Ablation-Reversible Heads Don't Transfer: A Stress Test for Mechanistic Role Claims in Transformers

# Ablation-Reversible Heads Don’t Transfer: A Stress Test for Mechanistic Role Claims in Transformers
Source: [https://arxiv.org/html/2606.08292](https://arxiv.org/html/2606.08292)
###### Abstract

In mechanistic interpretability, attention heads are commonly elevated to*role claims*\(e\.g\., “this head represents addition”\) when they are necessary for a behavior, encode it linearly, and recover that behavior when restored after ablation\. We show this evidence is insufficient: across three 7–8B instruction\-tuned models and five computation families, heads passing all three checks routinely fail to*transfer*the computation when their activations are patched into a different prompt under matched controls\. We introduceKID\(*Knowing / Intent / Doing*\), a role\-assignment lens for attention heads, and pair it with a three\-stage pipeline: capability\-selective screening \(CSS\), singular value decomposition \(SVD\), and activation transduction under matched controls\. Our results document a preliminary role taxonomy \(including prompt\-trajectory stabilizers, answer\-side logit\-bias heads, and soft computation\-pattern carriers\) and show that the*same\-answer control*\(a transduction target sharing the answer string but not the requested computation\) is an underused check that exposes broad state transfer masquerading as semantic specificity\.

## 1Introduction

A central goal of mechanistic interpretability \(MI\) is to understand*why*individual model components, particularly attention heads, matter behaviorally\. A common workflow combines two evidence classes: descriptive evidence \(a component’s activations encode interpretable information\) and causal evidence \(the component is necessary for some behavior\)\. These are often combined quickly: a head whose activations linearly decode the requested computation, and whose ablation damages performance, is treated as a candidate*representation*of that computation\.

We argue this inference is premature, and that the four properties commonly recruited as evidence \(selective necessity, linear decodability, ablation reversibility, and interventional generalizability\) are distinct and routinely dissociate\. A head can encode information linearly without being its causal locus; a head can be necessary without being interventionally generalizable; and a head can be ablation\-reversible \(in the sense that patching its activations restores performance\) without carrying a transferable semantic state\. Conflating these properties leads to over\-confident role claims and, downstream, to misleading interpretations of what transformer circuits are doing\.

To organize this critique constructively, we introduceKID: a three\-part lens that separates*knowing*\(the process by which the model recognizes what a prompt asks for\), a putative*intent*state \(a computation\-selection state after recognition and before execution\), and*doing*\(answer execution and generation\)\. KID is a role\-assignment vocabulary, not a claim about disjoint circuits\. The*knowing*framing is motivated byKadavathet al\.\[[2022](https://arxiv.org/html/2606.08292#bib.bib1)\], who showed that LLMs can often predict answerability before generating an answer — suggesting that prompt recognition and answer generation are not always simultaneous\.

We pair KID with a three\-stage empirical pipeline\.Capability\-selective screening\(CSS; similar toBair and others[2026](https://arxiv.org/html/2606.08292#bib.bib2)\) identifies small head sets whose targeted ablation selectively damages a measured capability while sparing others, establishing that those heads*matter*\.Singular value decomposition \(SVD\)\[Ahmad and others,[2025](https://arxiv.org/html/2606.08292#bib.bib3)\]inspects what information is linearly present inside those heads, using counterbalanced prompt controls to separate semantic structure from surface artifacts\.Activation transduction assaystest whether a head’s state can transport the requested computation from one prompt context to another under matched controls\. We treat only this third stage as evidence for a transferable computation\-selection state\.

We apply this pipeline to five computation families \(arithmetic, comparison, digit properties, dates, and times — all requiring more than factual lookup but less than chain\-of\-thought reasoning\) on three instruction\-tuned 7–8B models\. We find:

1. 1\.The dissociation result\.Selective necessity, linear decodability, ablation reversibility, and interventional generalizability come apart systematically\. The most common pattern is that heads pass the prompt\-side ablation\-reversibility check yet fail to transfer the computation under activation transduction\. Across all model\-family and rank combinations tested under activation transduction, including the cleanest prompt\-side CSS ranks identified, ablation reversibility does not imply interventional generalizability \(Table[1](https://arxiv.org/html/2606.08292#S5.T1)\)\.
2. 2\.A role taxonomy\.CSS\-selected heads exhibit heterogeneous roles across the KID frame: some behave as prompt\-trajectory stabilizers, some as answer\-side logit\-bias heads, some carry soft computation\-pattern information transferable across related families, and none in the current experiments clearly satisfies the full criteria for an interventionally generalizable computation\-selection state \(*intent*in the KID sense\)\.
3. 3\.Methodological implications\.Behavioral screening is a necessary precondition for interpretability claims, but insufficient for role assignment\. Role assignment requires activation transduction under matched controls\. The*same\-answer control*\(a transduction target sharing the answer with the source prompt but not the requested computation\) is an important but underused check that exposes broad state transfer masquerading as semantic specificity\.

Our pipeline and prompt families are released to facilitate replication and extension to additional models and capability classes\.

## 2Related Work

We situate this paper within four overlapping waves of mechanistic interpretability \(MI\) work: early component\-level findings, the common evidence stack used to support them, the growing catalogue of*interpretability illusions*that have complicated those findings, and the recent push toward methodological rigor and auditing\.

#### From induction heads to localized capabilities\.

Early MI work characterized individual attention heads as implementing identifiable algorithms: induction heads for in\-context learning\[Olssonet al\.,[2022](https://arxiv.org/html/2606.08292#bib.bib6)\], name\-mover and inhibition heads for indirect object identification\[Wanget al\.,[2023](https://arxiv.org/html/2606.08292#bib.bib7)\], factual\-association retrieval\[Menget al\.,[2022](https://arxiv.org/html/2606.08292#bib.bib8)\], and copy\-suppression heads\[McDougallet al\.,[2023](https://arxiv.org/html/2606.08292#bib.bib20)\]\. A parallel thread showed that capabilities can localize to surprisingly small parameter or activation subsets:O\(1O\(1–5\)5\)attention heads can suffice for specific measured capabilities\[Bair and others,[2026](https://arxiv.org/html/2606.08292#bib.bib2)\], and even a single weight can be critical for text generation\[Yuet al\.,[2024](https://arxiv.org/html/2606.08292#bib.bib17)\]\. The representational counterpart is the linearity hypothesis — that many relations and concepts are encoded as linear directions\[Hernandezet al\.,[2023](https://arxiv.org/html/2606.08292#bib.bib19)\]in subspaces shaped by superposition\[Elhageet al\.,[2022](https://arxiv.org/html/2606.08292#bib.bib16)\]\.

#### The common evidence stack\.

These findings rest on a recurring methodological combination: probes for linear decodability\[Belinkov,[2022](https://arxiv.org/html/2606.08292#bib.bib9), Burnset al\.,[2023](https://arxiv.org/html/2606.08292#bib.bib10)\], activation patching for causal mediation\[Viget al\.,[2020](https://arxiv.org/html/2606.08292#bib.bib13), Menget al\.,[2022](https://arxiv.org/html/2606.08292#bib.bib8), Conmyet al\.,[2023](https://arxiv.org/html/2606.08292#bib.bib14)\], and ablation for necessity\. The combination is widely employed but has no community\-agreed validation protocol, and probing alone has long been known to overstate causal claims\[Elazaret al\.,[2021](https://arxiv.org/html/2606.08292#bib.bib11), Hewitt and Liang,[2019](https://arxiv.org/html/2606.08292#bib.bib12)\]\. The patching tool itself has also received scrutiny:Zhang and Nanda \[[2024](https://arxiv.org/html/2606.08292#bib.bib26)\]show that within\-prompt patching results are sensitive to corruption method, evaluation metric, window size, and choice of corrupted tokens\. We address a complementary axis: even when intra\-prompt patching follows current best practices, the resulting evidence does not establish interventional generalizability, which requires*cross\-prompt*transduction under matched controls\.Toddet al\.\[[2024](https://arxiv.org/html/2606.08292#bib.bib15)\]showed that some internal states can be extracted and reused as function\-like operators — a stronger form of evidence that motivates our transduction assays\.

#### Interpretability illusions\.

A growing body of work shows that this common combination can produce confident\-looking but misleading conclusions\.Makelovet al\.\[[2023](https://arxiv.org/html/2606.08292#bib.bib21)\]demonstrate that subspace activation patching can change a model’s output via a*dormant parallel pathway*causally disconnected from the behavior of interest, dissociating successful intervention from faithful localization\.Friedmanet al\.\[[2024](https://arxiv.org/html/2606.08292#bib.bib22)\]show that simplified proxies \(PCA, clustering, SVD\-based summaries\) can match the original model in\-distribution while diverging out\-of\-distribution, undermining the predictive value of derived mechanistic stories\.Mélouxet al\.\[[2025](https://arxiv.org/html/2606.08292#bib.bib23)\]reframe circuit discovery as statistical estimation and find that single\-input causal mediation scores have high intrinsic variance, so circuits identified by common pipelines are fragile under input or hyperparameter perturbations\. Our dissociation result is complementary: rather than questioning a particular tool \(subspaces, proxies, scores\), we show that the*joint*evidence stack — selective necessity, linear decodability, and ablation reversibility — fails to imply transferable computation when probed by activation transduction under matched controls\.

