Detecting a Route Flip Is Easier Than Knowing Whether to Fix It: Causal Route-Mediated Damage in Quantized Mixture-of-Experts

# Detecting a Route Flip Is Easier Than Knowing Whether to Fix It: Causal Route-Mediated Damage in Quantized Mixture-of-Experts
Source: [https://arxiv.org/html/2608.11212](https://arxiv.org/html/2608.11212)
Parvel Gu Independent Researcher parvel\.gu@gmail\.com

###### Abstract

Top\-kkMixture\-of\-Experts \(MoE\) routing is discontinuous, so a deployment\-motivated numerical disturbance—simulated 4\-bit KV\-cache quantization read by a protected BF16 gate—pushes tokens across decision boundaries and flips which experts fire\. This paper proposes no new mitigation; it supplies a causal apparatus, several empirical findings, and a detection\-limit result for that disturbance\. A four\-run apparatus prices the route\-mediated fraction \(RMF\) of quantization damage, a token\-level attribution decomposes it by mechanism, and pre\-registered probes carry the findings across three architectures\. On OLMoE\-1B\-7B at 4\-bit KV \(pilot\), about a third of the damage is routing\-mediated under quantized compute: the route\-mediated fraction isRMF≈0\.31\\mathrm\{RMF\}\\approx 0\.31, confirmed as the process\-replicated central value \(five independent process invocations, mean0\.313±0\.0200\.313\\pm 0\.020\), with the discovery anchor0\.310\.31\[0\.20,0\.41\]\[0\.20,0\.41\]and a pre\-registered re\-execution at0\.2310\.231\. The deployable router margin detects that a flip occurred \(AUC0\.7720\.772\) but cannot tell a harmful flip from a helpful one \(at chance\): among the tested local, inference\-observable router statistics we find no predictor of a flip’s loss sign above chance—an empirical benefit\-detection barrier bounding selective repair restricted to this feature family\. The signed\-flip tax and the sign\-inseparability carry cross\-model; the clean\-reference remedy’s payout is architecture\-modulated; a controlled same\-checkpoint flag\-swap re\-scopes the gate’s normalization convention to a*damage\-magnitude*moderator, not a route\-recoverability mechanism\. A real int4 KV kernel yields a route\-mediated fraction compatible with the frozen fake\-quant dose curve but is underpowered \(95% CI\[−0\.111,0\.394\]\[\-0\.111,0\.394\]includes zero\): it rules out gross disagreement at int4, but is not an independent replication\. Headline hypotheses, thresholds, and evaluations were pre\-registered before measurement, with misses reported\. A pre\-registered held\-out read replicates the partition and the near\-cancelling tax out of sample; the strict impossibility exclusion narrowly misses\.

## 1Introduction and three claims

Hard top\-kkexpert routing scaled throughLepikhin et al\. \[[17](https://arxiv.org/html/2608.11212#bib.bib17)\],Fedus et al\. \[[7](https://arxiv.org/html/2608.11212#bib.bib7)\],Zhou et al\. \[[38](https://arxiv.org/html/2608.11212#bib.bib38)\]and stability\-regularized\[[39](https://arxiv.org/html/2608.11212#bib.bib39)\]variants into deployed sparse\-MoE LLMs\[[15](https://arxiv.org/html/2608.11212#bib.bib15)\]; routers encode their experts’ geometry\[[1](https://arxiv.org/html/2608.11212#bib.bib1)\]\. Selection byarg⁡top\-​k\\arg\\text\{top\-\}kis discontinuous, so a small numerical perturbation of the router’s input can change*which*experts fire\. We study one deployment\-origin disturbance—4\-bit KV\-cache quantization\[[12](https://arxiv.org/html/2608.11212#bib.bib12),[23](https://arxiv.org/html/2608.11212#bib.bib23)\]under a*protected*BF16 gate \(router weights and arithmetic in BF16, reading a quantized upstream hidden state\)—and ask what damage flows through the routing decision, and whether that damage can be detected or repaired from signals available at inference\.

This paper contributes a measurement apparatus and three findings, not a method:

1. 1\.A priced routing channel\.A four\-run causal apparatus decomposes quantization damage into a compute path and a routing path\. On OLMoE at 4\-bit KV, the route\-mediated fraction isRMF≈0\.31\\mathrm\{RMF\}\\approx 0\.31—confirmed as the process\-replicated central value \(five\-process mean0\.313±0\.0200\.313\\pm 0\.020; discovery anchor0\.310\.31\[0\.20,0\.41\]\[0\.20,0\.41\], pre\-registered re\-execution0\.2310\.231\); the compute×\\timesroute interaction is*measured*\(not assumed additive\) and excludes zero\. Nearly all \(99\.8%99\.8\\%\) of the*net signed*route\-mediated contribution is associated with a route\-set change at the scoring or an upstream layer \(majority nonlocal\)—a signed ratio of near\-cancelling components\. The partition is a*function*of architecture, dose, and damage domain—not a constant\.\[empirical, pilot\]
2. 2\.Detecting a flip is not knowing whether to fix it\.The deployable router margin scores flip*occurrence*at AUC0\.7720\.772but flip*harm*at chance \(AUC0\.4900\.490\)\. Across the tested local feature families, no predictor of a flip’s loss sign beats a rate\-matched random selector—an empirical benefit\-detection barrier that bounds selective repair*restricted to this feature family and protocol*\.\[empirical, pilot\]
3. 3\.Reference\-fidelity is architecture\-modulated\.Pinning a clean route recovers a bounded slice of the routed ceiling \(\+0\.23\+0\.23to0\.460\.46on two architectures\); a controlled same\-checkpoint flag\-swap re\-scopes the gate’s normalization convention to a*damage\-magnitude*moderator, not a route\-recoverability mechanism \(a fourth\-model axis is the remainingn=3n=3confound\)\.\[empirical, pilot\]

Claim perimeter\.We do*not*show that MoE routing is a control system, that quantization is uniquely harmful to MoE, or that route repair is impossible—only that*per\-token sign\-selective*repair of quantization\-induced flips is bounded near random under a protected\-gate KV disturbance, at pilot scale, on the architectures measured\. We report*findings*, not laws, and an*empirical barrier*, not a theorem: the negative result is scoped to the tested inference\-observable statistics—which now include a cross\-layer router vector over all1616layers \(Table[5](https://arxiv.org/html/2608.11212#A1.T5)\), also at chance—and does not rule out predictors using richer hidden\-state or trained\-decoder information\. Every claim carries an evidence\-grade tag\[empirical/pilot/bound\]; the reserved held\-out split is read*once*, on three pre\-registered endpoints \(§[7](https://arxiv.org/html/2608.11212#S7)\), with the one miss reported\.

## 2Related work and experimental setting

Discontinuity geometry\.Huu et al\. \[[13](https://arxiv.org/html/2608.11212#bib.bib13)\]classify routing discontinuities and propose input smoothing evaluated on clean benchmarks with no quantization study; we test that mechanism under the KV disturbance\.Causal audit of routing\.Engmann et al\. \[[6](https://arxiv.org/html/2608.11212#bib.bib6)\]audit whether population routing summaries predict the causal importance of expert ablations across OLMoE, Qwen1\.5\-MoE and DeepSeek and find observational metrics insufficient; we instead intervene on the route*mediator*under paired clean/quantized compute and ask whether inference\-observable signals predict the*sign*of route\-mediated token loss\.Router\-aware MoE PTQ\.Fu et al\. \[[9](https://arxiv.org/html/2608.11212#bib.bib9)\],Park et al\. \[[27](https://arxiv.org/html/2608.11212#bib.bib27)\],Deng et al\. \[[4](https://arxiv.org/html/2608.11212#bib.bib4)\],Hyeon and Do \[[14](https://arxiv.org/html/2608.11212#bib.bib14)\]align router logits under static weight/activation quantization; none reaches the KV disturbance or prices the damage causally\.Soft/continuous routing\.Zasada et al\. \[[36](https://arxiv.org/html/2608.11212#bib.bib36)\]trains relaxations with no quantization claim; routing\-free MoE\[[22](https://arxiv.org/html/2608.11212#bib.bib22)\]removes the router entirely\.KV compression / allocation\.GEAR\-class reconstruction\[[16](https://arxiv.org/html/2608.11212#bib.bib16)\]targets the attention output, not the routing argmax; layer\-wise precision pairs loss\-sensitivity to bits\[[19](https://arxiv.org/html/2608.11212#bib.bib19),[18](https://arxiv.org/html/2608.11212#bib.bib18),[37](https://arxiv.org/html/2608.11212#bib.bib37)\]; rotation\-based W4A4\[[2](https://arxiv.org/html/2608.11212#bib.bib2),[20](https://arxiv.org/html/2608.11212#bib.bib20)\]is orthogonal to the KV axis\. On OLMoE—the common evaluation model—our causal decomposition refines the router\-aware PTQ line’s correlational phenomenology: they observe that quantization perturbs routing; we price it \(the route\-mediated channel carries≈31%\\approx 31\\%of the damage\)\.

