PAGE: 分区感知门控KV-Cache淘汰

arXiv cs.LG 2026/09/22 04:00 论文
kv-cache eviction llm-inference memory-optimization gated-eviction academic-research
摘要
本文介绍了PAGE，一种分区感知的门控KV-Cache淘汰方法，它使用标量度量预测输入类别，仅在安全时应用淘汰，从而减少大语言模型中的精度损失。
arXiv:2609.22157v1 Announce Type: new Abstract: KV-cache eviction methods decide which tokens to keep but not whether to evict at all, so a benchmark mean can hide a class of inputs on which compression drives accuracy from 99\% to 0\%. We reframe eviction as a per-input admission decision and show that inputs separate into a capacity-bound class, where eviction is catastrophic at every budget, and a dilution-prone class, where eviction is safe or beneficial. A single label-free scalar computed from prefill attention, the early-to-late drop in pairwise top-$k$ head agreement, predicts this class before any decoding. PAGE thresholds this drop: it applies any base evictor when the drop is large and retains the full cache otherwise, with no training and no accuracy labels. The drop orders inputs by eviction safety consistently across four architecture families, and a per-model unlabeled pilot of about 100 inputs recalibrates the threshold for a new family. Used as a safeguard, PAGE cuts the harm rate on the capacity-bound regime from 0.75 to 0.026, a 29 $\times$ reduction, across four evictors, four models, and two benchmarks, turning a 99\% to 0\% collapse into a flat 89\% without retraining the evictor. The gate is inert wherever eviction is already safe, and the capacity-bound class it protects is a small, identifiable minority of inputs, so the benefit is a targeted safety gain rather than an average one. PAGE is a per-input safeguard, not a compressor: realized compression is $1.8 - 3.4 \times$ (mean 2.9$\times$) against a nominal 16$\times$ budget and decays toward unity by batch 16 under static provisioning, and a trained evictor wins at matched memory.
查看原文
查看缓存全文
缓存时间: 2026/09/22 09:14
# PAGE: Partition-Aware Gated KV-Cache Eviction
Source: [https://arxiv.org/html/2609.22157](https://arxiv.org/html/2609.22157)
Pankaj Kumarpankaj\.kumar@niser\.ac\.inAffiliation:School of Computer SciencesAffiliation:National Institute of Science Education and ResearchAffiliation:An OCC of Homi Bhabha National Institute, IndiaSubhankar Mishrasmishra@niser\.ac\.inAffiliation:School of Computer SciencesAffiliation:National Institute of Science Education and ResearchAffiliation:An OCC of Homi Bhabha National Institute, India

###### Abstract

KV\-cache eviction methods decide which tokens to keep but not whether to evict at all, so a benchmark mean can hide a class of inputs on which compression drives accuracy from 99% to 0%\. We reframe eviction as a per\-input admission decision and show that inputs separate into a capacity\-bound class, where eviction is catastrophic at every budget, and a dilution\-prone class, where eviction is safe or beneficial\. A single label\-free scalar computed from prefill attention, the early\-to\-late drop in pairwise top\-kkhead agreement, predicts this class before any decoding\. PAGE thresholds this drop: it applies any base evictor when the drop is large and retains the full cache otherwise, with no training and no accuracy labels\. The drop orders inputs by eviction safety consistently across four architecture families, and a per\-model unlabeled pilot of about 100 inputs recalibrates the threshold for a new family\. Used as a safeguard, PAGE cuts the harm rate on the capacity\-bound regime from 0\.75 to 0\.026, a 29×\\timesreduction, across four evictors, four models, and two benchmarks, turning a 99% to 0% collapse into a flat 89% without retraining the evictor\. The gate is inert wherever eviction is already safe, and the capacity\-bound class it protects is a small, identifiable minority of inputs, so the benefit is a targeted safety gain rather than an average one\. PAGE is a per\-input safeguard, not a compressor: realized compression is1\.8−3\.4×1\.8\-3\.4\\times\(mean 2\.9×\\times\) against a nominal 16×\\timesbudget and decays toward unity by batch 16 under static provisioning, and a trained evictor wins at matched memory\.

## 1Introduction

Large language models \(LLMs\) are increasingly used for long\-context tasks such as document understanding, retrieval, and extended reasoning\. As context length grows, the KV\-cache grows linearly with the input and becomes a memory bottleneck during inference\. KV\-cache eviction addresses this bottleneck by retaining only a subset of the states under a fixed memory budget\([Zhang et al\., 2023](https://arxiv.org/html/2609.22157#bib.bib12);[Xiao et al\., 2024](https://arxiv.org/html/2609.22157#bib.bib50);[Li et al\., 2024](https://arxiv.org/html/2609.22157#bib.bib14);[Cai et al\., 2025](https://arxiv.org/html/2609.22157#bib.bib15)\)\. Existing methods largely share the same formulation: given a fixed budget, determine*which*KV states to retain\. When discarded states are redundant, this can reduce attention dilution and even improve long\-context performance\([Bui et al\., 2026](https://arxiv.org/html/2609.22157#bib.bib11);[Yang et al\., 2026a](https://arxiv.org/html/2609.22157#bib.bib18);[Yang et al\., 2026c](https://arxiv.org/html/2609.22157#bib.bib20)\); however, when the answer depends on a small set of critical tokens, aggressive eviction can instead destroy essential information and severely degrade retrieval\.

Recent work has therefore focused on improving which states are retained through stronger importance signals, learned predictors, and information\-theoretic objectives\([Li et al\., 2024](https://arxiv.org/html/2609.22157#bib.bib14);[Cai et al\., 2025](https://arxiv.org/html/2609.22157#bib.bib15);[Yang et al\., 2026a](https://arxiv.org/html/2609.22157#bib.bib18);[Bui et al\., 2026](https://arxiv.org/html/2609.22157#bib.bib11);[Moschella et al\., 2026](https://arxiv.org/html/2609.22157#bib.bib7)\)\. While these methods can improve the accuracy–memory trade\-off and even outperform full\-cache inference by mitigating attention dilution\([Bui et al\., 2026](https://arxiv.org/html/2609.22157#bib.bib11)\), they still assume that eviction is appropriate for every input\. In particular, adaptive approaches either learn a scorer to estimate which states should be retained\([Bui et al\., 2026](https://arxiv.org/html/2609.22157#bib.bib11);[Yang et al\., 2026c](https://arxiv.org/html/2609.22157#bib.bib20);[Dong et al\., 2026](https://arxiv.org/html/2609.22157#bib.bib5);[Moschella et al\., 2026](https://arxiv.org/html/2609.22157#bib.bib7)\)or derive an unconditional capacity measure from query statistics\([Yang et al\., 2026a](https://arxiv.org/html/2609.22157#bib.bib18)\)\. This leaves two fundamental questions open:\(Q1\)*For which inputs does KV\-cache eviction help or hurt?*and\(Q2\)*Can this distinction be predicted a priori from a cheap inference\-time signal before decoding?*These questions are important because a benchmark\-level accuracy–memory trade\-off can mask a subset of inputs for which eviction is catastrophic\.

We answer both affirmatively by reframing KV\-cache eviction as an*input\-dependent admission decision*: rather than assuming that eviction should be applied to every input, we ask whether the model’s prefill attention contains a signal indicating when eviction is likely to be beneficial or harmful\. We find that the early\-to\-late drop in mean pairwise top\-kkhead agreement, denoted byDD, provides a useful label\-free signal that partitions inputs into a dilution\-prone class𝒟\\mathcal\{D\}and a capacity\-bound class𝒞\\mathcal\{C\}before any decoding \(Figure[1](https://arxiv.org/html/2609.22157#S1.F1)\)\. Based on this observation, we introducePAGE\(Partition\-AwareGatedEviction\), a training\-free wrapper that applies an existing eviction method whenDDexceeds a threshold and otherwise retains the full cache\. Since a benchmark mean can hide exactly this failure mode, we evaluate PAGE by what it prevents on the capacity\-bound regime rather than by a suite average\. It cuts the rate at which eviction destroys a correct answer by29×29\\timesat16×16\\timescompression, and at matched*achieved*cache it lifts the accuracy\-memory frontier above a crossover near1/31/3kept cache, losing to plain eviction below it \(Figure[4](https://arxiv.org/html/2609.22157#S4.F4)\)\. The same selectivity has a converse\. The gate is inert wherever eviction is already safe, so on inputs that eviction does not harm the gated and plain systems become identical and their measured difference is exactly zero\. PAGE is designed to prevent harmful eviction, not to maximize average compression\.

![Refer to caption](https://arxiv.org/html/2609.22157v1/PAGE-setup.png)Figure 1:PAGE uses prefill\-only attention to compute the head\-agreement dropDDand decide*whether*to evict\. A largeDDindicates dilution\-prone inputs, for which PAGE opens the gate and applies a base evictor, and a smallDDindicates capacity\-bound inputs, for which the gate remains closed and the full cache is retained\.##### Contributions

1. 1\.An empirical partitionof inputs into𝒞\\mathcal\{C\}and𝒟\\mathcal\{D\}, demonstrated across eight \(model, context\) cells on RULER\([Hsieh et al\., 2024](https://arxiv.org/html/2609.22157#bib.bib13)\)and confirmed by a controlled distractor sweep\. The early\-to\-late head\-agreement dropD:=agrearly−agrlateD:=\\mathrm\{agr\}\_\{\\text\{early\}\}\-\\mathrm\{agr\}\_\{\\text\{late\}\}orders tasks by eviction safety and separates the two classes at the task level \(Section[4\.1](https://arxiv.org/html/2609.22157#S4.SS1)\)\.
2. 2\.PAGE, a training\-free gating wrapperthat applies any base evictor whenD≥τD\\geq\\tauand retains the full cache otherwise, with azz\-score calibration recipe that transfers across four architecture families \(Section[3](https://arxiv.org/html/2609.22157#S3)\)\.
3. 3\.A substrate\-dependent capacity limit: the three scorer families we test \(attention\-based, geometric, attention\-free\) all collapse on capacity\-bound inputs at aggressive budgets, evidence of an information floor that no scorer among these families removes \(Section[4\.1](https://arxiv.org/html/2609.22157#S4.SS1.SSS0.Px5)\)\.
4. 4\.A scaling relationρ≈\(1−Afull\)⋅precov\\rho\\approx\(1\-A\_\{\\mathrm\{full\}\}\)\\cdot p\_\{\\mathrm\{recov\}\}, validated by head\-to\-heads with CapKV and DBTrimKV and a pre\-registered 32K test that preserves ordinal content but falsifies constant\-ratio proportionality \(Sections[4\.1](https://arxiv.org/html/2609.22157#S4.SS1),[5](https://arxiv.org/html/2609.22157#S5)\)\.

We adopt the dilution mechanism of[Bui et al\. \(2026\)](https://arxiv.org/html/2609.22157#bib.bib11)\(Proposition 3\.1, Corollary 3\.2\) and repurpose a known head\-agreement primitive as a gating signal; Section[2](https://arxiv.org/html/2609.22157#S2)positions these choices\. PAGE is a safeguard, not a compressor: at matched memory a trained evictor wins \(Section[6](https://arxiv.org/html/2609.22157#S6)\), it is inert wherever eviction is already safe \(Δ=0\\Delta=0in half the matrix cells\), and the\+22\.9\+22\.9pp headline is driven by one task family \(excluding NIAH\-MK3:\+4\.5\+4\.5pp; task\-label oracle:\+20\.1\+20\.1pp\)\. Realized compression is1\.81\.8–3\.4×3\.4\\times\(mean2\.9×2\.9\\times\) and decays toward1×1\\timesby batch 16 under static provisioning\.

## 2Related Work

KV\-cache eviction methods primarily differ in how they identify states to retain under a fixed budget\. H2O\([Zhang et al\., 2023](https://arxiv.org/html/2609.22157#bib.bib12)\), StreamingLLM\([Xiao et al\., 2024](https://arxiv.org/html/2609.22157#bib.bib50)\), SnapKV\([Li et al\., 2024](https://arxiv.org/html/2609.22157#bib.bib14)\), and PyramidKV\([Cai et al\., 2025](https://arxiv.org/html/2609.22157#bib.bib15)\)use attention, recency, or layer\-dependent statistics for retention\. Recent methods develop more specialized selection criteria: DBTrimKV\([Bui et al\., 2026](https://arxiv.org/html/2609.22157#bib.bib11)\)characterizes attention dilution from near\-tie distractors and uses selective retention to mitigate it, while CapKV\([Yang et al\., 2026a](https://arxiv.org/html/2609.22157#bib.bib18)\)derives an information\-theoretic eviction criterion\. IndexMem\([Yang et al\., 2026c](https://arxiv.org/html/2609.22157#bib.bib20)\)combines learned indexing with latent memory, and ForesightKV\([Dong et al\., 2026](https://arxiv.org/html/2609.22157#bib.bib5)\)and Learning\-to\-Evict\([Moschella et al\., 2026](https://arxiv.org/html/2609.22157#bib.bib7)\)predict future KV utility\. VECTOR\([Lin et al\., 2026b](https://arxiv.org/html/2609.22157#bib.bib33)\)and CriticalKV\([Feng et al\., 2026b](https://arxiv.org/html/2609.22157#bib.bib26)\)instead provide plug\-and\-play mechanisms over existing eviction policies\. These methods retain the conventional formulation of selecting which states to preserve once eviction is applied\.

Adaptive eviction methods further condition retention or budget allocation on the input or task\. DynamicKV\([Zhou et al\., 2025](https://arxiv.org/html/2609.22157#bib.bib17)\)uses task\-dependent attention statistics to allocate layer\-wise KV budgets, while EvicPress\([Feng et al\., 2025a](https://arxiv.org/html/2609.22157#bib.bib42)\)incorporates a context\-level eviction decision into a profiled quality\-latency optimization\. Attention\-Gate\([Zeng et al\., 2025](https://arxiv.org/html/2609.22157#bib.bib39)\)and Fast KVzip\([Kim et al\., 2026](https://arxiv.org/html/2609.22157#bib.bib28)\)learn adaptive gating or budget policies\. SAGE\-KV\([Wang et al\., 2025](https://arxiv.org/html/2609.22157#bib.bib44)\)is particularly close in its use of post\-prefill attention, using a one\-shot attention signal to select tokens and heads for retention\. PAGE instead uses the prefill signal to characterize whether the eviction operation should be applied, while the underlying retention policy remains unchanged\.

A complementary line of work studies the internal attention structure associated with retrieval and compression\. Retrieval\-head analyses identify sparse subsets of heads that drive long\-context retrieval\([Wu et al\., 2025](https://arxiv.org/html/2609.22157#bib.bib49)\), while[Ananthanarayanan et al\. \(2026\)](https://arxiv.org/html/2609.22157#bib.bib31)analyze how head consensus evolves across layers and relate these profiles to compression tolerance\. Chen et al\.\([Chen et al\., 2026](https://arxiv.org/html/2609.22157#bib.bib27)\)document task\-dependent degradation under eviction, and Zhang et al\.\([Zhang et al\., 2026](https://arxiv.org/html/2609.22157#bib.bib32)\)study when value\-aware eviction is beneficial\. VaSE\([Chang et al\., 2026](https://arxiv.org/html/2609.22157#bib.bib35)\)attributes some eviction failures to high\-magnitude value states, whereas ManifoldKV\([Datta et al\., 2026](https://arxiv.org/html/2609.22157#bib.bib29)\)considers geometric structure in key representations\. PAGE draws on this diagnostic perspective by using the early\-to\-late change in head agreement as an input\-level prefill statistic rather than as a retention score or an offline architectural descriptor\.

## 3The Gating Method: PAGE

##### Problem Formulation

For task𝖳\\mathsf\{T\}, modelMM, context lengthTT, letA⁡\(b,x\)A\(b,x\)denote the accuracy on inputxxat cache budgetbb, withbmax=1b\_\{\\max\}=1denoting the full, unevicted cache\. We call an input*capacity\-bound*if eviction at every tested budget degrades its accuracy relative to the full cache, and*dilution\-prone*if there exists some budget at which eviction improves accuracy\. The key evaluation criterion is the per\-input recovery rate:

ρKV\(𝖳,M,T\):=Prx\[A\(b∗\(x\),x\)\>A\(bmax,x\)\],b∗\(x\):=argmaxbA\(b,x\)\.\\rho\_\{\\mathrm\{KV\}\}\(\\mathsf\{T\},M,T\):=\\Pr\_\{x\}\\bigl\[A\(b^\{\\ast\}\(x\),x\)\>A\(b\_\{\\max\},x\)\\bigr\],\\qquad b^\{\\ast\}\(x\):=\\arg\\max\_\{b\}A\(b,x\)\.\(1\)This per\-input strict\-Pareto improvement frequency is a stronger statement than “mean accuracy is higher at somebb\.” We pre\-registeredρ≥0\.05\\rho\\geq 0\.05as “dilution\-prone” definition before any sweep\.

##### Algorithm

PAGE wraps any SnapKV\-style evictor in one conditional\. Given a promptxx, the base evictor’s budgetb∈\(0,1\]b\\in\(0,1\]\(the fraction of prompt positions the evictor is allowed to retain\), a sink\-and\-recency protection\(nsink,w\)\(n\_\{\\text\{sink\}\},w\)that always preserves the firstnsinkn\_\{\\text\{sink\}\}and lastwwpositions, and a gate thresholdτ\\tauon the head\-agreement drop:

PAGE\(x,base,b,τ\)=\{base\.evict\(cache,b\)ifD\(cache\.attentions\)≥τcacheotherwise\\boxed\{\\ PAGE\(x;\\,\\text\{base\},b,\\tau\)=\\begin\{cases\}\\text\{base\.evict\}\(\\text\{cache\},b\)&\\text\{if \}D\(\\text\{cache\}\.\\text\{attentions\}\)\\geq\\tau\\\\ \\text\{cache\}&\\text\{otherwise\}\\end\{cases\}\\ \}\(2\)where the prefill producescachetogether with its prefill attentions, from which we computeDDas in Eq\. equation[3](https://arxiv.org/html/2609.22157#S3.E3)\. The gate fires once per input, at prefill, before any decode step, and involves no backward pass, no training, and no per\-token decision\.

PAGE never observes correctness, which makes it label\-free in an accuracy sense\. Section[3](https://arxiv.org/html/2609.22157#S3.SS0.SSS0.Px4)states which calibration variants are additionally task\-label\-free, and Appendix[A\.3\.4](https://arxiv.org/html/2609.22157#A1.SS3.SSS4)gives the full details\.

Figure 2:DDseparates the two task classes \(Qwen2\.5\-1\.5B, RULER 4K,N=50N=50per task; dots are inputs, bars per\-task means\)\. NIAH\-MK3 sits belowτ=0\.07\\tau=0\.07and the dilution\-prone tasks above it\. The near\-tie MK1/MK2 tasks fall on the boundary, tracking the distractor gradient \(App\.[A](https://arxiv.org/html/2609.22157#A1)\)\.
##### Head\-Agreement DropDD

Take the prefill attention tensor\[L,H,T,T\]\[L,H,T,T\], forLLlayers,HHheads per layer and prompt lengthTT\. Project onto the lastw=32w=32rows, the observation queries, and average across them for a per\-\(layer, head, key\) attention vector\. For each layer and head pair we take the Jaccard similarity of the two heads’ top\-kkkey sets \(k=32k=32\) and average over pairs, giving a per\-layer agreementaℓa\_\{\\ell\}\. Binning theLLlayers into thirds and writingaearlya\_\{\\text\{early\}\},alatea\_\{\\text\{late\}\}for the mean agreement in the first and last bins, we set

D:=aearly−alate\.D:=a\_\{\\text\{early\}\}\-a\_\{\\text\{late\}\}\.\(3\)DDis one scalar per input, costingO⁡\(LH2k\)O\(LH^\{2\}k\):1717ms on Qwen2\.5\-1\.5B and8989ms on Mistral\-7B at 4K \(Table[26](https://arxiv.org/html/2609.22157#A1.T26)\)\. It is not free even when the base evictor already scores by attention, since that scoring uses head\-*averaged*attention whereasDDneeds the per\-head pattern, which requires materializing attention that fused FlashAttention\([Dao et al\., 2022](https://arxiv.org/html/2609.22157#bib.bib52)\)does not produce\. This cost is justified as a same\-inputs ablation against five other cheap prefill statistics showsDDis the only one that separates the partition at all, every alternative failing task\-level separation for the clear\-cut NIAH\-MK3 anchor\. Table[5](https://arxiv.org/html/2609.22157#A1.T5)also tracks how that separation narrows as the anchor moves toward the near\-tie MK2 boundary\.