#### Toward auditable MI\.

Sharkeyet al\.\[[2025](https://arxiv.org/html/2606.08292#bib.bib24)\]catalogue conflating hypotheses with conclusions as a recurring failure mode and call for stronger validation practices\.Lanet al\.\[[2026](https://arxiv.org/html/2606.08292#bib.bib25)\]go further, arguing that MI needs a standardized auditing layer because methodologically inconsistent studies of the same behavior have already produced conflicting conclusions in the literature\. Our pipeline is designed in this spirit: every role claim is gated on an interventional\-generalizability test under matched controls, including a*same\-answer control*that exposes broad state transfer masquerading as semantic specificity\. The outcome — a role taxonomy in which most CSS\-selected heads do*not*clear the bar for an interventionally generalizable computation\-selection state — is consistent with the illusions literature and operationalizes one path the rigor literature has called for\.

## 3The KID Framework

### 3\.1Role Definitions

We introduce KID as a role\-assignment vocabulary for attention heads identified by CSS\.Kadavathet al\.\[[2022](https://arxiv.org/html/2606.08292#bib.bib1)\]showed that LLMs can often predict which prompts they will answer correctly before generating the answer, suggesting that prompt understanding and answer generation may not occur simultaneously — leaving room for an intermediate*computation\-selection state after recognition and before execution*, which we name*intent*\. Our results do not yet show an intent state, but the KID lens organizes the role landscape we observe:

- •Knowing\.*Concept:*the model’s process of recognizing what the prompt asks for\. Token by token, the model builds an interpretation of the request; many possible interpretations may be active in parallel early in the prompt, with one strongly preferred by the final prompt token\.*Operationalization:*a head fills this role if its activations at prompt positions carry linearly decodable requested\-computation information and its ablation damages prompt\-level recognition rather than answer production\.
- •Intent\.*Concept:*a computation\-selection state after recognition and before execution\. If anti\-correlated requested computations share representational space \(addition and subtraction\), then committing to one should suppress the others;*intent*is the proposed locus of this commitment\.*Operationalization:*a head fills this role if it satisfies the*knowing*\-role criteria and is also*interventionally generalizable*— its state, when extracted from a source prompt and inserted into a target prompt, redirects behavior toward the source computation under matched controls\.
- •Doing\.*Concept:*answer execution — scoring candidate answers, formatting the continuation, generating the output\.*Operationalization:*a head fills this role if its activations at answer positions are necessary, its ablation damages the reference answer, and same\-prompt ablation reversal is achieved by restoring activations at answer \(not prompt\) positions\.

KID does not assume clean architectural boundaries\. A head may play a boundary or mixed role, and the aggregate behavior of a CSS top\-kkhead set need not correspond to a single KID role\. The frame is a vocabulary for asking targeted questions and designing discriminating assays, not a prior about model organization\.

### 3\.2Evidence Requirements

The four properties most commonly recruited as evidence in MI work are:

1. 1\.Selective necessity:targeted ablation of the head set damages the target capability while largely sparing other capabilities\.
2. 2\.Linear decodability:requested\-computation labels can be decoded from the head’s activations by a linear \(nearest\-centroid\) probe\.
3. 3\.Ablation reversibility:performance can be recovered by restoring the head’s clean activations after ablation, at some set of token positions\.
4. 4\.Interventional generalizability:activations from a source prompt with computationAA, when patched into a target prompt with computationBBunder matched controls, redirect behavior towardAA\.

The strongest evidence for an*intent*role requires all four together, with ablation reversibility established at*prompt*positions and interventional generalizability confirmed under same\-answer controls\. No head satisfying all four has been identified in the current experiments\.

### 3\.3The Three\-Stage Pipeline

The pipeline operationalizes KID role assignment:

Stage 1 — CSS:identify head sets that are selectively necessary\. This establishes behavioral importance but not any representational claim\.

Stage 2 — SVD:inspect what information is linearly present inside those heads using counterbalanced prompt controls to separate semantic structure from surface artifacts\. This provides descriptive evidence relevant to*knowing*role claims\.

Stage 3 — Activation transduction:test whether a head’s state transfers the requested computation to a new prompt context under matched controls \- giving evidence for interventional generalizability\.

### 3\.4Why the Properties Dissociate

The four properties are logically independent\. Understanding how they dissociate clarifies the failure modes we document \(see Figure[1](https://arxiv.org/html/2606.08292#S3.F1)\):

- •*Necessary but not decodable*: The head is causal but its state is opaque to linear probes\. Not the common case in our data\.
- •*Decodable but not necessary*: The information is present but not load\-bearing causally\. Prior probing critiques\[Elazaret al\.,[2021](https://arxiv.org/html/2606.08292#bib.bib11), Hewitt and Liang,[2019](https://arxiv.org/html/2606.08292#bib.bib12)\]document this\.
- •*Prompt\-ablation\-reversible but not interventionally generalizable*: Restoring the head’s own clean state in the same prompt recovers performance, but its state encodes contextual trajectory rather than a portable computation selection\. We term this prompt\-trajectory stabilizer\. This is the dominant failure mode we find\.
- •*Logprob\-moving under transduction but not computation\-specific*: The patch moves many candidate logprobs together because it carries general context from the source prompt, not a specific computation label\. Exposed by same\-computation and same\-answer controls\.

PromptKnowingIntent?DoingAnswerCSS \+ SVD\(Stages 1–2\)Activationtransduction\(Stage 3\)Generationaudit\(Stage 1–2\)probe accuracy0\.77–0\.93 ✓no confirmed*intent*headlogit\-bias headsconfirmed ✓

Figure 1:The KID framework and current findings at each role\.*Knowing*\-role \(high linear decodability, Stage 1–2\) and*Doing*\-role heads \(logit\-bias, answer\-side\) are confirmed in models\. No tested head satisfies the full criteria for an interventionally generalizable*Intent*state \(Stage 3\)\.

## 4Methods

### 4\.1Models

We study three 7–8B instruction\-tuned models: Qwen2\.5\-7B\-Instruct\[Qwen Team,[2025](https://arxiv.org/html/2606.08292#bib.bib4)\], Llama\-3\-8B\-Instruct\[Dubeyet al\.,[2024](https://arxiv.org/html/2606.08292#bib.bib5)\], and Mistral\-7B\-Instruct\-v0\.2\[Jianget al\.,[2023](https://arxiv.org/html/2606.08292#bib.bib18)\]\(referred to asqwen,llama, andmistral\)\. The three were chosen as representative publicly available instruction\-tuned models that differ in architecture and training recipe\. All three receive the full pipeline: CSS, SVD/readout, full\-trajectory restore, and activation transduction\.

### 4\.2Prompt Families

We organize prompt families into three conceptual tiers by presumed circuit complexity:

- •Factual recall: thefactsfamily\. Used only as a control class; these capabilities are expected to rely primarily on lookup rather than dedicated computation circuits\.
- •Simple computation: the primary focus\. Families aremaths\(arithmetic: addition, subtraction, multiplication, division\),compare\(ordered relations: largest, smallest, middle, closest, farthest\),digits\(digit properties: odd/even parity, primality, magnitude comparison\),dates\(date arithmetic: before/after, day\-of\-week\), andtimes\(temporal arithmetic: addition/subtraction of clock times\)\.
- •Composed computatione\.g\. chain\-of\-thought\. Not the current focus\. Useful as a future comparison class\.

Simple computation prompt families are hand\-built investigative probes motivated by two design principles\. First, anti\-correlated subtype pairs \(addition vs\. subtraction, largest vs\. smallest, odd vs\. even\) may share representational space while requiring distinct behavior, making them natural probes for polysemantically packed representations\[Elhageet al\.,[2022](https://arxiv.org/html/2606.08292#bib.bib16)\]\. Second, the families span symbolic, numeric, and temporal domains, providing coverage of diverse computation types at similar complexity\. Each family has subtypes corresponding to distinct requested computations, and the primary unit of analysis is the*model \+ prompt\-family*combination \(e\.g\.,qwen maths,llama digits\)\. Families are not assumed to match the model’s internal capability ontology; they are experimental levers\.