Setting\.Model: OLMoE\-1B\-7B \(allenai/OLMoE\-1B\-7B\-0924, pinned revision\), 16 layers, 64 experts, top\-k=8k=8,norm\_topk\_prob = False, protected BF16 gate\[[26](https://arxiv.org/html/2608.11212#bib.bib26)\]\. Corpus: a calibration split with a 6\-bucket manifest \(WikiText\-103\[[25](https://arxiv.org/html/2608.11212#bib.bib25)\], C4\[[28](https://arxiv.org/html/2608.11212#bib.bib28)\]\); the test split is unread except for one pre\-registered confirmatory read \(§[7](https://arxiv.org/html/2608.11212#S7)\)\. Decode: sequential teacher\-forced, 64\-token prefill then decode, per\-token NLL\. The pilot anchor isN=96N=96sequences \(18,43218\{,\}432decode tokens\); where measured, an expanded nested\-calibration sample ofN=384N=384\(4×N4\{\\times\}N\) is carried alongside\. Cross\-model probes use Qwen1\.5\-MoE\-A2\.7B\[[34](https://arxiv.org/html/2608.11212#bib.bib34)\], Qwen3\-30B\-A3B\[[35](https://arxiv.org/html/2608.11212#bib.bib35)\], and DeepSeek\-MoE\-16B\[[3](https://arxiv.org/html/2608.11212#bib.bib3)\]\. The primary disturbance is a*simulated*4\-bit symmetric fake\-quantization of the KV cache at full strength; an INT8\-activation condition is a near\-null \(excess NLL≈0\\approx 0\), so the damaging channel is the KV cache read upstream of the router, through attention\.

## 3Four\-run causal apparatus and estimands

Four runs\(single process per contrast\):YC​CY\_\{CC\}\(clean compute, free route; baseline\);YQ​PY\_\{QP\}\(quantized compute, clean routepinned\);YQ​FY\_\{QF\}\(quantized compute, free route\);YC​TY\_\{CT\}\(clean compute, quantized routetransplanted\)\. Pinning imposes the clean expert*set**and*its clean weights verbatim \(no renormalization, matchingnorm\_topk\_prob = False\); this is an*interchange intervention*on the routing mediator in the activation\-patching lineage\[[24](https://arxiv.org/html/2608.11212#bib.bib24),[31](https://arxiv.org/html/2608.11212#bib.bib31),[10](https://arxiv.org/html/2608.11212#bib.bib10),[11](https://arxiv.org/html/2608.11212#bib.bib11),[32](https://arxiv.org/html/2608.11212#bib.bib32),[30](https://arxiv.org/html/2608.11212#bib.bib30)\], not an ablation\.Estimand semantics\.RMF is an*interventional controlled\-route contribution under quantized compute, not a natural indirect effect*: the pinned condition is intentionally cross\-context \(a clean route set and its clean weights read against a quantized hidden state\) and prices the route channel under a specified mediator intervention; the reported conclusions depend on this intervention semantics\.

clean routequantized routeYC​CY\_\{CC\}clean cmp, freeYC​TY\_\{CT\}clean cmp, transpl\.YQ​PY\_\{QP\}quant cmp, pinnedYQ​FY\_\{QF\}quant cmp, freeclean computequant computeroutepure\{\}\_\{\\text\{pure\}\}\(clean\-context\)routefwd\{\}\_\{\\text\{fwd\}\}\(quant\-context; RMF numerator\)computecomputeFigure 1:The four\-run apparatus as a 2×\\times2 causal graph \(rows: clean vs\. quantized*compute*; columns: clean vs\. quantized*route*\)\. The deployment\-relevant quant\-context route contrast route=fwdL\(YQ​F\)−L\(YQ​P\)\{\}\_\{\\text\{fwd\}\}=L\(Y\_\{QF\}\)\-L\(Y\_\{QP\}\)\(red, the RMF numerator\) and the clean\-context route contrast route=pureL\(YC​T\)−L\(YC​C\)\{\}\_\{\\text\{pure\}\}=L\(Y\_\{CT\}\)\-L\(Y\_\{CC\}\)\(blue\) differ by the measured compute×\\timesroute interaction \(Table[1](https://arxiv.org/html/2608.11212#S4.T1)\); the vertical edge is the compute channelL​\(YQ​P\)−L​\(YC​C\)L\(Y\_\{QP\}\)\-L\(Y\_\{CC\}\)\.RMF=∑excess\_route/∑excess\_total\\mathrm\{RMF\}=\\sum\\text\{excess\\\_route\}/\\sum\\text\{excess\\\_total\}with excess\_route==routefwd\{\}\_\{\\text\{fwd\}\}\.RMF estimator\.excess\_total=L​\(YQ​F\)−L​\(YC​C\)\\text\{excess\\\_total\}=L\(Y\_\{QF\}\)\-L\(Y\_\{CC\}\);excess\_compute=L​\(YQ​P\)−L​\(YC​C\)\\text\{excess\\\_compute\}=L\(Y\_\{QP\}\)\-L\(Y\_\{CC\}\);excess\_route=excess\_total−excess\_compute\\text\{excess\\\_route\}=\\text\{excess\\\_total\}\-\\text\{excess\\\_compute\}; andRMF=∑excess\_route/∑excess\_total\\mathrm\{RMF\}=\\sum\\text\{excess\\\_route\}/\\sum\\text\{excess\\\_total\}—a*ratio of sums*, never a median of per\-sequence ratios \(unbounded variance near zero denominators\)\. CIs are bysequence\-cluster bootstrap\[[5](https://arxiv.org/html/2608.11212#bib.bib5)\]\(resample sequences, not tokens\); combined\-logistic AUCs are*sequence\-held\-out*train/val splits, not train\-fits\. An RMF is interpretable only whenexcess\_total\>0\\text\{excess\\\_total\}\>0and its CI excludes zero\. The two route paths are*not*additively separable at this dose: the interaction is measured \(YC​TY\_\{CT\}supplies the clean\-context path\), not assumed away\.

Token\-level attribution\.For each decode token we capture the top\-kkroute set at every layer under clean and quantized compute, setharm​\(t\)=L​\(YQ​F\)​\(t\)−L​\(YQ​P\)​\(t\)\\mathrm\{harm\}\(t\)=L\(Y\_\{QF\}\)\(t\)\-L\(Y\_\{QP\}\)\(t\), and classify:jumpif the scoring layer’s set changed; elsenonlocalif any upstream layer’s set changed; elsepure flux\. The three masks partition all tokens, so∑harm\\sum\\mathrm\{harm\}partitions exactly into jump\+\+nonlocal\+\+pure\-flux\.Estimand caveat\.Under the blanket intervention the token\-level harm label is an*attribution label*—the sign of that token’s counterfactualΔ\\DeltaNLL, quantized vs\. clean route—*not*a composable individual treatment effect\. The utility of a selective strategy is therefore evaluated by*running*that strategy \(§[5](https://arxiv.org/html/2608.11212#S5)\), never by summing labels\.

