You Only Pass Once: Answering and Abstaining Together in a Single Forward Pass of a Frozen Language Model

# Answering and Abstaining Togetherin a Single Forward Pass of a Frozen Language Model
Source: [https://arxiv.org/html/2608.14465](https://arxiv.org/html/2608.14465)
Zhongyao Chujustedwardchu@gmail\.comXinjie Hexh2442@columbia\.eduYouting Wangginkoin613@gmail\.comXukui Qinkuschqin@gmail\.comRunxiong Wucalvin\.wu@wisc\.eduYan\-Syuan Chenyansyuanchen@utexas\.edu

###### Abstract

A frozen language model on reasoning tasks has two coupled weaknesses: it under\-uses evidence that its own residual stream already encodes, and it fails to detect when the input is insufficient to answer, so it confabulates\. This paper consolidates two research lines—developed separately by its authors, reported here together as one system—that address these on the same residual stream: a conditional*steering probe**writes*the stream at mid\-stack layers and recovers reasoning accuracy from a frozen backbone, and a zero\-shot*sufficiency direction*𝐝\\mathbf\{d\}*reads*the stream and abstains when information is insufficient\. We deploy both in a single forward pass and study the interference between them\. The steering write shifts the residual state that𝐝\\mathbf\{d\}reads: on small models the one\-pass gate loses up to88AUROC points of cross\-domain transfer, while reading a separate clean pass doubles inference cost\. We keep𝐝\\mathbf\{d\}*fixed*and train a small network to reconstruct the pre\-steering residual from the steered one—mean\-squared error on \(steered, clean\) residual pairs that cost nothing to collect, with no sufficiency labels—then read𝐝\\mathbf\{d\}on the reconstruction\. Because training never sees sufficiency labels, the correction inherits the direction’s cross\-task stability\. The resulting system,YOPO\(You Only Pass Once\), answers, steers, and abstains from one forward pass of a frozen Qwen2\.5 backbone \(1\.5B/3B/7B\)\. One corrected pass recovers most of the two\-pass ceiling: at 1\.5B, transfer AUROC rises→0\.8880\.836\\\!\\to\\\!0\.888\(ceiling0\.9180\.918\) and in\-domain→0\.9590\.913\\\!\\to\\\!0\.959\. A supervised gate stacked on the correction—our*flagship*—takes the top one\-pass score at every scale \(in\-domain0\.982/0\.984/0\.9970\.982/0\.984/0\.997,*above*the two\-pass ceiling; transfer within0\.0060\.006/0\.0030\.003of it at 3B/7B\), at a transfer cost we quantify rather than hide; the purely label\-free correction remains the transfer\-safe choice at 1\.5B \(0\.8880\.888vs\.0\.8590\.859\)\. End to end, three\-way accuracy more than doubles the frozen baseline \(→0\.7980\.375\\\!\\to\\\!0\.798on 1\.5Bα\\alphaNLI\), exceeds either component alone \(0\.5900\.590steering\-only,0\.5600\.560gate\-only\), and the one\-pass system beats the two\-pass reference at every scale \(0\.798/0\.830/0\.8930\.798/0\.830/0\.893vs\.0\.753/0\.790/0\.8630\.753/0\.790/0\.863\) and on ten backbones across six model families \(10/1010/10\)\. We chart the full capacity–transfer frontier, giving quantitative form to our design principle that abstention should not be trained in; the interference is concentrated on small models and*inverts*at 7B, where the steered read is already the better substrate \(0\.9950\.995vs\.0\.9850\.985in\-domain\) and the identity\-initialized correction learns to do nothing\. A source\-side audit—early\-layer separability as a shortcut signal—catches our ownα\\alphaNLI construction leaking a surface artifact, so we anchor every architectural claim on native\-label replications \(SQuAD2, RepLiQA, MuSiQue\)\. On the standard four\-domain suite we contribute, to our knowledge, the first answer\-or\-abstain \(hybrid\) benchmark and take it on both axes: our gate tops every in\-domain dataset, and—deployed with zero target labels—is the only gate family that survives domain transfer, the label\-free direction fit on the hardest source \(MuSiQue\) matching its own supervised in\-domain ceiling on two of three transferable targets while every trained competitor collapses toward chance; the two are operating points of one label\-conditioned system\. Chain\-of\-thought answering, whose generated drafts can never reach our prefill\-time gate by construction, raises answerable multi\-hop QA five\-fold \(→0\.3130\.062\\\!\\to\\\!0\.313on MuSiQue\)\.

## 1Introduction

Consider a frozen language model asked to perform abductive inference: given observations, pick the more plausible explanation\([Bhagavatula et al\. 2020](https://arxiv.org/html/2608.14465#bib.bib1)\)\. Two failure modes dominate\. First, the model*under\-uses information it already has*: its residual stream demonstrably encodes evidence that never reaches the answer logits, and lightweight inference\-time interventions can recover it\. Second, the model*does not know when it has too little*: when the input is genuinely insufficient, a frozen model answers anyway—confidently—rather than abstaining\. A deployable reasoning system must do both:*maximally extract*what the context supports, and*abstain*when the context supports nothing\.

Both capabilities live on the same substrate, and this paper consolidates the two research lines that built them—one per author group, reported here as one system\. Our*steering line*shows that a small*conditional steering probe*thatwritesthe residual stream of a completely frozen backbone at a few mid\-stack layers lifts abductive accuracy by up to\+21\.7​pp\+21\.7\\,\\textrm\{pp\}on Qwen2\.5\-1\.5B and\+4\.96​pp\+4\.96\\,\\textrm\{pp\}\(exact McNemarp=1\.7×10−7p\{=\}1\.7\{\\times\}10^\{\-7\}\) on the hardest full\-precision 7B wall \(§[7](https://arxiv.org/html/2608.14465#S7)\)\. Complementarily, our*sufficiency line*shows that a*zero\-shot difference\-of\-means direction*𝐝\\mathbf\{d\}thatreadsthe residual stream detects insufficient context far ahead of the model’s own behavior—held\-out sel\-AUROC reaches0\.935/0\.997/0\.935/0\.7830\.935/0\.997/0\.935/0\.783across four QA domains whose zero\-shot spoken accuracies are only0\.854/0\.873/0\.588/0\.5350\.854/0\.873/0\.588/0\.535—and, in a three\-family comparison on native labels \(§[10](https://arxiv.org/html/2608.14465#S10)\), that*transfer debt grows with write access*: crossing domains costs the read\-only direction2\.7​pp2\.7\\,\\textrm\{pp\}, a constrained activation\-writer \(a steering probe of the same design as this paper’s writer, trained on the judgment task\)16\.3​pp16\.3\\,\\textrm\{pp\}, and a free weight\-writer \(LoRA\)23\.1​pp23\.1\\,\\textrm\{pp\}, both write families landing*below*the target domain’s own zero\-shot baseline—shipping a trained judgment is, on average, worse than shipping nothing—while the direction alone exports a gain \(\+8\.6​pp\+8\.6\\,\\textrm\{pp\}on average, 9 of 12 transfer arenas; see also the supervised\-classifier cross\-domain collapse of[Lavi et al\. 2025](https://arxiv.org/html/2608.14465#bib.bib6)\)\. In\-domain the ordering reverses—write freedom wins \(0\.826→0\.843→0\.9090\.826\\to 0\.843\\to 0\.909four\-arena mean, LoRA taking all four\)—so the principle prices*transfer*, not accuracy, and this paper measures that price as a function of capacity and scale\.

This paper studies the regime any real deployment requires: writer and reader*in the same forward pass*, since a separate clean pass for the gate doubles inference cost\. There the two interfere—the write perturbs the very state the direction reads\. The effect is measurable: on Qwen2\.5\-1\.5B, moving the read from the clean to the steered pass costs the gate→0\.9130\.962\\\!\\to\\\!0\.913in\-domain and→0\.8360\.918\\\!\\to\\\!0\.836on cross\-task transfer\. Two obvious fixes fail: a clean pass restores the gate at double cost, and a task\-supervised gate on steered states restores in\-domain accuracy but pays in transfer, steeply at small scale \(33–55points below the label\-free repair at 1\.5B\)\. The sharper question:*how much of the read can one steered pass recover before any task supervision, with its transfer cost, must be spent?*Our answer removes the*perturbation*, not the abstention\. The write is a smooth function of the residual it reads, so its effect can be learned and undone by reconstruction from \(steered, clean\) pairs that need no annotation; carrying no sufficiency labels, the repaired read keeps the direction’s transfer\.

Contributions\.We report the two component lines as first\-class results on one shared frozen grid, and add the practice and benchmarks that make them deploy together:

- \(i\)the steering writer with its full injection\-geometry benchmark across scale and datasets \(§[7](https://arxiv.org/html/2608.14465#S7)\);
- \(ii\)the zero\-shot sufficiency reader with its design principle quantified, for the first time, as a measured capacity–transfer frontier in the fused setting \(§[6](https://arxiv.org/html/2608.14465#S6)\);
- \(iii\)the label\-free correction that lets the two share one forward pass, doubling end\-to\-end three\-way accuracy over the frozen baseline while matching the two\-pass reference \(§[7](https://arxiv.org/html/2608.14465#S7)\);
- \(iv\)a controlled same\-field comparison of three one\-pass fusion architectures \(reconstruction, read\-only with a self\-suppressing write, and layer\-ordering\) on a shared injection module, showing the interference’s severity is protocol\-dependent \(§[10](https://arxiv.org/html/2608.14465#S10)\);
- \(v\)the first answer\-or\-abstain \(hybrid\) benchmark on the standard four\-domain suite \(to our knowledge\), where the supervised gate leads in\-domain on all four datasets and the label\-free direction, fit on the hardest source, transfers best across domains \(§[10](https://arxiv.org/html/2608.14465#S10)\)\.

The technical core is item \(iii\),a label\-free correction of the residual stream\. We keep the zero\-shot direction𝐝\\mathbf\{d\}*fixed*—never retrained, which preserves its provenance and transfer—and learn a small mapMMthat removes the steering perturbation:MMreconstructs the clean sufficiency\-layer residual from the steered residual\(s\) under a plain MSE objective\. Training uses*no sufficiency labels*; the \(steered, clean\) pairs are free by construction \(run the extractor once with hooks on and off\), so nothing task\-specific about abstention is learned\. At inference the system runs*one*steered pass, readss=𝐝⊤​M​\(hsteer\)s=\\mathbf\{d\}^\{\\top\}M\(h^\{\\mathrm\{steer\}\}\), and abstains whenssfalls below a percentile threshold\. Steering keeps its reasoning gain, the direction keeps its zero\-shot transfer, and the read is repaired\. Our highest\-scoring one\-pass gate stacks a small supervised boost on this correction \(§[5](https://arxiv.org/html/2608.14465#S5)\); the purely label\-free map below is both the mechanism that makes one pass viable and the transfer\-safe fallback\.

Concretely, on the frozen Qwen2\.5 grid, neither component approaches the combination: on 1\.5Bα\\alphaNLI 3\-way accuracy the frozen baseline scores0\.3750\.375, steering\-only0\.5900\.590, gate\-only0\.5600\.560, and the fused one\-pass system0\.7980\.798—beating the two\-pass reference at every scale \(0\.798/0\.830/0\.8930\.798/0\.830/0\.893vs\.0\.753/0\.790/0\.8630\.753/0\.790/0\.863\) and on ten backbones across six model families \(§[9](https://arxiv.org/html/2608.14465#S9), 10/10\)\. The correction itself is label\-free and effective where it is needed: at 1\.5B it lifts the one\-pass gate from0\.913/0\.8360\.913/0\.836\(in\-domain/transfer AUROC\) to0\.944/0\.8880\.944/0\.888, recovering63%63\\%of the transfer contamination\. And the contamination follows a scale law—the clean\-vs\-steered transfer gap falls0\.082→0\.031→0\.0130\.082\\to 0\.031\\to 0\.013across 1\.5B/3B/7B, inverting in\-domain at 7B \(the steered read*beats*the clean read,0\.9950\.995vs\.0\.9850\.985\), where the identity\-initialized map correctly learns to do nothing\. The correction thus matters most exactly where frozen\-model steering pays most—small models—and the two results compose into a budget\-conditioned recipe \(§[12](https://arxiv.org/html/2608.14465#S12)\)\.

Proposed configuration\.Under the hard one\-pass budget we propose the full\-capacity gate—multi\-layer de\-contamination plus BCE boost—which takes the top one\-pass score in\-domain at every scale \(above the two\-pass ceiling\) and the top transfer at 3B and 7B\. The Pareto frontier we chart is what disciplines this choice: task\-specific capacity buys in\-domain accuracy and costs transfer, monotonically—our quantitative confirmation, in the fused setting, of the sufficiency line’s design law—and the price is scale\-dependent: negligible at 3B and above, real at 1\.5B, where the label\-free map is the transfer\-safe fallback \(0\.8880\.888vs\.0\.8590\.859\) and no one\-pass gate we built beats the two\-pass clean read’s transfer \(0\.9180\.918\)\. We report this ceiling violation\-free, alongside the variants that failed \(§[11](https://arxiv.org/html/2608.14465#S11)\)\.