### 4\.3Stage 1: Capability\-selective screening

FollowingBair and others \[[2026](https://arxiv.org/html/2606.08292#bib.bib2)\], we zero all outputs of a candidate attention head across every token position and measure the reference\-answer log\-probability change\. Selectivity for a head is the target\-family damage minus the maximum damage across non\-target families\. Heads are ranked by selectivity score, and we form cumulative top\-kksets fork=1,3,5k=1,3,5by greedily adding heads\.

We also run two random\-mask diagnostics: a main pass using 256 stratified masks \(32 heads zeroed per mask\) with OMP sparse recovery \(20 nonzero coefficients per family\), and a follow\-up diagnostic using 1024 masks \(8 heads per mask\) to reduce broad\-ablation confounds\. Subset\-lattice evaluation directly measures every subset of each CSS top\-5 head set \(31 subsets for 5 heads\), characterizing singleton effects, leave\-one\-out losses, Shapley\-style marginal contributions, and additive residuals\.

### 4\.4Stage 2: Singular value decomposition

We apply SVD to head activation matrices to expose interpretable directions that component\-level analysis may miss\. A head may pack several semantic factors into a shared representational subspace; SVD separates them\.

We collect clean activations for each CSS\-selected head across a held\-out prompt inventory, then train nearest\-centroid probes to decode family and subtype labels from individual head residual contributions and from CSS top\-5 concatenated residuals\. This representation audit does not select heads; it asks whether behaviorally important sites contain linearly decodable requested\-computation information\.

Critically, we use*counterbalanced prompt controls*to separate semantic structure from surface artifacts\. Pure\-surface controls \(same answer string, different computation\) and same\-format controls are included alongside semantic targets\. Dominant SVD directions that shift under surface controls are flagged as nuisance\-dominant\.

### 4\.5Stage 3: Activation Transduction Assays

Activation transduction tests whether a head’s state can redirect behavior toward the source computation when patched into a matched target prompt\.

We capture clean activations from a source prompt and replace corresponding target prompt activations in selected CSS heads at selected token positions, then run the forward pass\. Source and target prompts are matched on surface factors \(template, item set, answer format\) but differ in the requested computation\.

Scoring:We measure reference\-answer log\-probability change, source\-answer log\-probability change, source\-vs\.\-correct margin change, and answer\-ordering changes \(fraction of prompts where the top candidate changes\)\.

Controls\.Three control conditions are essential\.*Same\-computation controls*share the requested computation but vary surface form; if these move as much as computation\-changing patches, the effect is not computation\-specific\.*Same\-answer controls*share the answer string but differ in computation; if these move comparably, the effect reflects answer\-string familiarity rather than computation\-selection transfer\.*Same\-prompt controls*patch the target with its own clean activations; near\-zero effect here confirms that flat results are not attributable to patch instability\.

Interventional generalizability requires that computation\-changing patches move more than same\-computation controls*and*produce answer\-ordering changes\. Soft logprob movement without answer\-ordering change is evidence that the patch affects the model, not that it transfers a computation\.

Full\-trajectory restore:We zero the CSS head set across all token positions, then separately restore activations at:*prompt\-all*\(all prompt token positions\),*prompt\-second\-half*\(second half of the prompt\),*answer\-all*\(all positions used to score reference answer tokens\),*answer\-first*\(the final prompt token predicting the first answer token\), and*answer\-rest*\(answer positions after the first\)\. Recovery fraction for a slice is \(restored damage−\-zero\-all damage\) / zero\-all damage\. A head that is answer\-all\-recoverable but not prompt\-all\-recoverable plays a*doing*\-side role; only prompt\-all\-recoverable heads are meaningful activation transduction targets\.

## 5Results

### 5\.1CSS Head Sets Are Selectively Necessary

Across the three models we screen 6 computation families giving 18 model \+ prompt\-family cells in total \(Table[4](https://arxiv.org/html/2606.08292#A5.T4)\)\. CSS finds a selective top\-5 head set in 13 of these cells; 3 further cells are selective but with broader collateral damage to other families; 3 cells fail selectivity outright\.

Direct subset evaluation confirms the effects are real and mostly additive\. Some model \+ prompt families are dominated by one head \(e\.g\.qwen mathsbyL23H12\), while others are 5\-head aggregates \(e\.g\.llama digits\)\. Random\-mask recovery partially supports these findings, recovering the dominantqwen mathshead and thellama digitsrank\-1 head, but not all top\-5 aggregates\.

Takeaway:CSS finds compact, real behavioral objects in all three models\. These are privileged targets for mechanistic study\. But selectivity shows behavioral importance, not mechanistic role\.

### 5\.2CSS Heads Are Linearly Decodable

A representation audit shows that CSS heads are not black boxes\. CSS top\-5 concatenated residual readouts achieve family\-level classification accuracies of 0\.77–0\.91 inqwen, 0\.79–0\.93 inllama, and 0\.76–0\.93 inmistral\. Individual heads can also carry fine\-grained subtype information:llama digitsrank\-1 \(L28H19\) reaches subtype accuracy 0\.920, andmistral digitsrank\-1 \(L15H0\) reaches 0\.840\. SVD decomposition exposes real intra\-head structure, consistent with multiple semantic directions packed into shared representational space\. However, counterbalanced prompt controls reveal that dominant SVD directions are sometimes nuisance\-dominant \(surface\-sensitive\) rather than semantically primary\.

Takeaway:Behaviorally important heads are linearly decodable, but linear decodability does not decide role\. Heads that strongly decode the requested computation are not thereby causal for it\.

### 5\.3The Dissociation: Four Properties Come Apart

Full\-trajectory restore localizes whether a head’s necessary role lives in prompt processing \(consistent with*knowing*or*intent*\) or in answer production \(consistent with*doing*\), by separately restoring prompt\-token and answer\-token activations after ablation\. Across all tested model \+ prompt\-family combinations \(Table[1](https://arxiv.org/html/2606.08292#S5.T1)\), three patterns are consistent:

- •CSS top\-5 sets are heterogeneous\.Within a single CSS top\-kkset, ranks frequently split into answer\-side \(logit\-bias\) and prompt\-side roles\. Some cells \(qwen maths\) are dominated by an answer\-side head; others \(llama digits\) mix prompt\-side and answer\-side ranks; aggregate top\-5 patches therefore conflate distinct roles\.
- •Prompt\-side recovery does not imply interventional generalizability\.Of the eight rows in Table[1](https://arxiv.org/html/2606.08292#S5.T1)marked prompt\-side \(✓\\checkmarkin column 3\), all eight fail property \(4\): sourceΔ\\Deltais inert, negative, or contaminated by control movement\.
- •Same\-computation controls expose broad context transfer\.Where sourceΔ\\Deltais positive \(e\.g\.qwen times\), same\-computation controls move equally, so the patch is not computation\-specific\.

Every row tested for property \(4\) fails clean interventional generalizability\. Figure[2](https://arxiv.org/html/2606.08292#A5.F2)\(Appendix[I](https://arxiv.org/html/2606.08292#A9)\) shows the prompt\-all vs\. answer\-all clusters; per\-head numbers are in Table[7](https://arxiv.org/html/2606.08292#A9.T7)\. Detailed case studies for all model \+ prompt\-family cells, plus the compare\-SV2 closest positive, are in Appendix[C](https://arxiv.org/html/2606.08292#A3)\.

Table 1:Evidence matrix for heads and head sets tested with activation transduction\. \(1\) Selective necessity; \(2\) linear decodability; \(3\) prompt\-side ablation reversibility \(prompt\-all recovery≥0\.7\\geq 0\.7, or×\\timesif answer\-side\); \(4\) interventional generalizability \(sourceΔ\\Deltaon opposite\-computation rows, controlled\)\. Every row tested for \(4\) fails clean interventional generalizability, showing dissociation\.
### 5\.4The Closest Positive: Soft Computation\-Pattern Transfer

One result deserves separate mention because it validates assay sensitivity\. Outside the CSS framework, an SVD\-identified subspace \(SV2:SV5\) of theqwen compare\_anchorhead \(L14H15\) carries ordered\-selection information across numbers, digits, letters, dates, and times\. Calibrated downstream injection at layer 18 produces a small but real source\-logprob lift \(\+0\.222\+0\.222, scaling monotonically withα\\alpha\); however, adversarial low\-margin rows show no answer\-ordering change atα=0\.80\\alpha=0\.80, and same\-answer controls move comparably\. This is the*closest positive*in our experiments: the assay can detect soft computation\-pattern transfer when it exists, which makes the negative CSS transduction results more informative — the assay is sensitive enough to find signal; the signal is simply absent in CSS\-localized heads\. Full numerical detail in Appendix[C](https://arxiv.org/html/2606.08292#A3)\.