## 4RMF, interaction and mechanism partition

Table 1:Two\-path decomposition of the route effect \(4\-bit KV, OLMoE,N=96N\{=\}96\)\. The quant\-context path \(routefwd\{\}\_\{\\text\{fwd\}\}, the RMF numerator\) exceeds the clean\-context path; their difference is the measured compute×\\timesroute interactionII\(CI excludes 0\)—itself a deployment fact, since a route\-only remedy cannot be budgeted as if compute damage were held fixed\. This re\-run’s route fraction \(route/fwd\{\}\_\{\\text\{fwd\}\}/total=0\.0175/0\.0757=0\.231=0\.0175/0\.0757=0\.231\) lies inside the headline RMF CI\[0\.20,0\.41\]\[0\.20,0\.41\]; the gap to the0\.310\.31anchor is run\-to\-run variation and winner’s curse\.###### Result 1\(Route\-mediated fraction and mechanism partition\)\.

On OLMoE at 4\-bit KV,RMF=0\.31\\mathrm\{RMF\}=0\.31, 95% CI\[0\.20,0\.41\]\[0\.20,0\.41\]\(excludes zero\)\. This is the*process\-replicated*central value: over five independent process invocations the four\-run RMF mean is0\.313±0\.0200\.313\\pm 0\.020\(range0\.2880\.288–0\.3390\.339; §[7](https://arxiv.org/html/2608.11212#S7), Table[4](https://arxiv.org/html/2608.11212#S7.T4)\), the discovery anchor is0\.310\.31, a pre\-registered re\-execution gives0\.2310\.231, and fixed\-process re\-estimates range≈0\.23\\approx 0\.23–0\.330\.33\. The damage partitionsjump45%45\\%⋅\\cdotnonlocal55%55\\%⋅\\cdotpure\-flux≈0\.2%\\approx 0\.2\\%; nearly all \(99\.8%99\.8\\%\) of the*net signed*route\-mediated contribution is associated with a route\-set change at the scoring or an upstream layer \(majority nonlocal\)\. This share is a ratio of*signed*per\-token contributions; because the oppositely\-signed flip components near\-cancel \(harmful\+0\.043\+0\.043/ beneficial−0\.047\-0\.047nats, net≈0\\approx 0; §[5](https://arxiv.org/html/2608.11212#S5)\), it is reported as the signed set\-change share, not an absolute\-value partition\. A single\-scoring\-layer indicator localizes only45%45\\%; the attribution algorithm recovers the rest as upstream jumps\.\[empirical, pilot\]

The partition is a function, not a number\.It is a mapped function of architecture×\\timesdose \(an aggressive\-dose sweep, re\-estimated atN=384N\{=\}384; App\.[A](https://arxiv.org/html/2608.11212#A1)\)×\\timesdamage domain: in the KV domainRMF=0\.31\\mathrm\{RMF\}=0\.31; in the weight\-PTQ domain\[[8](https://arxiv.org/html/2608.11212#bib.bib8),[21](https://arxiv.org/html/2608.11212#bib.bib21),[33](https://arxiv.org/html/2608.11212#bib.bib33)\]a first\-party*conservative lower bound*is0\.1150\.115–0\.1230\.123, stable across a≈8×\\approx 8\\timesdose range \(expert\-FFN RTN at 4\-bit and 3\-bit\)\. The weight\-domain lower bound is a different damage domain*and*dose from the KV pilot anchor0\.310\.31, and is not a re\-measurement of it\.\[empirical, pilot\]

## 5Detection versus selective utility

Letmmbe the quantized router margin \(weakest\-selected minus strongest\-unselected logit\), the strongest deployable single\-layer statistic at inference\. We distinguish four objects:FscoreF\_\{\\text\{score\}\}, a route\-set change at the*scoring*layer \(where the output NLL is read\);FanyF\_\{\\text\{any\}\}, a route\-set change at*any*layer \(scoring or upstream\);HH, the token attribution sign under the blanket route intervention \(whether pinning the clean route lowers this token’s loss\); andBπB\_\{\\pi\}, the realized benefit of*executing*a selective policyπ\\pi\. A pin helps tokenttiffFanyF\_\{\\text\{any\}\}holds andHHis favorable\. The scoring\-layer margin predictsFscoreF\_\{\\text\{score\}\}, whereas selective benefitBπB\_\{\\pi\}depends on a trajectory\-level functional involvingFanyF\_\{\\text\{any\}\}and downstream state—so a high flip\-occurrence AUC \(0\.7720\.772, anFscoreF\_\{\\text\{score\}\}read\-out\) and a largeP​\(harm\>0∣no scoring\-layer flip\)=0\.55P\(\\text\{harm\}\{\>\}0\\mid\\text\{no scoring\-layer flip\}\)=0\.55are consistent, not conflicting\.

###### Result 2\(Benefit\-detection barrier \(empirical\)\)\.

From two measured premises: \(P1\) the single\-layer margin scores flip*occurrence*atmargin→flip\\text\{margin\}\\to\\text\{flip\}AUC=0\.772=0\.772; \(P2\) given a flip, the margin does not resolve harm—margin→\(harmful∣flip\)\\text\{margin\}\\to\(\\text\{harmful\}\\mid\\text\{flip\}\)AUC=0\.490=0\.490,P​\(harmful∣flip\)=0\.572P\(\\text\{harmful\}\\mid\\text\{flip\}\)=0\.572\(a near coin flip\)\. Because the margin carries the first conjunct but not the second, a benefit predictor built from the tested local statistics scores at the barrier: benefit\-vs\-all AUC=0\.499=0\.499\.\[empirical\]

Population semantics\.The three AUCs are on distinct populations: flip\-vs\-all tokens \(0\.7720\.772\), harmful\-given\-flip*within*flipped tokens \(0\.4900\.490\), and benefit\-vs\-all tokens \(0\.4990\.499\)\. The last is a mixture over two negative groups—non\-flip tokens \(weight0\.5760\.576, separable at AUC0\.6150\.615\) and flipped\-but\-harmless tokens \(weight0\.4240\.424, AUC0\.3420\.342\)—reconstructing0\.576×0\.615\+0\.424×0\.342=0\.4990\.576\\times 0\.615\+0\.424\\times 0\.342=0\.499\. Benefit is not nested in the single\-layer flip indicator \(P​\(harm\>0∣no flip\)=0\.55P\(\\text\{harm\}\{\>\}0\\mid\\text\{no flip\}\)=0\.55; non\-flip contribution\+0\.009\+0\.009\[\+0\.005,\+0\.013\]\[\+0\.005,\+0\.013\]nats\) precisely because the damage is majority nonlocal: a single\-layer flip cannot carry a multi\-layer harm\. Richer probes agree: nonlinear and temporal predictors of harm\-given\-flip \(MLP, gradient\-boosted trees, and a budget\-matched temporal predictor\) all sit at chance, sequence\-held\-out\. The combined\-logistic sign\-AUC is0\.5200\.520\(OLMoE\), within the pre\-declared\|AUC−0\.5\|≤0\.05\|\\mathrm\{AUC\}\-0\.5\|\\leq 0\.05falsification band\.