##### Calibration

We distinguish two senses of label\-free\. PAGE is accuracy\-label\-free because the gate never observes correctness\. A calibration variant is additionally task\-label\-free when it also requires no task identities to setτ\\tau\. The two senses come apart across the variants below\.

The fixedτ=0\.07\\tau=0\.07used throughout is a within\-family convenience\. It mis\-classifies Qwen2\.5\-3B at 16K and fails outright on Qwen3\. The recommended variant standardizesDDper model over an unlabeled∼100\{\\sim\}100\-input pilot, and is task\-label\-free\. It transfers a single global threshold zero\-shot to every held\-out family tested: Llama\-architecture models \(Yi\-1\.5\-9B, Llama\-3\.1\-8B\) and Qwen3\-4B\([AI et al\., 2025](https://arxiv.org/html/2609.22157#bib.bib3);[Grattafiori et al\., 2024](https://arxiv.org/html/2609.22157#bib.bib4);[Yang et al\., 2025a](https://arxiv.org/html/2609.22157#bib.bib2)\)\. The intermediate 40\-input variant of Eq\. equation[5](https://arxiv.org/html/2609.22157#A1.E5)is accuracy\-label\-free but not task\-label\-free, because it uses task identities to formD¯𝒞\\bar\{D\}\_\{\\mathcal\{C\}\}andD¯𝒟\\bar\{D\}\_\{\\mathcal\{D\}\}\. We report fixed\-τ\\taunumbers as the conservative default\. Table[8](https://arxiv.org/html/2609.22157#A1.T8)maps the three variants to their label requirements and to the results that use each, so every gated number can be traced to the variant that produced it\. No variant uses accuracy labels, the two constant\-threshold variants use no task labels either, and the 40\-input midpoint is the only variant that does\. The one number computed at a threshold other than its reported value is the Qwen2\.5\-3B 4K SnapKV matrix cell, run atτ=0\.04\\tau=0\.04and reported atτ=0\.07\\tau=0\.07by exact post\-hoc re\-evaluation \(Appendix[F](https://arxiv.org/html/2609.22157#A6)\)\. Further calibration details appear in Table[7](https://arxiv.org/html/2609.22157#A1.T7)and Figure[6](https://arxiv.org/html/2609.22157#A1.F6), Appendix[A](https://arxiv.org/html/2609.22157#A1)\.

## 4Experiments

##### Setup

We use RULER\([Hsieh et al\., 2024](https://arxiv.org/html/2609.22157#bib.bib13)\)via thesimonjegou/ruler\([Jégou, 2024](https://arxiv.org/html/2609.22157#bib.bib24)\)port distributed with kvpress\([NVIDIA, 2024](https://arxiv.org/html/2609.22157#bib.bib25)\), whose four\-evictor lineup our base evictors follow, at context lengthsT∈\{4K,16K\}T\\in\\\{4\\mathrm\{K\},16\\mathrm\{K\}\\\}on four models: Qwen2\.5\-1\.5B\-Instruct, Qwen2\.5\-3B\-Instruct, Qwen2\.5\-14B\-Instruct\([Yang et al\., 2025b](https://arxiv.org/html/2609.22157#bib.bib23)\), and Mistral\-7B\-Instruct\-v0\.3\([Jiang et al\., 2023](https://arxiv.org/html/2609.22157#bib.bib22)\)\. Eviction is SnapKV\-style by default: we score each prompt position by the average attention from the lastw=32w=32queries across heads and layers, then keep the top\-bbpositions withb∈\{0\.0625,0\.125,0\.25,0\.375,0\.5,0\.625,0\.75,0\.875,1\.0\}b\\in\\\{0\.0625,0\.125,0\.25,0\.375,0\.5,0\.625,0\.75,0\.875,1\.0\\\}, and always preserve the firstnsink=4n\_\{\\text\{sink\}\}=4sink positions\([Xiao et al\., 2024](https://arxiv.org/html/2609.22157#bib.bib50)\)and the lastw=32w=32recent positions\. Cache slicing uses explicitposition\_idsto preserve rotary position embedding \(RoPE\) alignment\([Su et al\., 2024](https://arxiv.org/html/2609.22157#bib.bib51)\), rather than the attention\-mask trick that silently shifts RoPE on evicted positions\. Task codes are RULER’s: VT \(variable tracking\), FWE \(frequent\-words extraction\), QA\_1/QA\_2, and NIAH\-MKkk=niah\_multikey\_kk\(kknear\-tie keys, one carrying the answer\)\. The matrix uses RULER 4K with the four\-task mixed suite \(N=100N=100each\) across all sixteen cells\. Gating deltas carry95%95\\%cluster\-bootstrap intervals, all 16 positive with smallest lower bound\+9\.3\+9\.3pp, and remain significant under Benjamini\-Hochberg correction atq=0\.05q=0\.05across the 16 cells \(Appendix[A\.7\.2](https://arxiv.org/html/2609.22157#A1.SS7.SSS2)\)\. Full protocol and deferred tables are in Appendices[A](https://arxiv.org/html/2609.22157#A1)and[A\.7\.2](https://arxiv.org/html/2609.22157#A1.SS7.SSS2)\.

##### The partition

We define the partition as a pooled contrast: across the eight \(model, context\) cells, only2/5262/526NIAH\-MK3 inputs recover under eviction \(ρ=0\.004\\rho=0\.004, Wilson\[0\.001,0\.014\]\[0\.001,0\.014\]\), whereas five task families reachρ≥0\.05\\rho\\geq 0\.05at some context length\. Because individual cells at these sample sizes are underpowered, we interpret Table[1](https://arxiv.org/html/2609.22157#S4.T1)as this pooled contrast rather than as4848separate calls\. We restrict the definition of the partition to 4K and 16K\. The single 32K probe yieldsρ=0\.04\\rho=0\.04for NIAH\-MK3, just below the0\.050\.05threshold that defines the class \(Section[4\.1](https://arxiv.org/html/2609.22157#S4.SS1)\), and consequently falls outside our fitting range\. These below\-threshold cells arise from two mechanisms\. In saturated cells,Afull→1A\_\{\\mathrm\{full\}\}\\to 1leaves little headroom for eviction\. Longer contexts create headroom, as predicted by Eq\. equation[4](https://arxiv.org/html/2609.22157#S5.E4)\. The remaining three exceptions are budget\-insensitive: headroom exists, yet the same inputs remain incorrect across budgets\. These three are all QA cells, consistent with failures arising from parametric knowledge rather than cache allocation \(Appendix[A](https://arxiv.org/html/2609.22157#A1)\)\.

Table 1:Per\-input recovery rateρ\\rhoon RULER with Wilson95%95\\%intervals \(small type\)\. Bold marks point estimatesρ≥0\.05\\rho\\geq 0\.05\. NIAH\-MK3 \(precise multi\-key retrieval\) is the only task that systematically fails the threshold in every cell tested\.N=100N=100per \(task, cell\) except Qwen\-14B \(N=50N=50at 4K,N=30N=30at 16K\), Mistral 16K VT/FWE/QA\_1/NIAH\-MK3 \(N=50N=50\), Qwen\-3B 16K NIAH\-MK3 \(N=50N=50\), and Qwen\-1\.5B 16K NIAH\-MK3 \(N=46N=46\)\. At theseNNmost single cells straddle the0\.050\.05threshold and no per\-cell call is individually powered; the claim rests on the pooled contrast, which is unambiguous \(NIAH\-MK3:2/5262/526,ρ=0\.004\\rho=0\.004, Wilson\[0\.001,0\.014\]\[0\.001,0\.014\]\)\. Per\-cellNNvaries with compute budget and with the number of examples available at each context length, not with any post\-hoc selection\.
##### Boundary and Confound Analysis

A single capacity\-bound task leaves open whether NIAH\-MK3 names a class or an isolated construction, so we tested the boundary on four further RULER tasks chosen by mechanism rather than by outcome \(Table[3](https://arxiv.org/html/2609.22157#A1.T3), Appendix[A\.2\.4](https://arxiv.org/html/2609.22157#A1.SS2.SSS4)\)\. The results confirm a second capacity\-bound member \(niah\_multiquery\) and show that neither distractor count nor output length defines the class; what matters is whether distractors are near\-tie surface\-form variants of the answer\. Furthermore, three controls rule out the obvious confounds\. First, a distractor sweep over the RULER NIAH\-MultiKey family confirms the dilution mechanism of[Bui et al\. \(2026\)](https://arxiv.org/html/2609.22157#bib.bib11): meanDDshrinks monotonically as near\-tie distractors accumulate \(Table[4](https://arxiv.org/html/2609.22157#A1.T4)\)\. Second, re\-running the partition under the10%10\\%prefix and suffix protection of[Garcia \(2026\)](https://arxiv.org/html/2609.22157#bib.bib19)leaves it unchanged\. Third, replacing SnapKV scoring with uniform\-random scoring destroys accuracy at every budget, ruling out a generic regularization explanation \(Appendix[B](https://arxiv.org/html/2609.22157#A2), Table[31](https://arxiv.org/html/2609.22157#A2.T31)\)\.

##### External validation

The partition is not an artifact of synthetic RULER data\. On three LongBench subtasks with Qwen2\.5\-14B \(Table[11](https://arxiv.org/html/2609.22157#A1.T11), Appendix[A](https://arxiv.org/html/2609.22157#A1)\), the gate calls all three classes correctly*a priori*fromDDalone: lcc \(capacity\-bound,Δ=\+0\.146\\Delta=\+0\.146\), repobench\-p \(mixed\), and hotpotqa \(evict\-robust,Δ=0\.000\\Delta=0\.000\)\. The partition is sufficiently reproducible to motivate asking whether it can be detected before decoding\.

### 4\.1Analysis of PAGE

##### Predicting Unsafe Eviction

Figure[2](https://arxiv.org/html/2609.22157#S3.F2)shows thatDDseparates the two task classes on the fitting cell \(Qwen2\.5\-1\.5B, RULER 4K\): NIAH\-MK3 sits belowτ=0\.07\\tau=0\.07and the dilution\-prone tasks above it\. Per\-input AUC reaches1\.0001\.000on that cell, dropping to0\.9780\.978,0\.8990\.899, and0\.7410\.741on three held\-out cells \(Appendix[A\.3\.2](https://arxiv.org/html/2609.22157#A1.SS3.SSS2)\)\.DDis a useful one\-sided prefill signal: reliable at closing the gate on capacity\-bound inputs, only weakly discriminative on dilution\-prone ones\. On Yi\-1\.5\-9B and Llama\-3\.1\-8B the drop ordering transfers butτ=0\.07\\tau=0\.07does not; thezz\-scored variant with an unlabeled pilot maintains AUC≈0\.80\\approx 0\.80\(Table[24](https://arxiv.org/html/2609.22157#A1.T24)\)\.

##### Catastrophic Failure Prevention

The cleanest single cell demonstrates the safety property without aggregation\. On Mistral 4K NIAH\-MK3 \(Figure[3](https://arxiv.org/html/2609.22157#S4.F3)\), plain SnapKV collapses from0\.990\.99to0\.000\.00atb=0\.0625b=0\.0625, while gated SnapKV holds0\.890\.89at every budget\. The gate closes on90/10090/100inputs, with10/10010/100false positives where it opens and eviction destroys the needle\. Pooled over the77SnapKV cells at 4K and 16K, gating cuts the fixed\-budget harm rate from0\.750\.75to0\.0260\.026on the capacity\-bound task \(Table[27](https://arxiv.org/html/2609.22157#A1.T27)\), yielding a29×29\\timesreduction in harmful eviction that stands as the primary safety result\.

Figure 3:Mistral\-7B 4K NIAH\-MK3,N=100N=100: accuracy vs\. KV budget for plain SnapKV \(solid, collapses to 0\) and gated SnapKV \(dashed, 0\.89 flat across budgets\)\. The gate prevents the collapse without retraining the base evictor or seeing labels\.
##### Transfer Across Eviction Mechanisms

Table[2](https://arxiv.org/html/2609.22157#S4.T2)reports a4×44\\times 4matrix of four base evictors and four models under the same gate, sameτ\\tau, and no per\-method tuning\. EachΔ\\Deltais gated minus plain accuracy at matched*nominal*budget, not a compression win\. The gate composes with several tested eviction mechanisms, which means it works alongside them rather than advancing the frontier on its own\. Dropping NIAH\-MK3 takes the grand mean from\+22\.9\+22\.9pp to\+4\.5\+4\.5pp\. In half the cells the non\-MK3Δ\\Deltais exactly0\.0000\.000because the gate opens on every non\-MK3 input there, which is the intended behavior for a gate that should do nothing when eviction is safe\. The defensible headline is the harm reduction \(Table[27](https://arxiv.org/html/2609.22157#A1.T27)\) and the matched\-cache frontier \(Section[4\.1](https://arxiv.org/html/2609.22157#S4.SS1.SSS0.Px4)\)\. Composition also extends outside the attention\-score family, lifting a geometry\-based evictor byΔ=\+16\.2\\Delta=\+16\.2pp \(Figure[8](https://arxiv.org/html/2609.22157#A1.F8)\)\. Cross\-architecture results appear in Tables[16](https://arxiv.org/html/2609.22157#A1.T16)and[17](https://arxiv.org/html/2609.22157#A1.T17)\. Full per\-task decomposition, budget\-axis breakdown, and cross\-architecture tables are in Appendix[A\.4\.1](https://arxiv.org/html/2609.22157#A1.SS4.SSS1)\.

Table 2:Headline4×44\\times 4method\-agnostic matrix\. Same gate \(τ=0\.07\\tau=0\.07\), no per\-base\-evictor tuning;Δ\\Deltaaverages over budgetsb<1\.0b<1\.0\. All1616cells are positive with grand mean\+22\.9\+22\.9pp, but the secondΔ\\Deltarow shows what that is made of: excluding NIAH\-MK3 the grand mean falls to\+4\.5\+4\.5pp and is exactly0\.0000\.000in88of1616cells, where the gate opens on every non\-MK3 input and the two arms are the same system\. The Qwen2\.5\-3B SnapKV cell ran atτ=0\.04\\tau=0\.04and is reported atτ=0\.07\\tau=0\.07by exact post\-hoc re\-evaluation \(Appendix[F](https://arxiv.org/html/2609.22157#A6)\)\.†Qwen2\.5\-14B H2O is not an independent cell \(see text\)\. Per\-task decomposition: Table[12](https://arxiv.org/html/2609.22157#A1.T12)\.
##### Accuracy\-Memory Frontier

The gate falls back to the full cache when it closes, so the honest comparison is at matched*achieved*cache\. At matched achieved kept\-KV \(Figure[4](https://arxiv.org/html/2609.22157#S4.F4)\), gating beats plain SnapKV by3−193\-19pp once the target retains more than about a third of the cache, and loses below that where the full\-KV fallback dominates\. PAGE recovers69%69\\%of the headroom against a per\-input oracle, almost entirely from protecting the capacity\-bound anchor\. This recovery is bounded by how often the gate opens, since1−popen1\-p\_\{\\text\{open\}\}of the cache stays resident regardless of the nominal budgetbb, and so memory should be planned against that floor \(Table[22](https://arxiv.org/html/2609.22157#A1.T22)\)\.

The same floor sets the realized memory benefit\. Against a16×16\\timesnominal budget, realized compression is1\.81\.8–3\.4×3\.4\\timeswith mean2\.9×2\.9\\times, because the resident1−popen1\-p\_\{\\text\{open\}\}fraction limits what eviction removes\. Under static provisioning, where one gate\-closed sequence forces the batch to the full cache, this benefit decays toward1×1\\timesby batch 16 \(Table[22](https://arxiv.org/html/2609.22157#A1.T22)\)\. PAGE is therefore a per\-input safeguard rather than a compressor, with a memory benefit that is real at moderate batch and small kept\-KV targets and negligible once either the batch is large or the target is aggressive\.

##### Scorer Independent of Capacity Floor

The gate’s value depends on whether the capacity\-bound regime is a property of the input rather than the scorer\. On Qwen2\.5\-1\.5B RULER 4K, a faithful ManifoldKV\+Ada\-KV implementation\([Datta et al\., 2026](https://arxiv.org/html/2609.22157#bib.bib29);[Feng et al\., 2025b](https://arxiv.org/html/2609.22157#bib.bib16)\)and the attention\-free KeyDiff\([Park et al\., 2025](https://arxiv.org/html/2609.22157#bib.bib43)\)both fall to chance on NIAH\-MK3 below25%25\\%budget, like the four attention\-score evictors\. A geometry scorer that reaches0\.720\.72on two\-key NIAH against SnapKV’s0\.160\.16still collapses on three\-key retrieval\. The capacity limit is therefore substrate\-dependent rather than universal; full tables and the Llama\-3\.1\-8B rescue result are in Appendix[A\.4\.4](https://arxiv.org/html/2609.22157#A1.SS4.SSS4)\(Table[15](https://arxiv.org/html/2609.22157#A1.T15)\)\.

##### Per\-Input Gating Beyond Task\-Level Routing

A natural objection is that a simple task\-level policy could achieve the same result\. The task\-label oracle closes on every NIAH\-MK3 input and opens on every other, the best any task\-level policy can achieve without test\-time labels\. In 8 of 16 cells PAGE reproduces the oracle exactly; in 5 cells it*beats*the oracle by up to\+0\.198\+0\.198by closing on dilution\-prone inputs the oracle wrongly opens, and in 3 Mistral cells it loses by at most0\.0090\.009through false positives on MK3\. Overall the oracle reaches\+20\.1\+20\.1pp against PAGE’s\+22\.9\+22\.9pp\. Task\-level routing captures a substantial portion of the effect, but can fail on heterogeneous tasks where within\-task variation makes per\-input resolution useful\. Full per\-cell results appear in Appendix[A\.4\.1](https://arxiv.org/html/2609.22157#A1.SS4.SSS1)\(Table[14](https://arxiv.org/html/2609.22157#A1.T14)\)\.

##### Comparison with Published Methods and a Pre\-Registered 32K Test

Wrapping CapKV\([Yang et al\., 2026a](https://arxiv.org/html/2609.22157#bib.bib18)\)on LongBench yields\+1\.5\+1\.5/\+8\.3\+8\.3pp on two subtasks \(N=68N=68and2424\), though sample sizes are small and no formal claim is made\. Wrapping pretrained DBTrimKV\([Bui et al\., 2026](https://arxiv.org/html/2609.22157#bib.bib11)\)improves matched\-budget accuracy by\+23\.3\+23\.3pp, but the gate fires on only1\.7%1\.7\\%of records, so at matched*memory*plain DBTrimKV wins\. PAGE therefore does not advance the frontier over a strong trained method at matched memory, and its value lies in the label\-free per\-input decision to retain the full cache when eviction is unsafe\. Details appear in Appendix[A\.4](https://arxiv.org/html/2609.22157#A1.SS4)\. A pre\-registered out\-of\-range test at 32K \(Qwen2\.5\-1\.5B,N=100N=100\) fitsρ/\(1−Afull\)\\rho/\(1\-A\_\{\\mathrm\{full\}\}\)on 4K/16K and hashes predicted intervals before sweeping\. One of three predictions lands strictly inside its interval while both misses over\-recover in different ways\. What survives is ordinal rather than quantitative, as MK3’s ratio stays far below VT’s at every context length even though constant\-ratio proportionality fails\. We accordingly claim a directional relation rather than a quantitative law \(Table[21](https://arxiv.org/html/2609.22157#A1.T21), Appendix[A\.6](https://arxiv.org/html/2609.22157#A1.SS6)\)\.

Figure 4:Accuracy vs\.*achieved*kept\-KV fraction on the mixed 4K suite, SnapKV\. The gate falls back to the full cache when it closes, so gated points sit at larger kept\-KV than their nominal budget and the honest comparison is at matched achieved cache\. Above a target of≈1/3\\approx 1/3kept\-KV \(Qwen3B:0\.570\.57\) the gated curve is the Pareto frontier by up to\+19\+19pp; at the leftmost gated point plain eviction dominates it\. Gated results use the post\-hocτ=0\.07\\tau=0\.07reconstruction \(Appendix[F](https://arxiv.org/html/2609.22157#A6)\)\.

## 5Mechanistic Interpretation and Scaling Law

##### Dilution Mechanism

We adopt the dilution mechanism of[Bui et al\. \(2026\)](https://arxiv.org/html/2609.22157#bib.bib11)directly and claim no theoretical novelty\. For a head reading a relevant setℛ\\mathcal\{R\}against noise𝒩\\mathcal\{N\}with pre\-eviction signal massαℛ\\alpha\_\{\\mathcal\{R\}\}, near\-tie distractors force the dilutionδt\\delta\_\{t\}large and preferential retention reduces it\. Their Proposition 3\.1 establishes that near\-tie distractors force attention dilution in a single head, and Corollary 3\.2 shows preferential retention of high\-attention positions reduces it\. The partition follows from the mechanism: capacity\-bound tasks concentrate the signal \(αℛ→1\\alpha\_\{\\mathcal\{R\}\}\\to 1\), so imperfect scoring can only*lose*signal and eviction strictly degrades the head; dilution\-prone tasks spread it \(αℛ≪1\\alpha\_\{\\mathcal\{R\}\}\\ll 1\), so eviction of noise positions monotonically improves the head Signal\-Noise Ratio \(SNR\)\.