### 5\.5Role Taxonomy

Table[2](https://arxiv.org/html/2606.08292#S5.T2)summarises the role taxonomy that emerges from the case studies \(Appendix[C](https://arxiv.org/html/2606.08292#A3)\) and the compare\-SV2 result\. The*intent*role requires all four evidence properties together; no tested head satisfies all four\. The taxonomy is preliminary — additional models and families are likely to add or refine roles — but it organizes the failure modes we observe and predicts what evidence pattern would distinguish a future*intent*candidate from a stabilizer or logit\-bias head\.

Table 2:Role taxonomy for capability\-localized attention heads\. Evidence patterns and representative examples from the current experiments\. The*intent*role requires all four criteria; no tested head satisfies all four\. Rkkdenotes rankkkwithin the cumulative top\-5 CSS set for that cell\.

## 6Discussion

#### No assay substitutes for the others\.

Reference\-answer logprob damage tells you a head matters but conflates prompt\-side and answer\-side roles — a head with near\-zero first\-token damage but large answer\-continuation damage looks important but is not an*intent*candidate\. Linear decodability is descriptive, not causal: a head that strongly decodes the requested computation is not thereby its causal locus\. Prompt\-side ablation reversibility is necessary for an*intent*claim but is satisfied by stabilizers that do not store transferable state\.

#### Full\-trajectory restore is the critical intermediate step\.

Without it, the prompt/answer role split is invisible: aggregate ablation damage conflates heads whose role is entirely at answer positions \(logit\-bias\) with those whose role is at prompt positions \(stabilizer or*intent*candidate\)\.

#### Activation transduction is the only direct test for interventional generalizability,

and it must use matched controls\. An activation patch that lifts source logprobs while same\-computation controls do the same is not semantic interventional generalizability\. The same\-answer control is particularly important: it exposes patches that move answers by transferring answer\-string familiarity rather than computation\-selection state\.

The prompt\-side stabilizer role that consistently appears in the data has an interesting interpretation: these heads may be necessary for maintaining the computation type through the prompt \(preventing drift from the initially recognized computation\) without storing a transferable computation\-selection state\. If so, the ablation damage they cause is real but its mechanistic meaning is trajectory maintenance rather than computation selection\.

## 7Limitations

Model scope\.The evidence matrix covers three instruction\-tuned 7–8B models \(Qwen2\.5\-7B\-Instruct, Llama\-3\-8B\-Instruct, and Mistral\-7B\-Instruct\-v0\.2\), each receiving the full pipeline\. Whether the dissociation results and role taxonomy generalize to other architectures, scales, or training regimes remains open\. These models are publicly available instruction\-tuned models from major providers; they do not represent the full diversity of transformer architectures\.

Prompt family coverage\.The prompt families are hand\-built investigative probes, not a complete model\-native capability ontology\. They were chosen for experimental leverage: anti\-correlated subtypes, simple answer formats, and verifiable correct answers\. Results may not transfer to capability classes outside this set, including open\-ended generation, multi\-step reasoning, or capabilities that are not computation\-like\.

Taxonomy completeness\.The role taxonomy is preliminary\. The current experiments identify five role classes but do not provide exhaustive coverage\. Additional models and families are likely to reveal further role types or refine the existing ones\. The taxonomy should not be treated as a complete characterization of what CSS\-localized heads do\.

CSS vs\. SVD head selection\.The soft computation\-pattern carrier role \(compare\-SV2\) rests on SVD decomposition of a non\-CSS\-selected head\. Its relationship to the CSS\-identified role classes, and whether an SVD\-first search would find different mechanistic loci, are open questions\.

No confirmed intent state\.No head in the current experiments satisfies the full criteria for an interventionally generalizable computation\-selection state, but absence is not proof\. A single CSS head set — selectively necessary, linearly decodable, prompt\-side ablation\-reversible, and producing answer\-ordering changes under activation transduction with same\-computation and same\-answer controls flat — would establish that an intent state is stored at attention heads, even if uncommonly\. Conversely, if no such head set is found across broader coverage, we would expect the computation\-selection state \(if it exists\) to live in non\-attention components \(MLPs, residual stream directions\) or to be distributed across many heads rather than localized\.

## 8Conclusion

CSS identifies real, compact, often\-decodable heads — a strong starting point for MI\. The contribution of this paper is on the other side of that: necessity, linear decodability, ablation reversibility, and interventional generalizability are four distinct properties that dissociate at the rank level inside a top\-kkCSS set\.

Across the three\-model evidence matrix, CSS aggregates decompose into answer\-side logit\-bias heads and prompt\-side stabilizers\. The dissociation is consistent in the activation\-transduction suite \(Table[1](https://arxiv.org/html/2606.08292#S5.T1), Figure[2](https://arxiv.org/html/2606.08292#A5.F2)\): every head that satisfies the three commonly cited evidence criteria fails the fourth\. The cleanest prompt\-side targets identified by CSS produce flat or negative source deltas on opposite\-computation rows, confirming ablation reversibility without interventional generalizability\. The best soft positive \(theqwen compare\_anchor SV2:SV5subspace\) shows real ordered\-selection structure and a soft causal handle, but fails on direct adversarial low\-margin rows — demonstrating that the assay is sensitive enough to detect genuine computation\-pattern transfer when it is present\.

The method for finding a computation\-selection state, if it exists in attention heads, is now clear: full\-trajectory role localization to identify prompt\-side candidates, then activation transduction under same\-answer controls on the identified ranks — and, likely, downstream non\-attention sites when attention\-head patching remains broad\.