![Refer to caption](https://arxiv.org/html/2608.11212v1/figures/fig4_margin_auc.png)Figure 2:The benefit floor\. Deployable router margin: flip\-detection AUC0\.7720\.772vs harmful\-flip localization AUC0\.4900\.490\(benefit\-prediction AUC0\.4990\.499\)\. The margin carries occurrence but not harm\-direction\.Table 2:Oracle\-vs\-random battery \(clean\-route\-pin instrument, both architectures,N=384N\{=\}384; fractions of the route\-mediated component\)\. The oracle\-omniscient advantage \(oracle−\-random\) is null on OLMoE and positive on DeepSeek; the deployable margin gate recovers below random on both\. This is a*measured cross\-model contrast*, not a missing control\.Selective utility, run not summed\.We evaluate selective policies by executing them\. An*oracle*gate \(given the true harm sign\) and a rate\-matched*random*gate bound the achievable recovery; the deployable*margin*gate is the realistic policy \(Table[2](https://arxiv.org/html/2608.11212#S5.T2)\)\. On OLMoE the oracle buys nothing over random \(\+0\.4%\+0\.4\\%\[−1\.8,\+2\.8\]\[\-1\.8,\+2\.8\], CI includes 0\); on DeepSeek an oracle label buys a small but significant\+2\.3%\+2\.3\\%\[\+0\.9,\+3\.7\]\[\+0\.9,\+3\.7\]over random\. The*deployable*margin gate recovers*below*random on both architectures \(−1\.8%\-1\.8\\%\[−3\.5,−0\.1\]\[\-3\.5,\-0\.1\]on DeepSeek, precision≈\\approxchance\)\. So the “oracle beats nothing over random” form is OLMoE\-specific and did not generalize, while the practical floor—no deployable recovery from local features—holds on both\.\[empirical, pilot\]

Design implication \(scoped\)\.An inference\-time route correction driven by the*tested*deployment\-observable features—including online token\-wise router calibration built from those statistics—inherits the barrier for harmful\-flip localization\. This bounds selective\-repair schemes*restricted to this feature family and evaluation protocol*—now including a cross\-layer router vector over all1616layers, also at chance \(Table[5](https://arxiv.org/html/2608.11212#A1.T5)\)—and does not rule out predictors using richer hidden\-state or trained\-decoder information\. To refute the floor, a method must beat random at locating harmful\-to\-pin tokens usingonly inference\-observable features, with our labels, budget\-matched, on a paired CI vs random that excludes zero\.\[empirical\]

## 6Cross\-model replication and a controlled normalization flag\-swap

The tax and the sign\-inseparability carry\.On DeepSeek\-MoE\-16B \(N=384N\{=\}384, dose\-matched\), route\-mediated damage decomposes into harmful \(\+0\.2036\+0\.2036\[\+0\.199,\+0\.208\]\[\+0\.199,\+0\.208\]\) and beneficial \(−0\.1819\-0\.1819\[−0\.186,−0\.178\]\[\-0\.186,\-0\.178\]\) flip components that near\-cancel \(cancellation90\.2%90\.2\\%\), and the oracle harm sign is not predictable from local router statistics \(combined sign\-AUC0\.5070\.507, within the\|AUC−0\.5\|≤0\.05\|\\mathrm\{AUC\}\-0\.5\|\\leq 0\.05band\)\. The beneficial\-flip tax and sign\-inseparability therefore hold on a second architecture\.

Table 3:Preliminary cross\-architecture association for prefix\-reference recovery \(all rowsN=384N\{=\}384, nested\)\. The Qwen3 row is the*prefix\-only*deployable reference; a controlled full\-decode contrast recovers on Qwen3 \(below\), localizing the null to reference semantics\. The normalization\-convention mechanism was registered*before*the DeepSeek measurement; the DeepSeek row is a genuine prediction\-before\-measurement, the OLMoE and Qwen3 rows predate it\.Reference\-fidelity, re\-estimated\.Pinning a clean prefix route recovers a bounded directional slice of the routed ceiling: discovered\+0\.348\+0\.348\[0\.076,0\.622\]\[0\.076,0\.622\]atN=96N\{=\}96,*re\-estimated*\+0\.231\+0\.231\[0\.095,0\.363\]\[0\.095,0\.363\]on the expanded nested sample \(4×N4\{\\times\}N; the interval tightened×0\.49≈1/4\\times 0\.49\\approx 1/\\sqrt\{4\}, CI excludes zero\)\. We report this as measured with*no dominance claim*\. The payout is architecture\-modulated \(Table[3](https://arxiv.org/html/2608.11212#S6.T3)\): the twoFalse\-class magnitudes \(OLMoE\+0\.231\+0\.231, DeepSeek0\.4560\.456\) have overlapping intervals \(\[0\.246,0\.363\]\[0\.246,0\.363\]\), so we claim no rank ordering; theTrue\-class architecture is null under the deployable prefix\-only reference\.

Candidate moderator, controlled contrast, and firewalls\.A same\-checkpoint, adapter\-identity\-verified contrast \(max\|Δ​NLL\|=0\|\\Delta\\text\{NLL\}\|=0\) isolates the Qwen3 null to the*deployable prefix\-only*reference: under full\-decode clean\-route pinning, Qwen3 recovers\+0\.408\+0\.408\[\+0\.363,\+0\.574\]\[\+0\.363,\+0\.574\]of*total*quant damage versus the prefix\-only null\+0\.038\+0\.038, with an OLMoE control at\+0\.271\+0\.271\.Denominator firewall:the clean\-reference recovery\+0\.231\+0\.231is a fraction of the*route\-mediated*ceiling \(quant vs\. all\-clean\-routes\-pinned\), whereas the full\-decode/prefix\-only recoveries are fractions of*total*quant damage \(quant vs\. clean\)—the same intervention family under different denominators, not directly comparable\. The convention thus appears to moderate the deployable\-reference case specifically—but a controlled test now shows this is*not*a route\-recoverability mechanism\.Controlled flag\-swap \(the decisive single\-variable test\)\.On a fixed checkpoint we force the oppositenorm\_topk\_proband re\-measure the clean\-route pin recovery, with the adapter\-identity gate PASSING \(max\|Δ​NLL\|=0\|\\Delta\\text\{NLL\}\|=0\) on all four native/forced×\\times\{OLMoE, Qwen3\} configs—a genuinely single\-variable swap\. Clean\-route full\-decode recovery*persists under both conventions on both checkpoints*\(OLMoE\+0\.288\+0\.288/\+0\.483\+0\.483, Qwen3\+0\.408\+0\.408/\+0\.596\+0\.596; all four CIs exclude zero; the toggled configs are off\-native\-distribution, so we read robustness, not the magnitude delta\)\. The one clean single\-variable effect of the convention is on the*damage magnitude*\(routed ceiling×7\\times 7–1010,False=\{=\}more damage\), not recoverability\.

*Synthesis \(P7\)\.*The pre\-registered discriminator pattern stands as an association under the prefix protocol\. Two controlled single\-variable tests refine its interpretation: the convention bit does not gate recoverability \(recovery persists under both conventions, both checkpoints\), and the original null is protocol\-scoped \(full\-decode transplant recovers on the=Truemodel\)\. The convention does causally moderate damage magnitude \(×7\\times 7–1010, single\-variable\)\. What modulates cross\-architecture recovery magnitude remains open \(n=3n\{=\}3\)\. A second\-model replication on Qwen1\.5\-MoE givesRMF=0\.290\\mathrm\{RMF\}=0\.290\[0\.200,0\.372\]\[0\.200,0\.372\], with its always\-on shared\-expert channel \(10\.6%10\.6\\%of FFN\-output norm\) shifting damage into a class\-A exposure buffer\.\[empirical, pilot, 3 models\]

## 7Real\-kernel and held\-out validation

Real int4 kernel\.To test whether the route\-mediated fraction is a simulation artifact, a real low\-bit KV kernel \(a pack\-to\-int4 / dequant\-on\-read HQQ backend\) replaces the fake\-quant disturbance\. In the same session the positive control reproduces the canonical partition \(fake\-quant RMF0\.3390\.339\[0\.247,0\.427\]\[0\.247,0\.427\], covering the0\.310\.31anchor\), and thereal int4 RMF is0\.1940\.194\[−0\.111,0\.394\]\[\-0\.111,0\.394\]\. The point estimate is*compatible*with the band predicted from the frozen fake\-quant dose curve \(\[0\.087,0\.350\]\[0\.087,0\.350\]at the measured harm\), but the experiment is*underpowered*: the 95% CI includes zero, so it rules out gross disagreement at int4 without constituting an independent replication of a nonzero route\-mediated fraction\.Dose mismatch \(stated honestly\):the real int4 kernel inflicts total damage0\.00820\.0082nats versus the fake\-quant1×1\\timesoperating point’s0\.07570\.0757nats—the same nominal bit\-width at a very different*damage dose*, so this is not the fake\-quant “headline dose” point\.Equal\-prominence divergence:the real\-kernel RMF*declines*with dose \(0\.194→0\.129→0\.0900\.194\\to 0\.129\\to 0\.090for int4→\\toint3→\\toint2\) while the fake\-quant curve*rises*, so at the aggressive int2 dose the real share falls*below*its predicted band—the optimized kernel loads more damage onto the direct channel at aggressive bits—itself a measurement, not a refutation\.\[empirical, pilot\]

