
• In the value-before-key grammar, causal masking means a value token at position v_i < k_i cannot attend to its own key token k_i.
• Centering on the global dataset mean μ_disc cannot remove prompt-specific attention to the last record, because μ_disc averages opposite last-record colors to zero.

Layout and template (v5, v6). In v5 a blank-line layout pulled 19:5 toward line 2: its solo switch-A direction fell to 50.78% (65/128) while its routing direction stayed 128/128. In v6, 29-token inline examples left three 19:5-solo attention-shift cells short of the bar (7.7–10.2 pp).

Slot profiles (v8 calibration, T5 Table 5). Mean attention probability on each value slot over 64 calibration prompts in which every slot is queried equally often. The excess is Slot 4 minus the four-slot mean. The write-up’s blog table quotes 1.46× and 1.51× “toward Slot 1” for 21:13 and 22:9; those are the reciprocals of 0.69× and 0.66×. This page uses Slot 4 ÷ Slot 1 throughout.

The steering table (v3). Centered amplification x + (α − 1)(x − μ_disc) of 19:5 + 21:13 + 22:9 on the 64 discovery prompts (baseline 47/64), which were also the selection data. The zero-regression gate rejected all four candidates, and the selector abstained (identity).

The repair (v8-repair, Track B). Stage 1 froze a 24-candidate grid: β ∈ {0.5, 0.75, 1.0, 1.25} × {pre-softmax score, post-softmax probability} × α_22:9 ∈ {1.0, 1.5, 2.0}. Stage 2 selected probability centering, β = 0.5, α_22:9 = 2.0 on calibration (73.44% → 76.56%, 2 fixed / 0 broken, +0.2133 logits) before held-out inference.

• Held-out: red/blue 99/128 → 102/128 (4 fixed / 1 broken, +3) vs naive 100/128 (6 / 5, +1); green/yellow 46/64 → 48/64 (2 / 0, +2) vs naive 48/64 (4 / 2, +2); all 192: 145 → 150 (6 / 1, +5) vs 148 (10 / 7, +3). The naive column was run on the same held-out prompts.
• It passed 9 of 12 held-out subcriteria, including a +0.2814-logit median gain on green/yellow last-record errors (p = 0.0078125; the p-value belongs to that gain). The red/blue baseline-error median shift was −0.0407 logits, slightly the wrong way.
• Verdict: REJECTED, failing three of its four gates (A1, A2, B1). On the main held-out set it did not improve the margins of the recency errors it targeted, and on fresh colors its net gain only tied naive amplification. A separate gold/silver repair in the same run fixed 2 errors and broke 2.
• Why output amplification fails here: a constant positional bias toward the last slot, multiplied by a value vector that is red on some prompts and blue on others, averages to zero in output space.

Numbering. The repository numbers twelve versions, v1 to v12, plus follow-ups: the gold/silver study, the upstream screen and the read-only axis-c-q diagnostic. The doc’s own tables number rows differently. This page names runs instead of numbering them.

The bars changed between runs, each sealed in advance. v1 and v4-confirm needed 90% unassisted accuracy. v7 passed after three of its thresholds were revised before the run, using earlier outcomes: accuracy from 85% to 80%, and two attention-shift bars. Earlier failed studies were not regraded. Under the earlier 85% bar, v7’s green/yellow split (52 of 64, 81.25%) would have fallen short; at 80%, 52 of 64 is the smallest passing count (our arithmetic). v11 required the unmodified model to answer at least 103 of its 128 main held-out prompts.

What a pass covers. Heads were selected on calibration prompts, so calibration results are selection evidence, not confirmation. The selected heads are not shown to be unique or exclusive. Matching locations across the two sizes do not prove the heads are the same component.

The protected files grew run by run. Each retired run was locked into a hash-checked vault: 1,053 protected files by the capstone, 1,416 after v8-repair, and 21,073 protected file references verified by v12.

Sources. The source code is public under Apache-2.0, with a results ledger for every study in scasella/qwen3-auto-interp. The frozen reports, prompt sets and saved arrays are private, so a public clone cannot rerun the audits. Read the write-up.

Ready now means a method or lesson as the write-up describes it. The source code is public; the per-study reports, prompt sets and saved arrays are private. Cards 12 and 13 are this page’s reading of the results (Σ), and the write-up does not list them as uses. The report’s estimate of discovery compute saved by a small-model map has no measurement behind it, so this page leaves it out. Source keys are explained in the colophon; where the published write-up (W) differs from the earlier doc, W wins.