##### Scaling Relation

Combining the dilution mechanism with the headroom1−Afull\(M,T\)1\-A\_\{\\mathrm\{full\}\}\(M,T\)gives the scaling formula:

ρKV\(𝖳,M,T\)≈\(1−Afull\(M,T\)\)⋅precov\(ρℛ2/γ\),precov:\[0,∞\)→\[0,1\],\\rho\_\{\\mathrm\{KV\}\}\(\\mathsf\{T\},M,T\)\\;\\approx\\;\\bigl\(1\-A\_\{\\mathrm\{full\}\}\(M,T\)\\bigr\)\\cdot p\_\{\\mathrm\{recov\}\}\\bigl\(\\rho\_\{\\mathcal\{R\}\}^\{2\}/\\gamma\\bigr\),\\qquad p\_\{\\mathrm\{recov\}\}:\[0,\\infty\)\\to\[0,1\],\(4\)whereρℛ\\rho\_\{\\mathcal\{R\}\}is the retained fraction of relevant mass andγ\\gammathe noise\-retention ratio\. The alignment betweenDDand the partition is empirical:DDranks NIAH\-MK3 smallest in every Qwen and Mistral cell \(Table[24](https://arxiv.org/html/2609.22157#A1.T24)\), andρ/\(1−Afull\)\\rho/\(1\-A\_\{\\mathrm\{full\}\}\)fits a through\-origin slope on dilution\-prone tasks while remaining near zero on NIAH\-MK3 regardless of headroom \(Table[25](https://arxiv.org/html/2609.22157#A1.T25), Figure[9](https://arxiv.org/html/2609.22157#A1.F9)\)\. The pre\-registered 32K test preserves the ordinal structure of these results, yet it disproves the constant\-ratio proportionality implied by a direct interpretation of Eq\. equation[4](https://arxiv.org/html/2609.22157#S5.E4)\.

The theoretical bridge fromDDtoδt\\delta\_\{t\}requires a margin\-to\-noise ratio roughly three times the empirically observed values\. The sufficient\-condition analysis therefore motivates the mechanism, but does not validate the deployed gate\. Consequently, the paper’s empirical claims do not depend on this theoretical certification, instead rest on the observed partition and the direct gating results\. We provide full derivations in Appendices[A\.5](https://arxiv.org/html/2609.22157#A1.SS5),[D](https://arxiv.org/html/2609.22157#A4), and[E](https://arxiv.org/html/2609.22157#A5)\.

## 6Limitations

##### Architectural scope

DDpresumes softmax attention over a materialized key\-value cache and does not apply to linear\-attention or state\-space architectures\. Attempting to run it on layers that expose no key\-value cache in the standard form fails outright rather than degrading, which bounds the family of models these results speak to\.

##### The gate is inert on dilution\-prone\-only workloads

On the dilution\-prone LongBench subset \(qasper, triviaqa, trec, multifieldqa\_en\) the pooled gatedΔ\\Deltais within±1\\pm 1pp of plain on all four models \(Qwen2\.5\-1\.5B0\.0000\.000, Qwen2\.5\-3B\+0\.002\+0\.002, Mistral\-7B\+0\.003\+0\.003, Qwen2\.5\-14B−0\.008\-0\.008\)\. The partition predicts neutrality where a workload contains no capacity\-bound inputs, and we observe it, including the mildly negative tail\.

##### One\-sided prediction and remaining scope gaps

On LongBench passage\_count at Qwen2\.5\-14B the gate closes on all inputs \(meanD=−0\.013D=\-0\.013\) yet eviction is empirically safe, producing a benign false positive that costs compression rather than accuracy\. The symmetric failure arises at the single\-distractor boundary: NIAH\-MK2 is empirically capacity\-bound yet its meanD=0\.122D=0\.122co\-locates with genuinely dilution\-prone tasks, so the gate opens and eviction proceeds as a false negative that the mean\-DDthreshold cannot resolve without per\-input recovery information \(Appendix[A\.2\.5](https://arxiv.org/html/2609.22157#A1.SS2.SSS5)\)\.DDis therefore a one\-sided predictor that is reliable at detecting dilution\-prone inputs but not a perfect classifier\. A related consequence for deployment is that the gate\-open ratepopenp\_\{\\text\{open\}\}is workload\-dependent and not known before running, so static provisioning cannot size the cache frompopenp\_\{\\text\{open\}\}in advance and must either profile it per workload or plan against the1−popen1\-p\_\{\\text\{open\}\}resident floor\. Multilingual and code tasks remain out of scope\.

##### Threshold portability

The portability of the empirical partition depends on the fixed threshold that operationalizes it\. On Yi\-1\.5\-9B and Llama\-3\.1\-8B, the drop ordering transfers butτ=0\.07\\tau=0\.07does not\. It mis\-classifies niah\_multivalue on both models and inverts the drop\-vs\-ρ\\rhoprediction on Yi\. Azz\-scored variant repairs this with an unlabeled pilot, but it remains a calibration step, and per\-input separation stays at AUC≈0\.80\\approx 0\.80\. The residual gap traces to interior profile structure that the early\-minus\-late contrast cannot distinguish\. The statisticDDsummarizes the per\-layer agreement sequenceaℓa\_\{\\ell\}by its endpoints, discarding the shape between them\. A statistic that reads the full depth\-profile rather than just its endpoints would be a stronger per\-input predictor and is an open problem \(Appendix[A\.3\.3](https://arxiv.org/html/2609.22157#A1.SS3.SSS3)\)\.

## 7Conclusion

We show that KV\-cache eviction is heterogeneous: inputs fall into a capacity\-bound regime where compression causes severe degradation and a dilution\-prone regime where selective retention can preserve or improve accuracy\. The early\-to\-late head\-agreement dropDDseparates these regimes from the prefill alone, supporting this claim strongly on Qwen and Mistral and partially across architectures with per\-model calibration\. PAGE wraps any base evictor in a gate onDDand prevents catastrophic failures: on Mistral\-7B NIAH\-MK3 a99%→0%99\\%\\to 0\\%collapse under plain eviction becomes a flat89%89\\%under the gate, with the same protection on realistic lcc code completion and a lifted accuracy\-memory frontier where moderate compression is the target\. These gains come with real costs: the safeguard requires one attention\-exposing prefill pass, its memory benefit is bounded by1−popen1\-p\_\{\\text\{open\}\}and decays toward1×1\\timesat batch1616under static provisioning\. The open problem it leaves is a signal that transfers across model families without a per\-model pilot\.

### Reproducibility Statement

All runs use NVIDIA A100 80GB GPUs with PyTorch 2\.11, Transformers 5\.9, and Python 3\.13, in bfloat16 with greedy \(argmax\) decoding,max\_new\_tokens=128=128, and a fixed seed, with three input\-draw replicates on five SnapKV cells \(Appendix[A\.7\.3](https://arxiv.org/html/2609.22157#A1.SS7.SSS3)\)\. The two published head\-to\-heads run in the baselines’ own pinned environments: the DBTrimKV comparison uses the authors’trimkvenvironment \(Transformers 4\.57\.1, PyTorch 2\.8, FlashAttention 2\), and the CapKV comparison is our re\-implementation in an isolated environment, both documented with the released logs\. Models are the public Hugging Face checkpoints of Qwen2\.5\-1\.5B/3B/14B/32B\-Instruct, Mistral\-7B\-Instruct\-v0\.3, Yi\-1\.5\-9B\-Chat, Llama\-3\.1\-8B\-Instruct, and Qwen3\-4B\-Instruct\-2507\. Tasks come fromsimonjegou/ruler\([Jégou, 2024](https://arxiv.org/html/2609.22157#bib.bib24);[NVIDIA, 2024](https://arxiv.org/html/2609.22157#bib.bib25)\)and LongBench\([Bai et al\., 2024](https://arxiv.org/html/2609.22157#bib.bib21)\)\. Cache slicing preserves RoPE alignment via explicitposition\_ids, and 16K runs use SDPA prefill with an eager re\-forward of thew=32w=32observation window for scoring \(Appendix[F](https://arxiv.org/html/2609.22157#A6)\)\. Each table caption states its per\-cell sample sizes\. The gate is one thresholded scalar \(Eq\. equation[3](https://arxiv.org/html/2609.22157#S3.E3)\), so every gated number in the paper can be recomputed from the released per\-input logs\. Code, sweep configurations, and raw per\-input jsonl outputs will be released with the camera\-ready\.

### Ethics Statement

This work studies inference\-time efficiency of publicly released language models on public benchmarks\. It involves no human subjects, no personal data, and no new model training\. We see no ethical risk specific to this method beyond those of the underlying models\.

#### Acknowledgments

This work was supported by the Department of Atomic Energy, Government of India, under project code RIN4001\. The authors thank the School of Computer Sciences, National Institute of Science Education and Research \(NISER\), an OCC of Homi Bhabha National Institute, for institutional support\. We gratefully acknowledge the computing resources and GPU infrastructure provided by NISER that made the experiments in this work possible\.