Process replication\.To answer whether the RMF numerator—a small per\-token quantity—survives a change of process \(a different reduction order / kernel schedule\), we re\-ran the three core paired contrasts once per fresh Python process across five independent invocations \(OLMoE, kv4/s1\.0,N=96N\{=\}96; Table[4](https://arxiv.org/html/2608.11212#S7.T4)\)\. Within a process the paired execution is bitwise\-identical \(control max\|Δ\|=0\|\\Delta\|=0\); across processes the four\-run RMF has mean0\.3130\.313with between\-process SDσproc=0\.020\\sigma\_\{\\mathrm\{proc\}\}=0\.020\(range0\.2880\.288–0\.3390\.339\), i\.e\.RMF=0\.31±0\.02\\mathrm\{RMF\}=0\.31\\pm 0\.02, and the per\-token route\-numerator between\-process SD isσproc≤0\.0018\\sigma\_\{\\mathrm\{proc\}\}\\leq 0\.0018nats\. All variance is between\-process \(ICCprocess=1\.0\\text\{ICC\}\_\{\\text\{process\}\}=1\.0; within\-process0\)\.The route numerator \(≈0\.016\\approx 0\.016nats\) sits an order of magnitude above the measured cross\-process floor \(≤0\.0018\\leq 0\.0018nats\), so RMF is*not*a single\-process reduction\-order artifact; the0\.3130\.313mean confirms0\.310\.31as the process\-central value rather than a winner’s\-curse high\.\[empirical, pilot\]

Table 4:Process replication: five fresh process invocations of the core contrasts \(OLMoE, kv4/s1\.0,N=96N\{=\}96\)\.σproc\\sigma\_\{\\mathrm\{proc\}\}is the between\-process SD; the within\-process control is bitwise \(max⁡\|Δ\|=0\\max\|\\Delta\|=0\), soICCprocess=1\.0\\text\{ICC\}\_\{\\text\{process\}\}=1\.0\. The per\-token route\-numerator floor \(≤0\.0018\\leq 0\.0018nats\) is an order of magnitude below the route numerator \(≈0\.016\\approx 0\.016nats\): the RMF is process\-stable, not a reduction\-order artifact\.Task\-level reach\.On a task\-shaped workload \(ARC\-Easy,N=500N\{=\}500\) the KV\-quant route tax reproduces in NLL and in its signed\-flip cancellation signature \(cancellation0\.9660\.966, harmful\-dominant\), but does not produce a resolvable answer\-accuracy drop—the task\-level teeth are at most a≲1\\lesssim 1\-point directional echo\. We therefore read this as an*inference\-mechanism and loss\-decomposition*result,*not*evidence of a large downstream accuracy impact at this scale; the abstract and introduction claim no strong deployment harm while the task\-level effect is unresolved\.\[empirical, pilot\]

Held\-out confirmation \(the reserved test split, read once\)\.We read the reservedtestsplit*once*on three pre\-registered endpoints \(the protocol was hashed and committed before the read; read\-only, whatever fires reported undiluted\)\.\(1\) Partition replicates:the four\-run RMF is0\.4290\.429\[0\.330,0\.519\]\[0\.330,0\.519\]on held\-out; its CI overlaps the discovery interval\[0\.20,0\.41\]\[0\.20,0\.41\]\(MET\), and the route\-mediated share is if anything*stronger*out of sample—not a winner’s\-curse inflation of0\.310\.31\.\(2\) Tax null holds, with a stated caveat:the two\-sided signed\-flip tax nets\+0\.0043\+0\.0043\[\+0\.0005,\+0\.0079\]\[\+0\.0005,\+0\.0079\]\(Δ\|harm\+0\.042\\Delta\|\_\{\\text\{harm\}\}\{\+\}0\.042/Δ\|benef−0\.049\\Delta\|\_\{\\text\{benef\}\}\{\-\}0\.049\), far below20%20\\%of either signed component \(METin the pre\-registered equivalence sense\)—the near\-cancellation confirms out of sample; undiluted, the held\-out net CI*excludes zero*, so “a small, sign\-balanced residual” survives but “exactly zero” does not\.\(3\) The strict impossibility exclusion narrowly misses:oracle\-gated recovery is\+0\.0042\+0\.0042\[\+0\.0003,\+0\.0082\]\[\+0\.0003,\+0\.0082\], and the pre\-registered strict bound \(upper95%95\\%CI<0\.008<0\.008\) ismissed by0\.00020\.0002\. The recovery stays tiny and consistent with the impossibility*direction*, but we do*not*assert a strict held\-out exclusion; this miss is recorded at equal prominence \(Table[7](https://arxiv.org/html/2608.11212#A1.T7)\)\. Two of three headline endpoints confirm out of sample; the strict exclusion is softened to an unconfirmed bound\. TheN=384N\{=\}384results remain an*expanded nested calibration*re\-estimate \(never “confirmed”\), distinct from this read\.

## 8Limitations and conclusion

Limitations\.PilotNN\(96 sequences, withN=384N\{=\}384expanded calibration where measured\); a simulated primary disturbance with a real int4 anchor whose point estimate is compatible with the fake\-quant dose curve but underpowered \(95% CI\[−0\.111,0\.394\]\[\-0\.111,0\.394\]includes zero; the aggressive\-dose divergence is future work\); NLL\-primary metrics; a single primary condition \(4\-bit KV\)\. The RMF numerator \(route≈fwd0\.018\{\}\_\{\\text\{fwd\}\}\\approx 0\.018nats\) is small, so the RMF is reported as a sequence\-bootstrap CI*conditional on the fixed\-process paired execution*; across fixed\-process runs the estimated share ranged≈0\.23\\approx 0\.23–0\.330\.33\. The cross\-process wobble is now measured directly \(five\-process replication, §[7](https://arxiv.org/html/2608.11212#S7)\):σproc≤0\.0018\\sigma\_\{\\mathrm\{proc\}\}\\leq 0\.0018nats on the per\-token primitives—an order of magnitude below the route numerator—so the RMF is process\-stable \(±0\.02\\pm 0\.02on the ratio,ICCprocess=1\.0\\text\{ICC\}\_\{\\text\{process\}\}=1\.0\); only the smaller sub\-floor effects \(the smoothing residual, the smallest oracle−\-random differences\) remain*exploratory*\. All reported contrasts are single\-process and thus paired bitwise\-valid\. The held\-out read is done \(§[7](https://arxiv.org/html/2608.11212#S7)\): the partition \(0\.4290\.429\) and the near\-cancelling tax replicate out of sample; the strict impossibility exclusion narrowly misses \(upper CI0\.00820\.0082vs the0\.0080\.008bar\) and is recorded as a miss, not asserted\.

Conclusion\.We supply a four\-run causal apparatus that prices the routing channel of KV\-quantization damage, a mechanism partition, an empirical benefit\-detection barrier for the tested local feature family, and a cross\-model account of when a clean\-reference remedy pays out\. We claim no new mitigation method and no state\-of\-the\-art result: the contribution is a measurement apparatus and a set of honestly scoped findings about what route\-mediated damage is, what can be detected of it at inference, and what reference information its repair requires\.\[empirical, pilot\]

## Reproducibility statement

Every measured claim traces to a committed metric JSON and a signed decision record; model identifiers and revisions, dataset splits, decode protocol, determinism settings, and the disturbance specification are given in §[2](https://arxiv.org/html/2608.11212#S2)–§[3](https://arxiv.org/html/2608.11212#S3)and App\.[A](https://arxiv.org/html/2608.11212#A1)\. Reproducibility is within\-process bitwise \(identical\-repeat max\|Δ​NLL\|=0\|\\Delta\\text\{NLL\}\|=0\) with a cross\-process wobble measured by five\-process replication \(σproc≤0\.0018\\sigma\_\{\\mathrm\{proc\}\}\\leq 0\.0018nats per\-token,±0\.02\\pm 0\.02on the RMF ratio,ICCprocess=1\.0\\text\{ICC\}\_\{\\text\{process\}\}=1\.0; §[7](https://arxiv.org/html/2608.11212#S7)\) and absorbed by single\-process discipline\. A specification of the four\-run causal machinery \(RMF with winner’s\-curse anchors, the jump/nonlocal/flux attribution, the detection\-vs\-benefit test, and the determinism ladder\) accompanies the paper; a full artifact release is planned for the confirmatory version\.