## 2Related Work

Activation steering\.Fixed contrastive directions added to the residual stream\([Turner et al\. 2023](https://arxiv.org/html/2608.14465#bib.bib16);[Panickssery et al\. 2024](https://arxiv.org/html/2608.14465#bib.bib11)\), inference\-time shifts along learned directions\([Li et al\. 2023](https://arxiv.org/html/2608.14465#bib.bib9)\), representation engineering\([Zou et al\. 2023](https://arxiv.org/html/2608.14465#bib.bib20)\), task/function vectors\([Todd et al\. 2024](https://arxiv.org/html/2608.14465#bib.bib14);[Ilharco et al\. 2023](https://arxiv.org/html/2608.14465#bib.bib4)\), low\-rank subspace rewrites\([Wu et al\. 2024](https://arxiv.org/html/2608.14465#bib.bib18)\), and conditional gating of a fixed vector\([Lee et al\. 2024](https://arxiv.org/html/2608.14465#bib.bib7)\)\. Our steering probe differs by making the steering*direction itself*an input\-conditioned function of the residual; this paper reports that writer’s full benchmark across scale and studies its interaction with a reader\.Answerability and sufficiency reading\.Models linearly encode \(un\)answerability\([Kadavath et al\. 2022](https://arxiv.org/html/2608.14465#bib.bib5);[Slobodkin et al\. 2023](https://arxiv.org/html/2608.14465#bib.bib13)\); a difference\-of\-means direction transfers across datasets\([Lavi et al\. 2025](https://arxiv.org/html/2608.14465#bib.bib6)\)\. Our sufficiency line establishes the zero\-shot sufficiency gate, escorts its verdict into the model’s own spoken answer via zero\-training*relay steering*\(execution fidelity1\.00001\.0000in 16/16 cells, §[10](https://arxiv.org/html/2608.14465#S10)\), and shows on native labels why the read must stay untrained: the internal readout runs far ahead of the model’s spoken behavior, while any judgment*trained*in absorbs the source domain’s signature and pays for it under shift in proportion to write access—landing, for both write families, below the target domain’s own zero\-shot baseline—a failure mode the supervised\-classifier collapse of[Lavi et al\. 2025](https://arxiv.org/html/2608.14465#bib.bib6)foreshadows\. The fused, one\-pass setting—reading through an active write—is what neither line treated alone and what this paper adds\.Reconstruction as repair\.Our map is trained like a denoiser\([Vincent et al\. 2008](https://arxiv.org/html/2608.14465#bib.bib17);[Lehtinen et al\. 2018](https://arxiv.org/html/2608.14465#bib.bib8)\): reconstruct the unperturbed state from the perturbed one, with the corruption process \(here, the steering write\) supplying free training pairs\. Unlike representation “patching”/editing analyses, the target here is not interpretability but preserving a downstream zero\-shot readout; and unlike supervised probes, the objective carries no task labels, which is what preserves transfer\.

## 3Setup: a Writer and a Reader on the Residual Stream

The writer: the conditional steering probe\(the steering line’s contribution\)\. At each of a few mid\-stack layersℓ\\ellof a frozen backbone, a small MLP reads the residual𝐫ℓ,t\\mathbf\{r\}\_\{\\ell,t\}at five spread prompt positions and writes back𝐫′=𝐫\+a⁡∥𝐫∥​𝐮​\(𝐫\)\\mathbf\{r\}^\{\\prime\}=\\mathbf\{r\}\+a\\,\\lVert\\mathbf\{r\}\\rVert\\,\\mathbf\{u\}\(\\mathbf\{r\}\), with learned unit direction𝐮\\mathbf\{u\}and gated magnitudeaa\(Figure[1](https://arxiv.org/html/2608.14465#S3.F1)\)\. Only the probe \(∼\\sim1% of backbone parameters\) is trained, on answer cross\-entropy; the backbone is untouched\. Injection layers:\{12,16,20\}\\\{12,16,20\\\}\(1\.5B, 7B\),\{16,20,24\}\\\{16,20,24\\\}\(3B\)\.

EmbeddingLayers 0–11 \(frozen\)Layer 12Layers 13–15 \(frozen\)Layer 16Layers 17–19 \(frozen\)Layer 20Layers 21–27 \(frozen\)RMSNorm \+ LM headinput tokensanswer logitsread𝐫\\mathbf\{r\}at spread\-5 positions \(B×5×1536B\\times 5\\times 1536\)direction MLP1536→384→15361536\{\\to\}384\{\\to\}1536SiLU→𝐮⁡\(𝐫\)\\to\\ \\mathbf\{u\}\(\\mathbf\{r\}\)magnitude gate1536→51536\{\\to\}5,σ×αmax\\sigma\\times\\alpha\_\{\\max\}→a\\to\\ awrite𝐫←𝐫\+a​∥𝐫∥​𝐮​\(𝐫\)\\mathbf\{r\}\\leftarrow\\mathbf\{r\}\+a\\,\\lVert\\mathbf\{r\}\\rVert\\,\\mathbf\{u\}\(\\mathbf\{r\}\)steering sub\-probe \(×3\\times 3, identical design\)≈\\approx3\.58M params \(≈\\approx1% of backbone\)⋅\\cdotprobe\-only training \(answer cross\-entropy\)dashed = read \(hook\)solid = write\-backblue = injection layersgray = frozenFigure 1:The conditional steering probe \(the writer\): at each injection layer a per\-layer sub\-probe reads the residual at spread\-5 prompt positions, emits an input\-conditioned unit direction \(MLP\) and a gated magnitude, and writes𝐫\+a​∥𝐫∥​𝐮​\(𝐫\)\\mathbf\{r\}\\\!\+\\\!a\\lVert\\mathbf\{r\}\\rVert\\mathbf\{u\}\(\\mathbf\{r\}\)back through forward hooks\. The backbone stays frozen; the edit is hot\-swappable and fully reversible\.The reader: the zero\-shot sufficiency gate\(the sufficiency line’s contribution\)\. From labeled source\-domain examples,𝐝=mean⁡\(𝐡\|sufficient\)−mean⁡\(𝐡\|insufficient\)\\mathbf\{d\}=\\mathrm\{mean\}\(\\mathbf\{h\}\\,\|\\,\\text\{sufficient\}\)\-\\mathrm\{mean\}\(\\mathbf\{h\}\\,\|\\,\\text\{insufficient\}\)at a mid layer; scores=𝐝⊤​𝐡s=\\mathbf\{d\}^\{\\top\}\\mathbf\{h\}at the pre\-answer position; the threshold is fit on a selection split in\-domain and re\-derived label\-free \(median projection of unlabeled target inputs\) cross\-domain\. Two read\-layer rules coexist here, matched to construction\. The*controlled grid*\(§[4](https://arxiv.org/html/2608.14465#S4)–§[7](https://arxiv.org/html/2608.14465#S7)\) fixes the layer at proportional depth \(18 at 1\.5B/7B, 24 at 3B,≈0\.65\\approx\\\!0\.65\)—adequate there because every gate variant reads the same layer\. The*standard\-suite*sections use the causal\-onset protocol \(§[10](https://arxiv.org/html/2608.14465#S10)\), which selects the layer per domain and in fact excludes layer 18 on the QA domains \(negative steering\-response\); where the rules disagree, causal\-onset is the corrected one\. Terminology: “zero\-shot” here means two specific things, neither of them “no data”—\(i\) the direction has*no fitted weights*\(two class means and one threshold; no gradient\-trained parameters that could absorb task signature\), and \(ii\) it is applied*cross\-task without target\-domain data*\. Labeled source examples are used—to compute the means—but nothing is optimized against them\.

Data\.In\-domain:α\\alphaNLI reshaped into four redaction conditions \(full / rm\-obs1 / rm\-obs2 / replace\-both\), following the sufficiency line’s construction; sufficient==full, insufficient==replace\-both\. Transfer: \(i\) HellaSwag\([Zellers et al\. 2019](https://arxiv.org/html/2608.14465#bib.bib19)\)under the analogous full / rm\-first / rm\-last / replace construction; \(ii\) RepLiQA\([Monteiro et al\. 2024](https://arxiv.org/html/2608.14465#bib.bib10)\)—human\-written fictional documents absent from the web, ruling out memorization—with passage\-window conditions full / rm\-ctx / rm\-ans / replace \(RepLiQA also ships*native*answerability labels; the native\-label study of §[8](https://arxiv.org/html/2608.14465#S8)and the standard suite of §[10](https://arxiv.org/html/2608.14465#S10)use those, the constructed conditions here serve only the controlled\-transfer axis\); \(iii\) BoolQ\([Clark et al\. 2019](https://arxiv.org/html/2608.14465#bib.bib3)\)passages under full / rm\-first / rm\-last / replace\. All transfer sets are used*zero\-shot*:𝐝\\mathbf\{d\}and every map are fit onα\\alphaNLI only\. The two lines maintained independent codebases throughout, which this paper exploits as internal cross\-validation: every sufficiency\-gate quantity on the controlled grid was recomputed by the fusion codebase from the sufficiency line’s recipe, and wherever both implementations measured the same cell their agreement is reported\. §[8](https://arxiv.org/html/2608.14465#S8)runs the fused system directly on the sufficiency line’s construction manifests, prompts, and pipeline\.

Metric\.AUROC\(full vs\. replace\) of the sufficiency score on held\-out validation items, in\-domain \(α\\alphaNLI\) and zero\-shot transfer; all reads from a*single steered*forward pass unless explicitly marked as the two\-pass reference\.

## 4The Fusion Problem: Steering Contaminates the Read

Running the reader on the writer’s pass is not free\. Table[1](https://arxiv.org/html/2608.14465#S4.T1)isolates the contamination: the same fixed𝐝\\mathbf\{d\}, read at the same layer, on the clean vs\. the steered pass\.

Table 1:Contamination \(AUROC, full vs\. replace;α\\alphaNLI in\-domain, HellaSwag zero\-shot transfer\): the fixed zero\-shot direction𝐝\\mathbf\{d\}read on the steered vs\. clean pass\. The steering write costs the gate8\.28\.2transfer points at 1\.5B and3\.13\.1at 3B; at 7B the transfer cost is1\.31\.3points and the in\-domain effect*inverts*\(the steered residual is a*better*substrate for the read than the clean one\)\. The conflict is concentrated at small scale\.Why not just fix it with supervision? Training a gate on steered states*does*restore in\-domain accuracy—and that is precisely the trap\. the sufficiency line’s design law says trained abstention learns the task, not the sufficiency signal, and collapses under shift; our grid confirms the law’s fused\-setting analogue quantitatively \(§[6](https://arxiv.org/html/2608.14465#S6)\): every supervised bit of capacity added to the one\-pass gate moves it along a Pareto frontier—up in\-domain, down in transfer\. §[8](https://arxiv.org/html/2608.14465#S8)then tests the law at its source—training the abstention itself into the writer—and finds it scale\-conditional rather than absolute*on our constructed axis*: two opposite collapse modes at 1\.5B, stability \(and transferring abstention\) at 7B, but never a transfer win over the calibrated read\. The sufficiency line’s native four\-domain comparison sharpens the same boundary from the other side: at 7B on native labels, both write\-trained families still land below the target’s own zero\-shot baseline \(−16\.3/−23\.1pp\-16\.3/\-23\.1\\,\\textrm\{pp\}; §[1](https://arxiv.org/html/2608.14465#S1)\)—scale relaxes the collapse on the constructed axis without repealing the price on native labels\.

## 5Method: A Label\-Free Correction of the Steering Perturbation

The design principle is not a prohibition but a cost curve: supervised capacity added to the gate buys in\-domain accuracy and is paid for in transfer \(we chart the exchange rate in §[6](https://arxiv.org/html/2608.14465#S6), and it falls with scale\)\. What carries a transfer cost is training the*abstention*; training away the*perturbation*carries none, because a reconstruction target encodes no task judgment\. We exploit exactly this asymmetry—learn the effect of the write on the state, not the sufficiency decision:

minM⁡𝔼​∥M⁡\(hsteer\)−hclean∥22,s=𝐝⊤​M​\(hsteer\),\\min\_\{M\}\\;\\mathbb\{E\}\\,\\big\\lVert M\\\!\\left\(h^\{\\mathrm\{steer\}\}\\right\)\-h^\{\\mathrm\{clean\}\}\\big\\rVert\_\{2\}^\{2\},\\qquad s=\\mathbf\{d\}^\{\\top\}M\\\!\\left\(h^\{\\mathrm\{steer\}\}\\right\),\(1\)
wherehcleanh^\{\\mathrm\{clean\}\}/hsteerh^\{\\mathrm\{steer\}\}are the sufficiency\-layer residuals of the same input with steering hooks off/on—a pairing that is*free*\(no annotation; one extra training\-time forward\), and𝐝\\mathbf\{d\}stays fixed\. Two instantiations:\(i\) single\-layer:M⁡\(h\)=h\+U​σ​\(V​h\)M\(h\)=h\+U\\,\\sigma\(Vh\), a low\-rank \(r=64\) residual corrector on the sufficiency layer alone;\(ii\) multi\-layer \(ML\):MMis a one\-hidden\-layer MLP reading the concatenated steered residuals of the injection span \(e\.g\. layers\{12,14,16,18,20\}\\\{12,14,16,18,20\\\}at 1\.5B\), reconstructing the clean sufficiency\-layer state—richer input for undoing a multi\-layer write\. The full\-capacity configuration—ourflagship—stacks a small BCE\-trainedsupervised booston top of the reconstructed read; this*does*touch labels and buys in\-domain at a transfer price we quantify rather than hide \(negligible at 3B and above, §[6](https://arxiv.org/html/2608.14465#S6)\)\.

The key property is what the map is*not*trained on: sufficiency labels never enter the reconstruction objective, so nothing about “when to abstain onα\\alphaNLI” can leak intoMM\. The map only learns the geometry of the steering perturbation—which is task\-general, because the probe’s write is a smooth function of the residual it reads\. Figure[2](https://arxiv.org/html/2608.14465#S5.F2)shows the assembled one\-pass system\.

Scope of “label\-free\.”Wherever this paper \(tables included\) marks a gate variant*label\-free*, the claim is specific:*no abstention/sufficiency labels are optimized against anywhere in the read path*\. It is not a claim that the system is unsupervised: the steering probe is gradient\-trained on*answer*labels \(its own transfer cost is priced separately, on the write\-access ladder of §[8](https://arxiv.org/html/2608.14465#S8)\); the direction𝐝\\mathbf\{d\}uses labeled source examples to compute two class means but has no fitted parameters that could absorb a task signature \(§[3](https://arxiv.org/html/2608.14465#S3)\);MMtrains on reconstruction alone\. The one component that does optimize against abstention labels—the flagship’s boost—is the one that pays in transfer, which is the design law’s point\.