## References

- B\. Ahmadet al\.\(2025\)Beyond components: singular vector\-based interpretability of transformer circuits\.arXiv preprint arXiv:2511\.20273\.Cited by:[§1](https://arxiv.org/html/2606.08292#S1.p4.1)\.
- S\. Bairet al\.\(2026\)Compressed sensing for capability localization in LLMs\.arXiv preprint arXiv:2603\.03335\.Cited by:[item CSS \(capability\-selective screening\)\.](https://arxiv.org/html/2606.08292#A2.I3.ix1.p1.1),[§1](https://arxiv.org/html/2606.08292#S1.p4.1),[§2](https://arxiv.org/html/2606.08292#S2.SS0.SSS0.Px1.p1.2),[§4\.3](https://arxiv.org/html/2606.08292#S4.SS3.p1.2)\.
- Y\. Belinkov \(2022\)Probing classifiers: promises, shortcomings, and advances\.Computational Linguistics48\(1\),pp\. 207–219\.Cited by:[§2](https://arxiv.org/html/2606.08292#S2.SS0.SSS0.Px2.p1.1)\.
- C\. Burns, H\. Ye, D\. Klein, and J\. Steinhardt \(2023\)Discovering latent knowledge in language models without supervision\.InInternational Conference on Learning Representations,Cited by:[§2](https://arxiv.org/html/2606.08292#S2.SS0.SSS0.Px2.p1.1)\.
- A\. Conmy, A\. Mavor\-Parker, A\. Lynch, S\. Heimersheim, and A\. Garriga\-Alonso \(2023\)Towards automated circuit discovery for mechanistic interpretability\.InAdvances in Neural Information Processing Systems,Vol\.36\.Cited by:[§2](https://arxiv.org/html/2606.08292#S2.SS0.SSS0.Px2.p1.1)\.
- A\. Dubey, A\. Jauhri, A\. Pandey, A\. Kadian, A\. Al\-Dahle, A\. Letman, A\. Mathur, A\. Schelten, A\. Yang, A\. Fan,et al\.\(2024\)The Llama 3 herd of models\.arXiv preprint arXiv:2407\.21783\.Cited by:[§4\.1](https://arxiv.org/html/2606.08292#S4.SS1.p1.1)\.
- Y\. Elazar, S\. Ravfogel, A\. Jacovi, and Y\. Goldberg \(2021\)Amnesic probing: behavioral explanation with amnesic counterfactuals\.Transactions of the Association for Computational Linguistics9,pp\. 160–175\.External Links:[Link](https://arxiv.org/abs/2006.00995)Cited by:[§2](https://arxiv.org/html/2606.08292#S2.SS0.SSS0.Px2.p1.1),[2nd item](https://arxiv.org/html/2606.08292#S3.I3.i2.p1.1)\.
- N\. Elhage, T\. Hume, C\. Olsson, N\. Schiefer, T\. Henighan, S\. Kravec, Z\. Hatfield\-Dodds, R\. Lasenby, D\. Drain, C\. Chen,et al\.\(2022\)Toy models of superposition\.Note:Transformer Circuits ThreadExternal Links:[Link](https://transformer-circuits.pub/2022/toy_model/index.html)Cited by:[Appendix D](https://arxiv.org/html/2606.08292#A4.p1.1),[§2](https://arxiv.org/html/2606.08292#S2.SS0.SSS0.Px1.p1.2),[§4\.2](https://arxiv.org/html/2606.08292#S4.SS2.p3.1)\.
- D\. Friedman, A\. K\. Lampinen, L\. Dixon, D\. Chen, and A\. Ghandeharioun \(2024\)Interpretability illusions in the generalization of simplified models\.InProceedings of the 41st International Conference on Machine Learning,Proceedings of Machine Learning Research, Vol\.235,pp\. 14035–14059\.External Links:[Link](https://arxiv.org/abs/2312.03656)Cited by:[§2](https://arxiv.org/html/2606.08292#S2.SS0.SSS0.Px3.p1.1)\.
- E\. Hernandez, A\. Variengien, D\. Bau, and J\. Andreas \(2023\)Linearity of relation decoding in transformer language models\.arXiv preprint arXiv:2308\.09124\.External Links:[Link](https://arxiv.org/abs/2308.09124)Cited by:[§2](https://arxiv.org/html/2606.08292#S2.SS0.SSS0.Px1.p1.2)\.
- J\. Hewitt and P\. Liang \(2019\)Designing and interpreting probes with control tasks\.InProceedings of the 2019 Conference on Empirical Methods in Natural Language Processing,Cited by:[§2](https://arxiv.org/html/2606.08292#S2.SS0.SSS0.Px2.p1.1),[2nd item](https://arxiv.org/html/2606.08292#S3.I3.i2.p1.1)\.
- A\. Q\. Jiang, A\. Sablayrolles, A\. Mensch, C\. Bamford, D\. S\. Chaplot, D\. de las Casas, F\. Bressand, G\. Lengyel, G\. Lample, L\. Saulnier, L\. Renard Lavaud, M\. Lachaux, P\. Stock, T\. Le Scao, T\. Lavril, T\. Wang, T\. Lacroix, and W\. El Sayed \(2023\)Mistral 7b\.Note:arXiv preprint arXiv:2310\.06825External Links:[Link](https://arxiv.org/abs/2310.06825)Cited by:[§4\.1](https://arxiv.org/html/2606.08292#S4.SS1.p1.1)\.
- S\. Kadavath, T\. Conerly, A\. Askell, T\. Henighan, D\. Drain, E\. Perez, N\. Schiefer, Z\. Hatfield\-Dodds, N\. DasSarma, E\. Tran\-Johnson, S\. Johnston, S\. El\-Showk, A\. Jones, N\. Elhage, T\. Hume, A\. Chen, Y\. Bai, S\. Bowman, S\. Fort, D\. Ganguli, D\. Hernandez, J\. Jacobson, J\. Kernion, S\. Kravec, L\. Lovitt, K\. Ndousse, C\. Olsson, S\. Ringer, D\. Amodei, D\. Amodei, J\. Clark, S\. McCandlish, C\. Olah, and J\. Kaplan \(2022\)Language models \(mostly\) know what they know\.arXiv preprint arXiv:2207\.05221\.Cited by:[§1](https://arxiv.org/html/2606.08292#S1.p3.1),[§3\.1](https://arxiv.org/html/2606.08292#S3.SS1.p1.1)\.
- M\. Lan, N\. F\. Oozeer, C\. Bandi, P\. Quirke, A\. Meek, F\. Barez, and A\. Abdullah \(2026\)Make mechanistic interpretability auditable: a call to develop guidelines via continuous collaborative reviewing\.Note:Preprint, accepted to ICML 2026External Links:[Document](https://dx.doi.org/10.5281/zenodo.19671185),[Link](https://zenodo.org/records/19671185)Cited by:[§2](https://arxiv.org/html/2606.08292#S2.SS0.SSS0.Px4.p1.1)\.
- A\. Makelov, G\. Lange, and N\. Nanda \(2023\)Is this the subspace you are looking for? an interpretability illusion for subspace activation patching\.InNeurIPS 2023 Workshop on Attributing Model Behavior at Scale,External Links:[Link](https://arxiv.org/abs/2311.17030)Cited by:[§2](https://arxiv.org/html/2606.08292#S2.SS0.SSS0.Px3.p1.1)\.
- C\. McDougall, A\. Conmy, C\. Rushing, T\. McGrath, and N\. Nanda \(2023\)Copy suppression: comprehensively understanding an attention head\.arXiv preprint arXiv:2310\.04625\.External Links:[Link](https://arxiv.org/abs/2310.04625)Cited by:[§2](https://arxiv.org/html/2606.08292#S2.SS0.SSS0.Px1.p1.2)\.
- M\. Méloux, F\. Portet, and M\. Peyrard \(2025\)Mechanistic interpretability as statistical estimation: a variance analysis\.arXiv preprint arXiv:2510\.00845\.External Links:[Link](https://arxiv.org/abs/2510.00845)Cited by:[§2](https://arxiv.org/html/2606.08292#S2.SS0.SSS0.Px3.p1.1)\.
- K\. Meng, D\. Bau, A\. Andonian, and Y\. Belinkov \(2022\)Locating and editing factual associations in GPT\.InAdvances in Neural Information Processing Systems,Vol\.35\.Cited by:[§2](https://arxiv.org/html/2606.08292#S2.SS0.SSS0.Px1.p1.2),[§2](https://arxiv.org/html/2606.08292#S2.SS0.SSS0.Px2.p1.1)\.
- C\. Olsson, N\. Elhage, N\. Nanda, N\. Joseph, N\. DasSarma, T\. Henighan, B\. Mann, A\. Askell, Y\. Bai, A\. Chen, T\. Conerly, D\. Drain, D\. Ganguli, Z\. Hatfield\-Dodds, D\. Hernandez, S\. Johnston, A\. Jones, J\. Kernion, L\. Lovitt, K\. Ndousse, D\. Amodei, D\. Amodei, J\. Clark, S\. Kravec, S\. Bowman, J\. Kaplan, S\. McCandlish, and C\. Olah \(2022\)In\-context learning and induction heads\.Note:Transformer Circuits ThreadExternal Links:[Link](https://transformer-circuits.pub/2022/in-context-learning-and-induction-heads/index.html)Cited by:[§2](https://arxiv.org/html/2606.08292#S2.SS0.SSS0.Px1.p1.2)\.
- Qwen Team \(2025\)Qwen2\.5 technical report\.arXiv preprint arXiv:2412\.15115\.Cited by:[§4\.1](https://arxiv.org/html/2606.08292#S4.SS1.p1.1)\.
- L\. Sharkey, B\. Chughtai, J\. Batson, J\. Lindsey, J\. Wu, L\. Bushnaq, N\. Goldowsky\-Dill, S\. Heimersheim, A\. Ortega, J\. Bloom, S\. Biderman, A\. Garriga\-Alonso, A\. Conmy, N\. Nanda, J\. Rumbelow, M\. Wattenberg, N\. Schoots, J\. Miller, E\. J\. Michaud, S\. Casper, M\. Tegmark, W\. Saunders, D\. Bau, E\. Todd, A\. Geiger, M\. Geva, J\. Hoogland, D\. Murfet, and T\. McGrath \(2025\)Open problems in mechanistic interpretability\.Transactions on Machine Learning Research\.External Links:[Link](https://arxiv.org/abs/2501.16496)Cited by:[§2](https://arxiv.org/html/2606.08292#S2.SS0.SSS0.Px4.p1.1)\.
- E\. Todd, M\. Li, A\. S\. Sharma, A\. Mueller, B\. C\. Wallace, and D\. Bau \(2024\)Function vectors in large language models\.InInternational Conference on Learning Representations,Cited by:[§2](https://arxiv.org/html/2606.08292#S2.SS0.SSS0.Px2.p1.1)\.
- J\. Vig, S\. Gehrmann, Y\. Belinkov, S\. Qian, D\. Nevo, Y\. Singer, and S\. Shieber \(2020\)Investigating gender bias in language models using causal mediation analysis\.InAdvances in Neural Information Processing Systems,Vol\.33\.Cited by:[§2](https://arxiv.org/html/2606.08292#S2.SS0.SSS0.Px2.p1.1)\.
- K\. Wang, A\. Variengien, A\. Conmy, B\. Shlegeris, and J\. Steinhardt \(2023\)Interpretability in the wild: a circuit for indirect object identification in GPT\-2 small\.InInternational Conference on Learning Representations,External Links:[Link](https://arxiv.org/abs/2211.00593)Cited by:[§2](https://arxiv.org/html/2606.08292#S2.SS0.SSS0.Px1.p1.2)\.
- M\. Yu, M\. Chaudhary,et al\.\(2024\)The super weight in large language models\.arXiv preprint arXiv:2411\.07191\.External Links:[Link](https://arxiv.org/abs/2411.07191)Cited by:[§2](https://arxiv.org/html/2606.08292#S2.SS0.SSS0.Px1.p1.2)\.
- F\. Zhang and N\. Nanda \(2024\)Towards best practices of activation patching in language models: metrics and methods\.InInternational Conference on Learning Representations,External Links:[Link](https://arxiv.org/abs/2309.16042)Cited by:[§2](https://arxiv.org/html/2606.08292#S2.SS0.SSS0.Px2.p1.1)\.