## References

- J\. Ahn, I\. Seong, A\. Kedia, J\. Kim, H\. Jang, K\. Lee, and Y\. JeonLookaheadKV: fast and accurate kv cache eviction by glimpsing into the future without generation\.External Links:2603\.10899,[Link](https://arxiv.org/abs/2603.10899)Cited by:[§A\.1](https://arxiv.org/html/2609.22157#A1.SS1.SSS0.Px1.p3.1)\.
- AIet al\.\(2025\)01\. AI, :, A\. Young, B\. Chen, C\. Li, C\. Huang, G\. Zhang, G\. Zhang, G\. Wang, H\. Li, J\. Zhu, J\. Chen, J\. Chang, K\. Yu, P\. Liu, Q\. Liu, S\. Yue, S\. Yang, S\. Yang, W\. Xie, W\. Huang, X\. Hu, X\. Ren, X\. Niu, P\. Nie, Y\. Li, Y\. Xu, Y\. Liu, Y\. Wang, Y\. Cai, Z\. Gu, Z\. Liu, and Z\. DaiYi: open foundation models by 01\.ai\.External Links:2403\.04652,[Link](https://arxiv.org/abs/2403.04652)Cited by:[§3](https://arxiv.org/html/2609.22157#S3.SS0.SSS0.Px4.p2.1)\.
- Ananthanarayananet al\.\(2026\)S\. Ananthanarayanan, A\. Sengupta, and T\. ChakrabortyUnderstanding the physics of key\-value cache compression for llms through attention dynamics\.External Links:2603\.01426,[Link](https://arxiv.org/abs/2603.01426)Cited by:[§A\.1](https://arxiv.org/html/2609.22157#A1.SS1.SSS0.Px1.p1.1),[§2](https://arxiv.org/html/2609.22157#S2.p3.1)\.
- Baiet al\.\(2024\)Y\. Bai, X\. Lv, J\. Zhang, H\. Lyu, J\. Tang, Z\. Huang, Z\. Du, X\. Liu, A\. Zeng, L\. Hou, Y\. Dong, J\. Tang, and J\. LiLongBench: a bilingual, multitask benchmark for long context understanding\.External Links:2308\.14508,[Link](https://arxiv.org/abs/2308.14508)Cited by:[§7](https://arxiv.org/html/2609.22157#S7.SSx1.p1.1)\.
- Buiet al\.\(2026\)N\. Bui, H\. T\. Nguyen, A\. Cohan, and R\. YingMake each token count: towards improving long\-context performance with kv cache eviction\.External Links:2605\.09649,[Link](https://arxiv.org/abs/2605.09649)Cited by:[§A\.2\.5](https://arxiv.org/html/2609.22157#A1.SS2.SSS5.p1.1),[§A\.4\.8](https://arxiv.org/html/2609.22157#A1.SS4.SSS8.Px2.p1.1),[§A\.5](https://arxiv.org/html/2609.22157#A1.SS5.SSS0.Px1.p1.1),[§A\.5](https://arxiv.org/html/2609.22157#A1.SS5.p1.1),[Appendix E](https://arxiv.org/html/2609.22157#A5.p1.1),[§1](https://arxiv.org/html/2609.22157#S1.SS0.SSS0.Px1.p2.1),[§1](https://arxiv.org/html/2609.22157#S1.p1.1),[§1](https://arxiv.org/html/2609.22157#S1.p2.1),[§2](https://arxiv.org/html/2609.22157#S2.p1.1),[§4](https://arxiv.org/html/2609.22157#S4.SS0.SSS0.Px3.p1.1),[§4\.1](https://arxiv.org/html/2609.22157#S4.SS1.SSS0.Px7.p1.1),[§5](https://arxiv.org/html/2609.22157#S5.SS0.SSS0.Px1.p1.1)\.
- Caiet al\.\(2025\)Z\. Cai, Y\. Zhang, B\. Gao, Y\. Liu, Y\. Li, T\. Liu, K\. Lu, W\. Xiong, Y\. Dong, J\. Hu, and W\. XiaoPyramidKV: dynamic kv cache compression based on pyramidal information funneling\.External Links:2406\.02069,[Link](https://arxiv.org/abs/2406.02069)Cited by:[§A\.1](https://arxiv.org/html/2609.22157#A1.SS1.SSS0.Px1.p4.1),[§1](https://arxiv.org/html/2609.22157#S1.p1.1),[§1](https://arxiv.org/html/2609.22157#S1.p2.1),[§2](https://arxiv.org/html/2609.22157#S2.p1.1)\.
- Changet al\.\(2026\)T\. Chang, H\. Y\. Fu, D\. Fu, C\. Yang, J\. Thomason, and R\. JiaValue\-aware stochastic kv cache eviction for reasoning models\.External Links:2606\.03928,[Link](https://arxiv.org/abs/2606.03928)Cited by:[§A\.1](https://arxiv.org/html/2609.22157#A1.SS1.SSS0.Px1.p1.1),[§2](https://arxiv.org/html/2609.22157#S2.p3.1)\.
- Chenet al\.\(2026\)A\. Chen, R\. Geh, A\. Grover, G\. V\. den Broeck, and D\. IsraelThe pitfalls of kv cache compression\.External Links:2510\.00231,[Link](https://arxiv.org/abs/2510.00231v2)Cited by:[§A\.1](https://arxiv.org/html/2609.22157#A1.SS1.SSS0.Px1.p1.1),[§2](https://arxiv.org/html/2609.22157#S2.p3.1)\.
- Daoet al\.\(2022\)T\. Dao, D\. Y\. Fu, S\. Ermon, A\. Rudra, and C\. RéFLASHATTENTION: fast and memory\-efficient exact attention with io\-awareness\.InProceedings of the 36th International Conference on Neural Information Processing Systems,NIPS ’22,Red Hook, NY, USA\.External Links:ISBN 9781713871088Cited by:[§3](https://arxiv.org/html/2609.22157#S3.SS0.SSS0.Px3.p1.2)\.
- Dattaet al\.\(2026\)D\. Datta, T\. Neeraj, B\. Paudel, V\. Sharma, and S\. MukherjeeManifoldKV: training\-free kv cache compression via euclidean outlier detection\.External Links:2602\.08343,[Link](https://arxiv.org/abs/2602.08343)Cited by:[§A\.1](https://arxiv.org/html/2609.22157#A1.SS1.SSS0.Px1.p1.1),[§A\.4\.4](https://arxiv.org/html/2609.22157#A1.SS4.SSS4.p2.1),[§A\.4\.6](https://arxiv.org/html/2609.22157#A1.SS4.SSS6.p1.1),[§2](https://arxiv.org/html/2609.22157#S2.p3.1),[§4\.1](https://arxiv.org/html/2609.22157#S4.SS1.SSS0.Px5.p1.1)\.
- Donget al\.\(2026\)Z\. Dong, P\. Liu, J\. Li, Z\. Chen, H\. Peng, S\. Wang, and W\. X\. ZhaoForesightKV: optimizing kv cache eviction for reasoning models by learning long\-term contribution\.External Links:2602\.03203,[Link](https://arxiv.org/abs/2602.03203)Cited by:[§A\.1](https://arxiv.org/html/2609.22157#A1.SS1.SSS0.Px1.p4.1),[§1](https://arxiv.org/html/2609.22157#S1.p2.1),[§2](https://arxiv.org/html/2609.22157#S2.p1.1)\.
- Fenget al\.\(2025a\)S\. Feng, Y\. Liu, H\. Li, X\. Chen, S\. Shen, K\. Du, Z\. Gu, R\. Zhang, Y\. Huang, Y\. Cheng, J\. Yao, Q\. Zhang, G\. Ananthanarayanan, and J\. JiangEvicPress: joint kv\-cache compression and eviction for efficient llm serving\.External Links:2512\.14946,[Link](https://arxiv.org/abs/2512.14946)Cited by:[§A\.1](https://arxiv.org/html/2609.22157#A1.SS1.SSS0.Px1.p2.1),[§2](https://arxiv.org/html/2609.22157#S2.p2.1)\.
- Fenget al\.\(2026a\)Y\. Feng, H\. Guo, J\. Lv, S\. K\. Zhou, and X\. XieDefensiveKV: taming the fragility of KV cache eviction in LLM inference\.InThe Fourteenth International Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=nJgS06sX3O)Cited by:[§A\.1](https://arxiv.org/html/2609.22157#A1.SS1.SSS0.Px1.p3.1)\.
- Fenget al\.\(2025b\)Y\. Feng, J\. Lv, Y\. Cao, X\. Xie, and S\. K\. ZhouAda\-kv: optimizing kv cache eviction by adaptive budget allocation for efficient llm inference\.External Links:2407\.11550,[Link](https://arxiv.org/abs/2407.11550)Cited by:[§A\.1](https://arxiv.org/html/2609.22157#A1.SS1.SSS0.Px1.p4.1),[§A\.4\.4](https://arxiv.org/html/2609.22157#A1.SS4.SSS4.p2.1),[§4\.1](https://arxiv.org/html/2609.22157#S4.SS1.SSS0.Px5.p1.1)\.
- Fenget al\.\(2026b\)Y\. Feng, J\. Lv, H\. Guo, Y\. Cao, S\. K\. Zhou, and X\. XieCriticalKV: optimizing kv cache eviction from an output perturbation perspective\.External Links:2502\.03805,[Link](https://arxiv.org/abs/2502.03805)Cited by:[§A\.1](https://arxiv.org/html/2609.22157#A1.SS1.SSS0.Px1.p2.1),[§2](https://arxiv.org/html/2609.22157#S2.p1.1)\.
- Fuet al\.\(2025\)T\. Fu, Z\. Min, H\. Zhang, J\. Yan, G\. Dai, W\. Ouyang, and Y\. WangCache\-to\-cache: direct semantic communication between large language models\.External Links:2510\.03215,[Link](https://arxiv.org/abs/2510.03215)Cited by:[§A\.1](https://arxiv.org/html/2609.22157#A1.SS1.SSS0.Px1.p3.1)\.
- Garcia \(2026\)G\. GarciaProtection is \(nearly\) all you need: structural protection dominates scoring in globally capped kv eviction\.External Links:2605\.18053,[Link](https://arxiv.org/abs/2605.18053)Cited by:[§A\.2\.3](https://arxiv.org/html/2609.22157#A1.SS2.SSS3.p1.1),[§4](https://arxiv.org/html/2609.22157#S4.SS0.SSS0.Px3.p1.1)\.
- Grattafioriet al\.\(2024\)A\. Grattafiori, A\. Dubey, A\. Jauhri, A\. Pandey, A\. Kadian, A\. Al\-Dahle, A\. Letman, A\. Mathur, A\. Schelten, A\. Vaughan, A\. Yang, A\. Fan, A\. Goyal, A\. Hartshorn, A\. Yang, A\. Mitra, A\. Sravankumar, A\. Korenev, A\. Hinsvark, A\. Rao, A\. Zhang, A\. Rodriguez, A\. Gregerson, A\. Spataru, B\. Roziere, B\. Biron, B\. Tang, B\. Chern, C\. Caucheteux, C\. Nayak, C\. Bi, C\. Marra, C\. McConnell, C\. Keller, C\. Touret, C\. Wu, C\. Wong, C\. C\. Ferrer, C\. Nikolaidis, D\. Allonsius, D\. Song, D\. Pintz, D\. Livshits, D\. Wyatt, D\. Esiobu, D\. Choudhary, D\. Mahajan, D\. Garcia\-Olano, D\. Perino, D\. Hupkes, E\. Lakomkin, E\. AlBadawy, E\. Lobanova, E\. Dinan, E\. M\. Smith, F\. Radenovic, F\. Guzmán, F\. Zhang, G\. Synnaeve, G\. Lee, G\. L\. Anderson, G\. Thattai, G\. Nail, G\. Mialon, G\. Pang, G\. Cucurell, H\. Nguyen, H\. Korevaar, H\. Xu, H\. Touvron, I\. Zarov, I\. A\. Ibarra, I\. Kloumann, I\. Misra, I\. Evtimov, J\. Zhang, J\. Copet, J\. Lee, J\. Geffert, J\. Vranes, J\. Park, J\. Mahadeokar, J\. Shah, J\. van der Linde, J\. Billock, J\. Hong, J\. Lee, J\. Fu, J\. Chi, J\. Huang, J\. Liu, J\. Wang, J\. Yu, J\. Bitton, J\. Spisak, J\. Park, J\. Rocca, J\. Johnstun, J\. Saxe, J\. Jia, K\. V\. Alwala, K\. Prasad, K\. Upasani, K\. Plawiak, K\. Li, K\. Heafield, K\. Stone, K\. El\-Arini, K\. Iyer, K\. Malik, K\. Chiu, K\. Bhalla, K\. Lakhotia, L\. Rantala\-Yeary, L\. van der Maaten, L\. Chen, L\. Tan, L\. Jenkins, L\. Martin, L\. Madaan, L\. Malo, L\. Blecher, L\. Landzaat, L\. de Oliveira, M\. Muzzi, M\. Pasupuleti, M\. Singh, M\. Paluri, M\. Kardas, M\. Tsimpoukelli, M\. Oldham, M\. Rita, M\. Pavlova, M\. Kambadur, M\. Lewis, M\. Si, M\. K\. Singh, M\. Hassan, N\. Goyal, N\. Torabi, N\. Bashlykov, N\. Bogoychev, N\. Chatterji, N\. Zhang, O\. Duchenne, O\. Çelebi, P\. Alrassy, P\. Zhang, P\. Li, P\. Vasic, P\. Weng, P\. Bhargava, P\. Dubal, P\. Krishnan, P\. S\. Koura, P\. Xu, Q\. He, Q\. Dong, R\. Srinivasan, R\. Ganapathy, R\. Calderer, R\. S\. Cabral, R\. Stojnic, R\. Raileanu, R\. Maheswari, R\. Girdhar, R\. Patel, R\. Sauvestre, R\. Polidoro, R\. Sumbaly, R\. Taylor, R\. Silva, R\. Hou, R\. Wang, S\. Hosseini, S\. Chennabasappa, S\. Singh, S\. Bell, S\. S\. Kim, S\. Edunov, S\. Nie, S\. Narang, S\. Raparthy, S\. Shen, S\. Wan, S\. Bhosale, S\. Zhang, S\. Vandenhende, S\. Batra, S\. Whitman, S\. Sootla, S\. Collot, S\. Gururangan, S\. Borodinsky, T\. Herman, T\. Fowler, T\. Sheasha, T\. Georgiou, T\. Scialom, T\. Speckbacher, T\. Mihaylov, T\. Xiao, U\. Karn, V\. Goswami, V\. Gupta, V\. Ramanathan, V\. Kerkez, V\. Gonguet, V\. Do, V\. Vogeti, V\. Albiero, V\. Petrovic, W\. Chu, W\. Xiong, W\. Fu, W\. Meers, X\. Martinet, X\. Wang, X\. Wang, X\. E\. Tan, X\. Xia, X\. Xie, X\. Jia, X\. Wang, Y\. Goldschlag, Y\. Gaur, Y\. Babaei, Y\. Wen, Y\. Song, Y\. Zhang, Y\. Li, Y\. Mao, Z\. D\. Coudert, Z\. Yan, Z\. Chen, Z\. Papakipos, A\. Singh, A\. Srivastava, A\. Jain, A\. Kelsey, A\. Shajnfeld, A\. Gangidi, A\. Victoria, A\. Goldstand, A\. Menon, A\. Sharma, A\. Boesenberg, A\. Baevski, A\. Feinstein, A\. Kallet, A\. Sangani, A\. Teo, A\. Yunus, A\. Lupu, A\. Alvarado, A\. Caples, A\. Gu, A\. Ho, A\. Poulton, A\. Ryan, A\. Ramchandani, A\. Dong, A\. Franco, A\. Goyal, A\. Saraf, A\. Chowdhury, A\. Gabriel, A\. Bharambe, A\. Eisenman, A\. Yazdan, B\. James, B\. Maurer, B\. Leonhardi, B\. Huang, B\. Loyd, B\. D\. Paola, B\. Paranjape, B\. Liu, B\. Wu, B\. Ni, B\. Hancock, B\. Wasti, B\. Spence, B\. Stojkovic, B\. Gamido, B\. Montalvo, C\. Parker, C\. Burton, C\. Mejia, C\. Liu, C\. Wang, C\. Kim, C\. Zhou, C\. Hu, C\. Chu, C\. Cai, C\. Tindal, C\. Feichtenhofer, C\. Gao, D\. Civin, D\. Beaty, D\. Kreymer, D\. Li, D\. Adkins, D\. Xu, D\. Testuggine, D\. David, D\. Parikh, D\. Liskovich, D\. Foss, D\. Wang, D\. Le, D\. Holland, E\. Dowling, E\. Jamil, E\. Montgomery, E\. Presani, E\. Hahn, E\. Wood, E\. Le, E\. Brinkman, E\. Arcaute, E\. Dunbar, E\. Smothers, F\. Sun, F\. Kreuk, F\. Tian, F\. Kokkinos, F\. Ozgenel, F\. Caggioni, F\. Kanayet, F\. Seide, G\. M\. Florez, G\. Schwarz, G\. Badeer, G\. Swee, G\. Halpern, G\. Herman, G\. Sizov, Guangyi, Zhang, G\. Lakshminarayanan, H\. Inan, H\. Shojanazeri, H\. Zou, H\. Wang, H\. Zha, H\. Habeeb, H\. Rudolph, H\. Suk, H\. Aspegren, H\. Goldman, H\. Zhan, I\. Damlaj, I\. Molybog, I\. Tufanov, I\. Leontiadis, I\. Veliche, I\. Gat, J\. Weissman, J\. Geboski, J\. Kohli, J\. Lam, J\. Asher, J\. Gaya, J\. Marcus, J\. Tang, J\. Chan, J\. Zhen, J\. Reizenstein, J\. Teboul, J\. Zhong, J\. Jin, J\. Yang, J\. Cummings, J\. Carvill, J\. Shepard, J\. McPhie, J\. Torres, J\. Ginsburg, J\. Wang, K\. Wu, K\. H\. U, K\. Saxena, K\. Khandelwal, K\. Zand, K\. Matosich, K\. Veeraraghavan, K\. Michelena, K\. Li, K\. Jagadeesh, K\. Huang, K\. Chawla, K\. Huang, L\. Chen, L\. Garg, L\. A, L\. Silva, L\. Bell, L\. Zhang, L\. Guo, L\. Yu, L\. Moshkovich, L\. Wehrstedt, M\. Khabsa, M\. Avalani, M\. Bhatt, M\. Mankus, M\. Hasson, M\. Lennie, M\. Reso, M\. Groshev, M\. Naumov, M\. Lathi, M\. Keneally, M\. Liu, M\. L\. Seltzer, M\. Valko, M\. Restrepo, M\. Patel, M\. Vyatskov, M\. Samvelyan, M\. Clark, M\. Macey, M\. Wang, M\. J\. Hermoso, M\. Metanat, M\. Rastegari, M\. Bansal, N\. Santhanam, N\. Parks, N\. White, N\. Bawa, N\. Singhal, N\. Egebo, N\. Usunier, N\. Mehta, N\. P\. Laptev, N\. Dong, N\. Cheng, O\. Chernoguz, O\. Hart, O\. Salpekar, O\. Kalinli, P\. Kent, P\. Parekh, P\. Saab, P\. Balaji, P\. Rittner, P\. Bontrager, P\. Roux, P\. Dollar, P\. Zvyagina, P\. Ratanchandani, P\. Yuvraj, Q\. Liang, R\. Alao, R\. Rodriguez, R\. Ayub, R\. Murthy, R\. Nayani, R\. Mitra, R\. Parthasarathy, R\. Li, R\. Hogan, R\. Battey, R\. Wang, R\. Howes, R\. Rinott, S\. Mehta, S\. Siby, S\. J\. Bondu, S\. Datta, S\. Chugh, S\. Hunt, S\. Dhillon, S\. Sidorov, S\. Pan, S\. Mahajan, S\. Verma, S\. Yamamoto, S\. Ramaswamy, S\. Lindsay, S\. Lindsay, S\. Feng, S\. Lin, S\. C\. Zha, S\. Patil, S\. Shankar, S\. Zhang, S\. Zhang, S\. Wang, S\. Agarwal, S\. Sajuyigbe, S\. Chintala, S\. Max, S\. Chen, S\. Kehoe, S\. Satterfield, S\. Govindaprasad, S\. Gupta, S\. Deng, S\. Cho, S\. Virk, S\. Subramanian, S\. Choudhury, S\. Goldman, T\. Remez, T\. Glaser, T\. Best, T\. Koehler, T\. Robinson, T\. Li, T\. Zhang, T\. Matthews, T\. Chou, T\. Shaked, V\. Vontimitta, V\. Ajayi, V\. Montanez, V\. Mohan, V\. S\. Kumar, V\. Mangla, V\. Ionescu, V\. Poenaru, V\. T\. Mihailescu, V\. Ivanov, W\. Li, W\. Wang, W\. Jiang, W\. Bouaziz, W\. Constable, X\. Tang, X\. Wu, X\. Wang, X\. Wu, X\. Gao, Y\. Kleinman, Y\. Chen, Y\. Hu, Y\. Jia, Y\. Qi, Y\. Li, Y\. Zhang, Y\. Zhang, Y\. Adi, Y\. Nam, Yu, Wang, Y\. Zhao, Y\. Hao, Y\. Qian, Y\. Li, Y\. He, Z\. Rait, Z\. DeVito, Z\. Rosnbrick, Z\. Wen, Z\. Yang, Z\. Zhao, and Z\. MaThe llama 3 herd of models\.External Links:2407\.21783,[Link](https://arxiv.org/abs/2407.21783)Cited by:[§3](https://arxiv.org/html/2609.22157#S3.SS0.SSS0.Px4.p2.1)\.
- Harris \(1960\)T\. E\. HarrisA lower bound for the critical probability in a certain percolation process\.Mathematical Proceedings of the Cambridge Philosophical Society56\(1\),pp\. 13–20\.External Links:[Document](https://dx.doi.org/10.1017/S0305004100034241)Cited by:[§A\.5](https://arxiv.org/html/2609.22157#A1.SS5.SSS0.Px2.p3.2),[Appendix D](https://arxiv.org/html/2609.22157#A4.SS0.SSS0.Px4.p1.1)\.
- Hsiehet al\.\(2024\)C\. Hsieh, S\. Sun, S\. Kriman, S\. Acharya, D\. Rekesh, F\. Jia, Y\. Zhang, and B\. GinsburgRULER: what’s the real context size of your long\-context language models?\.External Links:2404\.06654,[Link](https://arxiv.org/abs/2404.06654)Cited by:[Appendix B](https://arxiv.org/html/2609.22157#A2.p1.1),[item 1](https://arxiv.org/html/2609.22157#S1.I1.i1.p1.1),[§4](https://arxiv.org/html/2609.22157#S4.SS0.SSS0.Px1.p1.1)\.
- Huet al\.\(2026\)L\. Hu, N\. Jia, R\. Wang, J\. Li, Q\. Yang, Y\. Hao, X\. Li, and X\. LiaoTAKE: task\-aware chunked KV cache eviction for efficient long\-context LLM prefill\.External Links:[Link](https://openreview.net/forum?id=kMLfUshPwo)Cited by:[§A\.1](https://arxiv.org/html/2609.22157#A1.SS1.SSS0.Px1.p3.1)\.
- Jégou \(2024\)S\. JégouRULER: hugging face port of the ruler benchmark \(simonjegou/ruler\)\.Note:Hugging Face datasetAccessed 2026\-07\-02External Links:[Link](https://huggingface.co/datasets/simonjegou/ruler)Cited by:[§4](https://arxiv.org/html/2609.22157#S4.SS0.SSS0.Px1.p1.1),[§7](https://arxiv.org/html/2609.22157#S7.SSx1.p1.1)\.
- Jianget al\.\(2023\)A\. Q\. Jiang, A\. Sablayrolles, A\. Mensch, C\. Bamford, D\. S\. Chaplot, D\. de las Casas, F\. Bressand, G\. Lengyel, G\. Lample, L\. Saulnier, L\. R\. Lavaud, M\. Lachaux, P\. Stock, T\. L\. Scao, T\. Lavril, T\. Wang, T\. Lacroix, and W\. E\. SayedMistral 7b\.External Links:2310\.06825,[Link](https://arxiv.org/abs/2310.06825)Cited by:[§4](https://arxiv.org/html/2609.22157#S4.SS0.SSS0.Px1.p1.1)\.
- Kimet al\.\(2026\)J\. Kim, D\. Han, and S\. YunFast kvzip: efficient and accurate llm inference with gated kv eviction\.External Links:2601\.17668,[Link](https://arxiv.org/abs/2601.17668)Cited by:[§A\.1](https://arxiv.org/html/2609.22157#A1.SS1.SSS0.Px1.p3.1),[§2](https://arxiv.org/html/2609.22157#S2.p2.1)\.
- Kolawole and Smith \(2026\)S\. Kolawole and V\. SmithEpiphany\-aware kv cache eviction without the attention matrix\.External Links:2606\.26472,[Link](https://arxiv.org/abs/2606.26472)Cited by:[§A\.1](https://arxiv.org/html/2609.22157#A1.SS1.SSS0.Px1.p3.1)\.
- Liet al\.\(2026a\)X\. Li, Y\. Wang, Y\. Liu, G\. Liu, D\. Qiu, S\. Liu, J\. Liang, W\. Huang, J\. Yu, and J\. ZhuLaTER: efficient test\-time reasoning via latent exploration and explicit verification\.External Links:2605\.07315,[Link](https://arxiv.org/abs/2605.07315)Cited by:[§A\.1](https://arxiv.org/html/2609.22157#A1.SS1.SSS0.Px1.p5.1)\.
- Liet al\.\(2026b\)Y\. Li, B\. Li, and T\. LanMomentKV: closing the directional gap in kv cache eviction for long\-context inference\.External Links:2606\.01563,[Link](https://arxiv.org/abs/2606.01563)Cited by:[§A\.1](https://arxiv.org/html/2609.22157#A1.SS1.SSS0.Px1.p3.1)\.
- Liet al\.\(2024\)Y\. Li, Y\. Huang, B\. Yang, B\. Venkitesh, A\. Locatelli, H\. Ye, T\. Cai, P\. Lewis, and D\. ChenSnapKV: llm knows what you are looking for before generation\.External Links:2404\.14469,[Link](https://arxiv.org/abs/2404.14469)Cited by:[§A\.1](https://arxiv.org/html/2609.22157#A1.SS1.SSS0.Px1.p4.1),[§1](https://arxiv.org/html/2609.22157#S1.p1.1),[§1](https://arxiv.org/html/2609.22157#S1.p2.1),[§2](https://arxiv.org/html/2609.22157#S2.p1.1)\.
- Linet al\.\(2026a\)X\. Lin, J\. Wang, O\. Kondrateva, Y\. Shi, B\. Li, and G\. L\. ZhangCompressKV: semantic\-retrieval\-guided kv\-cache compression for resource\-efficient long\-context llm inference\.External Links:2606\.24467,[Link](https://arxiv.org/abs/2606.24467)Cited by:[§A\.1](https://arxiv.org/html/2609.22157#A1.SS1.SSS0.Px1.p3.1)\.
- Linet al\.\(2026b\)Y\. Lin, J\. Ding, Y\. Xing, P\. He, J\. Tang, and S\. MukherjeeA simple plug\-in for improving eviction\-based kv cache compression\.External Links:2605\.23258,[Link](https://arxiv.org/abs/2605.23258)Cited by:[§A\.1](https://arxiv.org/html/2609.22157#A1.SS1.SSS0.Px1.p2.1),[§2](https://arxiv.org/html/2609.22157#S2.p1.1)\.
- Moschellaet al\.\(2026\)L\. Moschella, L\. Manduchi, and O\. SenerLearning to evict from key\-value cache\.External Links:2602\.10238,[Link](https://arxiv.org/abs/2602.10238)Cited by:[§A\.1](https://arxiv.org/html/2609.22157#A1.SS1.SSS0.Px1.p4.1),[§1](https://arxiv.org/html/2609.22157#S1.p2.1),[§2](https://arxiv.org/html/2609.22157#S2.p1.1)\.
- Ni and Lao \(2026\)N\. Ni and Y\. LaoAnchorKV: safety\-aware kv cache compression via soft penalty with a refusal anchor\.External Links:2606\.17872,[Link](https://arxiv.org/abs/2606.17872)Cited by:[§A\.1](https://arxiv.org/html/2609.22157#A1.SS1.SSS0.Px1.p3.1)\.
- NVIDIA \(2024\)NVIDIAKvpress: llm kv cache compression made easy\.Note:GitHub repositoryAccessed 2026\-07\-02External Links:[Link](https://github.com/NVIDIA/kvpress)Cited by:[§4](https://arxiv.org/html/2609.22157#S4.SS0.SSS0.Px1.p1.1),[§7](https://arxiv.org/html/2609.22157#S7.SSx1.p1.1)\.
- Parket al\.\(2025\)J\. Park, D\. Jones, M\. J\. Morse, R\. Goel, M\. Lee, and C\. LottKeyDiff: key similarity\-based KV cache eviction for long\-context LLM inference in resource\-constrained environments\.InThe Thirty\-ninth Annual Conference on Neural Information Processing Systems,External Links:[Link](https://openreview.net/forum?id=uBaFH7aQnC)Cited by:[§A\.1](https://arxiv.org/html/2609.22157#A1.SS1.SSS0.Px1.p1.1),[§A\.4\.4](https://arxiv.org/html/2609.22157#A1.SS4.SSS4.p2.1),[§4\.1](https://arxiv.org/html/2609.22157#S4.SS1.SSS0.Px5.p1.1)\.
- Suet al\.\(2024\)J\. Su, M\. Ahmed, Y\. Lu, S\. Pan, W\. Bo, and Y\. LiuRoFormer: enhanced transformer with rotary position embedding\.Neurocomput\.568\(C\)\.External Links:ISSN 0925\-2312,[Link](https://doi.org/10.1016/j.neucom.2023.127063),[Document](https://dx.doi.org/10.1016/j.neucom.2023.127063)Cited by:[§4](https://arxiv.org/html/2609.22157#S4.SS0.SSS0.Px1.p1.1)\.
- Tanget al\.\(2026\)Z\. Tang, P\. Jiao, X\. Chen, W\. Liu, S\. Li, and J\. ChenPredicting future utility: global combinatorial optimization for task\-agnostic kv cache eviction\.External Links:2602\.08585,[Link](https://arxiv.org/abs/2602.08585)Cited by:[§A\.1](https://arxiv.org/html/2609.22157#A1.SS1.SSS0.Px1.p4.1)\.
- Wanget al\.\(2025\)G\. Wang, S\. Upasani, C\. Wu, D\. Gandhi, J\. L\. Li, C\. Hu, B\. Li, and U\. ThakkerLLMs know what to drop: self\-attention guided KV cache eviction for efficient long\-context inference\.InSparsity in LLMs \(SLLM\): Deep Dive into Mixture of Experts, Quantization, Hardware, and Inference,External Links:[Link](https://openreview.net/forum?id=qg9dlCcNzr)Cited by:[§A\.1](https://arxiv.org/html/2609.22157#A1.SS1.SSS0.Px1.p1.1),[§2](https://arxiv.org/html/2609.22157#S2.p2.1)\.
- Wenet al\.\(2025\)H\. Wen, X\. Wu, Y\. Sun, F\. Zhang, L\. Chen, J\. Wang, Y\. Liu, Y\. Liu, Y\. Zhang, and Y\. LiBudgetThinker: empowering budget\-aware llm reasoning with control tokens\.External Links:2508\.17196,[Link](https://arxiv.org/abs/2508.17196)Cited by:[§A\.1](https://arxiv.org/html/2609.22157#A1.SS1.SSS0.Px1.p5.1)\.
- Wuet al\.\(2025\)W\. Wu, Y\. Wang, G\. Xiao, H\. Peng, and Y\. FuRetrieval head mechanistically explains long\-context factuality\.InThe Thirteenth International Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=EytBpUGB1Z)Cited by:[§A\.5](https://arxiv.org/html/2609.22157#A1.SS5.SSS0.Px3.p4.1),[§2](https://arxiv.org/html/2609.22157#S2.p3.1),[Remark 1](https://arxiv.org/html/2609.22157#Thmremark1.p1.1)\.
- Xiaoet al\.\(2024\)G\. Xiao, Y\. Tian, B\. Chen, S\. Han, and M\. LewisEfficient streaming language models with attention sinks\.InThe Twelfth International Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=NG7sS51zVF)Cited by:[§A\.1](https://arxiv.org/html/2609.22157#A1.SS1.SSS0.Px1.p4.1),[§1](https://arxiv.org/html/2609.22157#S1.p1.1),[§2](https://arxiv.org/html/2609.22157#S2.p1.1),[§4](https://arxiv.org/html/2609.22157#S4.SS0.SSS0.Px1.p1.1)\.
- Xuet al\.\(2026\)Z\. Xu, H\. Li, Q\. Xiao, F\. Teng, C\. J\. Zhang, L\. Chen, and Q\. LiFrom rigid to dynamic: entropy\-guided adaptive inference for long\-context llms\.External Links:2606\.09508,[Link](https://arxiv.org/abs/2606.09508)Cited by:[§A\.1](https://arxiv.org/html/2609.22157#A1.SS1.SSS0.Px1.p3.1)\.
- Yanget al\.\(2025a\)A\. Yang, A\. Li, B\. Yang, B\. Zhang, B\. Hui, B\. Zheng, B\. Yu, C\. Gao, C\. Huang, C\. Lv, C\. Zheng, D\. Liu, F\. Zhou, F\. Huang, F\. Hu, H\. Ge, H\. Wei, H\. Lin, J\. Tang, J\. Yang, J\. Tu, J\. Zhang, J\. Yang, J\. Yang, J\. Zhou, J\. Zhou, J\. Lin, K\. Dang, K\. Bao, K\. Yang, L\. Yu, L\. Deng, M\. Li, M\. Xue, M\. Li, P\. Zhang, P\. Wang, Q\. Zhu, R\. Men, R\. Gao, S\. Liu, S\. Luo, T\. Li, T\. Tang, W\. Yin, X\. Ren, X\. Wang, X\. Zhang, X\. Ren, Y\. Fan, Y\. Su, Y\. Zhang, Y\. Zhang, Y\. Wan, Y\. Liu, Z\. Wang, Z\. Cui, Z\. Zhang, Z\. Zhou, and Z\. QiuQwen3 technical report\.External Links:2505\.09388,[Link](https://arxiv.org/abs/2505.09388)Cited by:[§3](https://arxiv.org/html/2609.22157#S3.SS0.SSS0.Px4.p2.1)\.
- Yanget al\.\(2025b\)A\. Yang, B\. Yang, B\. Zhang, B\. Hui, B\. Zheng,et al\.Qwen2\.5 technical report\.External Links:2412\.15115,[Link](https://arxiv.org/abs/2412.15115)Cited by:[§4](https://arxiv.org/html/2609.22157#S4.SS0.SSS0.Px1.p1.1)\.
- Yanget al\.\(2026a\)J\. Yang, C\. Tang, L\. Zhen, and J\. LvRethinking kv cache eviction via a unified information\-theoretic objective\.External Links:2604\.25975,[Link](https://arxiv.org/abs/2604.25975)Cited by:[§A\.4\.8](https://arxiv.org/html/2609.22157#A1.SS4.SSS8.Px1.p1.1),[§1](https://arxiv.org/html/2609.22157#S1.p1.1),[§1](https://arxiv.org/html/2609.22157#S1.p2.1),[§2](https://arxiv.org/html/2609.22157#S2.p1.1),[§4\.1](https://arxiv.org/html/2609.22157#S4.SS1.SSS0.Px7.p1.1)\.
- Yanget al\.\(2026b\)N\. Yang, C\. Wang, Y\. Liu, B\. Tian, and H\. ZhangCompilerKV: risk\-adaptive kv compression via offline experience compilation\.External Links:2602\.08686,[Link](https://arxiv.org/abs/2602.08686)Cited by:[§A\.1](https://arxiv.org/html/2609.22157#A1.SS1.SSS0.Px1.p2.1)\.
- Yanget al\.\(2026c\)X\. Yang, H\. Gu, B\. Xu, L\. Li, B\. Liu, J\. Liu, Q\. Zhu, S\. Han, and Y\. GuoIndexMem: learned kv\-cache eviction with latent memory for long\-context llm inference\.External Links:2605\.25475,[Link](https://arxiv.org/abs/2605.25475)Cited by:[§1](https://arxiv.org/html/2609.22157#S1.p1.1),[§1](https://arxiv.org/html/2609.22157#S1.p2.1),[§2](https://arxiv.org/html/2609.22157#S2.p1.1)\.
- Zenget al\.\(2025\)Z\. Zeng, B\. Lin, T\. Hou, H\. Zhang, and Z\. DengIn\-context kv\-cache eviction for llms via attention\-gate\.External Links:2410\.12876,[Link](https://arxiv.org/abs/2410.12876)Cited by:[§A\.1](https://arxiv.org/html/2609.22157#A1.SS1.SSS0.Px1.p3.1),[§2](https://arxiv.org/html/2609.22157#S2.p2.1)\.
- Zhaiet al\.\(2026\)Z\. Zhai, B\. Li, B\. Xiao, M\. Li, and X\. WangAdaptive test\-time compute allocation for reasoning llms via constrained policy optimization\.External Links:2604\.14853,[Link](https://arxiv.org/abs/2604.14853)Cited by:[§A\.1](https://arxiv.org/html/2609.22157#A1.SS1.SSS0.Px1.p5.1)\.
- Zhanget al\.\(2026\)R\. Zhang, H\. Liang, D\. Chang, L\. Hu, F\. Kong, H\. Yin, and Y\. LiWhen does value\-aware kv eviction help? a fixed\-contract diagnostic for non\-monotone cache compression\.External Links:2605\.08234,[Link](https://arxiv.org/abs/2605.08234)Cited by:[§A\.1](https://arxiv.org/html/2609.22157#A1.SS1.SSS0.Px1.p1.1),[§2](https://arxiv.org/html/2609.22157#S2.p3.1)\.
- Zhanget al\.\(2023\)Z\. Zhang, Y\. Sheng, T\. Zhou, T\. Chen, L\. Zheng, R\. Cai, Z\. Song, Y\. Tian, C\. Ré, C\. Barrett, Z\. Wang, and B\. ChenH2\{\}\_\{2\}o: heavy\-hitter oracle for efficient generative inference of large language models\.External Links:2306\.14048,[Link](https://arxiv.org/abs/2306.14048)Cited by:[§A\.1](https://arxiv.org/html/2609.22157#A1.SS1.SSS0.Px1.p4.1),[§1](https://arxiv.org/html/2609.22157#S1.p1.1),[§2](https://arxiv.org/html/2609.22157#S2.p1.1)\.
- Zhouet al\.\(2026\)L\. Zhou, S\. Li, Z\. Li, S\. Liu, Z\. Zhao, and W\. ZhengUT\-aca: uncertainty\-triggered adaptive context allocation for long\-context inference\.External Links:2603\.18446,[Link](https://arxiv.org/abs/2603.18446)Cited by:[§A\.1](https://arxiv.org/html/2609.22157#A1.SS1.SSS0.Px1.p4.1)\.
- Zhouet al\.\(2025\)X\. Zhou, W\. Wang, M\. Zeng, J\. Guo, X\. Liu, L\. Shen, M\. Zhang, and L\. DingDynamicKV: task\-aware adaptive kv cache compression for long context llms\.External Links:2412\.14838,[Link](https://arxiv.org/abs/2412.14838)Cited by:[§2](https://arxiv.org/html/2609.22157#S2.p2.1)\.