Context\+ QuestionL0​…​L11L\_\{0\}\\ldots L\_\{11\}\(clean\)L12​…​L27L\_\{12\}\\ldots L\_\{27\}\(steered\)answerlogitsfrozen LLM: residual streamconditional steering probewrites𝐫\+a​∥𝐫∥​𝐮​\(𝐫\)\\mathbf\{r\}\{\+\}a\\lVert\\mathbf\{r\}\\rVert\\mathbf\{u\}\(\\mathbf\{r\}\), layers\{12,16,20\}\\\{12,16,20\\\}⊕\\oplusde\-contamination mapMMlabel\-free: trained steered→\\toclean,𝐝\\mathbf\{d\}FIXEDreadh18steerh^\{\\mathrm\{steer\}\}\_\{18\}gate:s=𝐝⊤​M​\(hsteer\)s=\\mathbf\{d\}^\{\\top\}M\(h^\{\\mathrm\{steer\}\}\)s<τs<\\tau?abstain \(0\)yeselse: steeredanswer \(1/2\)

Figure 2:YOPO\(You Only Pass Once\): one\-pass fusion with a label\-free correction\. The steering probe \(blue, the writer\)*writes*the residual stream at layers\{12,16,20\}\\\{12,16,20\\\}; the same steered pass is read at a mid layer, passed through the reconstruction mapMM\(ours, orange—trained only to reconstruct the clean residual, never on sufficiency labels\), and scored against the FIXED zero\-shot direction𝐝\\mathbf\{d\}\(the sufficiency gate, purple, the reader\)\. Below thresholdτ\\tau\(a percentile cut\) the system abstains; otherwise it emits the steering\-amplified answer\. One forward pass serves both the write and the read\. Layer indices shown for Qwen2\.5\-1\.5B/7B; 3B uses\{16,20,24\}\\\{16,20,24\\\}, read layer 24\.Algorithm 1: YOPO inference \(one forward pass\) Input:itemxx; frozen backbone; steering probe \(injection layersℐ=\{12,16,20\}\\mathcal\{I\}\{=\}\\\{12,16,20\\\}\); reconstruction mapMM; fixed sufficiency direction𝐝\\mathbf\{d\}; read layerℓr=18\\ell\_\{r\}\{=\}18; thresholdτ\\tau1\. Run one forward pass onxx; during the pass:2\. at eachℓ∈ℐ\\ell\\in\\mathcal\{I\}:𝐫ℓ←𝐫ℓ\+a⁡∥𝐫ℓ∥​𝐮​\(𝐫ℓ\)\\ \\mathbf\{r\}\_\{\\ell\}\\leftarrow\\mathbf\{r\}\_\{\\ell\}\+a\\,\\lVert\\mathbf\{r\}\_\{\\ell\}\\rVert\\,\\mathbf\{u\}\(\\mathbf\{r\}\_\{\\ell\}\)*// steering write \(answer\)*3\. atℓr\\ell\_\{r\}: capture the steered residualhsteerh^\{\\mathrm\{steer\}\}*// no second pass*4\.s←𝐝⊤​M​\(hsteer\)s\\leftarrow\\mathbf\{d\}^\{\\top\}M\(h^\{\\mathrm\{steer\}\}\)*// reconstructed sufficiency read*5\.ifs<τs<\\taureturnabstain*//τ\\tau: a label\-free percentile*6\.else returnarg⁡max\\arg\\maxanswer logits*// steering\-amplified answer*

## 6Results: the One\-Pass Pareto Frontier, Across Scale

Table 2:The one\-pass sufficiency gate across scale \(AUROC full vs\. replace;α\\alphaNLI in\-domain, HellaSwag zero\-shot transfer; single steered pass except the italic reference\)\. De\-contamination is label\-free; the BCE boost is supervised\. At 1\.5B capacity trades transfer for in\-domain along a clean frontier; at 3B the boosted map reaches in\-domain*above*the 2\-pass ceiling at a0\.0060\.006transfer cost; at 7B the identity\-anchored map learns≈\\approxidentity \(floor==de\-contam row\) because there is no contamination left to undo\. See Figure[3](https://arxiv.org/html/2608.14465#S6.F3)\.Figure 3:The one\-pass capacity–transfer frontier across scale\. Each hue is a frozen Qwen2\.5 backbone; points are one\-pass gates in increasing capacity order \(line\); the haloed★\\bigstaris our proposed flagship \(ML de\-contamination\+\+BCE boost\) and×\\timesis the two\-pass clean\-read reference \(2×2\\timescost\)\. At 1\.5B the frontier slopes down—capacity buys in\-domain and costs transfer; at 3B it flattens; at 7B all one\-pass gates cluster at the ceiling\. The 7B multi\-layer reconstruction point is omitted \(convergence failure, §[11](https://arxiv.org/html/2608.14465#S11)\)\.The correction repairs the read, label\-free \(1\.5B\)\.The single\-layer map lifts transfer→0\.8880\.836\\\!\\to\\\!0\.888—recovering63%63\\%of the contamination with no sufficiency labels—and in\-domain→0\.9440\.913\\\!\\to\\\!0\.944; the multi\-layer map trades some transfer \(0\.8690\.869\) to reach the 2\-pass clean ceiling in\-domain \(0\.9590\.959\)\.

The design law, quantified \(1\.5B\)\.Moving down Table[2](https://arxiv.org/html/2608.14465#S6.T2)’s 1\.5B block adds task\-specific capacity: in\-domain rises→0\.9820\.944\\\!\\to\\\!0\.982while transfer falls→0\.8590\.888\\\!\\to\\\!0\.859—the design law as a measured frontier, not a binary\. No one\-pass gate we built beats the 2\-pass clean read’s transfer at 1\.5B \(0\.9180\.918\); the label\-free map narrows the gap from8\.28\.2to3\.03\.0points\.

The trade\-off relaxes with scale \(3B\)\.Every 3B variant improves both columns over the floor, and the frontier flattens: the boosted map reaches0\.9840\.984in\-domain—above the clean ceiling—at a transfer within0\.0060\.006of it \(0\.9170\.917vs\.0\.9220\.922\)\.

At 7B there is no perturbation left to correct—and the map learns that\.The steered read already beats the clean read in\-domain \(0\.9950\.995vs\.0\.9850\.985\) and sits within0\.0130\.013on transfer; the identity\-initialized map, with nothing to undo, learns≈\\approxidentity \(its row coincides with the floor to four decimals\)\. This no\-harm behavior is a design property of the residual corrector, not luck: the reconstruction objective, not a hyper\-parameter, decides it, which is what lets one recipe deploy across scale\.

Scale trend\.Contamination \(clean−\-steered transfer gap\):0\.0820\.082at 1\.5B,0\.0310\.031at 3B,0\.0130\.013at 7B \(Figure[3](https://arxiv.org/html/2608.14465#S6.F3)\)\. The fusion problem is a small\-model problem—which is where frozen\-model steering buys the most reasoning accuracy in the first place \(\+21\.7​pp\+21\.7\\,\\textrm\{pp\}at 1\.5B vs\.\+4\.96​pp\+4\.96\\,\\textrm\{pp\}at 7B, §[7](https://arxiv.org/html/2608.14465#S7)\)\. De\-contamination is the piece that makes the small\-model deployment coherent: big write, repaired read, one pass\.

Cross\-dataset axes saturate—a negative result about the benchmark, not the gate\.Our constructed RepLiQA/BoolQ transfer axes turn out too easy \(every gate0\.980\.98–1\.001\.00: a different\-document replacement is superficially detectable\), and a hard variant \(same document, answer sentence deleted\) too hard—every gate, including the two\-pass clean read, floors at0\.560\.56–0\.680\.68\(§[11](https://arxiv.org/html/2608.14465#S11), item v\)\. The discriminative constructed axis is therefore HellaSwag; the calibrated middle ground the bracketing calls for is exactly what native labels provide, and §[8](https://arxiv.org/html/2608.14465#S8)moves the fused system onto that axis\.

## 7The Steering Probe’s Benchmark and the Combined System

The two components are results of this paper in their own right, not borrowed baselines: this section reports the writer’s full benchmark \(consolidating the steering line\) and the combined end\-to\-end system; the reader’s fused\-setting quantification is §[6](https://arxiv.org/html/2608.14465#S6), and its standalone characterization on native labels is §[10](https://arxiv.org/html/2608.14465#S10)\.

Steering: injection\-geometry grid\.Appendix[A](https://arxiv.org/html/2608.14465#A1)\(Table[10](https://arxiv.org/html/2608.14465#A1.T10)\) sweeps the writer’s configuration—layer count \(1/3/5/71/3/5/7\), injection positions \(last vs\. spread\-5\), andαmax\\alpha\_\{\\max\}—across three datasets and the scale ladder\. Three regularities: spread positions dominate last\-token injection at every layer count \(1\.5Bα\\alphaNLI\+20\.2\+20\.2vs\.\+14\.7\+14\.7at 3 layers\), layer count is a weak lever, and gains are competence\-modulated—large where the frozen baselineB0\\mathrm\{B\}\_\{0\}is weak, small where it is strong \(best 7B cell:81\.181\.1α\\alphaNLI vs\.76\.576\.5frozen\)\.

Combined system \(YOPO\): answer or abstain, end to end\.Following the sufficiency line’s protocol, we evaluate 3\-way accuracy \(correct==right answer on answerable conditions, abstain on the no\-information condition\) on the 4\-condition validation sets, with percentile\-calibrated thresholds \(quantile transfer across tasks\)\. Policies: frozen baseline, steering\-only, gate\-only \(clean read, no steering\), the 2\-pass reference \(steered answer\+\+clean gate\), and YOPO—our one\-pass fusion \(steered answer\+\+gate from the naive steered read, the de\-contamination map, the multi\-layer map, or the flagship\)—each at abstain percentiles\{20,25,30\}\\\{20,25,30\\\}; Table[3](https://arxiv.org/html/2608.14465#S7.T3)reportsp=25p\{=\}25\(matching the25%25\\%insufficient prior; the sweep is in the released JSONs\)\. The flagship’s BCE boost is fit on the in\-domain train rows with the end\-to\-end\-consistent label \(answerable==any non\-replace condition\); on 4\-condition data this, not full\-vs\-rest, is the gate’s actual job\.

Four readings\.*\(i\) Neither component suffices alone:*steering\-only never abstains and gate\-only forgoes the reasoning gain; the combination beats both everywhere \(e\.g\. 1\.5Bα\\alphaNLI:0\.3750\.375baseline,0\.5900\.590steer\-only,0\.5600\.560gate\-only,0\.7980\.798fused flagship\)\.*\(ii\) One pass beats two in\-domain:*the flagship gate tops the 2\-pass reference at every scale \(0\.7980\.798vs\.0\.7530\.753at 1\.5B;0\.8300\.830vs\.0\.7900\.790at 3B;0\.8930\.893vs\.0\.8630\.863at 7B—its one\-pass gate AUROC on the same items is0\.989/0\.993/0\.9980\.989/0\.993/0\.998\); the label\-free de\-contamination gate already ties or beats it \(0\.760/0\.790/0\.8800\.760/0\.790/0\.880; at 7B the steered read is the better substrate, consistent with Table[1](https://arxiv.org/html/2608.14465#S4.T1)\)\.*\(iii\) The design law is visible end to end:*on HellaSwag transfer at 1\.5B the flagship pays for its in\-domain lead \(0\.5120\.512vs\. the label\-free map’s0\.5920\.592and the 2\-pass0\.5980\.598\); at 3B it leads even there \(0\.6520\.652vs\.0\.6420\.642\); at 7B the label\-free single\-layer map is the best one\-pass transfer policy we measure \(0\.7540\.754\)—the same capacity–transfer frontier as §[6](https://arxiv.org/html/2608.14465#S6), now in accuracy points\.*\(iv\) The transfer caveat is the writer’s, not the gate’s:*at 1\.5B on HellaSwag, steering\-only \(0\.5020\.502\) does not beat the baseline \(0\.5000\.500\)—theα\\alphaNLI\-trained single\-task probe does not transfer its answer gain \(§[7](https://arxiv.org/html/2608.14465#S7)\)—so the fused system’s transfer value there is carried by the gate\.

Table 3:Combined\-system benchmark: end\-to\-end 3\-way accuracy \(answer correctly on answerable conditions / abstain on the no\-information condition\), 4\-cond validation sets, abstain percentilep=25p\{=\}25via quantile transfer\. “Label\-free” scopes to the*read path*: no abstention labels are optimized against \(the steering probe in every row is answer\-label trained; see §[5](https://arxiv.org/html/2608.14465#S5)\)\. The 7B ML de\-contam cells inherit that variant’s convergence failure \(§[11](https://arxiv.org/html/2608.14465#S11)\) and are reported for completeness\.
## 8Native Labels: Behavioral vs\. Internal, and the Fused System

Our 4\-condition sets construct insufficiency by redaction\. The sufficiency line’s earlier native\-label study, which this section replicates and builds on, complements them with*native human labels*on Qwen2\.5\-7B: SQuAD 2\.0\([Rajpurkar et al\. 2018](https://arxiv.org/html/2608.14465#bib.bib12)\), whose unanswerable questions are adversarially written with planted decoy answers, and RepLiQA\([Monteiro et al\. 2024](https://arxiv.org/html/2608.14465#bib.bib10)\)full documents \(contamination\-free\), recast as a binary sufficiency judgment \(gold token 1/2; 2,000/2,000 and 749/253 train/eval, class\-balanced—the standard suite of §[10](https://arxiv.org/html/2608.14465#S10)supersedes these cuts with strict fit\-1,200/sel\-800/test\-2,000 splits per domain\)\.