## Acknowledgments and disclosure

AI\-assisted tooling was used in research orchestration and manuscript preparation; all experimental designs, adjudications, and claims were human\-directed and human\-verified\.

## References

- Ahrac et al\. \[2026\]Sagi Ahrac, Noya Hochwald, and Mor Geva\.Routers learn the geometry of their experts: Geometric coupling in sparse mixture\-of\-experts\.*arXiv preprint arXiv:2605\.12476*, 2026\.Router\-expert geometric coupling\.
- Ashkboos et al\. \[2024\]Saleh Ashkboos, Amirkeivan Mohtashami, Maximilian L\. Croci, Bo Li, Pashmina Cameron, Martin Jaggi, Dan Alistarh, Torsten Hoefler, and James Hensman\.QuaRot: Outlier\-free 4\-bit inference in rotated LLMs\.*arXiv preprint arXiv:2404\.00456*, 2024\.Rotation\-based W4A4 family \(QuaRot/DuQuant ancestry\)\.
- Dai et al\. \[2024\]Damai Dai, Chengqi Deng, Chenggang Zhao, R\. X\. Xu, Huazuo Gao, Deli Chen, Jiashi Li, Wangding Zeng, Xingkai Yu, Y\. Wu, Zhenda Xie, Y\. K\. Li, Panpan Huang, Fuli Luo, Chong Ruan, Zhifang Sui, and Wenfeng Liang\.DeepSeekMoE: Towards ultimate expert specialization in mixture\-of\-experts language models\.*arXiv preprint arXiv:2401\.06066*, 2024\.Cross\-model architecture \(DeepSeek\-MoE\-16B\), norm\_topk\_prob=False\.
- Deng et al\. \[2026\]Jianing Deng, Song Wang, Dongwei Wang, Zijie Liu, Tianlong Chen, Huanrui Yang, and Jingtong Hu\.GEMQ: Global expert\-level mixed\-precision quantization for moe LLMs\.*arXiv preprint arXiv:2605\.23078*, 2026\.
- Efron and Tibshirani \[1993\]Bradley Efron and Robert J\. Tibshirani\.*An Introduction to the Bootstrap*\.Chapman & Hall, New York, 1993\.ISBN 0\-412\-04231\-2\.
- Engmann et al\. \[2026\]Leonard Engmann, Christian Medeiros Adriano, and Holger Giese\.From observation to intervention: A causal audit of expert importance in mixture\-of\-experts models\.*arXiv preprint arXiv:2606\.10703*, 2026\.
- Fedus et al\. \[2021\]William Fedus, Barret Zoph, and Noam Shazeer\.Switch transformers: Scaling to trillion parameter models with simple and efficient sparsity\.*arXiv preprint arXiv:2101\.03961*, 2021\.
- Frantar et al\. \[2022\]Elias Frantar, Saleh Ashkboos, Torsten Hoefler, and Dan Alistarh\.GPTQ: Accurate post\-training quantization for generative pre\-trained transformers\.*arXiv preprint arXiv:2210\.17323*, 2022\.
- Fu et al\. \[2025\]Zhongqian Fu, Tianyi Zhao, Ning Ding, Xianzhi Yu, Xiaosong Li, Yehui Tang, and Yunhe Wang\.EAQuant: Enhancing post\-training quantization for moe models via expert\-aware optimization\.*arXiv preprint arXiv:2506\.13329*, 2025\.
- Geiger et al\. \[2021\]Atticus Geiger, Hanson Lu, Thomas Icard, and Christopher Potts\.Causal abstractions of neural networks\.*arXiv preprint arXiv:2106\.02997*, 2021\.Interchange interventions / causal abstraction\.
- Goldowsky\-Dill et al\. \[2023\]Nicholas Goldowsky\-Dill, Chris MacLeod, Lucas Sato, and Aryaman Arora\.Localizing model behavior with path patching\.*arXiv preprint arXiv:2304\.05969*, 2023\.Path patching\.
- Hooper et al\. \[2024\]Coleman Hooper, Sehoon Kim, Hiva Mohammadzadeh, Michael W\. Mahoney, Yakun Sophia Shao, Kurt Keutzer, and Amir Gholami\.KVQuant: Towards 10 million context length LLM inference with KV cache quantization\.*arXiv preprint arXiv:2401\.18079*, 2024\.KV\-cache quantization line – the disturbance domain’s adjacent literature\.
- Huu et al\. \[2026\]Tho Tran Huu, Huu\-Tuan Nguyen, Thien\-Hai Nguyen, Nhat\-Tri Ho, Viet\-Hoang Tran, Tho Quan, and Tan Minh Nguyen\.Geometric and stochastic analysis of discontinuities in sparse mixture\-of\-experts\.*arXiv preprint arXiv:2606\.19036*, 2026\.Foundation: order\-classified discontinuities, order\-1 volume dominance, diffusion first\-hit\.
- Hyeon and Do \[2026\]Sieun Hyeon and Jaeyoung Do\.Is retraining\-free enough? the necessity of router calibration for efficient moe compression\.*arXiv preprint arXiv:2603\.02217*, 2026\.
- Jiang et al\. \[2024\]Albert Q\. Jiang, Alexandre Sablayrolles, Antoine Roux, Arthur Mensch, Blanche Savary, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Emma Bou Hanna, Florian Bressand, Gianna Lengyel, Guillaume Bour, Guillaume Lample, Lélio Renard Lavaud, Lucile Saulnier, Marie\-Anne Lachaux, Pierre Stock, Sandeep Subramanian, Sophia Yang, Szymon Antoniak, Teven Le Scao, Théophile Gervet, Thibaut Lavril, Thomas Wang, Timothée Lacroix, and William El Sayed\.Mixtral of experts\.*arXiv preprint arXiv:2401\.04088*, 2024\.
- Kang et al\. \[2024\]Hao Kang, Qingru Zhang, Souvik Kundu, Geonhwa Jeong, Zaoxing Liu, Tushar Krishna, and Tuo Zhao\.GEAR: An efficient KV cache compression recipe for near\-lossless generative inference of LLM\.*arXiv preprint arXiv:2403\.05527*, 2024\.KV\-residual compensation: reconstructs attention output, not routing argmax\.
- Lepikhin et al\. \[2020\]Dmitry Lepikhin, HyoukJoong Lee, Yuanzhong Xu, Dehao Chen, Orhan Firat, Yanping Huang, Maxim Krikun, Noam Shazeer, and Zhifeng Chen\.GShard: Scaling giant models with conditional computation and automatic sharding\.*arXiv preprint arXiv:2006\.16668*, 2020\.
- Li et al\. \[2025a\]Fei Li, Song Liu, Weiguo Wu, Shiqiang Nie, and Jinyu Wang\.KVmix: Gradient\-based layer importance\-aware mixed\-precision quantization for KV cache\.*arXiv preprint arXiv:2506\.08018*, 2025a\.Layer\-wise KV allocation\.
- Li et al\. \[2025b\]Xing Li, Zeyu Xing, Yiming Li, Linping Qu, Hui\-Ling Zhen, Wulong Liu, Yiwu Yao, Sinno Jialin Pan, and Mingxuan Yuan\.KVTuner: Sensitivity\-aware layer\-wise mixed\-precision KV cache quantization for efficient and nearly lossless LLM inference\.*arXiv preprint arXiv:2502\.04420*, 2025b\.
- Lin et al\. \[2024\]Haokun Lin, Haobo Xu, Yichen Wu, Jingzhi Cui, Yingtao Zhang, Linzhan Mou, Linqi Song, Zhenan Sun, and Ying Wei\.DuQuant: Distributing outliers via dual transformation makes stronger quantized LLMs\.*arXiv preprint arXiv:2406\.01721*, 2024\.
- Lin et al\. \[2023\]Ji Lin, Jiaming Tang, Haotian Tang, Shang Yang, Wei\-Ming Chen, Wei\-Chen Wang, Guangxuan Xiao, Xingyu Dang, Chuang Gan, and Song Han\.AWQ: Activation\-aware weight quantization for LLM compression and acceleration\.*arXiv preprint arXiv:2306\.00978*, 2023\.
- Liu et al\. \[2026\]Yilun Liu, Jinru Han, Sikuan Yan, Volker Tresp, and Yunpu Ma\.Routing\-free mixture\-of\-experts\.*arXiv preprint arXiv:2604\.00801*, 2026\.
- Liu et al\. \[2024\]Zirui Liu, Jiayi Yuan, Hongye Jin, Shaochen Zhong, Zhaozhuo Xu, Vladimir Braverman, Beidi Chen, and Xia Hu\.KIVI: A tuning\-free asymmetric 2bit quantization for KV cache\.*arXiv preprint arXiv:2402\.02750*, 2024\.
- Meng et al\. \[2022\]Kevin Meng, David Bau, Alex Andonian, and Yonatan Belinkov\.Locating and editing factual associations in GPT\.*arXiv preprint arXiv:2202\.05262*, 2022\.Causal tracing / activation patching\.
- Merity et al\. \[2016\]Stephen Merity, Caiming Xiong, James Bradbury, and Richard Socher\.Pointer sentinel mixture models\.*arXiv preprint arXiv:1609\.07843*, 2016\.Source of the WikiText\-103 corpus \(wikitext\-103\-raw\-v1\)\.
- Muennighoff et al\. \[2024\]Niklas Muennighoff, Luca Soldaini, Dirk Groeneveld, Kyle Lo, Jacob Morrison, Sewon Min, Weijia Shi, Pete Walsh, Oyvind Tafjord, Nathan Lambert, Yuling Gu, Shane Arora, Akshita Bhagia, Dustin Schwenk, David Wadden, Alexander Wettig, Binyuan Hui, Tim Dettmers, Douwe Kiela, Ali Farhadi, Noah A\. Smith, Pang Wei Koh, Amanpreet Singh, and Hannaneh Hajishirzi\.OLMoE: Open mixture\-of\-experts language models\.*arXiv preprint arXiv:2409\.02060*, 2024\.Primary evaluation model \(allenai/OLMoE\-1B\-7B\-0924\)\.
- Park et al\. \[2026\]Hancheol Park, Geonho Lee, Tairen Piao, and Tae\-Ho Kim\.Value\-and\-structure alignment for routing\-consistent quantization of mixture\-of\-experts models\.*arXiv preprint arXiv:2606\.05688*, 2026\.Router\-aware MoE PTQ; “preserve top\-k decision boundaries”\.
- Raffel et al\. \[2019\]Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J\. Liu\.Exploring the limits of transfer learning with a unified text\-to\-text transformer\.*arXiv preprint arXiv:1910\.10683*, 2019\.Source of the C4 corpus \(allenai/c4, en\)\.
- Shazeer et al\. \[2017\]Noam Shazeer, Azalia Mirhoseini, Krzysztof Maziarz, Andy Davis, Quoc Le, Geoffrey Hinton, and Jeff Dean\.Outrageously large neural networks: The sparsely\-gated mixture\-of\-experts layer\.*arXiv preprint arXiv:1701\.06538*, 2017\.Sparsely\-gated MoE – the top\-k routing primitive\.
- Syed et al\. \[2023\]Aaquib Syed, Can Rager, and Arthur Conmy\.Attribution patching outperforms automated circuit discovery\.*arXiv preprint arXiv:2310\.10348*, 2023\.Attribution patching\.
- Vig et al\. \[2020\]Jesse Vig, Sebastian Gehrmann, Yonatan Belinkov, Sharon Qian, Daniel Nevo, Simas Sakenis, Jason Huang, Yaron Singer, and Stuart Shieber\.Causal mediation analysis for interpreting neural NLP: The case of gender bias\.*arXiv preprint arXiv:2004\.12265*, 2020\.Causal mediation analysis in neural networks\.
- Wang et al\. \[2022\]Kevin Wang, Alexandre Variengien, Arthur Conmy, Buck Shlegeris, and Jacob Steinhardt\.Interpretability in the wild: a circuit for indirect object identification in GPT\-2 small\.*arXiv preprint arXiv:2211\.00593*, 2022\.Circuit\-level path patching in the wild\.
- Xiao et al\. \[2022\]Guangxuan Xiao, Ji Lin, Mickael Seznec, Hao Wu, Julien Demouth, and Song Han\.SmoothQuant: Accurate and efficient post\-training quantization for large language models\.*arXiv preprint arXiv:2211\.10438*, 2022\.
- Yang et al\. \[2024\]An Yang et al\.Qwen2 technical report\.*arXiv preprint arXiv:2407\.10671*, 2024\.Qwen MoE family \(shared\-expert design\); replication model Qwen1\.5\-MoE\-A2\.7B shipped as a Qwen\-team blog release, no standalone arXiv paper – this technical report is the citable family record\.
- Yang et al\. \[2025\]An Yang et al\.Qwen3 technical report\.*arXiv preprint arXiv:2505\.09388*, 2025\.Qwen3\-30B \(norm\_topk\_prob=True arm of the P7 discriminator\)\.
- Zasada et al\. \[2026\]Mikołaj Zasada, Łukasz Struski, Jacek Tabor, and Marcin Kurdziel\.SoftMoE: Soft differentiable routing for mixture\-of\-experts in LLMs\.*arXiv preprint arXiv:2606\.17952*, 2026\.
- Zhang et al\. \[2025\]Tao Zhang, Ziqian Zeng, Hao Peng, Huiping Zhuang, and Cen Chen\.MixKVQ: Query\-aware mixed\-precision KV cache quantization for long\-context reasoning\.*arXiv preprint arXiv:2512\.19206*, 2025\.
- Zhou et al\. \[2022\]Yanqi Zhou, Tao Lei, Hanxiao Liu, Nan Du, Yanping Huang, Vincent Zhao, Andrew Dai, Zhifeng Chen, Quoc Le, and James Laudon\.Mixture\-of\-experts with expert choice routing\.*arXiv preprint arXiv:2202\.09368*, 2022\.
- Zoph et al\. \[2022\]Barret Zoph, Irwan Bello, Sameer Kumar, Nan Du, Yanping Huang, Jeff Dean, Noam Shazeer, and William Fedus\.ST\-MoE: Designing stable and transferable sparse expert models\.*arXiv preprint arXiv:2202\.08906*, 2022\.Routing stability / z\-loss\.