• 01 · T1 P6–P8; T2 §3.2, §4.2; R §2.3; T11. Pooled 960/960 is B_upstream_Q and C_upstream_Q over v4–v7 (0.6B) and v10 (1.7B): direction only, and v4–v6 failed other sealed checks. Stage 1 version: C_U_v_qspan 2.3648 against C_U_kv_context 0.0089 logits (v11 Primary, 100% per-prompt dominance); about 17.1× in v12. v11 failed its accuracy prerequisite (W).
• 02 · T2 §3.3; T5 Release §2.4; T10, T11; W. v7 B_upstream_Q and C_upstream_Q: 100.00% direction on both splits (T2 Table 2). v11: all four three-stage routes in the predicted direction on the 192 held-out prompts and the 64 selection prompts. v12: 92.2% to 100%.
• 03 · T2 §2.2: H^patched = BF16(H^meas,clean + [H̃^rec,patched − H^rec,clean]_FP32); “0.00000000 logit error across all runs”; fused BF16 and explicit FP32 differ by ≤ 0.045.
• 04 · T1 P3 table; T2 §6.1. For h(x) = s_task(x) + b_prior with E[s_task] = 0, μ_h = b_prior. Mean-replacing 24:7: 1 fixed / 3 broken on both splits. Zeroing it: 4 / 0 on calibration, 3 / 4 on the 128 confirmation prompts. The gold/silver follow-up failed a calibration prerequisite (W).
• 05 · T1 P5 steering table, all on v3’s 64 discovery prompts, which also chose the settings: α = 2.0 gave +1.4676 alone and +1.5565 with 27:14 mean-ablated, with 15/17 errors worse and 4 broken. T5 P7.5 repair table: 6 / 1 against naive 10 / 7 on 192 held-out prompts.
• 06 · T1 P7; T2 §2.4; R; T7, T10. 56 float claims, 55 matched; the drift was 0.03109455108691406 against 0.03109455108642578 (4.88 × 10⁻¹³, 13th decimal). From v5 the reviewer picks metric_refs and code binds the values: 83/83 in v7, 109/109 in v10, 31/31 in v12.
• 07 · T2 §2.1, App A; T5 P7.5; R; T7; W Limits. manifest.json is frozen before the first target forward pass with a pre-inference commit (ff46c4b in v7). 1,053 protected files by v7, 1,416 by v8, 21,073 protected file references by v12. v1 scored 115/128 (89.84375%) against a sealed 116/128. v9’s harness caught a worktree glob bug that would have reused 26 retired keys. v7 passed after three thresholds were revised before the run, using earlier outcomes (accuracy 85% to 80%, and two attention-shift bars).
• 08 · T2 §2.3; R §3: planted_pointer_model must PASS; literal_query_only_control, direct_k_color_only_control, nuisance_control and reversed_control must FAIL; the three-stage runs add final_token_hop0_only.
• 09 · T2 §2.2, §2.4; T9; T10; W Limits. 71 file pairs / 655 arrays in v5–v7; 66 pairs / 612 arrays in v10; 84 pairs / 1,212 arrays in v12. Audit agreement ≤ 1.53 × 10⁻⁵ against a 3.0 × 10⁻⁵ tolerance. The two fresh runs are not extra samples, and the audits reuse some of the same NumPy arithmetic as the production code.
• 10 · T1 P8; T2 Abstract; W Reproducibility: one 24 GB Apple M4 Pro MacBook Pro (MPS), BF16 weights. No wall-clock timings are reported.
• 11 · T2 Table 1; T5 §6.3.2; T10; W. v1 89.84% against 90.0%; v2 128/128 on held-out; upstream’s uniform 30 pp per-head gate against 29.2 and 15.0 pp; v8 vocabulary net +2 (2 / 0) tied the naive +2 (4 / 2); v11 101/128 against a required 103, on the last 168 unretired whitelist words.
• 12 · Σ our reading. Five disjoint key pools, v4–v7 and v10 (R §2.3); v5 solo_19:5_A = 50.78% (65/128) while its ΔQ_T routing stayed 128/128 (T2 §6.2); v8 Track A gold/silver baseline 85.94% → 96.88% (T5 §6.3.3).
• 13 · Σ our reading. 32/32 against 15/32 on v3’s 64 discovery prompts (T2 §6.2); 85.94% → 96.88% (T5 §6.3.3); 22/22 = 13 errors in v1 and 9 in the gold/silver follow-up, one head, after the fact, descriptive (T3 #4; W); +1.56 with 15/17 errors worse (T1 P5).
• 14 · W; T9 §5.4; T10; T11 §5.6. v10: blind screens over 176 heads (layers 15–25) and 144 heads (layers 10–18), 2,134 microbatches, PASS with 108/108 criteria. v12: the six Stage 0 coordinates frozen from 0.6B, zero new Stage 0 search, paired with v10’s Stage 1 and the shared Stage 2; PASS with 63/63 criteria; 127/128 Primary correct unmodified; C_hop0_qspan 1.15 logits (92.19%) is the lowest route. W: “six locations carried into a partly rediscovered pathway, not all twelve carried over unchanged.”
• 15 · T5 P7.5, §6.3.2, Row 9; W. Probability-space centering β = 0.5 with α_22:9 = 2.0, selected on calibration from a frozen 24-candidate grid; 6 fixed / 1 broken held-out (145 → 150 of 192); failed three of its four gates; the vocabulary net gain tied the naive comparator; the gold/silver repair fixed 2 and broke 2.
• 16 · T4 §2; R §3 Use Case 1 (its wording is not used here). v1 read-out 126/128 (98.4375%) against the model’s 115/128; 22/22 = 13 + 9 errors.
• 17 · R §3 Use Case 4: quantization, pruning and fine-tuning guardrails, proposed with no experiment.
• 18 · T5 Table 5, Horizon 3; T6 #2. Slot-4 excess over the four-slot mean: +0.05037 (19:5), −0.04301 (21:13), −0.01649 (22:9).
• 19 · T6 #2. Liu et al. 2024 describe a U-shaped curve over long contexts; this study’s v3 errors were a last-row pull.
• 20 · T6 #3; T7, T8 (v9-json-hop0); W. Query over key stamps 11.53× (Primary) and 7.77× (Vocabulary) on quoted JSON and Markdown tables; quote padding compressed logit margins about tenfold and quoted-JSON accuracy dropped, so magnitude gates failed; both tracks failed.
• 21 · T4 §3; T5 Horizon 2; T6 #1; T9 (v10 on Qwen3-1.7B); W Limits.
• 22 · T2 §7 (the first hop was unidentified at the time); T10, T11 (v11 found Stage 0 by screening all 240 heads in layers 0–14 over the question span); W “Next experiment”.
• 23 · T4 §4; W Code: Apache-2.0, source only; the historical runners have fixed paths and are not turnkey replays; the master audit stops without the private evidence.