The model knows, but does not say\.On the same 125 unanswerable RepLiQA items, the behavioral route \(answering with explicit permission to abstain\) still force\-answers 44; a difference\-of\-means read of the*same forward pass*separates 124/125, catching all 44\. Across prompting variants the behavioral ceiling is≈0\.89\\approx\\\!0\.89decision accuracy \(forced chain\-of\-thought\) while the read is essentially saturated \(our replication: ranking AUROC0\.99880\.9988\)—direct evidence that the sufficiency signal exists in the residual stream and the decision pathway does not use it\. On adversarial SQuAD2,*everything*ties at≈0\.86\\approx\\\!0\.86: when models do force\-answer there,6262–71%71\\%of the answers are exactly the annotator\-planted decoy—traps good enough to fool the behavior fool the internal signal too\.

The write\-access ladder\.In the sufficiency line’s native\-label study \(values below are as measured there; this construction and protocol differ from the standard\-suite figures of §[10](https://arxiv.org/html/2608.14465#S10), so the two are not expected to coincide numerically\), training the judgment in\-domain works and ranks by write freedom: free weight\-write \(LoRAr=3r\{=\}3\) beats the steering probe trained on the same data, which beats the read\-only probe\. Under task shift \(SQuAD2→\\toRepLiQA zero\-shot\) the ranking*inverts by the same key*: the free\-write rung collapses hardest \(a∼23​pp\\sim\\\!23\\,\\textrm\{pp\}drop with a∼44%\\sim\\\!44\\%force\-answer rate\), constrained activation\-writing drops moderately, and the read\-only direction drops least—recoverable to the best value in this comparison by a one\-line label\-free recalibration \(median threshold, balanced prior\)\. The four\-domain study \(§[1](https://arxiv.org/html/2608.14465#S1)\) generalizes this single cell to the full4×4×34\{\\times\}4\{\\times\}3grid and the ladder holds \(−2\.7/−16\.3/−23\.1pp\-2\.7/\-16\.3/\-23\.1\\,\\textrm\{pp\}; the sufficiency line’s measurement reportsp=2\.3×10−5p\{=\}2\.3\{\\times\}10^\{\-5\}\)\. The free\-write rung was additionally re\-run from scratch in the fusion line’s environment—trainer and evaluator identical—and the collapse and its dangerous direction replicate independently: SQuAD20\.8930\.893in\-domain, RepLiQA0\.7790\.779under shift with a42\.2%42\.2\\%force\-answer rate \(the same regime; the single cross\-domain cell sits within the documented±0\.10\\pm 0\.10seed spread\)\. The one place our re\-run visibly departs is the RepLiQA*in\-domain*free\-write rung, which retrains to only0\.8740\.874on our machine—a 749\-item training set is exactly where LoRA is seed\- and budget\-sensitive—but the conclusion is reference\-free and survives: under shift the ordering is read\>\>constrained\-write\>\>free\-write, and the free\-write rung carries the highest force\-answer rate\. Read<<constrained write<<free write in\-domain, inverting under shift: the design law of §[4](https://arxiv.org/html/2608.14465#S4), measured a third way, on real labels\. YOPO’s architecture sits at the ladder’s low\-capacity end: a read\-only gate plus a constrained writer, with the write’s side effect on the read cancelled label\-free\.

The fused system on the native\-label construction\.The ladder evaluates the writer and the reader as*alternatives*; deployment stacks them—which raises the write–read interference question on this data\. We run the full fusion pipeline on the same manifests \(Qwen2\.5\-1\.5B; a scale the ladder study does not cover\): train the steering probe on the SQuAD2 judgment task in the identical configuration, read the sufficiency direction from the same steered pass, and repair with the reconstruction map\. Three findings\.*\(i\) The behavioral–internal gap widens at small scale:*1\.5B zero\-shot judgment scores0\.710/0\.5970\.710/0\.597\(SQuAD2/RepLiQA, the latter with78%78\\%force\-answer\), yet the probe protocol reads0\.770/0\.9800\.770/0\.980on the same model’s clean states—RepLiQA insufficiency is already saturated in the 1\.5B residual stream while the behavioral route collapses; the model that most needs the gate has the signal and cannot say it\.*\(ii\) Contamination is benign when the writer optimizes the judgment itself:*the steered read matches the clean read in\-domain \(0\.8590\.859vs\.0\.8630\.863AUROC\) and beats it on SQuAD2→\\toRepLiQA transfer \(0\.9430\.943vs\.0\.9390\.939;0\.9490\.949with the multi\-layer map, decision accuracy0\.8780\.878after median calibration—the best one\-pass transfer policy\)\. Unlike theα\\alphaNLI writer, trained on*answering*\(Table[1](https://arxiv.org/html/2608.14465#S4.T1)\), this writer is trained on the very judgment the gate reads: the perturbation correlates with the signal, and the 7B\-style inversion appears at 1\.5B\. The interference is a property of the writer’s objective, not of writing per se\.*\(iii\) The design law bites harder on real data:*the flagship again leads in\-domain \(0\.8670\.867AUROC,0\.7920\.792accuracy\) but collapses across datasets \(0\.5650\.565/0\.5300\.530\)—the supervised boost binds to SQuAD2’s adversarial signature just as LoRA does behaviorally \(−23\.7​pp\-23\.7\\,\\textrm\{pp\}\), while every label\-free variant transfers intact\. On real data the flagship is an in\-domain instrument; cross\-dataset deployment belongs to the label\-free stack plus median calibration\.

The 7B leg both replicates and extends\. Run end\-to\-end in the fusion environment, every behavioral and probe row of the earlier study reproduces to within0\.0080\.008\(zero\-shot judgment0\.855/0\.8740\.855/0\.874, probe on SQuAD20\.8590\.859, cross\-task strict/median/ranking0\.834/0\.917/0\.9600\.834/0\.917/0\.960\); the one disagreement is RepLiQA’s in\-domain threshold placement, where ranking is saturated on both sides \(AUROC0\.99880\.9988\)—placement, not signal\. In the fused setting the perturbation is absent in\-domain \(0\.9290\.929steered==0\.9290\.929clean\) and small on transfer \(0\.9410\.941vs\.0\.9650\.965\); the multi\-layer map’s convergence failure replicates on real data \(AUROC0\.500\.50, §[11](https://arxiv.org/html/2608.14465#S11)\); and the flagship again leads in\-domain \(0\.9340\.934AUROC,0\.8680\.868accuracy\) with a far smaller transfer debt than at 1\.5B \(0\.8820\.882vs\.0\.5650\.565\)—the contamination scale law, reproduced on native labels\.

One direction, measured across five datasets\.With clean states on disk, the full direction\-transfer cross\-matrix costs only arithmetic \(Table[4](https://arxiv.org/html/2608.14465#S8.T4)\); every cell is recomputed from our own extractions\. To the four datasets above we add a fifth with a different failure mode: MuSiQue\([Trivedi et al\. 2022](https://arxiv.org/html/2608.14465#bib.bib15)\)multi\-hop questions with native answerability labels \(2,000/1,000 balanced, supports\-first windows so the gold chain is never truncated\)\. At 7B, 19 of 20 off\-diagonal cells are≥0\.795\\geq 0\.795ranking AUROC \(mean0\.8790\.879; the exception,α\\alphaNLI→\\toMuSiQue,0\.7660\.766\): directions fit on native labels rank our constructed minimal pairs and vice versa \(HellaSwag→\\toSQuAD20\.9300\.930; SQuAD2→\\toRepLiQA0\.9610\.961\)\. At 1\.5B half the cells sit at or below0\.680\.68: the “one sufficiency direction” picture*emerges with scale*—the geometric face of the flagship’s transfer\-debt law \(0\.565→0\.8820\.565\\to 0\.882\), visible in the raw vectors as theα\\alphaNLI–HellaSwag cosine rising0\.58→0\.750\.58\\to 0\.75\. \(An earlier internal pre\-validation on an easier controlledα\\alphaNLI variant found the same ordering as our0\.8050\.805on the harder minimal\-pair construction\.\) MuSiQue splits sharply by role: hardest*target*column \(no source exceeds0\.8300\.830; in\-domain only0\.8500\.850—multi\-hop sufficiency is genuinely harder\) yet at 7B the strongest*source*row \(all four transfer cells≥0\.916\\geq 0\.916\): the direction distilled from the hardest data generalizes best\. Fusion follows suit—the MuSiQue\-trained one\-pass stack transfers to RepLiQA at0\.9170\.917\(ranking AUROC0\.9690\.969\) and SQuAD2 at0\.8440\.844, while the reverse SQuAD2→\\toMuSiQue direction manages0\.7420\.742—and the multi\-layer map’s 7B convergence failure replicates a third time here \(AUROC0\.500\.50in all six fusion analyses; §[11](https://arxiv.org/html/2608.14465#S11)\)\.

Table 4:Direction\-transfer cross\-matrix, computed entirely from our stored states\.Each row: the sufficiency directionddis fit on that dataset’s train split \(the sufficiency line’s v2 protocol: per\-layer difference of means on an 80% subset,L∗L^\{\*\}by held\-out AUROC, frozen\); each column: ranking AUROC \(↑\\uparrow\) of that frozen direction on the target dataset’s evaluation split, clean states, no recalibration\. Diagonal \(gray\)==in\-domain\.α\\alphaNLI/HellaSwag are our constructed 4\-condition sets \(sufficient==non\-*replace*\); SQuAD2/RepLiQA carry native labels; MuSiQue \(multi\-hop, supports\-first windows, native answerability labels\) is both the hardest target column and, at 7B, the strongest source row\. Layer sweep restricted to the capture set shared by all five extractions\.Writing on the hardest data: the free\-write rung, retrained on multi\-hop\.Is the LoRA rung’s collapse \(−23\.7​pp\-23\.7\\,\\textrm\{pp\},44%44\\%force\-answer\) a property of free writing, or of SQuAD2’s adversarial signature? Retraining the identical rung on MuSiQue mostly dissolves it: in\-domain0\.8760\.876, transfer0\.8570\.857/0\.8460\.846\(MQ→\\toSQuAD2/RepLiQA\)—a22–3​pp3\\,\\textrm\{pp\}drop against the SQuAD2\-trained rung’s11\.4​pp11\.4\\,\\textrm\{pp\}—with force\-answer18\.5/28\.1%18\.5/28\.1\\%against42\.2%42\.2\\%\. The drift still points the dangerous way \(force\-answer rises from6%6\\%in\-domain\), but training data alone halves it\. Consistent with the cross\-matrix:*judgment*training, like direction fitting, inherits the hard data’s generality; what cannot \(next\) is training the abstention into the answering head\.

Training the abstention itself: two collapses that scale cures, and one that calibration cures\.The ladder trains the*judgment*; the expensive end, per §[4](https://arxiv.org/html/2608.14465#S4), is training the*abstention*into the writer\. We test it directly: a hybrid steering probe with a three\-way head \(answer 1, answer 2, “cannot answer”\), same architecture and budget as the answer\-only writer, trained once onα\\alphaNLI and once on MuSiQue, scored end\-to\-end by three\-way accuracy\. At 1\.5B the design law fires in two opposite directions: theα\\alphaNLI\-trained hybrid transfers with abstention recall collapsed to0\.080\.08\(it stops abstaining\), the MuSiQue\-trained one over\-abstains \(91%/70%91\\%/70\\%of answerable items\)—each small model ships its training set’s abstention prior, not the concept\. At 7B both collapses vanish: in\-domain0\.8800\.880\(α\\alphaNLI, above the two\-pass reference0\.86250\.8625\) and0\.8720\.872\(MuSiQue, beating its two\-pass reference0\.7980\.798by7\.4​pp7\.4\\,\\textrm\{pp\}\) with over\-abstention≤0\.10\\leq 0\.10;α\\alphaNLI→\\toHellaSwag transfer reaches0\.7260\.726with abstention recall0\.8480\.848—trained abstention*does*transfer at 7B \(0\.08→0\.8480\.08\\to 0\.848\), a second scale\-emergent capability\. Transferring is not winning, though \(the four\-domain suite lands the trained families below target zero\-shot even at 7B, §[1](https://arxiv.org/html/2608.14465#S1)\), and scale does not deliver a transfer*win*here either: MuSiQue→\\toHellaSwag lands at0\.6820\.682, below the zero\-shot three\-way prompt \(0\.7020\.702\)—the hardest training data did not buy the best transferred abstention, in sharp contrast to its best\-source status at the read level\.

Decomposing that failure is more instructive than the failure itself \(Appendix[B](https://arxiv.org/html/2608.14465#A2)\)\. Three results carry the weight: recalibrating the hybrid’s own abstention logit with a label\-free target quantile recovers\+6\+6–8​pp8\\,\\textrm\{pp\}everywhere \(the gap was a decision\-layer failure, not a representation one\); the write’s net value is\+7\+7–8​pp8\\,\\textrm\{pp\}in\-domain and zero\-to\-negative on transfer; and both pre\-registered repairs fall short of the calibrated clean read—a raw read–write split fails exactly because it lacks the reconstruction map \(gate AUROC0\.9170\.917clean→0\.858\\to 0\.858steered\), and a multi\-source hybrid cures the prior\-carry collapse but only ties its transfer line \(0\.744<0\.7840\.744<0\.784\)\.