## Appendix ADeferred Tables, Derivations, and Secondary Experiments

### A\.1Extended Related Work

Section[2](https://arxiv.org/html/2609.22157#S2)positions PAGE against the decision axes prior work optimizes\. This subsection gives the full treatment, starting with the five neighbors closest to our setup before turning to concurrent, older, and adjacent work\.

##### Concurrent 2026 diagnostics and wrappers

[Zhang et al\. \(2026\)](https://arxiv.org/html/2609.22157#bib.bib32)ask a similar headline question, namely when value\-aware KV eviction helps\. Their work is complementary to ours along a clear axis\. Their score is*value\-aware*\(a per\-input support\-coupling scoreϕ⁡\(x\)\\phi\(x\)over value states\), whereas our signal is*attention topology*\. Beyond this signal difference, their unit of analysis is the selector rather than the task, theirϕ⁡\(x\)\\phi\(x\)drives diagnostic grid splits rather than an eviction gate, and they report that diagnostic signals transfer across selectors only conditionally, which makes the single transferred threshold we report non\-obvious\.[Chen et al\. \(2026\)](https://arxiv.org/html/2609.22157#bib.bib27)document instruction\-type\-dependent degradation under five eviction methods, with some instruction types becoming entirely ignored, the closest published task\-level failure taxonomy\. We cede the hurts\-degradation observation to them and claim instead the joint helps\-versus\-hurts partition plus the a priori predictor\.[Ananthanarayanan et al\. \(2026\)](https://arxiv.org/html/2609.22157#bib.bib31)compute head\-consensus levels and report how they evolve with depth, describing distinct profiles by architecture \(early consensus with late diversification on one family, late convergence on another\) and relating those profiles descriptively to compression tolerance\. Their statistic is not purely*within\-layer*: they too report a depth\-wise contrast, substantially the diagnosis Appendix[A\.3\.3](https://arxiv.org/html/2609.22157#A1.SS3.SSS3)reaches independently\. We differentiate instead on the three axes that do hold: per input rather than per architecture, computed online at prefill rather than offline, and thresholded to make a deployment decision rather than used as a descriptive metric\. To our knowledge the statistic has not been proposed as an eviction gate before, and the ablation of Table[5](https://arxiv.org/html/2609.22157#A1.T5)shows it separates the partition cleanly \(AUC1\.0001\.000\) on the selecting cell and transfers across families\. On the failure side,[Chang et al\. \(2026\)](https://arxiv.org/html/2609.22157#bib.bib35)\(VaSE\) trace catastrophic eviction failures to high\-magnitude value states, an axis orthogonal to our attention\-topology account, and ManifoldKV\([Datta et al\., 2026](https://arxiv.org/html/2609.22157#bib.bib29)\)shows that a Euclidean\-outlier key scorer improves NIAH\-MultiKey retention under compression, which is why we define “capacity\-bound” relative to the scorer being gated \(Section[4\.1](https://arxiv.org/html/2609.22157#S4.SS1.SSS0.Px5)\)\. SAGE\-KV\([Wang et al\., 2025](https://arxiv.org/html/2609.22157#bib.bib44)\)shares our*premise*: after prefilling, the model’s own attention already indicates which tokens can be dropped, read once rather than per decode step, with a head\-level analysis\. The difference is what is done with the premise\. SAGE\-KV always compresses and uses the signal to pick*which*tokens and heads to keep, whereas we use a signal from the same source to decide*whether*to evict at all, do no head\-level selection, and, unlike SAGE\-KV, characterize a task class on which eviction cannot be made safe by any choice of tokens\. KeyDiff\([Park et al\., 2025](https://arxiv.org/html/2609.22157#bib.bib43)\)is an attention\-free, FlashAttention\-compatible evictor whose stated motivation is precisely that materializing attention is expensive\. We address it empirically in the scorer\-independence analysis \(Section[4\.1](https://arxiv.org/html/2609.22157#S4.SS1.SSS0.Px5)\)\. KeyDiff collapses on NIAH\-MK3 below 25% budget, as does every scorer we tested\. Its effectiveness therefore does not confer safety on the capacity\-bound class\.

On the wrapper side, VECTOR\([Lin et al\., 2026b](https://arxiv.org/html/2609.22157#bib.bib33)\)and CriticalKV\([Feng et al\., 2026b](https://arxiv.org/html/2609.22157#bib.bib26)\)are plug\-and\-play augmentations over multiple base evictors, and both always compress under a fixed budget and adapt*which*tokens are kept, whereas our gate decides*whether*to evict at all, a priori from a label\-free attention signal\. The serving system EvicPress\([Feng et al\., 2025a](https://arxiv.org/html/2609.22157#bib.bib42)\)also chooses whether to evict per context, but as part of a profiled quality\-latency optimization over storage tiers rather than from an attention statistic, and without a task\-type partition\. Cross\-family transfer of eviction control is itself known through CompilerKV’s\([Yang et al\., 2026b](https://arxiv.org/html/2609.22157#bib.bib30)\)portable per\-head retention tables\. We instead transfer one fixed threshold across the Qwen and Mistral families, extended to Llama\-architecture models and Qwen3 via an unlabeled per\-model standardization\.

Further concurrent evictors and allocators, EntropyInfer\([Xu et al\., 2026](https://arxiv.org/html/2609.22157#bib.bib36)\), CompressKV\([Lin et al\., 2026a](https://arxiv.org/html/2609.22157#bib.bib37)\), MomentKV\([Li et al\., 2026b](https://arxiv.org/html/2609.22157#bib.bib34)\), EpiKV\([Kolawole and Smith, 2026](https://arxiv.org/html/2609.22157#bib.bib40)\), DefensiveKV\([Feng et al\., 2026a](https://arxiv.org/html/2609.22157#bib.bib41)\), LookaheadKV\([Ahn et al\., 2026](https://arxiv.org/html/2609.22157#bib.bib46)\), and TAKE\([Hu et al\., 2026](https://arxiv.org/html/2609.22157#bib.bib38)\), adapt budgets or scores per head, layer, token, or task, but none gates the eviction decision per input or identifies a task class where eviction hurts monotonically\. AnchorKV\([Ni and Lao, 2026](https://arxiv.org/html/2609.22157#bib.bib45)\)is also “safety\-aware” but in a different sense from ours: it biases retention scores away from harmful\-prompt directions for jailbreak defense while always compressing, whereas our “collapse\-avoiding” sense is about not destroying task accuracy\. Learned gates \(Attention\-Gate\([Zeng et al\., 2025](https://arxiv.org/html/2609.22157#bib.bib39)\), Fast KVzip\([Kim et al\., 2026](https://arxiv.org/html/2609.22157#bib.bib28)\)\) share the “gate” name but train their gating parameters, unlike our inference\-time scalar\. A separate line uses learnable per\-layer gates for cross\-model KV\-cache*fusion*\(C2C\([Fu et al\., 2025](https://arxiv.org/html/2609.22157#bib.bib47)\)\), which addresses communication between models, orthogonal to eviction within one\.

Beyond the concurrent methods above, an older set of baselines and training\-based predictors anchors the comparison\. SnapKV\([Li et al\., 2024](https://arxiv.org/html/2609.22157#bib.bib14)\), H2O\([Zhang et al\., 2023](https://arxiv.org/html/2609.22157#bib.bib12)\), StreamingLLM\([Xiao et al\., 2024](https://arxiv.org/html/2609.22157#bib.bib50)\), PyramidKV\([Cai et al\., 2025](https://arxiv.org/html/2609.22157#bib.bib15)\), and Ada\-KV\([Feng et al\., 2025b](https://arxiv.org/html/2609.22157#bib.bib16)\)are the standard training\-free eviction baselines\. We use SnapKV\-style scoring as the base for our gate and demonstrate orthogonality on H2O, StreamingLLM, and PyramidKV\. ForesightKV\([Dong et al\., 2026](https://arxiv.org/html/2609.22157#bib.bib5)\)and Learning\-to\-Evict\([Moschella et al\., 2026](https://arxiv.org/html/2609.22157#bib.bib7)\)train predictors of future utility and require labels or rollouts to do so\. UT\-ACA\([Zhou et al\., 2026](https://arxiv.org/html/2609.22157#bib.bib8)\)and LU\-KV\([Tang et al\., 2026](https://arxiv.org/html/2609.22157#bib.bib6)\)are calibration\-based context allocators on a single substrate\. None of these proposes a binary task\-type partition or an a priori predictor\.

Finally, three methods adapt compute on axes adjacent to but distinct from ours: AdaCompute\-GBM\([Zhai et al\., 2026](https://arxiv.org/html/2609.22157#bib.bib9)\)on the self\-consistency sample\-count axis, BudgetThinker\([Wen et al\., 2025](https://arxiv.org/html/2609.22157#bib.bib1)\)on the CoT chain\-length axis, and LaTER\([Li et al\., 2026a](https://arxiv.org/html/2609.22157#bib.bib10)\)on latent\-then\-explicit reasoning\. These work on substrates orthogonal to the KV\-cache axis we study\.

Table 3:Mean head\-agreement dropDDand gate\-open fraction on four additional RULER tasks,N=100N=100per cell,τ=0\.07\\tau=0\.07\. niah\_multiquery \(four required keys, no real distractors\) closes the gate on two of three models and sits nearest the anchor on the third, confirming a second capacity\-bound task\. qa\_2 \(29 real hard\-negative documents\), niah\_single\_1 \(no distractors\), and cwe \(ten exact output tokens\) all open the gate on most or all inputs, so neither distractor count nor exact\-token output length predicts the class\.

### A\.2Additional Partition Analyses

This subsection presents the robustness checks, confound analyses, and boundary diagnostics that support the empirical partition of Section[4](https://arxiv.org/html/2609.22157#S4)\.

#### A\.2\.1Saturation, budget\-insensitivity, and context\-length scaling

A cell below the dilution\-prone threshold for two different reasons, and only one of them is benign\. Saturation is the benign case\. Qwen2\.5\-3B hasρ≈0\\rho\\approx 0on VT at 4K becauseAfull≈1A\_\{\\mathrm\{full\}\}\\approx 1, and the same model reachesρ=0\.32\\rho=0\.32on FWE at 16K once headroom opens\. Mistral\-7B repeats the pattern: at 4K it is largely saturated \(Afull=1\.00A\_\{\\mathrm\{full\}\}=1\.00on VT,0\.820\.82on FWE\), and at 16K VT and FWE recover strongly \(ρ=0\.32\\rho=0\.32and0\.220\.22, niah\_multivalue0\.06→0\.210\.06\\to 0\.21\)\. Budget\-insensitivity is the informative case instead, because headroom exists and recovery does not occur\. On Mistral, QA\_1 hasρ=0\.04/0\.00\\rho=0\.04/0\.00at 4K/16K despiteAfull=0\.81/0\.70A\_\{\\mathrm\{full\}\}=0\.81/0\.70, and QA\_2 hasρ=0\.01/0\.00\\rho=0\.01/0\.00despiteAfull=0\.50/0\.56A\_\{\\mathrm\{full\}\}=0\.50/0\.56, and QA\_2 on Qwen\-14B behaves the same way\. These are all QA, where the residual errors resemble parametric\-knowledge failures that no cache budget can repair, a phenomenon distinct from the capacity limit exhibited by NIAH\-MK3\.

The headroom argument predicts the behaviour as context grows, and Qwen2\.5\-14B tests it directly by re\-entering the dilution regime at long context\. At 4K, three dilution\-prone tasks \(VT, FWE, QA\_2\) sit atρ≈0\\rho\\approx 0: saturation, sinceAfull∈\[0\.92,1\.00\]A\_\{\\mathrm\{full\}\}\\in\[0\.92,1\.00\]leaves no headroom for recovery, as Eq\. equation[4](https://arxiv.org/html/2609.22157#S5.E4)predicts\. At 16K, two of five dilution\-prone tasks cross the threshold \(FWE0\.00→0\.200\.00\\to 0\.20, QA\_10\.06→0\.100\.06\\to 0\.10\), niah\_multivalue stays above it \(0\.08→0\.070\.08\\to 0\.07\), and the capacity\-bound NIAH\-MK3 stays at exactly0\.000\.00at both scales\. VT \(0\.00→0\.030\.00\\to 0\.03\) and QA\_2 \(0\.02→0\.030\.02\\to 0\.03\) remain below threshold because the inputs that the model gets wrong at 4K stay wrong at every budget at 16K\. Headroom opens, dilution returns, and NIAH\-MK3 stays pinned: the partition behaves as the scaling formula dictates, not as task identity dictates\.