## Appendix ASupplementary material

*Relegated from the body: the disturbance/topology detail, the aggressive\-dose sweep, the predictions registry, the negative\-result ledger, the evidence matrix, the supplementary instruments, and the exchange\-rate arm\.*

### Disturbance specification\.

The perturbation is 4\-bit symmetric fake\-quantization of the KV cache at full strength\. For each written key/value slicexx, stepδ=max⁡\|x\|/\(23−1\)\\delta=\\max\|x\|/\(2^\{3\}\{\-\}1\)over the head\-dim axis \(per token, per head\);xq=round​\(x/δ\)⋅δx\_\{q\}=\\mathrm\{round\}\(x/\\delta\)\\cdot\\delta\(round\-to\-nearest, clip to\[−8,7\]\[\-8,7\]\), no zero\-point\. K and V share the quantizer; quantization is applied on cache write at both prefill and decode and dequantized at read\. The router weights and arithmetic remain in BF16 over the quantized upstream state \(the “protected gate”\); a strength parameter interpolates the stored tensor toward the clean tensor \(1\.01\.0= full quantization\)\. The INT8\-activation condition is a near\-null \(excess NLL≈0\\approx 0\)\. The matched1×1\\timesdose is0\.07570\.0757nats, band\[0\.0605,0\.0908\]\[0\.0605,0\.0908\]\.