Where the interference lives, and the one repair that breaks the trade\-off\.A controlled decomposition localizes the damage exactly: under transfer the trained abstention*score*is untouched \(ranking AUROC0\.93370\.9337steered vs\.0\.93380\.9338clean\) while the*answer head*pays6\.4​pp6\.4\\,\\textrm\{pp\}—of which only1\.9​pp1\.9\\,\\textrm\{pp\}is the write per se and≈4\.5​pp\\approx\\\!4\.5\\,\\textrm\{pp\}is the abstain\-class gradient shaping the shared steering vector\. Four independent write\-side repairs \(down\-weighting, KL anchoring, PCGrad\) all remove the interference and all repay it in gate quality: within one shared write vector, answer fidelity and abstention expressiveness trade at par under shift \(Appendix[B](https://arxiv.org/html/2608.14465#A2)\)\. The variant that breaks the trade\-off moves the abstention*out of the write*: keep the write answer\-only and train a small MLP head that*reads*the steered residual \(layer 18, stop\-gradient into the write path\)\. This*read\-head*improves both sides at once: interference gone by construction, and the gate better than every prior score \(0\.9550\.955steered /0\.9640\.964clean vs\. the zero\-shot direction’s0\.9200\.920and the prompt’s0\.9340\.934, same items\)\. End to end it sets the best transfer score we measure—0\.793±0\.0030\.793\\pm 0\.003over three seeds, the first trained abstention to beat the calibrated behavioral read \(0\.7840\.784\)—while its in\-domain steered channel \(0\.878±0\.0070\.878\\pm 0\.007\) still beats the two\-pass reference\. The advantage is source\-general \(oneα\\alphaNLI head beats the zero\-shot direction on every transfer column of the five\-dataset sweep\) but scale\-emergent like everything else here: the steered\-channel head collapses at 1\.5B \(0\.6270\.627\) and recovers through 3B \(0\.8250\.825\) to 7B \(0\.9550\.955\)—a fourth scale\-emergence datum\. Finally, teaching the write to*self\-mute*on unlabeled out\-of\-distribution prompts yields YOPO\-2 \(Figure[4](https://arxiv.org/html/2608.14465#S8.F4)\): answer\-only write with a self\-suppressing gate, read\-head abstention, label\-free threshold, one forward pass\. Atλ=0\.3\\lambda\{=\}0\.3\(three seeds\) it scores0\.877±0\.0080\.877\\pm 0\.008in\-domain—above the two\-pass reference on every seed—and0\.781±0\.0120\.781\\pm 0\.012on transfer with the steering active: parity, not victory, against the calibrated read \(0\.7840\.784\)\. Two further gate objectives trace one monotone*steering\-strength frontier*\(Appendix[B](https://arxiv.org/html/2608.14465#A2)\); we report two operating points—in\-domain\-first \(0\.883±0\.0080\.883\\pm 0\.008\) and balanced \(parity under shift\)—and record that, with the write active, surpassing the calibrated read under shift is out of reach for this architecture at 7B\.

EmbeddingLayers 0–11 \(frozen\)Layer 12Layers 13–15 \(frozen\)Layer 16Layer 17 \(frozen\)Layer 18 \(read\)Layer 19 \(frozen\)Layer 20Layers 21–27 \(frozen\)RMSNorm \+ LM headinput tokensanswer\-only write\(×3\\times 3, Fig\.[1](https://arxiv.org/html/2608.14465#S3.F1)design\)direction𝐮⁡\(𝐫\)\\mathbf\{u\}\(\\mathbf\{r\}\)⋅\\cdotself\-muting gateaatrained: answer CE \(answerable rows only\)\+\+gate suppression on*unlabeled*OOD prompts⇒\\Rightarrowin\-domainaaactive⋅\\cdotunder shifta→0a\\\!\\to\\\!0abstention read\-head\(459K\)MLP3584→128→13584\{\\to\}128\{\\to\}1on the layer\-18 statetrained: BCE, stop\-gradient into the write path→\\tosufficiency scoressdecision \(label\-free\)s≥Quantile1−q​\(target scores\)s\\geq\\mathrm\{Quantile\}\_\{1\-q\}\(\\text\{target scores\}\)⇒\\Rightarrow“cannot answer”else answer=arg⁡max=\\arg\\maxanswer logitsone forward pass⋅\\cdotbackbone frozen⋅\\cdotdashed = read \(hook\)⋅\\cdotsolid = write\-backoperating points: in\-domain\-first \(two\-sided gate\)⋅\\cdotbalanced \(λ=0\.3\\lambda\{=\}0\.3\)Figure 4:YOPO\-2: one pass, write and read on separate channels\.The answer\-only steering write \(orange\) fires through a*self\-suppressing*magnitude gate trained with unlabeled out\-of\-distribution negatives—active in\-domain, near\-zero under shift\. Abstention never touches the write: a small read\-head \(blue\) scores sufficiency from the layer\-18 state of the same pass \(stop\-gradient\), and a label\-free quantile threshold turns the score into the abstain decision \(green\)\. In\-domain this configuration beats the two\-pass reference on every seed \(0\.8770\.877–0\.8830\.883\); under shift it holds parity with the best alternative \(0\.781±0\.0120\.781\\pm 0\.012vs\.0\.7840\.784\) while the read\-head’s score is the best transfer gate we measure \(0\.9550\.955–0\.9640\.964AUROC\)\.Taken together, the dissection refines the design law from a price list to an architectural rule: the abstention belongs on the*read*side—trained there, it beats every alternative under shift \(0\.797±0\.0020\.797\\pm 0\.002on the muted channel\) and cedes nothing in\-domain; trained into the write, four independent repairs confirm a structural answer\-fidelity/abstention trade that none can beat\. And the whole system can live in one forward pass with the write active: in\-domain everything above the two\-pass reference, under shift parity with the best alternative\. The design law, conditioned on scale and located at the write, survives—as an architecture rule rather than a prohibition\.

## 9Beyond Qwen: Ten Backbones, Six Families

Every number so far lives on one model family\. The identical pipeline—probe, one\-pass extraction, direction, flagship gate, end\-to\-end benchmark—is re\-run on seven further backbones spanning five other families \(Qwen2\.5\-0\.5B, OLMo\-2\-1B, TinyLlama\-1\.1B, StableLM\-2\-1\.6B, SmolLM2\-1\.7B, Phi\-3\-mini\-3\.8B, Mistral\-7B\), nothing retuned: layers mapped by proportional depth, Qwen hyperparameters verbatim, single seed per cell \(Table[5](https://arxiv.org/html/2608.14465#S9.T5)\)\. Three regularities\.*\(i\)*The one\-pass flagship beats the two\-pass reference on10 of 10backbones \(flagship gate AUROC0\.9630\.963–0\.9980\.998everywhere\): the fusion is a property of instruction\-tuned residual streams, not of Qwen\.*\(ii\)*The perturbation’s size varies by family—catastrophic \(SmolLM2→0\.7540\.975\\\!\\to\\\!0\.754\) to nearly absent \(OLMo\-2→0\.9200\.926\\\!\\to\\\!0\.920\)—yet the repaired gate lands at≥0\.963\\geq 0\.963on every backbone: the interference varies, the solution does not\.*\(iii\)*On the three backbones where steering buys no answer lift \(TinyLlama, Phi\-3\-mini, Mistral\-7B\), the gate alone still adds\+19\+19to\+23​pp\+23\\,\\textrm\{pp\}end to end: the reader does not need the writer to succeed\.

Table 5:Cross\-family end\-to\-end validation: ten backbones, six families, 0\.5B–7B\.Same pipeline as Table[3](https://arxiv.org/html/2608.14465#S7.T3)on theα\\alphaNLI 4\-condition policy benchmark \(answer/abstain accuracy,↑\\uparrow, abstention budgetp=25%p\{=\}25\\%\): zero\-shot baseline; steering only; the proposed one\-pass flagship \(steer\+\+multi\-layer map\+\+BCE boost\); the two\-pass reference \(clean re\-read,2×2\\timescost\)\. Last column: gate ranking AUROC read from the*steered*pass, naive→\\toflagship \(==echo size and its repair\)\. Steering probes for non\-Qwen backbones come from our earlier backbone studies or are retrained by the same recipe \(layers mapped by proportional depth\); single seed per cell\.Bold==one\-pass flagship≥\\geqtwo\-pass reference\.
## 10The Standard Suite: Self\-Audit, Replication, and the First Hybrid Benchmark

Everything so far was measured on benchmarks at least partly of our own construction\. This section audits those constructions with a source\-side leak test, replicates the reader’s claims on a standard four\-domain suite under an independently implemented protocol, and contributes the first*hybrid*\(answer\-or\-abstain\) benchmark on that suite\.

The construction audit \(a red flag we confirm on ourselves\)\.A sufficiency judgment cannot precede the integration of question and context, so linear separability in*early*layers can only be a construction artifact—a source\-side check requiring no target data\([Lavi et al\. 2025](https://arxiv.org/html/2608.14465#bib.bib6)\)\. Sweeping diff\-of\-means AUROC per layer over stored clean states: our 4\-conditionα\\alphaNLI construction separates at layer 11 already \(0\.9080\.908; layer 12:0\.9550\.955\), HellaSwag is milder but flagged \(L110\.7930\.793\), and native RepLiQA flags hardest of all \(layer 2:≥0\.99\\geq 0\.99—question–document topic mismatch is surface\-visible\); native SQuAD2 shows the clean profile \(≤0\.60\\leq 0\.60through layer 12\) and MuSiQue\-Full never crosses0\.900\.90\. The constructed\-set in\-domain gate numbers of §[6](https://arxiv.org/html/2608.14465#S6)–§[7](https://arxiv.org/html/2608.14465#S7)therefore ride partly on a shortcut and should be read as controlled\-construction results; the architecture’s claims are anchored on the native\-label replications \(§[8](https://arxiv.org/html/2608.14465#S8)\) and the suite below\. The audit itself is a contribution: cheap, source\-side, and worth making standard for constructed abstention benchmarks\.

The judgment task \(task B\) on the standard suite: an independent re\-implementation\.The sufficiency line’s protocol selects the read layer by a*causal\-onset gate followed by an in\-gate peak*:L0=arg⁡maxℓ​\|ψ⁡\(ℓ\)−ψ⁡\(ℓ−1\)\|L\_\{0\}=\\arg\\max\_\{\\ell\}\|\\psi\(\\ell\)\-\\psi\(\\ell\{\-\}1\)\|—ψ\\psibeing the line’s steering\-response score—lands unanimously on layer 19 in all four domains, and the read layer is the selection\-split AUROC peak overℓ≥L0\\ell\\geq L\_\{0\}\(hs\[19–28\]\);*one rule for all cells*, with the cross\-domain threshold calibrated as the median projection of a few hundred*unlabeled*target inputs\. Early layers—the shortcut axes the audit flags—fall below the causal onset and are excluded automatically\. Re\-implemented in the fusion codebase \(independent extraction code and fit/sel cuts\), reading at the gated layers \(hs21/hs19/hs19/hs19\), the decision\-accuracy diagonal reproduces within≈0\.4​pp\\approx 0\.4\\,\\textrm\{pp\}:0\.8575/0\.9520/0\.7840/0\.70100\.8575/0\.9520/0\.7840/0\.7010on SQuAD2/RepLiQA/MuSiQue\-C/MuSiQue\-F against the line’s own0\.8595/0\.9530/0\.7850/0\.70500\.8595/0\.9530/0\.7850/0\.7050\. The gate is what makes these numbers agree: RepLiQA’s global selection\-AUROC peak is an early layer \(AUROC0\.9990\.999, read0\.97650\.9765\) that the causal onset excludes as a shortcut axis, and the gated hs19 gives the causally valid0\.95200\.9520; the protocol is now a component of our stack\. Our trained read\-head, applied across both a prompt\-format and a dataset shift, stays serviceable \(ties the in\-domain\-fitted gate on MuSiQue\-C,0\.77750\.7775vs\.0\.78400\.7840\) but trails on single\-paragraph domains—sharpening its role: it is the abstention channel*of the fused system*, not a competitor to the right\-layer gate as a pure detector\.

Three families on one suite: the write\-access ladder, in full\.Table[6](https://arxiv.org/html/2608.14465#S10.T6)measures the introduction’s three\-family comparison: read\-only direction, constrained activation\-writer \(a steering probe of the fusion line’s design, trained on the judgment task\), and free weight\-writer \(LoRA\), each fit per domain and evaluated on all four\. In\-domain, write freedom wins \(0\.826→0\.843→0\.9090\.826\\to 0\.843\\to 0\.909mean, LoRA taking all four\)\. Crossing domains the ordering inverts by the same key: the direction gives back2\.7​pp2\.7\\,\\textrm\{pp\}and still beats the target’s own zero\-shot baseline in 9 of 12 arenas \(\+8\.6​pp\+8\.6\\,\\textrm\{pp\}mean\); the write families give back16\.3/23\.1​pp16\.3/23\.1\\,\\textrm\{pp\}and land*below*it \(−3\.2/−3\.5pp\-3\.2/\-3\.5\\,\\textrm\{pp\}\)—shipping a trained judgment across domains is, on average, worse than shipping nothing\. Forcing chain\-of\-thought lowers the spoken judgment on three of four domains: behavioral reasoning does not recover the internal signal\.