#### A\.2\.2The partition is not a task\-name heuristic

Task identity and dilution\-proneness could in principle be confounded, but they are not\. The NIAH family contains structurally different subtasks\. niah\_multivalue \(one key, many values\) is dilution\-prone in seven of the eight cells measured \(Table[1](https://arxiv.org/html/2609.22157#S4.T1)\), while NIAH\-MK3 \(three near\-tie keys, one of which is the answer\) is capacity\-bound in all of them, and the distractor sweep \(Table[4](https://arxiv.org/html/2609.22157#A1.T4)\) places niah\_multikey\_1 \(no near\-tie distractors\) on the dilution\-prone side as well\. The*near\-tie distractor*structure, not the surface task category, determines the class, and the head\-agreement drop in Section[3](https://arxiv.org/html/2609.22157#S3.SS0.SSS0.Px3)catches the distinction\. A non\-RULER probe confirms this: LongBench passage\_retrieval\_en \(pick 1 of 30 paragraphs,N=100N=100, Qwen2\.5\-1\.5B, prompts 10 – 16K tokens\) looks NIAH\-like but has no near\-tie distractors, and it is evict\-robust in practice\. Accuracy stays flat fromb=1\.0b=1\.0tob=0\.0625b=0\.0625\(0\.29→0\.260\.29\\to 0\.26,ρ=0\.01\\rho=0\.01\), while its mean dropD=0\.105D=0\.105sits squarely in the dilution\-prone cluster\. The gate opens on all100/100100/100inputs\. The predictor correctly classifies this surface\-similar but structurally different task a priori\.

#### A\.2\.3Protection\-matched ablation

The partition could be an artifact of our relatively light protection setting\.[Garcia \(2026\)](https://arxiv.org/html/2609.22157#bib.bib19)argue that structural protection dominates scorer choice, so we re\-ran the Qwen2\.5\-1\.5B 4K partition tasks with their10%10\\%prefix\+\+10%10\\%suffix protection \(nsink=w=410n\_\{\\text\{sink\}\}=w=410,N=100N=100per task\)\. Protection overrides the budget, so all nominalb≤0\.1875b\\leq 0\.1875share an effective floor of824824kept tokens \(≈0\.21\\approx 0\.21of context\)\. Under this heavy protection the partition remians unchanged\. NIAH\-MK3 still collapses \(0\.650\.65full\-KV→0\.09\\to 0\.09at the floor, an86%86\\%relative loss despite the floor cache being3\.3×3\.3\\timesour light\-protection cache at nominalb=0\.0625b=0\.0625\), so the capacity\-bound failure is not protection\-fixable\. The eviction\-helps signal survives on the dilution\-prone side \(ρ\\rho: FWE0\.06→0\.130\.06\\to 0\.13, QA\_10\.08→0\.070\.08\\to 0\.07, VT0\.06→0\.030\.06\\to 0\.03, aggregate0\.077≥0\.050\.077\\geq 0\.05\), and FWE’s floor accuracy \(0\.310\.31\) exceeds its full\-KV accuracy \(0\.220\.22\)\. Heavy protection is also not free: protected VT drops to0\.000\.00at the floor while our light\-protection run holds0\.750\.75at nominalb=0\.125b=0\.125, because protected prefix/suffix tokens crowd out the scorer\-selected middle tokens the task requires\. In our harnesswwis both the recency protection and the SnapKV scoring window, so this run is a protection\-heavy SnapKV variant rather than an exact replication of their protocol\.

Table 4:Distractor\-count sweep on the NIAH\-MultiKey family \(Qwen2\.5\-1\.5B, RULER 4K,N=50N=50per task\)\. Mean head\-agreement dropDDshrinks monotonically as the near\-tie distractor count grows\.
#### A\.2\.4Boundary and confound analysis: full table

A single capacity\-bound task leaves open whether NIAH\-MK3 names a class or an isolated construction\. We tested the boundary directly on four further RULER tasks chosen by mechanism rather than by outcome: a second near\-tie retrieval task predicted capacity\-bound, a real\-hard\-negative task predicted dilution\-prone despite carrying more distractors than any other task in the suite, a single\-needle control with no distractors at all predicted dilution\-prone, and a code\-completion task requiring ten exact low\-redundancy output tokens predicted capacity\-bound\. Table[3](https://arxiv.org/html/2609.22157#A1.T3)reports the outcome atτ=0\.07\\tau=0\.07,N=100N=100per cell\.

The results confirm that the partition is not defined by distractor count or output length\. niah\_multiquery is capacity\-bound on two of three models, giving the class a confirmed second member\. qa\_2 carries the most distractors of any task tested yet sits comfortably on the dilution\-prone side\. What separates the two classes is whether distractors are near\-tie surface\-form variants of the answer: the distractor sweep isolates this directly \(Table[4](https://arxiv.org/html/2609.22157#A1.T4)\)\. The class has two entry conditions: a near\-tie surface\-form distractor, or a conjunctive multi\-key answer\. Both conditions concentrate the answer into a small, non\-redundant token set, which is the property the gate responds to\.

#### A\.2\.5Near\-tie distractor count drivesDD

The capacity\-bound classification rests on a mechanism claim: that near\-tie distractors, not task identity, distractor count, or output length in general, driveDDdownward\. Section[A\.2](https://arxiv.org/html/2609.22157#A1.SS2)already shows that real hard\-negative distractors do not have this effect, since qa\_1 and qa\_2 carry the most distractors in the suite and exhibits the largestDD\(Table[24](https://arxiv.org/html/2609.22157#A1.T24)\)\. Exact\-token output length also does not, since cwe requires ten exact low\-redundancy tokens yet keeps the gate open on every input tested \(Table[3](https://arxiv.org/html/2609.22157#A1.T3)\)\. This subsubsection isolates the near\-tie case directly\. The RULER NIAH\-MultiKey family lets us sweep the near\-tie distractor count with the number of documents held fixed: niah\_multikey\_1 \(no near\-tie distractors\), niah\_multikey\_2 \(one\), niah\_multikey\_3 \(two\)\. The dilution mechanism of[Bui et al\. \(2026\)](https://arxiv.org/html/2609.22157#bib.bib11)predicts that more near\-tie distractors should produce larger expected dilutionδt\\delta\_\{t\}and, via App\.[E](https://arxiv.org/html/2609.22157#A5), smaller head\-agreement dropDD\. On Qwen2\.5\-1\.5B at RULER 4K,N=50N=50per task, we observe exactly this: a clean monotone gradient \(Table[4](https://arxiv.org/html/2609.22157#A1.T4)\)\.

DDshrinks by∼3\.5×\\sim 3\.5\\timesfrom0→20\\to 2near\-tie distractors, and per\-input ranges between MK2 and MK3 do not overlap \(maxMK3⁡D=0\.062<minMK2⁡D=0\.088\\max\_\{\\text\{MK3\}\}D=0\.062<\\min\_\{\\text\{MK2\}\}D=0\.088\)\. The partition predictor separates 2\-distractor inputs from≤1\\leq 1\-distractor inputs100%100\\%of the time atτ=0\.07\\tau=0\.07\. The monotone gradient replicates on Mistral\-7B\-v0\.3 \(D=0\.081,0\.072,0\.060D=0\.081,0\.072,0\.060for MK1/MK2/MK3,N=50N=50per task\), confirming the mechanism is not Qwen\-specific, though the finer per\-input MK2/MK3 non\-overlap is not reproduced \(their ranges overlap on Mistral\)\.

This clean separation between00and22distractors leaves open what happens at the single\-distractor boundary, and MK2 is exactly that case\. It is empirically capacity\-bound at low budgets \(plain SnapKV collapses from80%80\\%atb=1b\{=\}1to0%0\\%atb=0\.0625b\{=\}0\.0625\) yet is classified as dilution\-prone by the predictor atτ=0\.07\\tau=0\.07: MK2’s meanD=0\.122D=0\.122sits between the MK3 cluster \(D≤0\.062D\\leq 0\.062\) and the MK1 cluster \(D≥0\.099D\\geq 0\.099\), co\-located with genuinely dilution\-prone FWE \(D=0\.098D=0\.098\) and niah\_multivalue \(D=0\.107D=0\.107\)\. No single mean\-DDthreshold separates MK2 from the dilution\-prone cluster on this model, so the predictor falls back to its weakest form here\. It correctly classifies MK3 and the standard dilution\-prone tasks but mis\-classifies single\-near\-tie MK2\. Per\-input recovery information beyond meanDDwould be needed to catch it at deployment\.

Table 5:Gate\-signal ablation on Qwen2\.5\-1\.5B\-Instruct \(RULER 4K,N=50N=50per task, one shared prefill per input\)\. Each cheap prefill statistic is tested for separating the capacity\-bound anchor \(NIAH\-MK3\) from the dilution\-prone tasks \(vt, fwe, qa\_1, multivalue\)\. “Sep\.” = a single threshold puts the capacity\-bound task mean\(s\) strictly on one side of all four dilution task means\. AUCs are per\-input and oriented per signal \(0\.50\.5= chance\)\. “MK mono\.” = task means are monotone along the MK1→\\toMK2→\\toMK3 distractor gradient;rr= Pearson correlation withDD\.

### A\.3Signal and Method Details

This subsection presents the ablation, held\-out validation, and hyperparameter sensitivity analyses that support the signal selection and method design in Section[3](https://arxiv.org/html/2609.22157#S3)\.

#### A\.3\.1Gate\-signal ablation: extended analysis

Table[5](https://arxiv.org/html/2609.22157#A1.T5)gives the headline comparison; Section[3](https://arxiv.org/html/2609.22157#S3.SS0.SSS0.Px3)summarises the key findings\. This subsubsection provides the extended analysis of the signal’s two free parameters\.

##### The signal’s two free parameters

DDdepends on a top\-kkparameter and a bin fraction\. The justification fork=32k=32was that it is commensurate with\|ℛ\|\|\\mathcal\{R\}\|, which is the quantity the gate exists to avoid knowing, so an empirical check tests that choice\. Overk∈\{8,16,32,64,128\}k\\in\\\{8,16,32,64,128\\\}on the selecting cell and on a held\-out Mistral\-7B cell \(N=400N=400inputs each\),k=32k=32maximises both the separation margin and the per\-input AUC on*both*cells \(Qwen2\.5\-1\.5B: margin\+0\.068\+0\.068, AUC1\.0001\.000; Mistral\-7B: margin\+0\.020\+0\.020, AUC0\.9770\.977\)\. This empirical validation replaces the original heuristic\. The choice is not robust upward\. The MK3\-lowest ordering on which the gate depends breaks atk=128k=128on Qwen2\.5\-1\.5B and atk≥64k\\geq 64on Mistral\-7B\.

The bin fraction is the less sensitive parameter, but only whereDDworks at all\. RecomputingDDwith early and late bins at1/41/4,1/31/3and1/21/2of the layer stack, from the stored per\-layer agreements at no additional inference cost, leaves the task ordering intact on every Qwen cell we retained\. The margin narrows as the bins widen but never changing sign \(Qwen2\.5\-1\.5B 4K:\+0\.084\+0\.084,\+0\.068\+0\.068,\+0\.041\+0\.041; Qwen2\.5\-3B 4K:\+0\.047\+0\.047,\+0\.042\+0\.042,\+0\.025\+0\.025; Qwen2\.5\-3B 16K:\+0\.087\+0\.087,\+0\.067\+0\.067,\+0\.045\+0\.045\)\. On the two Llama\-architecture cells the ordering is inverted at*every*bin fraction \(Llama\-3\.1\-8B−0\.002\-0\.002,−0\.011\-0\.011,−0\.024\-0\.024; Yi\-1\.5\-9B−0\.033\-0\.033,−0\.031\-0\.031,−0\.032\-0\.032\)\. This is the same transfer failure Section[4\.1](https://arxiv.org/html/2609.22157#S4.SS1.SSS0.Px1)reports for the fixedτ\\tauon those families rather than a separate defect of the binning\. No choice of bin fraction repairs it\. The thirds convention is therefore not load\-bearing where the signal transfers, and is not the reason the signal fails where it does not\. The Mistral per\-layer logs are corrupt and excluded, so this sweep covers five of the seven cells\.

One methodological point falls out of thekksweep\. Sweepingkkat the deployed fixedτ=0\.07\\tau=0\.07inverts the conclusion\.k=8k=8then postsΔ=\+0\.239\\Delta=\+0\.239on Qwen2\.5\-1\.5B and\+0\.391\+0\.391on Mistral\-7B, apparently beatingk=32k=32, while its gate\-open fraction is0\.000\.00\. The gate has silently become full\-KV fallback, and the apparent gain is the full cache\. The location and scale ofDDmove withkk\(pooled meanDDis\+0\.138\+0\.138atk=32k=32but negative atk=8k=8andk=128k=128\), so any sweep of a parameter that rescalesDDmust recalibrateτ\\taualongside it, or it ablates the threshold rather than the parameter\. This is the same failure mode as the Qwen3 fixed\-τ\\taucell of Section[3](https://arxiv.org/html/2609.22157#S3.SS0.SSS0.Px4), and we report gate\-open fractions beside everyΔ\\Deltain the sweep for that reason\.

Table 6:Gate\-signal ablation repeated on held\-out cells\. “sep\.” counts the signals whose mean on NIAH\-MK3 lies strictly below their mean on every dilution\-prone task, which is the property the gate thresholds, and “margin” is that gap forDD\. “margin\-” excludes niah\_multivalue, the exclusion Appendix[A\.3\.3](https://arxiv.org/html/2609.22157#A1.SS3.SSS3)places on the Llama\-architecture ordering claim\. AUC is per\-input separability of NIAH\-MK3 from the pooled dilution\-prone tasks\. The wrapper column records which memory workaround produced the cell \(Appendix[A\.3\.6](https://arxiv.org/html/2609.22157#A1.SS3.SSS6)\)\.

#### A\.3\.2Held\-out signal ablation

Table[5](https://arxiv.org/html/2609.22157#A1.T5)is measured on the cellDDwas selected\. An AUC of1\.0001\.000there is the number a reader should trust least\. We therefore repeat the ablation on three cells that played no part in selecting the statistic \(Table[6](https://arxiv.org/html/2609.22157#A1.T6)\), and the result splits into what survives held\-out testing and what does not\.

What survives is the qualitative claim:DDremains the only one of the six statistics that achieves task\-level separation anywhere, and it does so on two of the three held\-out cells\. Every alternative fails on every cell, held out or not, so the claim Table[5](https://arxiv.org/html/2609.22157#A1.T5)makes now rests on more than the measurement that selected the signal\.

What does not survive is the fitting cell’s exact number\. The per\-input AUC of1\.0001\.000is a property of that cell alone\. Held out, it is0\.8990\.899,0\.9780\.978, and0\.7410\.741, so we report1\.0001\.000as a fitting\-cell figure rather than as the separability ofDDin general\.

The two weak held\-out cells share a common cause: both are decided by a single task, niah\_multivalue\. On Llama\-3\.1\-8B, NIAH\-MK3 sits atD=0\.0710D=0\.0710while niah\_multivalue sits at0\.06070\.0607, giving an unrestricted margin of−0\.0103\-0\.0103\. Consequently,DDseparates on two of the three held\-out cells, not three, once niah\_multivalue is counted\. The other three dilution\-prone tasks lie above MK3, and against the nearest of them \(VT at0\.07830\.0783\) the margin is\+0\.0073\+0\.0073if niah\_multivalue is excluded\. That figure is the one Appendix[A\.3\.3](https://arxiv.org/html/2609.22157#A1.SS3.SSS3)derives from the depth profile, reached here from an independent measurement and it already places this exclusion on the task\-level ordering claim for a stated reason: niah\_multivalue is eviction\-fragile on Llama\-architecture models, so a lowDDthere is arguably the correct call rather than a mis\-ordering\. We did not register that exclusion before running this ablation, so we report it here as a post\-hoc diagnostic rather than a confirmed prediction, and Table[6](https://arxiv.org/html/2609.22157#A1.T6)gives both margins so either reading is checkable\. On Qwen2\.5\-14B the margin of\+0\.0032\+0\.0032is likewise set by niah\_multivalue at0\.04870\.0487, and excluding it the margin is\+0\.0436\+0\.0436against FWE\.

Figure 5:Per\-layer head agreementaℓa\_\{\\ell\}, averaged over inputs \(N=100N=100per task, RULER 4K\)\. Shaded bands are the early and late thirds that defineDD\. Left: on Qwen2\.5\-1\.5B the profile decays with depth and the capacity\-bound task holds the highest late plateau, as \(A3\) predicts\. Right: on Llama\-3\.1\-8B the profile is non\-monotone and NIAH\-MK3 is nearly indistinguishable from VT under the same contrast, which is why the fixedτ\\taudoes not transfer to that family\.
#### A\.3\.3The per\-layer profile behindDD

The small Llama\-3\.1\-8B margin above is a symptom\. This subsubsection diagnoses the cause by examining the per\-layer profile thatDDsummarizes\. Assumption \(A3\) in App\.[E](https://arxiv.org/html/2609.22157#A5)asserts a layer structure: early layers respond to local context, late layers to task structure, which is why an early\-minus\-late contrast should separate the two classes\. The paper elsewhere reports only the binned scalarDD\. We plot the profileaℓa\_\{\\ell\}itself \(Figure[5](https://arxiv.org/html/2609.22157#A1.F5)\)\. It is recomputed from the released per\-layer logs at zero GPU cost\.

On Qwen2\.5\-1\.5B the profile behaves as \(A3\) describes\. Agreement decays with depth, and NIAH\-MK3 holds a markedly higher late plateau \(0\.2830\.283\) than the dilution\-prone tasks \(0\.2270\.227on VT\)\. The contrast separates them by\+0\.068\+0\.068\. On Llama\-3\.1\-8B it does not\. The profile is non\-monotone, with a pronounced mid\-stack spike, and NIAH\-MK3 and VT become nearly indistinguishable under the contrast \(D=\+0\.071D=\+0\.071against\+0\.078\+0\.078, a margin of\+0\.007\+0\.007, an order of magnitude smaller than on Qwen\)\.

We report this because it is the mechanistic content behind a failure the paper otherwise leaves unexplained\. The fixed threshold does not transfer to the Llama architecture\. Per\-input AUC there is≈0\.80\\approx 0\.80rather than1\.0001\.000, not because the signal is absent but because the depth profile it summarises has a different shape\. An early\-minus\-late contrast is the right summary of a monotone profile and the wrong summary of a profile with interior structure, which is also why the depth\-correlation statistic comes out anti\-correlated on Llama rather than merely weak\. A statistic that reads the profile shape rather than its endpoints is the natural next step, and this is the concrete form of the “per\-input statistic beyond meanDD” that Section[6](https://arxiv.org/html/2609.22157#S6)names as future work\. We attempted it, from the stored per\-layer agreements at no additional inference cost, and report the outcome because it is informative in both directions\.

Three endpoint\-free readings of the profile were tested againstDDon five cells: the late\-plateau level alone, the regression slope ofaℓa\_\{\\ell\}on depth, and the fraction of adjacent layer pairs that decrease\. The late\-plateau level, which the contrast between MK3 at0\.2830\.283and VT at0\.2270\.227above suggests as the natural candidate,*fails*: its per\-input AUC is at or below chance on every cell \(0\.4120\.412,0\.2010\.201,0\.2030\.203,0\.0060\.006,0\.2980\.298\), and on Llama\-3\.1\-8B it is almost perfectly anti\-correlated\. The observation that motivated it is real on Qwen and does not generalise\. The regression slope matchesDDbut never exceeds it \(1\.0001\.000,1\.0001\.000,1\.0001\.000,0\.7140\.714,0\.8000\.800againstDD’s1\.0001\.000,1\.0001\.000,1\.0001\.000,0\.7860\.786,0\.8030\.803\), which indicates the endpoint contrast is already extracting most of what the profile carries\. A monotonicity statistic reads higher thanDDon one cell \(Yi\-1\.5\-9B,0\.9120\.912against0\.8030\.803\) and at chance on another \(Llama\-3\.1\-8B,0\.5520\.552\)\. AtN=50N=50capacity\-bound inputs per cell, with three statistics tested across five cells and no correction for that multiplicity, we treat the single high value as unexplained rather than as a result, and do not build on it\.

The conclusion we draw is narrow and negative: none of the three shape statistics transfers uniformly, and none improves onDDin a way that replicates, so the open problem of Section[6](https://arxiv.org/html/2609.22157#S6)stands unresolved\.

#### A\.3\.4Calibration recipe details

Section[3](https://arxiv.org/html/2609.22157#S3.SS0.SSS0.Px4)summarizes the calibration recipe\. This subsubsection gives the full recipe, its validation, its sensitivity toτ\\tau, and the architecture\-normalized variant\.