## Appendix ABroader Impacts

This work is foundational interpretability research\. Its positive impact is to make mechanistic evidence standards more precise: behaviorally important, decodable, and ablation\-reversible components should not be promoted to semantic role claims without matched interventional tests\. Better evidence separation can reduce overconfident claims about model internals and improve safety audits\. The main negative impact is dual\-use: sharper localization and intervention methods could also help target model weaknesses or manipulate behavior\. We mitigate this by reporting aggregate role diagnostics on simple synthetic tasks rather than releasing a new model, dataset of harmful prompts, or deployment method\.

## Appendix BGlossary

This glossary collects terms defined in the main text\. Where a term has both a*concept*\(what role it plays\) and an*operationalization*\(how we test for it\), both are given\.

#### Framework terms\.

KID\.*Knowing / Intent / Doing*: a role\-assignment lens for attention heads \(§3\.1\)\. KID is a vocabulary for asking targeted questions about a behaviorally important head, not a prior about model architecture\.

Knowing\.The model’s process of recognizing what the prompt asks for\. A head fills this role if its activations at prompt positions carry linearly decodable requested\-computation information and its ablation damages prompt\-level recognition rather than answer production\.

Intent\.A computation\-selection state after recognition and before execution\. A head fills this role if it satisfies the*knowing*criteria*and*is interventionally generalizable: its state, when extracted from a source prompt and inserted into a target prompt, redirects behavior toward the source computation under matched controls\. No head in the current experiments satisfies all four criteria\.

Doing\.Answer execution, scoring, formatting, generation\. A head fills this role if its activations at answer positions are necessary, its ablation damages the reference answer, and same\-prompt ablation reversal is achieved by restoring activations at answer \(not prompt\) positions\.

Role claim\.A statement of the form “this head representsX” or “this head implementsX” for some computationX\. The paper’s central claim is that the standard evidence pipeline is insufficient to support such claims\.

#### The four evidence properties

Selective necessity\.Targeted ablation of the head set damages the target capability while largely sparing other capabilities\.

Linear decodability\.Requested\-computation labels can be decoded from the head’s activations by a linear \(nearest\-centroid\) probe\.

Ablation reversibility\.Performance can be recovered by restoring the head’s clean activations after ablation, at some set of token positions\. Distinguish*prompt\-side*reversibility \(restore at prompt positions\) from*answer\-side*reversibility \(restore at answer positions\)\.

Interventional generalizability\.Activations from a source prompt with computationAA, when patched into a target prompt with computationBBunder matched controls, redirect behavior towardAA\.

#### Pipeline and assays\.

CSS \(capability\-selective screening\)\.Stage 1 of the pipeline\. Identifies small head sets whose targeted ablation selectively damages a specific capability while sparing others\. FollowingBair and others \[[2026](https://arxiv.org/html/2606.08292#bib.bib2)\]\.

SVD readout\.Stage 2 of the pipeline\. Trains nearest\-centroid probes on CSS\-selected head residuals to decode family and subtype labels; inspects intra\-head structure via singular value decomposition\.

Activation transduction\.Stage 3 of the pipeline\. Captures clean activations from a source prompt with one requested computation, and patches them into a target prompt that requires a different computation\. Tests whether the head’s state encodes a transferable computation selection\.

Full\-trajectory restore\.After zeroing a CSS head set across all token positions, separately restore activations at distinct slices to localize where the head’s necessary role lives\. Recovery fraction for a slice is \(restored damage−\-zero\-all damage\) / zero\-all damage\.

Restore slices\.Token\-position groups used in full\-trajectory restore:*prompt\-all*\(all prompt token positions\);*prompt\-second\-half*\(second half of the prompt\);*answer\-all*\(all positions used to score reference\-answer tokens\);*answer\-first*\(final prompt token, predicting the first answer token\);*answer\-rest*\(answer positions after the first\)\.

Source / target prompt\.In activation transduction, the*source*prompt provides the activations to be patched in\. The*target*prompt receives the patch and is the prompt the model actually answers\. Source and target are matched on surface factors but differ in the requested computation\.

#### Controls

Same\-computation control\.Source and target share the requested computation but vary surface form\. If these patches move output as much as computation\-changing patches, the effect is not computation\-specific\.

Same\-answer control\.Source and target share the answer string but differ in computation\. If these patches move output comparably, the effect reflects answer\-string familiarity rather than computation\-selection transfer\.

Same\-prompt control\.Patch the target with its own clean activations\. Near\-zero effect here confirms that flat results are not attributable to patch instability\.

Counterbalanced prompt controls\.In SVD experiments, pure\-surface controls \(same answer string, different computation\) and same\-format controls included alongside semantic targets\. Used to flag SVD directions as*nuisance\-dominant*\(surface\-sensitive\) rather than semantically primary\.

#### Role taxonomy

Answer\-side logit\-bias head\.Selectively necessary; damage is answer\-restorable; ablation lifts plausible\-wrong answers and depresses the reference answer\.

Prompt\-side stabilizer\.Prompt\-recoverable but inert or negative under activation transduction on opposite\-computation rows\. The dominant failure mode in our data: necessary for trajectory maintenance, not for storing a transferable computation selection\.

Prompt\-primary, context\-broad head\.Prompt\-restorable; activation transduction transfers broad source context \(controls move equally\), not a specific computation\.

Soft computation\-pattern carrier\.An SVD subspace decodable across related families with a real but soft downstream causal handle, but no answer\-ordering change on adversarial low\-margin rows\. Theqwen compare\_anchor SV2:SV5subspace is the only such case in the current experiments\.

#### Measurements and notation\.

SourceΔ\\Delta\.In activation transduction, the change in source\-answer log\-probability after patching\. Positive means the patch shifts probability mass toward the source\-prompt’s correct answer\.

MarginΔ\\Delta\.Change in source\-vs\.\-correct margin \(logprob difference between source\-prompt\-correct and target\-prompt\-correct candidates\)\.

Answer\-ordering change\.Fraction of prompts on which the top\-ranked candidate changes after patching\. The strict bar for interventional generalizability: soft logprob movement without ordering change does not count as a computation switch\.

Recovery fraction\.\(restored damage−zero\-all damage\)/zero\-all damage\(\\text\{restored damage\}\-\\text\{zero\-all damage\}\)/\\text\{zero\-all damage\}for a given restore slice\. A head answer\-all\-recoverable but not prompt\-all\-recoverable plays a*doing*role; only prompt\-all\-recoverable heads are meaningful activation\-transduction targets\.

Probe / subtype accuracy\.Family\-level nearest\-centroid classification accuracy on top\-5 concatenated residuals \(probe accuracy\) and within\-family subtype classification accuracy on the rank\-1 head alone \(subtype accuracy\)\. Both reported in Table[6](https://arxiv.org/html/2606.08292#A6.T6)\.

Model \+ prompt\-family cell\.The primary unit of analysis: the intersection of one model and one prompt family, writtenqwen maths,llama digits, etc\.

Rkk\.Rankkkwithin the cumulative top\-5 CSS set for a cell\. R1 is the head with highest individual selectivity; R2–R5 are added greedily\.

## Appendix CCase Studies

This appendix gives full numerical detail for the case\-study cells across all three models, plus the compare\-SV2 closest positive\. Each subsection opens with the role assignment from Table[2](https://arxiv.org/html/2606.08292#S5.T2)and then walks through the evidence\.

### C\.1qwen maths: An Answer\-Side Logit\-Bias Head

Role:answer\-side reference\-answer support / logit\-bias head; not a prompt\-side*intent*state\.

The top\-5 set is dominated by rank\-1 headL23H12\. Activation transduction using last\-4\-token activations produces visible logprob movement \(source delta\+0\.460\+0\.460, correct\-top 0\.969→\\to0\.881\), but removingL23H12eliminates almost the entire effect \(correct\-top unchanged at 0\.969\)\. The effect is rank\-1 dependent\.

Full\-trajectory restore identifies the role: rank\-1 damage \(0\.259\) is almost entirely answer\-restorable \(answer\-all recovery 1\.000, prompt\-all recovery 0\.022\)\. The head matters during or after the first answer token, not during prompt processing\.

Generation and role\-typing audits characterize the role further\. Under top\-5 ablation, reference\-answer damage is 0\.364 while plausible\-wrong answers gain probability, consistent with an answer\-side logit\-bias head rather than generic continuation damage\. On a 120\-prompt arithmetic inventory, rank\-1 exact\-match damage is 0\.092 with 12 margin\-crossing rows\. However, expanded controls show this is not arithmetic\-selective: control max is 0\.100, mostly fromtimes\.