Table 6:The three\-family comparison on the standard four\-domain suite \(Qwen2\.5\-7B, judgment decision accuracy; the sufficiency line’s measurement\)\. In\-domain, capacity ranks the families \(LoRA sweeps all four\); across the 12 cross\-domain arenas the ranking inverts: only the read\-only direction exports a gain over the target’s own zero\-shot spoken judgment \(\+8\.6​pp\+8\.6\\,\\textrm\{pp\}mean, 9 of 12 arenas\), both write families landing below it\. Forced chain\-of\-thought lowers the spoken judgment on three of four domains\.The hybrid task \(task C\): to our knowledge, the first benchmark on this suite\.The suite’s judge framing tests the decision alone; deployment asks for the hybrid: answer when the context suffices, abstain when it does not\. We benchmark it directly \(Table[7](https://arxiv.org/html/2608.14465#S10.T7)\)—one greedy generation pass per domain under an answer\-or\-say\-“unanswerable” prompt, with every gate variant composed offline over the same stored states\. Scoring is fully deterministic: answerable rows score on the answer under SQuAD\-official normalization \(containment in either direction against any gold alias, or token\-F1≥0\.5\\geq 0\.5\); unanswerable rows score on abstention, detected by a fixed published regex set\. The scorer also emits a “gray\-zone” file \(strict misses with0\.2<F1<0\.50\.2<\\mathrm\{F1\}<0\.5\) as a hook for optional LLM adjudication;*no reported number in this paper depends on it*—every task\-C figure is the deterministic tier alone:

Table 7:Task C \(hybrid answer\-or\-abstain\) on the standard four\-domain suite with the zero\-shot sufficiency gate, Qwen2\.5\-7B\. Columns: raw answerable\-QA accuracy; hybrid accuracy under zero\-shot, calibrated zero\-shot, and OR\-composition with the sufficiency gate; the oracle upper bound; and the precision of answers actually given, zero\-shot→\\to\+\+gate\. OR\-composition on RepLiQA gains\+18\.3​pp\+18\.3\\,\\textrm\{pp\}\(98\.6%98\.6\\%of the oracle gap\) and lifts answered\-precision→0\.6360\.459\\\!\\to\\\!0\.636; the multi\-hop domains are answering\-bound\.Three findings\.*\(i\) RepLiQA benefits most:*OR\-composing the model’s own abstention with the gate yields\+18\.3​pp\+18\.3\\,\\textrm\{pp\}\(98\.6%98\.6\\%of the oracle gap\) and lifts answered\-precision→0\.6360\.459\\\!\\to\\\!0\.636—internal knowledge converted into deployment\-visible trust, the paper’s mechanism measured end to end\.*\(ii\) On adversarial SQuAD2 all systems tie*\(\+0\.8​pp\+0\.8\\,\\textrm\{pp\}\): annotator\-planted decoys fool the internal signal along with the behavior\.*\(iii\) On multi\-hop the binding constraint is answering, not abstention:*raw answerable\-QA is0\.319/0\.0620\.319/0\.062on MuSiQue\-C/F, so the oracle headroom collapses to3\.5/2\.7​pp3\.5/2\.7\\,\\textrm\{pp\}and no abstention policy has room—the task\-C ceiling there is answering capability \(task A\)\. Everywhere, OR\-composition beats gate\-priority: the generation’s own abstention carries signal the gate does not\.

The flagship gate on the hybrid task: in\-domain and cross\-domain\.The table above uses the zero\-shot direction; Table[8](https://arxiv.org/html/2608.14465#S10.T8)benchmarks the full source×\\timestarget matrix\. Per dataset we fit a supervised read\-head \(BCE MLP3584→128→13584\{\\to\}128\{\\to\}1on the layer\-18 state, the flagship’s read\-side form\) and the zero\-shot direction; diagonal cells use a labeled threshold, off\-diagonal cells a label\-free one \(combined abstention rate matched to the known insufficient prior—no target labels\)\. Read\-head cells are three\-seed means \(±≤0\.002\\pm\\\!\\leq\\\!0\.002\)\. Our system takes the benchmark on both axes\.*\(i\) It tops every in\-domain dataset*\(0\.845/0\.805/0\.642/0\.5050\.845/0\.805/0\.642/0\.505\), beating the direction everywhere it can move \(largest margin\+2\.3​pp\+2\.3\\,\\textrm\{pp\}on MuSiQue\-C; RepLiQA and MuSiQue\-F tie at the domain ceiling\)\.*\(ii\) With zero target labels, it is the only gate family that survives transfer\.*Fit on the hardest source \(MuSiQue\-Full\), the label\-free direction transfers at0\.828/0\.745/0\.6250\.828/0\.745/0\.625and matches its own supervised in\-domain ceiling on two of three targets \(SQuAD20\.8280\.828vs\.0\.8340\.834; MuSiQue\-C0\.6250\.625vs\.0\.6190\.619\), while every trained competitor collapses off\-diagonal \(read\-head ranking AUROC0\.5630\.563on MuSiQue\-C→\\toSQuAD2\)—the cross\-matrix ordering of §[8](https://arxiv.org/html/2608.14465#S8), decided on task C\. Two honest limits sharpen the claim: RepLiQA keeps a6​pp6\\,\\textrm\{pp\}gap to the supervised ceiling \(the price of zero\-label deployment, still ahead of every trained alternative\), and the multi\-hop domains are answering\-bound\.*\(iii\) One label\-conditioned system covers both regimes*—the read\-head where the target has labels, the hardest\-source direction where it does not\. That no*single*gate wins both is our design principle, not a shortfall: re\-standardizing the supervised gate by label\-free target statistics recovers the worst collapsed cell \(→0\.7680\.563\\\!\\to\\\!0\.768\) but degrades the strong ones and never overtakes the direction \(§[11](https://arxiv.org/html/2608.14465#S11)\)\.

Table 8:Task C \(hybrid answer\-or\-abstain\) on the standard four\-domain suite, Qwen2\.5\-7B\. Hybrid accuracy: answerable rows scored on the answer \(normalized containment or token\-F1≥0\.5\\geq 0\.5\), unanswerable rows on abstention; OR\-composition with the generation’s own abstention\. In\-domain gates are fit on the target’s own split \(read\-head cells are three\-seed means,±≤0\.002\\pm\\leq 0\.002\); the cross\-domain column applies the direction fit on the*hardest*source \(MuSiQue\-Full, label\-free threshold\) to each target \(its own row is in\-domain, marked “–”\)\. The supervised read\-head leads every in\-domain cell; cross\-domain, the label\-free direction from the hardest source matches in\-domain on two of three transferable targets while the supervised gate collapses off\-diagonal\. Multi\-hop targets are answering\-bound \(oracle within3\.5/2\.7​pp3\.5/2\.7\\,\\textrm\{pp\}of gen\-only\)\.Figure 5:Task C \(hybrid answer\-or\-abstain\) on the standard four\-domain suite, Qwen2\.5\-7B \(Table[8](https://arxiv.org/html/2608.14465#S10.T8)\)\. Blue: the in\-domain flagship read\-head, top on all four datasets\. Orange: the label\-free direction fit on the hardest source \(MuSiQue\-Full\), deployed cross\-domain with no target labels—it reaches the in\-domain bar on SQuAD2 and MuSiQue\-C and trails only on RepLiQA \(MuSiQue\-F is the source, so it has no cross bar\)\. The oracle cap \(dashed\) and zero\-shot floor \(solid gray\) bound each domain: the wide oracle gap on SQuAD2 is answering headroom, while on the multi\-hop domains the oracle nearly meets the floor—these are answering\-bound, and no gate has room there\.Unlocking the answering side without touching the judge\.Chain\-of\-thought answering is the standard treatment for multi\-hop questions, but it writes intermediate conclusions—including erroneous ones—into the very context a later reader would consume; in Table[6](https://arxiv.org/html/2608.14465#S10.T6)’s behavioral rows,*forcing*it lowers spoken judgment on three of four domains \(→0\.5550\.588\\\!\\to\\\!0\.555,→0\.5160\.535\\\!\\to\\\!0\.516on the MuSiQue variants\)\. Because our gate reads the*prefill*state, the hazard is excluded temporally: the judge decides before the first reasoning token exists\. Under a step\-by\-step answering prompt with the prefill gate unchanged \(pre\-registered lines: answerable QA≥0\.15\\geq 0\.15begins the unlock,≥0\.25\\geq 0\.25is a clear success\), answerable QA rises0\.319→0\.4820\.319\\to 0\.482on MuSiQue\-C and0\.062→0\.3130\.062\\to 0\.313on MuSiQue\-F—five\-fold on the hardest domain—and hybrid accuracy sets records on both \(0\.625→0\.6900\.625\\to 0\.690;0\.505→0\.5790\.505\\to 0\.579\)\. The gate’s calibration under the reasoning prompt matches its judge\-prompt values \(0\.94/0\.780\.94/0\.78selection AUROC\), confirming the temporal isolation empirically\. The residual45%45\\%over\-abstention on answerable MuSiQue\-F items is the answering ceiling again, not a gate failure: when the model cannot assemble the answer, abstaining is often the calibrated response, and the oracle sits only2\.7​pp2\.7\\,\\textrm\{pp\}above baseline here\.

The full fusion, verified end to end\.Two integrations close the loop\.*\(i\) Relay steering:*re\-implemented on the fusion stack \(independent directions, thresholds, extraction code\), it reproduces its signature result in full—execution fidelity1\.00001\.0000in all 16 cells: the model*speaks*exactly the judge matrix, per item, the cross\-domain cost still one unlabeled scalar\. Two interference phenomena meet here and must not be conflated:*internal interference*is downstream layers overwriting an injected*verdict*\(write\-to\-speak, resolved by the relay\);*write–read interference*\(§[4](https://arxiv.org/html/2608.14465#S4)\) is the steering write perturbing the sufficiency*read*\(write\-to\-read, resolved by the reconstruction map\)—two faces of one shared interface, addressed on complementary sides\.*\(ii\) Single\-forward deployment:*the hybrid runs as a true one\-pass product—the gate reads the generation prompt’s own prefill state \(the judge\-fitted direction transfers across prompt frames at0\.940\.94–0\.990\.99selection AUROC\)—and reproduces the offline\-composed benchmark within≤2​pp\\leq 2\\,\\textrm\{pp\}, preserving the RepLiQA gain at\+17\.5​pp\+17\.5\\,\\textrm\{pp\}\. Whatever the model later writes, chain\-of\-thought drafts included, cannot reach the judge: reasoning pollution is architecturally excluded\.

Three fusion architectures, compared on one field\.The interference of §[4](https://arxiv.org/html/2608.14465#S4)admits three architectural remedies, and this suite lets us compare them under a controlled protocol:*one shared injection module*\(the same answer\-trained probe, layers\{16,20,24\}\\\{16,20,24\\\},α=0\.3\\alpha\{=\}0\.3\), one scorer, one exam, so the only variable is how each design handles the write’s contamination of the read\.*\(A\) Reconstruction*: read the map\-restored pre\-injection state \(§[5](https://arxiv.org/html/2608.14465#S5)\)—the controlled\-set optimum\.*\(B\) Read\-only with a self\-muting write*: inject always\-on, score sufficiency read\-only from the layer\-18 state, threshold label\-free—the simplest design, no pre\-filter and no map\.*\(C\) Layer ordering*\(the sufficiency line’s single\-pass fusion\): a coarse judgment gates injection, drops the most\-uncertainδ\\delta\-quantile to keep those streams clean, writes only at post\-judgment layers, and adjudicates on the clean band\. We re\-implement \(C\) on our stack and place \(B\) beside it \(Table[9](https://arxiv.org/html/2608.14465#S10.T9); three\-way hybrid accuracy, in\-domain, single seed\):

Table 9:Three one\-pass fusion architectures on one shared injection module \(answer\-trained probe, layers\{16,20,24\}\\\{16,20,24\\\},α=0\.3\\alpha\{=\}0\.3\), three\-way hybrid accuracy, in\-domain\. \(A\) reconstruction is the discriminative\-set optimum; under this generative protocol the simplest read\-only design \(B, BCE read\-head\) leads both cells, and \(C\) layer\-ordering reproduces the sufficiency line’s reported gains\. The write–read interference is protocol\-dependent: severe on the controlled set, mild here\. Row \(B\) numbers are seed\-checked on both trained components \(footnote in text\); \(C\) is single\-seed\.Our shared\-module re\-implementation of \(C\) reproduces the sufficiency line’s own in\-domain cells \(0\.840/0\.7430\.840/0\.743in the original runs;0\.852/0\.7170\.852/0\.717here—almost exact on RepLiQA, same\-sign and smaller on MuSiQue\-C\)\. Two findings\.*\(i\) The simplest design leads in\-domain*\(B, read\-head\): \(C\)’s pre\-filter and stream\-dropping and \(A\)’s map are both avoidable here, because under the*generative*protocol the diff\-of\-means direction stays separable on the injected state \(class separation compresses about twofold, clean−6\.1/\+15\.3\-6\.1/\{\+\}15\.3to injected−4\.8/\+8\.3\-4\.8/\{\+\}8\.3, but does not collapse; read\-side recall0\.9790\.979\)\. This does not overturn §[5](https://arxiv.org/html/2608.14465#S5): on the*discriminative*controlled set the interference is severe and \(A\) remains the optimum—the conflict’s severity is protocol\-dependent\.*\(ii\) The ablation localizes the write’s role*: injection off, the model over\-abstains on its own \(MuSiQue\-C wrong\-abstain0\.6120\.612, answerable accuracy0\.2960\.296\); injection on restores both \(0\.2090\.209/0\.6210\.621\)\. The write suppresses spontaneous over\-abstention; the read catches genuine insufficiency—orthogonal roles\. The sharper causal witness: injection*destroys behavioral*abstention \(unanswerable items fabricate full answers\) while read\-side recall holds at0\.9790\.979—read\-side abstention survives exactly what write\-side abstention does not\. Cross\-domain, \(B\) transfers by swapping one unlabeled threshold \(rq→\\tomqc0\.6910\.691, mqc→\\torq0\.7520\.752; both above the target zero\-shot\)\.*Seed scope\.*\(B\) is re\-checked on both trained components: read\-head seeds\{0,1,2\}\\\{0,1,2\\\}move the BCE cells by≤0\.0015\\leq 0\.0015\(RepLiQA0\.887±0\.0000\.887\\pm 0\.000, MuSiQue\-C0\.800±0\.0010\.800\\pm 0\.001\); retraining the injection module with a second seed and rerunning the full generative pipeline moves the d\-version by≤0\.003\\leq 0\.003\(→0\.8770\.874\\\!\\to\\\!0\.877,→0\.7320\.734\\\!\\to\\\!0\.732\) and the BCE cells to0\.889/0\.7950\.889/0\.795\. Worst case across both axes, \(B, read\-head\) keeps a\+3\.4/\+7\.8\+3\.4/\+7\.8\-point margin over \(C\)\. The \(C\) replication and the ablation/cross\-domain cells remain single\-seed and we report them as such\.