##### Two senses of “label\-free”

PAGE never observes correctness, making it*accuracy\-label\-free*, which is weaker than*task\-label\-free*\. The fixed\-τ\\taurecipe below needs2020inputs from a known capacity\-bound task and2020from a known dilution\-prone one\. Thezz\-scored variant assumes neither, and we use the stronger term only for it\.

##### Recipe

For a new \(model, context\):

1. 1\.Pick2020inputs from a known capacity\-bound task \(NIAH\-MK3\) and compute the head\-agreement dropDiD\_\{i\}on each\. Average to getD¯𝒞\\bar\{D\}\_\{\\mathcal\{C\}\}\.
2. 2\.Pick2020inputs from a known dilution\-prone task \(VT\) and computeD¯𝒟\\bar\{D\}\_\{\\mathcal\{D\}\}\.
3. 3\.Set τ=12\(D¯𝒞\+D¯𝒟\)\.\\tau=\\tfrac\{1\}\{2\}\\bigl\(\\bar\{D\}\_\{\\mathcal\{C\}\}\+\\bar\{D\}\_\{\\mathcal\{D\}\}\\bigr\)\.\(5\)

4040prefills, no labels, no decode,<5<5minutes on a single A100\.

##### Validation

On four cells \(Table[7](https://arxiv.org/html/2609.22157#A1.T7)\)\. The recipe lifts Qwen2\.5\-3B 16K from\+3\.4\+3\.4pp to\+5\.4\+5\.4pp \(the only failure cell turned into a win\) and lifts Mistral 4K from\+18\.7\+18\.7pp to\+22\.3\+22\.3pp\. It is neutral on average across the four cells but with smaller variance\.

Table 7:Calibration\-recipe validation\.D¯𝒞\\bar\{D\}\_\{\\mathcal\{C\}\}uses NIAH\-MK3 \(N=20N=20\);D¯𝒟\\bar\{D\}\_\{\\mathcal\{D\}\}uses VT \(N=20N=20\)\. Boldedτ\\tau\-choice column is the winner per cell\. The pilot means here are computed on2020\-input samples and therefore differ slightly from theN≥50N\\geq 50per\-task means of Table[24](https://arxiv.org/html/2609.22157#A1.T24)\.Table 8:The threeτ\\tauvariants used in the paper, their label requirements, and where each is applied, referenced from Section[3](https://arxiv.org/html/2609.22157#S3.SS0.SSS0.Px4)\. Accuracy labels are never used by any variant\. The fixed value produces all headline numbers; the sole exception is the Qwen2\.5\-3B 4K SnapKV matrix cell, run atτ=0\.04\\tau=0\.04and reported atτ=0\.07\\tau=0\.07by exact post\-hoc re\-evaluation \(Appendix[F](https://arxiv.org/html/2609.22157#A6)\)\.VariantAccuracy\-label\-freeTask\-label\-freeUsed forFixedτ=0\.07\\tau=0\.07✓✓Qwen2\.5 and Mistral headline resultszz\-scored per\-model pilot✓✓Cross\-family transfer \(Yi, Llama, Qwen3\)40\-input midpoint \(Eq\. equation[5](https://arxiv.org/html/2609.22157#A1.E5)\)✓–Calibration validation \(Table[7](https://arxiv.org/html/2609.22157#A1.T7)\)

##### Threshold sensitivity

Sweepingτ∈\{0\.01,0\.025,0\.04,0\.055,0\.07,0\.085,0\.10,0\.13,0\.16,0\.20\}\\tau\\in\\\{0\.01,0\.025,0\.04,0\.055,0\.07,0\.085,0\.10,0\.13,0\.16,0\.20\\\}on Qwen2\.5\-1\.5B at RULER 4K \(mixed suite,N=100N=100, budgets\{0\.5,0\.25,0\.125,0\.0625\}\\\{0\.5,0\.25,0\.125,0\.0625\\\}, SnapKV\) shows an operational plateauτ∈\[0\.055,0\.10\]\\tau\\in\[0\.055,0\.10\]inside whichΔ\\Deltavaries by under11pp\. Both false\-positive \(gate fires on capacity\-bound MK3\) and false\-negative \(gate stays closed on dilution\-prone VT/FWE/QA\_1\) rates stay at or below9%9\\%\. The deployedτ=0\.07\\tau=0\.07sits in the middle of this plateau \(Figure[6](https://arxiv.org/html/2609.22157#A1.F6)\)\. Two scope conditions attach to that statement\. The sweep is on the cell that selected the signal, and we do not claim the plateau transfers\. It is a fitting\-cell measurement, reported here because the deployed constant should not be a critical threshold on the cell it came from\.Δ\\Deltaalone is also the wrong quantity to look for a plateau in, since raisingτ\\taucloses the gate more often and substitutes full\-KV fallback for eviction, which raisesΔ\\Deltamonotonically while destroying compression\. We therefore read the plateau jointly with the false\-positive and false\-negative rates above, and report achieved kept\-KV alongsideΔ\\Deltawherever the threshold varies\. Outside it the behaviour changes character\. Below0\.040\.04, FP≥64%\\geq 64\\%andΔ≤\+0\.06\\Delta\\leq\+0\.06\. Above0\.130\.13, FN≥33%\\geq 33\\%and the method degenerates toward “always full KV,” which on this full\-KV\-strong suite still yields a largeΔ\\Delta, since the sweep’s raw maximum is in fact atτ=0\.20\\tau=0\.20, but only at the price of never compressing, so it is not a useful operating point\. The deployed threshold is not critically sensitive to the exact value\.

Figure 6:τ\\tausensitivity on Qwen2\.5\-1\.5B, RULER 4K\. MeanΔ\\Delta\(gated−\-plain\) over \(task, budget\) cells\. Shaded band: operational plateau where\|Δ−Δτ=0\.07\|≤1\|\\Delta\-\\Delta\_\{\\tau=0\.07\}\|\\leq 1pp and FP\+\+FN≤0\.10\\leq 0\.10\. The deployedτ=0\.07\\tau=0\.07sits in the middle of the plateau\.
##### Architecture\-normalized variant: the z\-scored drop

The recipe above calibrates a per\-cell threshold from two labeled pilot tasks\. A stronger variant needs no task labels at all: standardize the drop per model,z⁡\(x\)=\(D⁡\(x\)−μM\)/σMz\(x\)=\(D\(x\)\-\\mu\_\{M\}\)/\\sigma\_\{M\}, withμM,σM\\mu\_\{M\},\\sigma\_\{M\}pooled over an unlabeled∼100\\sim 100\-input pilot, and use one global thresholdθz\\theta\_\{z\}\. Fittingθz=−0\.69\\theta\_\{z\}=\-0\.69on the five Qwen/Mistral cells*only*and transferring it zero\-shot to the two held\-out Llama\-architecture models: task\-level separation of NIAH\-MK3 from\{\\\{QA\_1, QA\_2, VT, FWE\}\\\}succeeds in77of77cells \(pooled cross\-cell AUC0\.9650\.965\), where rawDDwith one threshold manages44of77\. The reason is that rawDDis an architecture\-invariant*ordering*whose location and scale are model\-specific:τ=0\.07\\tau=0\.07sits atz=\+0\.69z=\+0\.69on Yi butz=−0\.97z=\-0\.97on Llama\. These are two opposite failure modes that standardization removes\. Downstream, the z\-gate lifts Llama\-3\.1\-8B fromΔ=\+0\.109\\Delta=\+0\.109to\+0\.174\\bm\{\+0\.174\}\(NIAH\-MK3 gate\-open0\.56→0\.300\.56\\to 0\.30, MK3 accuracy0\.46→0\.720\.46\\to 0\.72\) and gives YiΔ=\+0\.145\\Delta=\+0\.145with*real*compression \(kept\-KV0\.220\.22–0\.320\.32versus0\.76−0\.890\.76\-0\.89under the fixed\-τ\\taufallback\)\. Two honest scopes: niah\_multivalue must be excluded from the task\-level ordering claim \(its meanDDsits below MK3 on both Llama\-architecture models, which is empirically the right call there, since it is eviction\-fragile on both\), and per\-input MK3\-vs\-rest AUC on the Llama\-architecture models is intrinsically≈0\.80\\approx 0\.80, since no monotone rescaling changes within\-model ranking\. A depth\-correlation statistic over the per\-layer profile scores AUC0\.220\.22on Llama\. This does not mean the depth profile is uninformative there\. An AUC of0\.220\.22is*anti*\-correlated, and inverting its sign gives0\.780\.78, comparable toDD’s own≈0\.80\\approx 0\.80on that family\. The profile carries signal on Llama with the opposite sign to the one assumption \(A3\) predicts, which Appendix[A\.3\.3](https://arxiv.org/html/2609.22157#A1.SS3.SSS3)shows directly\.

##### A fourth family where fixedτ\\taufails outright: Qwen

The starkest transfer test is Qwen3\-4B\-Instruct, a different model generation from the Qwen2\.5 calibration set, whose drop distribution is compressed to a different scale entirely \(μ=0\.034\\mu=0\.034,σ=0\.017\\sigma=0\.017pooled over400400inputs\)\. There the fixedτ=0\.07\\tau=0\.07sits atz=\+2\.0z=\+2\.0and the gate essentially never fires\. It keeps99\.4%99\.4\\%of the cache and its apparentΔ=\+0\.43\\Delta=\+0\.43is a pure full\-KV\-fallback artifact with0\.6%0\.6\\%compression\. The z\-scored threshold \(τQwen3=μ\+θzσ=0\.022\\tau\_\{\\text\{Qwen3\}\}=\\mu\+\\theta\_\{z\}\\sigma=0\.022, sameθz=−0\.69\\theta\_\{z\}=\-0\.69\) restores a working gate\. NIAH\-MK3 stays closed \(open fraction0\.020\.02, accuracy0\.05→0\.980\.05\\to 0\.98\) while the three dilution\-prone tasks open \(0\.94−1\.000\.94\-1\.00\), yielding2\.3×2\.3\\timescompression \(43%43\\%mean kept\-KV\) atΔ=\+0\.235\\Delta=\+0\.235over plain and recovering54\.5%54\.5\\%of the per\-input oracle headroom\. The NIAH\-MK3\-smallest ordering transfers cleanly\. Qwen3 is thus the cleanest evidence for the paper’s central claim about the predictor: the drop is an architecture\-invariant*ordering*whose scale must be standardized per model\. Here fixed\-τ\\taudoes not merely underperform\. It does nothing\.

##### Status

The recipe is the deployment\-friendly default: it always fixes the failure cell\. The z\-scored variant extends it label\-free across architecture families\. We report fixed\-τ\\taunumbers throughout as the conservative default so readers see both the robustness of one constant and what standardization buys\.

#### A\.3\.5Head\-pair and layer subsampling

##### How many head pairs doesDDneed?

Layer count is only half of theO⁡\(LH2k\)O\(LH^\{2\}k\)cost\. The other half is the pair count, and it is the half that scales badly:6666pairs atH=12H=12but780780atH=40H=40\. The released logs cannot answer this, because the probe averages over pairs before writing, so we re\-ran the probe retaining the per\-pair Jaccards and subsampled offline \(Table[9](https://arxiv.org/html/2609.22157#A1.T9)\)\. Random subsets are drawn2020times per fraction, since a single unrepresentative draw would understate what subsampling can do\.

The ordering on which the gate depends survives*every*draw down to a single pair out of6666\. At2%2\\%of the pairs the margin is\+0\.0735\+0\.0735, against\+0\.0717\+0\.0717using all of them\. We read this as a statement about the cost model rather than a recommendation to gate on a single pair: theH2H^\{2\}term is not load\-bearing, so the gate can be made substantially cheaper on exactly the wide\-head models where it is most expensive, which is the deployment objection of Section[6](https://arxiv.org/html/2609.22157#S6)\. The caveats are that this is one model at one context length, that it is an ordering result on task means rather than a per\-input one\. The margin is not monotone in the fraction \(the5%5\\%row dips to\+0\.0665\+0\.0665\), which is sampling noise at120120inputs\.

Table 9:Head\-pair subsampling \(Qwen2\.5\-1\.5B, RULER 4K,H=12H=12,6666pairs,L=28L=28,N=30N=30inputs per task over four tasks,120120input\-task rows in total\)\. “Margin” is the gap between meanDDon NIAH\-MK3 and the smallest meanDDamong the dilution\-prone tasks; “ordering” counts the draws in which that margin stayed positive\.
##### How many layers doesDDneed?

The gate’s cost grows with the number of layers scanned, so we ask whether a subset suffices\. RecomputingDDfrom layer subsets of the stored per\-layer agreements needs no GPU\. We first check validity: recomputing over allLLlayers reproduces thedropthe deployed gate actually thresholded, bit\-exactly on the two Qwen cells and to4×10−44\\times 10^\{\-4\}on Mistral, which is two orders of magnitude belowτ\\tau\. Table[10](https://arxiv.org/html/2609.22157#A1.T10)then reports whether each subset preserves the ordering the gate relies on, NIAH\-MK3 ranking below every other task\. Halving the layers is safe on all three cells, though the margin shrinks by roughly a quarter on Qwen2\.5\-1\.5B and by an order of magnitude on Qwen2\.5\-3B\. Beyond that the signal degrades and is cell\-dependent: every\-4th holds only on Qwen2\.5\-3B, the early bin alone inverts the ordering everywhere, and the single first\-and\-last\-layer pair happens to work on Qwen2\.5\-1\.5B while failing badly on Mistral\. We therefore do not recommend subsampling belowL/2L/2, and we read the coincidental successes as a caution against tuning the layer set per cell\.

Table 10:Layer subsampling\. “Margin” is the gap between meanDDon NIAH\-MK3 and the smallest meanDDamong the other tasks, so a positive margin means a separating threshold still exists on that subset\. Recomputed with zero GPU fromhead\_agreement\_per\_layerin the released per\-layer logs\.

#### A\.3\.6Gate\-signal probe: wrapper provenance

The gate\-signal probe requests every layer’s full\[H,T,T\]\[H,T,T\]attention, which reaches roughly120120GiB for Qwen2\.5\-14B at 4K and cannot be run directly\. Two wrappers make it fit\. The retention wrapper \(v1\) calls the stock attention and slices the returned tensor, and the query\-chunk wrapper \(v3\) chunks the query axis while calling the stock function unchanged\. We validated each against the stock script on the fitting cell before using it: v1 agrees exactly \(D=0\.0412D=0\.0412against0\.04120\.0412on the same host\) and v3 agrees to\+0\.000029\+0\.000029, which is floating\-point reassociation\. We report this validation because a third wrapper failed the same check\. Rewriting attention through SDPA moved meanDDfrom0\.04480\.0448to0\.03000\.0300, a33%33\\%shift, reproducibly on two different GPUs, so the cause is the output path perturbing hidden states and compounding across layers rather than a hardware difference\. No reported number uses this third wrapper\. Separating that0\.01480\.0148code artifact from the0\.00350\.0035hardware effect required varying code path and hardware together, since either comparison alone against the released numbers confounds the two\.

### A\.4Experimental Details and Secondary Results

This subsection collects the full tables, decompositions, and secondary experiments that support the experimental validation of Section[4](https://arxiv.org/html/2609.22157#S4)\.

#### A\.4\.1Per\-task decomposition of the matrix

Table[2](https://arxiv.org/html/2609.22157#S4.T2)reports one number per cell; decomposing that number by task explains where it comes from\. Table[12](https://arxiv.org/html/2609.22157#A1.T12)breaks down every matrix cell by task and reports the gate\-open fraction that explains the zeros, and two structural facts follow from it\. First,Δnon\-MK3\\Delta\_\{\\text\{non\-MK3\}\}is exactly0\.0000\.000in88of1616cells, and in each of those the gate opens on100%100\\%of non\-MK3 inputs, so the gated and plain arms execute identically: the zero is an identity, not a null result\. Second, the meanΔMK3\\Delta\_\{\\mathrm\{MK3\}\}is\+0\.780\+0\.780while the grand mean is\+0\.229≈14ΔMK3\+0\.229\\approx\\tfrac\{1\}\{4\}\\Delta\_\{\\mathrm\{MK3\}\}, the suite’s MK3 share\. Since per\-task accuracy is additive under reweighting, the headline for a workload whose capacity\-bound share isffisΔ⁡\(f\)=f⋅ΔMK3\+\(1−f\)⋅Δrest\\Delta\(f\)=f\\cdot\\Delta\_\{\\mathrm\{MK3\}\}\+\(1\-f\)\\cdot\\Delta\_\{\\text\{rest\}\}, which is near\-linear through the origin \(Figure[7](https://arxiv.org/html/2609.22157#A1.F7)\):Δ⁡\(0\)=\+0\.045\\Delta\(0\)=\+0\.045,Δ⁡\(0\.25\)=\+0\.229\\Delta\(0\.25\)=\+0\.229\(the reported suite\),Δ⁡\(0\.5\)=\+0\.412\\Delta\(0\.5\)=\+0\.412\. A deployment therefore sees the gate’s benefit in proportion to how much capacity\-bound traffic it actually serves, and the realistic\-workload estimate of that share is in Table[11](https://arxiv.org/html/2609.22157#A1.T11)\.

Table 11:The partition on a non\-synthetic workload: three LongBench subtasks, Qwen2\.5\-14B, SnapKV,τ=0\.07\\tau=0\.07\.DDis the mean head\-agreement drop and “open” the fraction of inputs on which the gate fires\. “Sensitivity” is the fraction of full\-cache\-correct answers plain eviction destroys atb=0\.0625b=0\.0625\(the capacity signal\) andρ\\rhothe fraction of inputs on which eviction recovers a full\-cache failure \(the dilution signal\)\. The gate’s class call is made fromDDalone, before decoding, and matches the empirical class on all three\.Table 12:Per\-taskΔ\\Delta\(gated−\-plain, budgetsb<1\.0b<1\.0,τ=0\.07\\tau=0\.07\) for all1616matrix cells, with the gate\-open fraction on non\-MK3 inputs\. Rows marked†\\daggerhaveΔnon\-MK3\\Delta\_\{\\text\{non\-MK3\}\}exactly0\.0000\.000with the gate open on every non\-MK3 input, so gated≡\\equivplain there by construction\. Recomputed from the released per\-input logs\.##### Budget convention

Δ\\Deltaaverages over the eviction budgetsb<1\.0b<1\.0\. Includingb=1\.0b=1\.0leaves the value unchanged because the gated and plain arms coincide there\. Restricting instead to\{0\.125,0\.25,0\.5\}\\\{0\.125,0\.25,0\.5\\\}gives\+0\.240\+0\.240, and to the four budgets shared by all cells\+0\.243\+0\.243\. We reportb<1\.0b<1\.0throughout\.

Figure 7:GatingΔ\\Deltaas a function of the capacity\-bound shareffof the workload,Δ⁡\(f\)=fΔMK3\+\(1−f\)Δrest\\Delta\(f\)=f\\Delta\_\{\\mathrm\{MK3\}\}\+\(1\-f\)\\Delta\_\{\\text\{rest\}\}, mean\-line slope0\.73540\.7354\. Grey lines are the1616matrix cells, the blue line their mean, and the dashed marker thef=0\.25f=0\.25composition of our mixed suite\. BecauseΔrest\\Delta\_\{\\text\{rest\}\}is exactly zero in half the cells, the mean is close to linear through the origin, so the headline\+22\.9\+22\.9pp should be read as a statement about a workload that is one quarter capacity\-bound rather than as a property of the method\.Figure 8:The headline4×44\\times 4method\-agnostic matrix\. Bars are gated−\-plain accuracy averaged over budgets\. The wrapper is positive in every one of1616cells with a singleτ=0\.07\\tau=0\.07and no per\-base\-evictor tuning\. Grand mean\+22\.9\+22\.9pp; excluding NIAH\-MK3,\+4\.5\+4\.5pp \(Table[12](https://arxiv.org/html/2609.22157#A1.T12)\)\.

#### A\.4\.2Budget\-axis decomposition

Table[13](https://arxiv.org/html/2609.22157#A1.T13)decomposes the Qwen2\.5\-3B 4K SnapKV cell along the budget axis, complementing the budget\-averagedΔ\\Deltavalues reported in Table[2](https://arxiv.org/html/2609.22157#S4.T2)and Figure[8](https://arxiv.org/html/2609.22157#A1.F8)\.

Table 13:Qwen2\.5\-3B 4K, SnapKV, mixed suite\. Plain accuracy collapses from0\.880\.88to0\.190\.19as the budget shrinks; gated holds0\.61−0\.880\.61\-0\.88across the entire range\.
#### A\.4\.3The task\-label oracle

Section[4\.1](https://arxiv.org/html/2609.22157#S4.SS1.SSS0.Px6)summarizes the task\-label oracle comparison\. Table[14](https://arxiv.org/html/2609.22157#A1.T14)gives the full per\-cell results\.