### C\.2llama digits: A Mixed Aggregate Where Prompt Recovery Does Not Imply Interventional Generalizability

Role:mixed aggregate — answer\-side logit\-bias heads \(ranks 1, 4\), prompt\-side stabilizer \(rank 3\), mixed component \(rank 5\)\.

This cell has all the surface ingredients for an*intent*hypothesis: selective necessity \(top\-5 selectivity 0\.531\), a highly subtype\-decodable rank\-1 head \(subtype accuracy 0\.920\), and meaningful prompt\-second\-half restore \(recovery 0\.422, control max 0\.028\)\.

Activation transduction fails\. Patching top\-5 prompt\-second\-half activations gives source delta\+0\.160\+0\.160and answer\-changed rate 0\.013\. The source digit property does not redirect behavior\.

Full\-trajectory restore explains the aggregate\. Ranks 1 and 4 are answer\-restorable; rank 3 is prompt\-side \(prompt\-all recovery 1\.003, answer\-all recovery−0\.019\-0\.019\); rank 5 is mixed\. Targeted activation transduction on the prompt\-side ranks: rank\-3 patches give source delta\+0\.001\+0\.001\(inert\); rank\-5 patches move in the wrong direction\.

### C\.3qwen times: A Prompt\-Primary Cell With Context\-Broad Transfer

Role:prompt\-primary but context\-broad\. Real prompt\-trajectory necessity; no specific computation\-selection state confirmed\.

Full\-trajectory restore establishes a genuinely prompt\-primary locus: top\-5 prompt\-all restore recovers 0\.722 of zero\-all damage and prompt\-second\-half restores 0\.757, while answer\-all restores only 0\.478\. Rank\-1 \(L0H0\) is strongly prompt\-side \(prompt\-second\-half recovery 0\.816, answer\-all recovery 0\.057\)\.

Activation transduction is control\-sensitive\. Patching rank\-1 prompt\-all from a time\-addition source lifts source logprobs \(\+1\.209\+1\.209\), but same\-computation controls move equally \(\+1\.338\+1\.338\) and damage correct\-top \(0\.625→\\to0\.500\)\. Prompt\-all disambiguation confirms that source answers, source\-operation candidates, and impossible or format distractors all move together, indicating broad source\-prompt context transfer rather than a specific time\-operation selection\.

### C\.4llama compare: Prompt\-Side Ranks Are Stabilizers, Not Intent Carriers

Role:prompt\-side stabilizers\. The cleanest available CSS prompt\-rank targets fail interventional generalizability, extending the dissociation to the most favorable test case\.

Full\-trajectory restore classifies the full top\-5 as answer\-primary \(answer\-all recovery 0\.760 vs\. prompt\-all recovery 0\.354\)\. Rank\-level restore reveals a clean split: ranks 2 and 3 are strongly prompt\-side \(rank\-2: prompt\-second\-half recovery 0\.949, answer\-all recovery 0\.205; rank\-3: prompt\-all recovery 1\.040, answer\-all recovery−0\.019\-0\.019\), while ranks 1, 4, and 5 are answer\-side\.

This made ranks 2 and 3 the cleanest available activation transduction targets for an*intent*state\. The result is negative\. Under activation transduction on opposite\-relation same\-candidate rows, the prompt\-side ranks are flat or negative: rank\-2 prompt\-second\-half gives source delta−0\.210\-0\.210, margin delta−0\.198\-0\.198; rank\-3 prompt\-all gives source delta−0\.015\-0\.015, margin delta−0\.011\-0\.011\. All\-row movement is small and produces no answer\-ordering change\. Same\-prompt controls confirm the negative read is not patch instability\.

#### Mistral rows\.

The Mistral case studies extend the same role read\.mistral datesrank 1 \(L25H12\) is cleanly prompt\-side \(prompt\-all recovery 1\.02\) but inert under source patching \(sourceΔ=\+0\.001\\Delta=\+0\.001\)\.mistral comparerank 1 \(L8H1\) is prompt\-primary \(prompt\-all recovery 0\.95\) but broad and control\-sensitive under source patching\.

### C\.5Soft Computation\-Pattern Transfer: The Compare\-SV2 Result

Role:soft computation\-pattern carrier\. TheSV2:SV5subspace encodes abstract ordered\-selection structure with a real but soft causal handle\. It does not constitute a clean interventionally generalizable computation switch, and falls short of the*intent*criteria\.

Outside the CSS framework, SVD\-based decomposition of theqwen compare\_anchorhead \(L14H15\) identifies a subspace \(SV2:SV5\) that carries broader ordered\-selection information, activating across numeric largest/smallest and closest/farthest, digit comparisons, letter ordering, and date and time relations\.

Matched component patching at the local head \(SV2:SV5slice only\) selectively lifts source\-relation answers on ordered\-selection targets while leaving pure surface controls weaker\. Calibrated downstream residual injection at layer 18 amplifies this signal \(source logprob\+0\.222\+0\.222, margin\+0\.237\+0\.237\) and scales monotonically withα\\alpha\. However, the direct adversarial test using near\-boundary low\-margin ordered rows shows no answer\-ordering change and near\-zero ordered movement atα=0\.80\\alpha=0\.80\. Same\-answer controls can move comparably to ordered rows\.

This result is the*closest positive*in the current experiments: the methodology can detect soft computation\-pattern transfer when it exists, which makes the negative CSS transduction results more informative — the assay is sensitive enough to find signal; the signal is simply absent in CSS heads\.

## Appendix DPrompt Family Details

We use five computation families plus a factual\-recall control\. Subtype pairs are anti\-correlated \(e\.g\., addition vs\. subtraction\) so that selecting one computation should suppress the other, making the families natural probes for polysemantically packed representations\[Elhageet al\.,[2022](https://arxiv.org/html/2606.08292#bib.bib16)\]\. Table[3](https://arxiv.org/html/2606.08292#A4.T3)summarises the families\.

Table 3:Prompt families\. Subtype pairs are anti\-correlated and may share representational space\. Each family uses a fixed template with candidate options and a reference answer; the model is scored on reference\-answer log\-probability\. All families have 25 items\.Counterbalanced control construction for SVD experiments: each semantic prompt \(subtypeAA\) is paired with a surface control prompt that shares the answer string but uses a different subtype \(e\.g\., the answer “9” appearing in both an addition and a multiplication prompt\)\. Controls are drawn from the same template with candidate sets chosen so the reference answer is identical\. This isolates semantic \(subtype\-specific\) SVD directions from surface \(answer\-string\-related\) directions\.

For activation transduction, pairs are constructed by matching template, candidate set, and answer format across opposite\-subtype prompts \(e\.g\., source: “which is largest?”, target: “which is smallest?”\), sharing the same candidate numbers but requiring the opposite relation\. Same\-answer controls replace the source with a prompt from a different subtype that has the same answer string\.

## Appendix ECSS Screening Details

For each model\-family cell, selectivity is computed as:

sh=Δtarget​\(h\)−maxf≠target⁡Δf​\(h\)s\_\{h\}=\\Delta\_\{\\text\{target\}\}\(h\)\-\\max\_\{f\\neq\\text\{target\}\}\\Delta\_\{f\}\(h\)whereΔf​\(h\)\\Delta\_\{f\}\(h\)is the reference\-answer log\-probability change for familyffunder zero\-ablation of headhh\. Heads are ranked byshs\_\{h\}descending, and the top\-kkcumulative set greedily adds heads in that order\.

Random\-mask recovery runs use: \(main pass\) 256 stratified masks with 32 heads zeroed per mask, OMP recovery with 20 nonzero coefficients; \(follow\-up diagnostic\) 1024 masks with 8 heads per mask\.

Subset\-lattice evaluation measures all2k−12^\{k\}\-1nonempty subsets of the top\-5 set\. Reported metrics per subset: target damage, maximum control damage, selectivity, and per\-head marginal contribution\.

Table[5](https://arxiv.org/html/2606.08292#A5.T5)lists the Qwen, Llama and Mistral CSS top\-5 sets\. Selectivity is target\-family damage minus maximum control\-family damage\. Heads are listed in rank order \(descending selectivity within the cumulative top\-5 screen\)\.