• “Heads were selected on calibration prompts, so calibration results are selection evidence, not confirmation. The selected heads are not shown to be unique or exclusive, and this is not a complete account of how the model does lookup.” (W, Limits)
• “Matching locations across the two sizes do not prove the heads are the same component. The pathway that passed in the larger model uses 18:7 in place of 15:4.” (W, Limits)
• “‘Answer preference’ and accuracy here mean the model’s preference between two specified answer words, such as red and blue, at the next token. Free-form generation was not tested.” (W, Limits)
• “The two fresh runs per confirmation show the numbers repeat exactly; they are not extra samples. The separate audits reuse some of the same NumPy arithmetic as the production code. No one outside the project has reviewed the work.” (W, Limits)
• “The confirmation of the last two stages passed after three of its thresholds were revised before the run, using earlier outcomes: accuracy from 85% to 80%, and two attention-shift bars. Earlier failed studies were not regraded.” (W, Limits)
• The six heads of the first manuscript are “a verified, high-leverage causal subgraph, not an exhaustive or exclusive circuit. Separate Q and K patch effects need not sum linearly through softmax and RMSNorm, and intervention ratios represent controlled contrast magnitudes rather than percentages of total causal mediation.” (T2 §7) The same limits apply to the twelve, which passed every gate only in Qwen3-1.7B, with 18:7 in place of 15:4.
• The first manuscript said the heads before 17:1, 16:4 and 15:4 were not identified (T2 §7). v11 then screened all 240 heads in layers 0–14 across the question span and selected six in layers 11–14 (T10, T11). The map no longer marks that gap.
• The report’s estimate that a small-model map cuts discovery compute has no measurement behind it, so this page leaves it out. The write-up says measuring that benefit needs investigations that start with the map compared against ones that start without it.
• 24:7’s lean comes from the gold/silver follow-up only, which failed a calibration prerequisite. It is not shown to cause the v1 red/blue errors.