Positioning and a caveat\.The paper’s two lines put one shared read–write interface to two complementary ends\. The sufficiency line reads a judgment the frozen model already holds and escorts it to faithful speech—*say what you know*\(task B; zero\-training relay steering\); the fusion*writes*the reasoning the model lacks,*reads*the sufficiency it has, and combines them into an answer\-or\-abstain system in a single pass \(task C\)\. One interface, two uses: speak what is known, write what is not, and—the fusion’s own piece—read soundly*through*the write, so the two can share one forward pass\. Finally, a cross\-line audit of the steering trainer found a position\-indexing defect in the steering trainer’s spread\-5 positions under left padding \(mixed\-length batches slide non\-last position slots\); the end\-to\-end results stand—training and evaluation share the same positions and the probe adapts—but “spread\-5” should be read as “the trainer’s realized positions” rather than the nominal design; single\-position and last\-position results are unaffected\.

## 11What Failed

Consistent with our pre\-registration protocol, we report the variants that did not survive\. \(i\)*Supervised MLPs on the steered read*\(d\-anchored and full\): in\-domain0\.9720\.972–0\.9790\.979but transfer0\.8460\.846–0\.8670\.867at 1\.5B—on or below the frontier, never above\. \(ii\)*A learned layer\-combination read*: never better than the naive floor at any scale\. \(iii\)*The multi\-layer reconstruction map does not converge at 7B*\(AUROC0\.500\.50; MSE stalls at6×6\\timesbudget\): large\-magnitude outlier channels dominate the raw MSE and the map fits the mean\. A per\-feature\-standardized variant repairs 7B \(0\.983/0\.9670\.983/0\.967\) but degrades 1\.5B/3B transfer—the standardization statistics are in\-domain quantities, leaking task signature by the very mechanism this paper studies—so we report the registered recipe with its failure; the identity\-anchored single\-layer map is the scale\-robust variant\. The failure replicates on native\-label data and MuSiQue \(all six fusion analyses\): three datasets, one diagnosis\. \(iv\) At 3B the BCE\-trained*demap*exceeds the clean ceiling on transfer \(0\.9324±0\.00230\.9324\\pm 0\.0023over five seeds, every seed above0\.9220\.922\) but does not extend to 7B—reported as a scale\-local observation, not a claim\. \(v\)*Our constructed cross\-dataset axes fail as benchmarks*: the replace constructions saturate \(0\.980\.98–1\.001\.00for every gate\) and the hard rm\-ans condition floors everyone at0\.560\.56–0\.680\.68including the two\-pass clean read; on the hard axis the supervised boost degrades most \(→0\.5650\.668\\\!\\to\\\!0\.565\)—the design law’s signature even where the signal is weak\. \(vi\)*Domain\-adversarial de\-contamination does not help*: a gradient\-reversal discriminator on the map’s objective is neutral at weak strength and damages transfer at meaningful strength \(λ=0\.3\\lambda\{=\}0\.3:0\.7840\.784\)—forcing domain invariance erases part of the sufficiency signal itself\. \(vii\)*A write\-site relocation*\(\{12,16,20\}→\{16,20,24\}\\\{12,16,20\\\}\\\!\\to\\\!\\\{16,20,24\\\},\+3\.13​pp\+3\.13\\,\\textrm\{pp\}in the sufficiency line’s generative measurement\)*does not replicate*under the discriminative two\-tokenα\\alphaNLI evaluation \(−0\.9/−1\.4pp\-0\.9/\-1\.4\\,\\textrm\{pp\}at both magnitudes\); the gain is evaluation\-protocol\-specific and we keep\{12,16,20\}\\\{12,16,20\\\}\. \(viii\)*No single supervised gate wins task C both in\-domain and cross\-domain*: the read\-head leads every in\-domain cell but collapses off\-diagonal, and its label\-free\-standardized and multi\-source repairs never overtake the direction cross\-domain—the supervised\-in\-domain / label\-free\-cross\-domain split is the capacity–transfer principle itself, not a gap a single gate closes\.

## 12Discussion

What this evaluation establishes\.The claims rest on one of the broadest evaluations of frozen\-model reasoning\-with\-abstention we are aware of: the writer’s injection\-geometry grid \(§[7](https://arxiv.org/html/2608.14465#S7), Appendix[A](https://arxiv.org/html/2608.14465#A1)\); the reader’s capacity–transfer frontier at three scales \(§[6](https://arxiv.org/html/2608.14465#S6)\); end\-to\-end accuracy where one pass beats two at every scale and on ten backbones across six families \(§[9](https://arxiv.org/html/2608.14465#S9)\); a native\-label study with a write\-access ladder \(§[8](https://arxiv.org/html/2608.14465#S8)\); and, on the standard four\-domain suite, a source\-side construction audit, a cross\-implementation validation of the right\-layer protocol, and the first answer\-or\-abstain benchmark on it \(to our knowledge\), which our system tops in\-domain on all four datasets while its label\-free family is the only one to survive transfer \(§[10](https://arxiv.org/html/2608.14465#S10)\)\. The deployment impact is concrete: a frozen backbone gains a reasoning writer and a trustworthy abstention reader in a single forward pass, at no accuracy cost over the two\-pass alternative and no per\-domain labels\.

A budget\-conditioned recipe\.If a second \(partial\) forward is affordable, the clean read remains the transfer\-optimal gate\. Under a hard one\-pass budget our default is the flagship \(multi\-layer de\-contamination\+\+boost\): it is the score leader in\-domain at every scale and on transfer at 3B and above\. Fall back to the purely label\-free map when the deployment is small\-scale \(1\.5B\)*and*worst\-case task shift dominates—there the boost’s transfer cost is real \(→0\.8590\.888\\\!\\to\\\!0\.859\)\.Why label\-free transfers\.The reconstruction target is a physical state, not a task judgment; the map learns to invert a perturbation whose geometry is induced by the probe, not by the dataset\. The moment labels enter \(boost\), task signature enters, and transfer pays, in proportion to how much the labels helped in\-domain\.Limitations\.Our 4\-condition sets construct insufficiency by redaction, and the audit of §[10](https://arxiv.org/html/2608.14465#S10)shows theα\\alphaNLI construction carries an early\-layer artifact: constructed\-set in\-domain gate numbers are controlled\-construction results, the architecture’s claims anchored on the native\-label and standard\-suite replications; the two cross\-dataset constructions were too easy to rank gates \(§[11](https://arxiv.org/html/2608.14465#S11)\), leaving HellaSwag as the redaction\-axis transfer evidence, complemented by the native\-label and standard\-suite axes\. Every quantity was recomputed within this paper’s two codebases—behavioral, probe, and both write rungs replicated from raw manifests—so no number rests on unverified artifacts; a bit\-level identity check between the two lines’ fittedddvectors was not performed and is not load\-bearing \(no claim depends on vector identity, only on both reading the same signal, which the item\-level replication establishes\)\. The main capacity–transfer grid is Qwen2\.5; the cross\-family grid covers ten backbones and six families but one benchmark axis \(α\\alphaNLI\),≤\\leq8B\. Most grid cells are single\-seed with a consistent 1\.5B/3B/7B trend; where seeds were re\-run the effects hold \(task\-C flagship three\-seed±≤0\.002\\pm\\\!\\leq\\\!0\.002; the 3B demap cell stable over five seeds,0\.9843±0\.00050\.9843\\pm 0\.0005/0\.9324±0\.00230\.9324\\pm 0\.0023\), but full error bars on the capacity–transfer and steering grids await a re\-extraction we did not run\. The multi\-layer reconstruction recipe is not scale\-robust as registered \(§[11](https://arxiv.org/html/2608.14465#S11)\); only the identity\-anchored single\-layer map is\.

## 13Conclusion

A frozen model’s residual stream can host both a reasoning*writer*and a sufficiency*reader*in a single forward pass—but only if the architecture respects one asymmetry: keep the abstention a calibrated read \(training it in collapses outright at small scale and, even at 7B where it stabilizes and transfers, buys in\-domain accuracy without ever beating the calibrated read under shift\), but do train away the*perturbation*the write leaves on the read \(this is label\-free and transfers\)\. The reconstruction map operationalizes exactly this—a fixed zero\-shot direction and a learned inverse of the write—and the resulting system, YOPO, answers, steers, and abstains from one forward pass at no loss to the two\-pass alternative\. Across the Qwen2\.5 scale grid the map removes most of the perturbation where it is largest \(small models\) and reduces to the identity where there is none to remove \(7B\), and the remaining capacity–transfer frontier—which we chart rather than collapse to a single point—quantifies, in the fused setting, the design principle the read\-only gate was built on\.

### Reproducibility Statement

Every number in this paper is recomputable from committed per\-item logs, scored JSON artifacts, and the scripts listed in Appendix[C](https://arxiv.org/html/2608.14465#A3); residual extractions and trained probes are regenerable from the same scripts \(large binaries are excluded from the repository by size, not by necessity\)\. All datasets are public benchmarks \(α\\alphaNLI, HellaSwag, PIQA, BoolQ, SQuAD 2\.0, RepLiQA, MuSiQue\), used under their published licenses via their canonical releases\. All experiments ran on a single Apple\-silicon workstation \(128 GB unified memory, bfloat16\); Appendix[C](https://arxiv.org/html/2608.14465#A3)documents the Apple\-silicon\-specific engineering required to reproduce them\.

### Ethics Statement

This work uses only public benchmark datasets; no human subjects, personal data, or annotation labor were involved\. The backbone models are open\-weight and remain completely frozen: every intervention is an inference\-time, hot\-swappable edit, reversible by removing a forward hook\. The system’s purpose is harm\-reducing—teaching a frozen model to abstain when its context is insufficient reduces confident confabulation, a primary failure mode of deployed assistants\. The same read/write machinery could in principle steer models toward undesired behavior; we study and release only reasoning\-accuracy and abstention applications, and the design law we quantify \(trained behavioral control collapses under shift\) is itself evidence that such misuse transfers poorly\.

## References

- Bhagavatula et al\. \(2020\)Chandra Bhagavatula, Ronan Le Bras, Chaitanya Malaviya, Keisuke Sakaguchi, Ari Holtzman, Hannah Rashkin, Doug Downey, Scott Yih, and Yejin Choi\.Abductive commonsense reasoning\.In*International Conference on Learning Representations*, 2020\.
- Bisk et al\. \(2020\)Yonatan Bisk, Rowan Zellers, Ronan Le Bras, Jianfeng Gao, and Yejin Choi\.Piqa: Reasoning about physical commonsense in natural language\.In*Proceedings of AAAI*, 2020\.
- Clark et al\. \(2019\)Christopher Clark, Kenton Lee, Ming\-Wei Chang, Tom Kwiatkowski, Michael Collins, and Kristina Toutanova\.Boolq: Exploring the surprising difficulty of natural yes/no questions\.In*Proceedings of NAACL*, 2019\.
- Ilharco et al\. \(2023\)Gabriel Ilharco, Marco Tulio Ribeiro, Mitchell Wortsman, Suchin Gururangan, Ludwig Schmidt, Hannaneh Hajishirzi, and Ali Farhadi\.Editing models with task arithmetic\.In*International Conference on Learning Representations*, 2023\.
- Kadavath et al\. \(2022\)Saurav Kadavath, Tom Conerly, Amanda Askell, Tom Henighan, Dawn Drain, Ethan Perez, Nicholas Schiefer, Zac Hatfield\-Dodds, Nova DasSarma, Eli Tran\-Johnson, et al\.Language models \(mostly\) know what they know\.*arXiv preprint arXiv:2207\.05221*, 2022\.
- Lavi et al\. \(2025\)Maor Juliet Lavi, Tova Milo, and Mor Geva\.Detecting \(un\)answerability in large language models with linear directions\.*arXiv preprint arXiv:2509\.22449*, 2025\.
- Lee et al\. \(2024\)Bruce W Lee, Inkit Padhi, Karthikeyan Natesan Ramamurthy, Erik Miehling, Pierre Dognin, Manish Nagireddy, and Amit Dhurandhar\.Programming refusal with conditional activation steering\.*arXiv preprint arXiv:2409\.05907*, 2024\.
- Lehtinen et al\. \(2018\)Jaakko Lehtinen, Jacob Munkberg, Jon Hasselgren, Samuli Laine, Tero Karras, Miika Aittala, and Timo Aila\.Noise2noise: Learning image restoration without clean data\.In*Proceedings of ICML*, 2018\.
- Li et al\. \(2023\)Kenneth Li, Oam Patel, Fernanda Viégas, Hanspeter Pfister, and Martin Wattenberg\.Inference\-time intervention: Eliciting truthful answers from a language model\.In*Advances in Neural Information Processing Systems*, 2023\.
- Monteiro et al\. \(2024\)Joao Monteiro, Pierre\-Andre Noel, Etienne Marcotte, Sai Rajeswar, Valentina Zantedeschi, David Vazquez, Nicolas Chapados, Christopher Pal, and Perouz Taslakian\.Repliqa: A question\-answering dataset for benchmarking llms on unseen reference content\.*Advances in Neural Information Processing Systems*, 2024\.
- Panickssery et al\. \(2024\)Nina Panickssery, Nick Gabrieli, Julian Schulz, Meg Tong, Evan Hubinger, and Alexander Matt Turner\.Steering llama 2 via contrastive activation addition\.*arXiv preprint arXiv:2312\.06681*, 2024\.
- Rajpurkar et al\. \(2018\)Pranav Rajpurkar, Robin Jia, and Percy Liang\.Know what you don’t know: Unanswerable questions for SQuAD\.In*Proceedings of ACL*, 2018\.
- Slobodkin et al\. \(2023\)Aviv Slobodkin, Omer Goldman, Avi Caciularu, Ido Dagan, and Shauli Ravfogel\.The curious case of hallucinatory \(un\)answerability: Finding truths in the hidden states of over\-confident large language models\.In*Proceedings of EMNLP*, 2023\.
- Todd et al\. \(2024\)Eric Todd, Millicent L Li, Arnab Sen Sharma, Aaron Mueller, Byron C Wallace, and David Bau\.Function vectors in large language models\.In*International Conference on Learning Representations*, 2024\.
- Trivedi et al\. \(2022\)Harsh Trivedi, Niranjan Balasubramanian, Tushar Khot, and Ashish Sabharwal\.Musique: Multihop questions via single\-hop question composition\.*Transactions of the Association for Computational Linguistics*, 10, 2022\.
- Turner et al\. \(2023\)Alexander Matt Turner, Lisa Thiergart, David Udell, Gavin Leech, Ulisse Mini, and Monte MacDiarmid\.Activation addition: Steering language models without optimization\.*arXiv preprint arXiv:2308\.10248*, 2023\.
- Vincent et al\. \(2008\)Pascal Vincent, Hugo Larochelle, Yoshua Bengio, and Pierre\-Antoine Manzagol\.Extracting and composing robust features with denoising autoencoders\.In*Proceedings of ICML*, 2008\.
- Wu et al\. \(2024\)Zhengxuan Wu, Aryaman Arora, Zheng Wang, Atticus Geiger, Dan Jurafsky, Christopher D Manning, and Christopher Potts\.Reft: Representation finetuning for language models\.In*Advances in Neural Information Processing Systems*, 2024\.
- Zellers et al\. \(2019\)Rowan Zellers, Ari Holtzman, Yonatan Bisk, Ali Farhadi, and Yejin Choi\.Hellaswag: Can a machine really finish your sentence?In*Proceedings of ACL*, 2019\.
- Zou et al\. \(2023\)Andy Zou, Long Phan, Sarah Chen, James Campbell, Phillip Guo, Richard Ren, Alexander Pan, Xuwang Yin, Mantas Mazeika, Ann\-Kathrin Dombrowski, et al\.Representation engineering: A top\-down approach to ai transparency\.*arXiv preprint arXiv:2310\.01405*, 2023\.