Table 4:CSS top\-5 selectivity summary\. Target damage is reference\-answer logprob change under top\-5 ablation\. Selectivity is target damage minus control maximum\. 13 of 18 cells are cleanly selective; 2 are selective with broader collateral damage; the 3 remaining cells fail selectivity\.00\.250\.250\.50\.50\.750\.751100\.250\.250\.50\.50\.750\.7511*Doing*role*Knowing*rolePrompt\-All RecoveryAnswer\-All Recoveryanswer\-side \(logit\-bias\)prompt\-side \(stabilizer\)mixed \(aggregates\)Figure 2:Full\-trajectory restore: prompt\-all vs\. answer\-all recovery for the main tested heads and aggregates\. Answer\-side \(blue circles\) cluster in the lower\-right; prompt\-side stabilizers \(red squares\) cluster in the upper\-left\. No head lies in the upper\-right quadrant \(high on both axes\), which would be required for an*intent*candidate that is also answer\-generative\. The dashed diagonal \(prompt\-all\+answer\-all=1\\text\{prompt\-all\}\+\\text\{answer\-all\}=1\) separates the two role clusters\. Aggregate top\-kksets \(green triangles\) fall between clusters, confirming they mix roles across constituent ranks\. Axis labels use abbreviated family names: digs =digits, cmp =compare\.Table 5:CSS top\-5 head sets per family, with models shown left to right\. Rank order is by selectivity within each model’s cumulative screen\. Sel\. = selectivity \(target damage−\-control max\)\.
## Appendix FSVD Analysis Details

SVD decomposition of head residual contribution matrices exposes interpretable directions\. Theη2\\eta^\{2\}statistic measures the fraction of variance in the first singular value accounted for by the requested\-computation label, relative to a shuffle null\. The SVD excess is the ratio of the first singular value to the median; values substantially above 1 indicate a dominant structured direction\.

Counterbalanced controls pair each semantic target prompt with a surface control matching the answer string but differing in requested computation\. An SVD direction that shifts comparably under surface controls is classified as nuisance\-dominant\.

Selected SVD results for the main case study heads are in Table[6](https://arxiv.org/html/2606.08292#A6.T6)\. Family\-level probe accuracy \(top\-5 concatenated residuals, nearest\-centroid\) ranges from 0\.77 to 0\.93 across models and prompt families\.

Table 6:SVD\-based representation audit summary\. Probe accuracy is family\-level nearest\-centroid classification on top\-5 concatenated residuals\. Subtype accuracy is for the rank\-1 head alone\. A direction is flagged nuisance\-dominant if it shifts comparably under surface\-control prompts\.
## Appendix GActivation Transduction Protocol

Source and target prompts in each transduction pair are matched on: surface template, candidate item set, answer format, and target token position\. They differ in the requested computation \(e\.g\., source: largest, target: smallest\)\. Both source\-to\-target and target\-to\-source directions are tested where applicable\.

Patch modes tested per cell:

- •Full head state at specified token position range\.
- •SVD component slice \(SV2:SV5for compare\-SV2 experiments\)\.
- •Rank\-specific prompt\-second\-half, prompt\-all patches\.
- •Residual\-delta injection at downstream layers \(compare\-SV2 downstream experiments\)\.

Same\-answer control construction: for each \(source, target\) pair, replace the source with a prompt that has the same answer but a different requested computation\. Same\-computation controls replace the source with a different surface form of the same computation\.

Alpha stress tests for the compare\-SV2 downstream residual injection: the causal handle scales monotonically with injection magnitude\. Atα=0\.20\\alpha=0\.20: source logprob\+0\.067\+0\.067, margin\+0\.072\+0\.072\. Atα=0\.40\\alpha=0\.40: source\+0\.127\+0\.127, margin\+0\.145\+0\.145\. Atα=0\.80\\alpha=0\.80: source\+0\.222\+0\.222, margin\+0\.237\+0\.237on the calibrated held\-out set\. However, on the adversarial low\-margin ordered rows \(n=10n=10rows within margin 1\.25, 6 source\-best\-wrong\), theα=0\.80\\alpha=0\.80patch produces answer\-changed rate 0\.000 and near\-zero ordered movement, indicating the soft causal handle does not flip decisions on genuinely marginal prompts\.

Hard\-row inventory for exact\-output audits: forqwen maths, 120 prompts were scored under top\-5 ablation\. Exact\-match damage is 0\.092 \(11 rows\), with control\-max damage 0\.100 \(mostlytimes\), confirming the effect is not maths\-selective\. Forllama digits, exact\-match damage under top\-5 ablation is target\-skewed \(0\.075 target vs\. 0\.025 control maximum\)\.

Exact\-output audit methodology: each prompt is run under greedy decoding with and without ablation\. A “damaged” row is one where the greedy first token changes from correct to a different candidate under ablation\. Margin is defined as the logprob difference between the correct answer token and the best competing candidate token\.

## Appendix HCompute Resources

All experiments ran on Google Cloud Platform \(GCP\) virtual machines\. Two machine types were used:

- •g2\-standard\-8: 1×\\timesNVIDIA L4 GPU \(24 GB VRAM\), 8 vCPUs, 32 GB RAM\. Used for smaller experiments: representation audits, generation audits, and single\-head analysis scripts\.
- •a2\-highgpu\-1g: 1×\\timesNVIDIA A100 GPU \(40 GB VRAM\), 12 vCPUs, 85 GB RAM\. Used for full\-trajectory restore, activation transduction, random\-mask recovery, and subset lattice experiments\.

Approximate per\-experiment runtimes \(including model load\):

- •CSS behavioral screen \(one model, all families\):≈\\approx2–3 hours on A100\.
- •Full\-trajectory restore \(one model \+ family\):≈\\approx22–60 minutes on A100\.
- •Activation transduction \(one model \+ family, all patch targets\):≈\\approx1–2 hours on A100\.
- •Subset\-lattice evaluation \(one model \+ family\):≈\\approx45–90 minutes on A100\.
- •Representation audit \(one full\-coverage model, all families\):≈\\approx1 hour on A100\.
- •Random\-mask recovery \(256 masks, one cell\):≈\\approx30–60 minutes on A100\.
- •SVD and downstream patching experiments:≈\\approx30–90 minutes each on A100\.

Across all experiments reported in the paper, the estimated total compute is approximately 60–80 A100\-GPU\-hours\. No model training was performed; all computation is inference\-time forward passes on pretrained publicly released checkpoints\.

## Appendix IExtended Numerical Results

Table 7:Full\-trajectory restore results for main case studies\. Recovery fraction==\(restored damage−\-zero\-all damage\) / zero\-all damage\. Values near 1\.0 indicate full recovery at that position range; near 0 indicate no recovery\.† best restore is answer\-rest \(1\.025\)\. ‡ best restore is prompt\-second\-half\.

Table 8:Activation transduction results\. SourceΔ\\Delta==source\-answer logprob change\. MarginΔ\\Delta==source\-vs\.\-correct margin change\. Answer Changed==fraction of prompts where top candidate changes\. Controls show the same metric for the most relevant control condition\.Table 9:Generation audit summary\. EM damage==fraction of prompts where greedy completion changes from correct to incorrect under ablation\.
## Appendix JSkeptical Analysis of CSS

study\-css\-statistical\-sparsity\-audit\.md documents the analysis of a “skeptical\-reviewer" viewpoint: Are CSS head sets genuinely sparse and statistically unusual, or are we over\-reading the visible top of a long\-tailed distribution of many mildly damaging heads?

The answer is mixed\. The selected top\-5 sets are statistically extreme versus random additive head sets in all audited cells, so the CSS screen is not just picking arbitrary heads\. But that does not imply all cells are truly “small in number\." Qwen has the strongest sparse cases: ‘qwen25 digits‘, ‘qwen25 maths‘, and ‘qwen25 times‘ concentrate positive selectivity into low effective head counts\. Several Llama and Mistral cells are statistically non\-random but broad\-tailed, with many mildly positive heads and low top\-5 positive\-mass share\. Exact top\-5 head reuse across families is zero in all three models, so the current artifacts do not support a simple “same heads cluster all math\-like functions" story\. The packing\-pressure and polysemantic\-packing explanations remain live conjectures, not established results\.

## Appendix KSkeptical Analysis of SVD

study\-svd\-statistical\-meaning\-audit\.ms documents the analysis of a “skeptical\-reviewer" viewpoint: Are we interpreting inevitable low\-rank structure as meaningful mechanism?

The answer is again mixed\. SVD/readout structure is real: 441/468 audited SVD alignment rows exceed shuffled\-label p95, and many CSS/shortlist states are strongly linearly readable\. But meaningful representation is not the same as mechanism\. The Llama activation\-atlas random null is the sharpest caution: layer\-matched random head sets match or exceed the CSS atlas on family separability and SVD concentration\. Head\-output SVD can be behaviorally sufficient in some cells, but Qwen maths admits matched\-random/direct\-null compatible rescue, weakening a unique\-component story\. The strongest positive SVD\-as\-causal\-organization evidence is downstream\-local: compact Qwen MLP\-delta SVD slices rescue where matched\-random deltas mostly fail\. Current artifacts do not establish polysemantic packing pressure\.