###### Lemma 1\(Top\-kkselection is discontinuous\)\.

Let the hidden state range over a*connected*regionH⊆ℝdH\\subseteq\\mathbb\{R\}^\{d\}and letR:H→\{vertices of​Δ​\(E,k\)\}R:H\\to\\\{\\text\{vertices of \}\\Delta\(E,k\)\\\}be a deterministic hard top\-kkselector\[[29](https://arxiv.org/html/2608.11212#bib.bib29)\]\. IfRRis non\-constant it cannot be continuous everywhere onHH: route changes occur on score\-tie surfaces where thekk\-th and\(k\+1\)\(k\{\+\}1\)\-th logits coincide \(including higher\-order ties\)\. This is a discontinuity of the*selector*; the final MoE output can still be continuous across a tie when the crossing experts carry vanishing weight\. Hence route jumps cannot be removed globally—only pushed to low\-weight boundaries \(the smoothing idea\) or eliminated by a gate continuous by construction\.

\[background property\]

### Disturbance\-gain instrument\.

Per\-layer gaingl=mediantoken​‖δ​xl\+1‖/‖δ​xl‖g\_\{l\}=\\mathrm\{median\}\_\{\\text\{token\}\}\\\|\\delta x\_\{l\+1\}\\\|/\\\|\\delta x\_\{l\}\\\|withδ​x=xquant−xclean\\delta x=x\_\{\\text\{quant\}\}\-x\_\{\\text\{clean\}\}: raw∏gl=56\.7\\prod g\_\{l\}=56\.7; normalized \(relative\-perturbation\)∏g~l=1\.84\\prod\\tilde\{g\}\_\{l\}=1\.84, front\-loaded \(g~L​0=2\.19\\tilde\{g\}\_\{L0\}=2\.19; interior transitions near or below unit gain; net\-of\-L0 contractive×0\.84\\times 0\.84\)\. Four further instruments \(accumulated covariance; temporal persistence with lag\-1≈0\.38\\approx 0\.38, peak0\.410\.41; small\-gain depth decay; soundness\) corroborate the event\-accumulation picture \(damage accrues as jump events at successive switching surfaces, not as amplitude growth\)\. The naïve “amplifying cascade” reading was a relative\-vs\-absolute measurement artifact, corrected here\.

### Probe battery for harm\-given\-flip\.

Beyond the single\-layer margin, richer function classes on the tested*local*router statistics do not resolve harm direction given a flip \(Table[5](https://arxiv.org/html/2608.11212#A1.T5); harm\-given\-flip AUC, sequence\-held\-out over9696sequences,n=2,553n\{=\}2\{,\}553flipped tokens\)\. A logistic combination, an MLP, gradient\-boosted trees, and a short route\-history \(temporal\) predictor all include0\.50\.5\. Critically, the*decisive*predictor the review calls for—a cross\-layer router vector reading*all1616layers’*margins, entropies, gate\-gaps, and top\-kkgaps \(8080features\)—was captured in a pre\-registered targeted recapture and also scores at the barrier: logistic0\.5120\.512\[0\.468,0\.546\]\[0\.468,0\.546\]and gradient\-boosted0\.5080\.508\[0\.479,0\.527\]\[0\.479,0\.527\], both inside the pre\-declared\|AUC−0\.5\|≤0\.05\|\\mathrm\{AUC\}\-0\.5\|\\leq 0\.05band with CI covering0\.50\.5\. The recapture reproduced the flipped\-token population exactly \(n=2,553n\{=\}2\{,\}553; harmful rate0\.5840\.584\), so this is not a power artifact\. The barrier therefore holds for the*whole*tested deployable per\-layer observable set, not just the single scoring\-layer margin\. No cell is fabricated\.

Table 5:Probe battery \(harm\-given\-flip, sequence\-held\-out;n=2,553n\{=\}2\{,\}553flipped tokens,9696sequences\)\. Every tested function class—including the cross\-layer router vector over all1616layers—sits within the pre\-declared\|AUC−0\.5\|≤0\.05\|\\mathrm\{AUC\}\-0\.5\|\\leq 0\.05band, with CI covering0\.50\.5\. No fabricated cell\.
### Aggressive\-dose sweep\.

The route\-mediated share rises from31%31\\%\(matched1×1\\times\) to58%58\\%near5\.4×5\.4\\timesdose, then significantly declines to54%54\\%at11\.7×11\.7\\timesas the direct KV\-corruption channel overtakes routing \(channel crossover: direct×2\.35\\times 2\.35vs route×2\.03\\times 2\.03; OLMoE,N=384N\{=\}384paired\)\. The aggressive\-regime recovery ceiling for any routing\-consistency intervention is bounded by the*peak*share≈0\.58\\approx 0\.58\. This peak is a simulated\-injector measurement; the real\-kernel ladder \(§[7](https://arxiv.org/html/2608.11212#S7)\) shows the real share*declines*at aggressive bits, so the fake\-quant curve likely over\-states it there\. The strict\-monotone prediction is a registered miss \(the5\.4×→11\.7×5\.4\\times\{\\to\}11\.7\\timesdecline is significant, paired\+0\.0339\+0\.0339\[\+0\.0210,\+0\.0464\]\[\+0\.0210,\+0\.0464\]atN=384N\{=\}384\)\.

### Symmetric attenuation and directional recovery\.

Direction\-agnostic boundary\-smoothing nets≈0\\approx 0with a small significant residual \(\+0\.00247\+0\.00247\[\+0\.00046,\+0\.00458\]\[\+0\.00046,\+0\.00458\]nats\): on harmful\-flip tokensΔ=\+0\.043\\Delta=\+0\.043\[\+0\.037,\+0\.049\]\[\+0\.037,\+0\.049\], on beneficial\-flip tokensΔ=−0\.047\\Delta=\-0\.047\[−0\.055,−0\.039\]\[\-0\.055,\-0\.039\]—near\-equal, oppositely signed, so symmetric attenuation cancels under sign\-balanced flip harm\. This is the mechanism behind the class taxonomy: a direction\-agnostic \(“class\-B”\) remedy is at the floor, while a directional clean\-reference \(“class\-C”\) remedy recovers the bounded slice above\.*Instrument firewall:*the boundary\-smoothing equivalence result \(a fixed\-process exploratory5\.1%5\.1\\%equivalence region on the harmful component\) is a*different instrument*from the clean\-route\-pin recovery \(8\.9%8\.9\\%on OLMoE /8\.4%8\.4\\%on DeepSeek\) and from the0\.4560\.456clean\-reference remedy on DeepSeek—three different measurements, never conflated\.

### Exchange\-rate arm\.

Storing clean routes \(∼22\\sim 22B/token/layer\) is≈28\.7×\\approx 28\.7\\timesmore byte\-efficient \(recovery\-weighted\) than a4→84\{\\to\}8\-bit prefix\-KV upgrade \(∼2048\\sim 2048B/token/layer\) at recovering route\-mediated damage—but*partial, not sufficient*: routes recover0\.2910\.291of the route ceiling against the precision arm’s0\.9460\.946\(an upper bound on its route\-mediated recovery\), so the pre\-registered “routes≥0\.5×\\geq 0\.5\\timesprecision” bar is not met\. The robust statement is the per\-byte efficiency, not a dominance claim\.

Table 6:Predictions registry \(pre\-registered; a way to lose, a mechanism citation, and a named settling measurement per entry\)\.Table 7:Negative\-result ledger \(symmetric reporting; internal conjectures held to the same standard as external claims\)\.Table 8:Evidence matrix \(the primary splits are calibration; the reserved test split was read once, pre\-registered, §[7](https://arxiv.org/html/2608.11212#S7)\. FD = full\-decode pin, pfx = prefix\-only reference\)\.