## Appendix AThe Steering Injection\-Geometry Grid

Datasets:α\\alphaNLI, HellaSwag\([Zellers et al\. 2019](https://arxiv.org/html/2608.14465#bib.bib19)\), and PIQA\([Bisk et al\. 2020](https://arxiv.org/html/2608.14465#bib.bib2)\)\. Each probe is trained on 5k items of its task \(seed 0\) and evaluated on 1,532 held\-out items against the frozen baselineB0\\mathrm\{B\}\_\{0\}\. “–” cells are configurations outside the registered sweep, not pending runs\.

Table 10:Steering benchmark grid: accuracy \(%Δ\\Deltavs\. the frozen baselineB0\\mathrm\{B\}\_\{0\}\) across injection layer count, position scheme, andαmax\\alpha\_\{\\max\}, per dataset and backbone\.
## Appendix BTraining the Abstention In: Decomposition and Repairs

This appendix carries the full decomposition and repair experiments behind the summary of §[8](https://arxiv.org/html/2608.14465#S8)\.

Decomposing the hybrid’s transfer failure\(post\-hoc on stored states, then pre\-registered follow\-ups\)\. The hybrid commits to “cannot answer” by argmax at generation time—an uncalibrated threshold frozen into the weights\. Re\-reading its ownp⁡\(“0”\)p\(\\text\{\`\`0''\}\)as a*score*and thresholding at the label\-free quantile of the target set \(the same trick the read\-only stack uses\) recovers\+6\+6–8​pp8\\,\\textrm\{pp\}everywhere \(MuSiQue→\\toHellaSwag0\.682→0\.7440\.682\\to 0\.744;→α\\to\\alphaNLI0\.7325→0\.8100\.7325\\to 0\.810; ranking AUROC of the trained score0\.9180\.918–0\.9700\.970\): most of the transfer gap was never a representation failure, only a decision\-layer one\. The remainder cleanly separates the write’s value by domain: in\-domain the write beats the calibrated clean read by\+7\+7–8​pp8\\,\\textrm\{pp\}\(0\.8640\.864vs\.0\.7900\.790MuSiQue;0\.8850\.885vs\.0\.81250\.8125α\\alphaNLI\)—training*does*refine the in\-domain partition—while on transfer its net contribution is zero to negative \(0\.7440\.744vs\. the calibrated clean three\-way prompt’s0\.7840\.784on HellaSwag;0\.8100\.810vs\.0\.8150\.815onα\\alphaNLI\)\. The calibrated clean three\-way prompt is itself a strong baseline we have not seen reported \(though its prompt format differs from the two\-way judgment sets above, so the numbers are not directly comparable across constructions\)\.

Two pre\-registered repair candidates\.*D1, a raw read–write split*\(the write stays answer\-only; abstention becomes a quantile\-calibrated read of a direction fit on the writer’s steered features\), fails both its lines \(0\.6240\.624on HellaSwag against targets\>0\.744\>0\.744and\>0\.784\>0\.784\)—and fails*for the thesis’s reason*: without the reconstruction map, the answer\-writer’s perturbation swamps the cross\-domain read \(gate AUROC0\.9170\.917clean→0\.858\\to 0\.858steered; answer accuracy0\.820→0\.7190\.820\\to 0\.719\)\. The split architecture is fine—its clean\-channel variant scores0\.7740\.774—but reading a steered pass raw is exactly the write–read interference of §[4](https://arxiv.org/html/2608.14465#S4); the correction is not an optional part\.*D2, a multi\-source hybrid*\(α\\alphaNLI\+\+MuSiQue 50/50 at the same 2,000\-item budget\), repairs what it targets and no more: the prior\-carry collapse is cured outright \(transfer over\-abstention0\.269→0\.0990\.269\\to 0\.099; onα\\alphaNLI0\.26→0\.0470\.26\\to 0\.047with abstention recall0\.960\.96\), in\-domain stays near the full single\-source cells with half the per\-source data \(0\.8700\.870α\\alphaNLI,0\.8450\.845MuSiQue\), and—most telling—its argmax*equals*its calibrated score \(0\.744=0\.7440\.744\{=\}0\.744on HellaSwag\): source diversity internalizes the threshold that single\-source training leaves miscalibrated\. But it exactly ties, rather than beats, its pre\-registered transfer line \(0\.7440\.744\), still short of the calibrated clean read \(0\.7840\.784\)\.

Four write\-side repairs, one fate\.On theα\\alphaNLI\-trained hybrid, abstain\-class down\-weighting \(λ=0\.25/0\.5\\lambda\{=\}0\.25/0\.5: answer head0\.789/0\.7810\.789/0\.781, gate0\.900/0\.9200\.900/0\.920\), a KL answer\-preservation anchor \(best answer head,0\.8110\.811; gate0\.8970\.897\), and PCGrad gradient surgery \(answer head0\.7870\.787; gate0\.8910\.891, the worst net score,0\.7160\.716\) all eliminate the write–read interference and all pay for it in gate quality: within a single shared write vector, answer fidelity and abstention expressiveness trade at par under shift \(λ=0\.5\\lambda\{=\}0\.5’s0\.7460\.746is the best write\-side net,\+1​pp\+1\\,\\textrm\{pp\}over baseline\)\. The repair that breaks the trade\-off—moving the abstention out of the write entirely—is the read\-head of §[8](https://arxiv.org/html/2608.14465#S8)\.

Steering\-strength frontier \(gate objectives\)\.Suppressing the write’s magnitude gate on unlabeled out\-of\-distribution prompts atλ=0\.3\\lambda\{=\}0\.3gives the balanced YOPO\-2 operating point of §[8](https://arxiv.org/html/2608.14465#S8); stronger suppression \(λ=0\.5/1\.0\\lambda\{=\}0\.5/1\.0:0\.782/0\.7860\.782/0\.786transfer\) buys no more and bleeds in\-domain \(0\.860/0\.85750\.860/0\.8575\)\. Two further gate objectives close the question: a hinge that penalizes only OOD magnitudes above a floor \(three seeds: in\-domain0\.859±0\.0180\.859\\pm 0\.018, transfer0\.781±0\.0130\.781\\pm 0\.013\) and a two\-sided objective that additionally holds in\-domain magnitudes up \(in\-domain0\.883±0\.0080\.883\\pm 0\.008—above the two\-pass reference on every seed, the best in\-domain configuration we have—but transfer0\.764±0\.0140\.764\\pm 0\.014\)\. Three mechanistically distinct objectives trace one monotone frontier: each increment of in\-domain steering gain costs a comparable increment of out\-of\-domain suppression, while the suppressed\-channel score stays configuration\-independent at0\.7930\.793–0\.7970\.797\.

## Appendix CReproducibility

All numbers are recomputable from committed per\-item logs and scripts\.Steering grid \(Table[10](https://arxiv.org/html/2608.14465#A1.T10)\):scripts/m27b\_grid\.shtrains every cell \(train\_steer\.py, 5k items, seed 0, lr10−410^\{\-4\}, 3 epochs, batch 4\) and evaluates on 1,532 held\-out items \(eval\_steer\.py\); per\-item JSONs inexperiments/m27/runs/, table viascripts/m27\_table\.py\.Gate/fusion grids \(§[6](https://arxiv.org/html/2608.14465#S6)\):residual extraction viascripts/m28\_extract\.py\(320\-token budget; 4\-cond buildersscripts/m28\_build\_\*\.py\); variants and Pareto rows viascripts/m28b\_eval\.py/m28c\_eval\.py\(fits are CPU\-deterministic,torch\.manual\_seed\(0\); seed sensitivity of the one above\-ceiling cell:scripts/m28b\_replicate\.py, seeds 0–4\)\.End\-to\-end \(Table[3](https://arxiv.org/html/2608.14465#S7.T3)\):scripts/m29\_extract\.py\(clean\+steered logits and residuals in one pass pair\) andscripts/m29\_e2e\_eval\.py; the flagship’s BCE label is answerable==non\-replace\.Native\-label study \(§[8](https://arxiv.org/html/2608.14465#S8)\):the sufficiency line’s manifests and pipeline ship in its v2 delivery; our fused run usesscripts/m30\_convert\.py→\\totrain\_steer\.py\(their configuration: layers\{12,16,20\}\\\{12,16,20\\\}, spread\-5, learned gate,αmax=0\.3\\alpha\_\{\\max\}\{=\}0\.3, 2,000 items, 3 epochs\)→\\toscripts/m29\_extract\.py\(\-\-max\-len 2304for full documents\)→\\toscripts/m30\_analyze\.py\(their probe protocol verbatim: 80/20 split by example id, seed 7, layer and threshold chosen on the held\-out 20%, frozen before eval; median calibration for cross\-dataset thresholds\)\.Cross\-matrix \(Table[4](https://arxiv.org/html/2608.14465#S8.T4)\):scripts/m31\_cross\_matrix\.py, pure post\-processing of the stored m29/m30 extractions; layer sweep over the shared capture set, one JSON per scale inexperiments/m31/\.Ladder self\-replication and cross\-family grid \(M31\):scripts/m31\_grid\.shruns \(a\) the LoRAr=3r\{=\}3rung with the sufficiency line’s trainer/evaluator copied verbatim \(scripts/m31\_train\_peft\.py/m31\_eval\_peft\.py; their hyperparameters: q/k/v/o/gate/up/down, 3 epochs, lr10−410^\{\-4\}\) on their SQuAD2 judgment manifests, and \(b\) the full extract→\\toe2e pipeline on every non\-Qwen backbone \(V21 probes from the m12/m21 backbone studies or retrained by the same recipe; layers mapped by proportional depth\)\. Backbones are stock instruction\-tuned checkpoints, frozen throughout; probes are the only trained parameters \(≈\\approx1% of backbone\)\.MuSiQue leg, hybrid probe, and calibration study \(M32–M34\):scripts/m32\_build\_musique\.pybuilds the judgment set from MuSiQue\-Full \(supports\-first word budget so gold chains are never truncated; token p9912261226, all windows≤2048\\leq 2048\);scripts/m32\_grid\_v2\.shruns probe training, chunked extraction, the six bidirectional fusion analyses, both5×55\{\\times\}5cross\-matrices, and the LoRA rung on MuSiQue\. The three\-way hybrid probes \(scripts/m33\_train\_hybrid\.py, label set\{0,1,2\}\\\{0,1,2\\\}with0=0=“cannot answer”; MuSiQue variant carries the true answer among the candidates as a trap\) and their extractions/analysis run fromscripts/m33\_grid\_v3\.sh→\\tom33\_analyze\.py\(acc3standard: answerable rows scored on the answer, insufficient rows on abstention\)\. The calibration decomposition isscripts/m34\_recalib\.py\(label\-free quantile ofp⁡\(“0”\)p\(\\text\{\`\`0''\}\)at the designed insufficient fraction\); the read–write split and multi\-source cells arescripts/m34\_grid\.shwith pre\-registered decision lines in the script header\.Standard\-suite benchmark \(M39, §[10](https://arxiv.org/html/2608.14465#S10)\):scripts/m39\_build\_data\.pyassembles the four domains \(test sets verbatim from the Lavi release / the sufficiency line’s committed curated\-MuSiQue manifests / the deterministic seed\-7 MuSiQue\-Full rebuild; source\-side fit/sel cut from earlier pools, seed 7—a documented deviation shown immaterial by the 16/16 replication\);m39\_extract\.pycaptures every decoder layer’s last\-prompt\-token state plus the judge logits;m39\_analyze\.pyimplements the HOME/TRAVEL layer protocol, the unlabeled\-median threshold, and the red\-flag audit;m39\_generate\.py\+\+m39\_score\.pyproduce the hybrid benchmark \(one generation pass, gates composed offline\)\. Apple\-silicon reproducibility notes: all tokenizer calls bucket shapes withpad\_to\_multiple\_of=128\(unbucketed dynamic padding balloons MPSGraph’s per\-shape cache\); LoRA training on MPS additionally requires segmented execution \(\-\-segment\-steps, fresh process per segment, AdamW moments reset at boundaries, constant lr\)—a workaround for a driver\-side per\-process leak in backward passes through frozen 7B weights, documented inICLR\_STATUS\.md\.