The honest reading has three parts\. In88of1616cells PAGE reproduces the oracle*exactly*, so there the gate is a perfect task classifier andDDbuys label\-freeness rather than per\-input resolution\. In55cells PAGE*beats*the oracle, by up to\+0\.198\+0\.198, which no task\-level policy can do, since the surplus comes from closing on individual dilution\-prone inputs that the oracle wrongly opens\. In33Mistral cells PAGE loses by at most0\.0090\.009through false positives on MK3\. Overall the oracle reaches\+20\.1\+20\.1pp against PAGE’s\+22\.9\+22\.9pp\.

So most of the matrixΔ\\Deltais a task\-level effect that a cheating baseline could match, and we say so\. The per\-input claim rests on the cells where PAGE exceeds the oracle\. Llama\-3\.1\-8B NIAH\-MK3, where the meanD=0\.071D=0\.071sits just*above*the fixedτ\\tauso that a task\-level policy keyed on that mean would open everywhere and gain nothing, does not support this argument, for two reasons\. First, the oracle gap on that cell is*negative*under both thresholds we report\. PAGE reaches\+0\.089\+0\.089against the oracle’s\+0\.162\+0\.162atτ=0\.07\\tau=0\.07, and\+0\.125\+0\.125against\+0\.162\+0\.162under thezz\-scored threshold, so the cheating baseline wins there rather than loses\. Second, the premise itself is not robust\. The margin is0\.00120\.0012inDD, and whether the task mean falls above or below thezz\-scored threshold flips under three of four plausible definitions of the unlabeled pilot, which Section[3](https://arxiv.org/html/2609.22157#S3.SS0.SSS0.Px4)does not pin down\. Both quantities are recomputable from the released per\-input log\. The reconstruction reproduces the deployed gate exactly on all12001200evicting rows\.

Table 14:PAGE against a task\-label oracle that closes on NIAH\-MK3 and opens elsewhere\.Δ\\Deltais gated minus plain over budgetsb<1\.0b<1\.0\. A gap of exactly0\.0000\.000means the gate reproduced the oracle’s decisions on every input; a positive gap requires within\-task per\-input variation\.
#### A\.4\.4Scorer\-independence: full tables

Section[4\.1](https://arxiv.org/html/2609.22157#S4.SS1.SSS0.Px5)summarizes the scorer\-independence result\. The full tables follow\.

The single\-mask ManifoldKV variant used in the main text is not a fair test of a geometry scorer’s full capability, so we also built a faithful ManifoldKV\+Ada\-KV implementation\([Datta et al\., 2026](https://arxiv.org/html/2609.22157#bib.bib29);[Feng et al\., 2025b](https://arxiv.org/html/2609.22157#bib.bib16)\): scoresi=∥ki−μ∥2s\_\{i\}=\\lVert k\_\{i\}\-\\mu\\rVert\_\{2\}against the per\-\(layer, kv\-head\) key centroidμ\\mu, with Ada\-KV head\-wise budget reallocation \(safeguard floorfloor\_alpha=0\.5\\texttt\{floor\\\_alpha\}=0\.5plus a global top\-kkover the remaining per\-head scores\)\. Ragged per\-head keep counts are realized by masking evicted keys to−∞\-\\inftyper kv\-head rather than physically pruning, which reproduces exactly the logits a ragged compressed cache would produce with no over\-allocation, and the measured kept fraction matches the nominal budget to four decimals\. We add KeyDiff\([Park et al\., 2025](https://arxiv.org/html/2609.22157#bib.bib43)\)\(negative cosine to the same centroid\) as the published attention\-free scorer\.

Before trusting a negative result from this scorer, we first confirm it is competent\. Table[15](https://arxiv.org/html/2609.22157#A1.T15)\(a\) is the control that makes the negative result interpretable: on two\-key NIAH the geometry scorer reproduces exactly the multi\-key advantage its authors report, reaching0\.720\.72atb=0\.5b=0\.5where SnapKV is at0\.160\.16\. A scorer that can do this is not failing MK3 for want of a better scoring rule, and indeed every scorer we test still collapses on MK3\. Table[15](https://arxiv.org/html/2609.22157#A1.T15)\(b\) shows that atb≤0\.25b\\leq 0\.25, SnapKV, KeyDiff, and ManifoldKV \(post\- and pre\-RoPE, uniform and Ada\-KV allocation\) are all at or near0\.000\.00against a full\-cache0\.660\.66\. The geometry scorer does not beat a properly per\-head SnapKV at any budget here and is weaker atb=0\.5b=0\.5\(0\.060\.06\-0\.100\.10versus0\.320\.32\)\. The conclusion we draw is the one the gate is built on, stated with the scope Section[6](https://arxiv.org/html/2609.22157#S6)establishes\. On this cell, on capacity\-bound inputs, the recoverable information is not present in any25%25\\%subset of the cache, so none of the scoring rules we test \(attention\-based, geometric, or attention\-free\) recovers it, and the only safe action is not to evict\. That floor is substrate\-dependent rather than universal\. The same geometry scorer reaches0\.9900\.990atb=0\.5b=0\.5on Llama\-3\.1\-8B at 8K, and the budget below which every scorer fails ranges fromb≤0\.125b\\leq 0\.125tob≤0\.25b\\leq 0\.25across the models we ran\.

Table 15:Scorer\-independence of the capacity limit \(Qwen2\.5\-1\.5B, RULER 4K,N=50N=50\)\. \(a\) The geometry scorer reproduces the published two\-key advantage, so it is competent\. \(b\) On three\-key NIAH\-MK3 every scorer collapses below25%25\\%budget\. Accuracy at nominal budgetbb\.\(a\) two\-key NIAH, the positive control

\(b\) three\-key NIAH\-MK3

#### A\.4\.5Detect\-and\-retry as an alternative design

The gate is not the only way to handle capacity\-bound inputs\. A natural objection is that one could evict unconditionally and simply re\-run the inputs that fail, avoiding the gate and its attention\-exposing pass entirely\. The comparison is analytic, so we state it rather than measure it\. Writingp𝒞p\_\{\\mathcal\{C\}\}for the prevalence of capacity\-bound inputs andcprec\_\{\\mathrm\{pre\}\},cdecc\_\{\\mathrm\{dec\}\}for prefill and decode cost, PAGE payscgatec\_\{\\mathrm\{gate\}\}on every input plus a memory cost of\(1−popen\)\(1\-p\_\{\\text\{open\}\}\)full caches, wherecgatec\_\{\\mathrm\{gate\}\}is1717ms on Qwen2\.5\-1\.5B and8989ms on Mistral\-7B at 4K \(Table[26](https://arxiv.org/html/2609.22157#A1.T26)\)\. Detect\-and\-retry instead pays nothing up front but incurs a second full prefill and decode on every input it retries, so its expected overhead is\(p𝒞⋅TPR\+\(1−p𝒞\)⋅FPR\)⋅\(cpre\+cdec\)\(p\_\{\\mathcal\{C\}\}\\cdot\\mathrm\{TPR\}\+\(1\-p\_\{\\mathcal\{C\}\}\)\\cdot\\mathrm\{FPR\}\)\\cdot\(c\_\{\\mathrm\{pre\}\}\+c\_\{\\mathrm\{dec\}\}\), and every capacity\-bound input its detector misses is returned wrong rather than merely late\. At the prevalencep𝒞≈0\.25p\_\{\\mathcal\{C\}\}\\approx 0\.25measured on the realistic workload \(Table[11](https://arxiv.org/html/2609.22157#A1.T11)\) and withcgatec\_\{\\mathrm\{gate\}\}two orders of magnitude below a full prefill\-plus\-decode, retry breaks even only if its detector is both near\-perfect in recall and has a false\-positive rate below roughly0\.030\.03, since each false positive costs a doubled request\. The two designs also differ in kind rather than degree: the gate spends bounded memory to make a failure impossible, while retry spends unbounded tail latency to make it recoverable, and only the gate is available to a system that cannot re\-run a request\. We note this as a design point rather than a claim, since we did not build a decode\-side distress detector, and a good one would be a contribution in its own right\.

##### Static per\-route policy

A serving team with a known capacity\-bound endpoint has a third option that costs nothing at all: route by endpoint and disable eviction on it, with no attention pass and no detector\. Where that is available it is the right baseline, and by Table[14](https://arxiv.org/html/2609.22157#A1.T14)a task\-level policy already captures roughly88%88\\%of what PAGE achieves on our matrix, so the honest comparison is narrow\. PAGE earns its cost only where routing is unavailable or insufficient: mixed endpoints that serve both classes, traffic whose class is not known at admission, and the within\-task variation of Section[4\.1](https://arxiv.org/html/2609.22157#S4.SS1.SSS0.Px4), where inputs of the same nominal task fall on opposite sides\. We did not evaluate a routed deployment, and a reader whose traffic is cleanly separable by endpoint should treat static routing as the default and the gate as the fallback for what routing cannot reach\.

#### A\.4\.6Composition beyond attention\-score evictors

The comparison above assumes the gate’s signal generalizes beyond attention\-score scoring, an assumption worth testing directly\. To check composition beyond attention\-score\-based bases, we add a ManifoldKV\-style scorer\([Datta et al\., 2026](https://arxiv.org/html/2609.22157#bib.bib29)\): per\-\(layer, head\) Euclidean distance of each key to the head’s key centroid, averaged into a single shared keep mask \(a single\-mask variant of their per\-layer design, forced by our uniform\-cache harness\)\. On the Qwen2\.5\-1\.5B 4K mixed suite \(N=100N=100/task, four budgets\), the same gate at the sameτ=0\.07\\tau=0\.07lifts it byΔ=\+16\.2\\Delta=\+16\.2pp with no negative \(task, budget\) cell, and on NIAH\-MK3 the gate recovers full\-KV accuracy \(0\.00→0\.650\.00\\to 0\.65\) at every budget\. Two observations follow\. The gate signal is attention\-based and scorer\-independent, so composition extends outside the attention\-score family, but our single\-mask variant does*not*reproduce ManifoldKV’s reported multi\-key rescue \(plain accuracy0\.010\.01atb=0\.5b=0\.5\)\. Since their per\-layer, per\-head design may behave differently, we treat their published numbers as the authoritative claim and scope ours accordingly \(Section[6](https://arxiv.org/html/2609.22157#S6)\)\.

#### A\.4\.7Cross\-architecture, scale, and best\-plain results

Table[16](https://arxiv.org/html/2609.22157#A1.T16)extends the SnapKV gate to two Llama\-architecture models, and Table[17](https://arxiv.org/html/2609.22157#A1.T17)compares the best plain vs\. best gated evictor per model\.

Table 16:Cross\-architecture SnapKV\-only runs on two Llama\-architecture models\. These use the four most aggressive budgets\{0\.0625,0\.125,0\.25,0\.5\}\\\{0\.0625,0\.125,0\.25,0\.5\\\}rather than the eight\-budget grid of Table[2](https://arxiv.org/html/2609.22157#S4.T2), so theΔ\\Deltavalues are not directly comparable to the matrix rows \(aggressive\-budget\-only averaging inflatesΔ\\Delta\)\.On architecture, Yi\-1\.5\-9B \(Δ=\+39\.0\\Delta=\+39\.0pp\) and Llama\-3\.1\-8B \(Δ=\+10\.9\\Delta=\+10\.9pp, Table[16](https://arxiv.org/html/2609.22157#A1.T16)\) are Llama\-architecture descendants distinct from Qwen and Mistral\. Only the SnapKV column was run for compute, and on a smaller, more aggressive budget grid \(see caption\)\. The sign is positive on both, but on these two models part of the gain comes from the gate closing conservatively on tasks where plain SnapKV collapses, rather than from a correctly recovered partition\. The per\-task breakdown and the shared Llama\-arch family caveat \(niah\_multivalue mis\-classifies on both Yi and Llama\) are in Section[A\.6\.3](https://arxiv.org/html/2609.22157#A1.SS6.SSS3)and Appendix[A\.3\.3](https://arxiv.org/html/2609.22157#A1.SS3.SSS3)\.

On scale, a SnapKV\-only run on Qwen2\.5\-32B\-Instruct \(RULER 4K mixed suite,N=100N=100\) confirms the predictor scales but also illustrates the saturation arm of the scaling formula\. The drop ordering transfers cleanly \(NIAH\-MK3 smallest atD=0\.025D=0\.025, then FWE0\.0520\.052, VT0\.0790\.079, QA\_10\.1030\.103\)\. At the same time the 32B model is near\-saturated at 4K \(Afull=1\.00A\_\{\\mathrm\{full\}\}=1\.00on VT and NIAH\-MK3,0\.93−0\.940\.93\-0\.94on FWE/QA\_1\), so by Eq\. equation[4](https://arxiv.org/html/2609.22157#S5.E4)there is essentially no dilution headroom, and the gate’s value is capacity\-bound protection rather than recovery: plain SnapKV collapses atb=0\.0625b=0\.0625\(NIAH\-MK30\.000\.00, VT0\.000\.00, FWE0\.090\.09\) while the gate holds the full cache on the low\-drop tasks, giving meanΔ=\+0\.335\\Delta=\+0\.335atτ=0\.07\\tau=0\.07\(driven by NIAH\-MK3\+0\.88\+0\.88and FWE\+0\.44\+0\.44\) and\+0\.237\+0\.237at the z\-scored threshold with more compression \(0\.450\.45vs\.0\.630\.63kept\-KV\)\. We report this as a scale point for the partition and predictor, not as additional dilution evidence\.

Table 17:Best plain evictor vs\. best gated evictor per model, over the four base evictors of Table[2](https://arxiv.org/html/2609.22157#S4.T2)at the same budget grid\.The best\-plain\-versus\-best\-gated comparison still leaves open why the matrix’s gains differ across base evictors rather than landing at one number, which the per\-evictor behaviour explains\. StreamingLLM keeps only3636tokens regardless of budget, so on the dilution\-prone fraction it is near zero plain and near zero gated, and gating contributes only via the gate\-closed NIAH\-MK3 inputs that go from00to full\-KV accuracy\. SnapKV is budget\-scaled and degrades more gracefully, so it has less room for gating to recover\. PyramidKV’s depth\-weighted scoring biases toward bottom layers but produces similar absolute gains to SnapKV\. The pattern is that gatingΔ\\Deltatracks how much the base evictor collapses on the capacity\-bound fraction\. Two implementation caveats apply: our PyramidKV is a depth\-weighted variant of the published per\-layer budget schedule, and under two\-pass prefill scoring \(used on Qwen2\.5\-14B for memory\) the H2O score only sees the lastwwqueries, so the 14B H2O column degenerates toward SnapKV\-style scoring\. ItsΔ\\Deltathere should be read as a near\-duplicate of the SnapKV cell rather than an independent base evictor\.

#### A\.4\.8Head\-to\-head tables

##### Head\-to\-head with CapKV on LongBench

CapKV\([Yang et al\., 2026a](https://arxiv.org/html/2609.22157#bib.bib18)\)is the closest published method that reports on LongBench\. No public CapKV codebase exists yet, since their preprint is dated 2026\-04\-28, so we re\-implement CapKV’s per\-\(layer, kv\-head\) statistical\-leverage scoresi=wi⋅vi⊤A−1vis\_\{i\}=w\_\{i\}\\cdot v\_\{i\}^\{\\top\}A^\{\-1\}v\_\{i\}withA=I\+∑iwivivi⊤A=I\+\\sum\_\{i\}w\_\{i\}v\_\{i\}v\_\{i\}^\{\\top\}andwi=exp⁡\(⟨ki,μq⟩β/d\)w\_\{i\}=\\exp\(\\langle k\_\{i\},\\mu\_\{q\}\\rangle\\beta/\\sqrt\{d\}\)from their equations, then wrap it in our gate\. Two LongBench subtasks, Qwen2\.5\-3B\-Instruct, budgetb=0\.5b=0\.5, CapKV temperatureβ=5\\beta=5\(their default; we writeβ\\betafor theirτ\\tauto avoid clashing with our gate threshold\)\. Results in Table[18](https://arxiv.org/html/2609.22157#A1.T18)\.

Table 18:Gated vs\. plain CapKV \(our re\-implementation\) on two LongBench subtasks, Qwen2\.5\-3B\-Instruct,b=0\.5b=0\.5\.Both columns are positive at matched budget\. Conditional on the gate firing \(drop≥0\.07\\geq 0\.07, the sameτ=0\.07\\tau=0\.07we use everywhere\), plain and gated agree by construction\. On the gate\-closed subset where the wrapper falls back to full KV, the difference is\+4\.3\+4\.3pp on qasper \(Nclosed=23N\_\{\\text\{closed\}\}=23\) and\+18\.2\+18\.2pp on triviaqa \(Nclosed=11N\_\{\\text\{closed\}\}=11\)\. The headline numbers are not a reproduction of CapKV’s Table 1 \(different model, different metric, 16K eager cap on prompt length\) and we report them as a directional head\-to\-head: at these sample sizes \(N=68,24N=68,24\) wrapping CapKV in the gate is weakly positive overall and concentrates its gain on the gate\-closed subset, consistent with the orthogonality claim of Section[4\.1](https://arxiv.org/html/2609.22157#S4.SS1.SSS0.Px3)\. We do not promote “never hurts” to a formal claim at these sample sizes, and larger LongBench runs are clean follow\-up work\.

##### Head\-to\-head with DBTrimKV on RULER

[Bui et al\. \(2026\)](https://arxiv.org/html/2609.22157#bib.bib11)\(DBTrimKV\) is the published trained\-gate evictor the paper’s mechanism section adopts\. The authors ship pretrained gates on Hugging Face for several Qwen3 variants \(no Qwen2\.5 checkpoint exists, so the head\-to\-head is necessarily on a different model family\)\. We run DBTrimKV\-Qwen3\-4B\-Instruct\-2507 on RULER 4K,N=30N=30inputs per task on \(NIAH\-MK3, FWE, VT, QA\_1\), at three memory budgetsM∈\{128,256,512\}M\\in\\\{128,256,512\\\}\. The wrapper uses the same fixedτ=0\.07\\tau=0\.07calibrated on Qwen2\.5\-1\.5B, with no per\-model tuning\. Results in Table[19](https://arxiv.org/html/2609.22157#A1.T19)\.

Table 19:Gated vs\. plain DBTrimKV \(pretrained Qwen3\-4B\-Instruct\-2507 gates\) on RULER 4K at three memory budgets\. See the caveat paragraph: the gate fires on only1\.7%1\.7\\%of records, so the win is dominated by the full\-KV fallback\.Nplain DBTrimKVgated DBTrimKVΔ\\Deltaall \(3 budgets×\\times4 tasks\)3600\.6170\.850\+0\.233\\bm\{\+0\.233\}per task: NIAH\-MK3900\.4671\.000\+0\.533\+0\.533per task: FWE900\.2220\.600\+0\.378\+0\.378per task: VT900\.9891\.000\+0\.011\+0\.011per task: QA\_1900\.7890\.800\+0\.011\+0\.011per budget:M=128M=1281200\.4750\.850\+0\.375\+0\.375per budget:M=256M=2561200\.6170\.850\+0\.233\+0\.233per budget:M=512M=5121200\.7580\.850\+0\.092\+0\.092
##### Honest caveat: the gate fires rarely on Qwen3 atτ=0\.07\\tau=0\.07

At our default threshold the gate is open on6/360=1\.7%6/360=1\.7\\%of records\. The remaining∼98%\\sim 98\\%trigger the full\-KV fallback, which explains the largeΔ\\Deltaon NIAH\-MK3 \(\+0\.533\+0\.533\): the gate closing turns off DBTrimKV’s compress step entirely\. As a consequence, cache occupancy under our wrapper is∼14\.5×\\sim 14\.5\\timesplain DBTrimKV at the same nominalMM\. The\+0\.233\+0\.233is therefore a*quality*win at matched budget, not a*memory\-budget*win at matched cache size\. The rare gate firing here is the same Qwen3 scale mismatch analyzed in Section[3](https://arxiv.org/html/2609.22157#S3.SS0.SSS0.Px4): Qwen3\-4B’s drop distribution \(μ=0\.034\\mu=0\.034\) puts the fixedτ=0\.07\\tau=0\.07atz=\+2\.0z=\+2\.0, so a per\-model z\-scored threshold \(τQwen3=0\.022\\tau\_\{\\text\{Qwen3\}\}=0\.022\) is the right deployment default and, applied to the same suite, restores a genuinely compressing gate \(43%43\\%kept\-KV,Δ=\+0\.235\\Delta=\+0\.235\)\. The headline is that wrapping the strongest published trained\-gate evictor with our partition\-aware gate strictly improves matched\-budget accuracy, with the gain concentrated on the capacity\-bound task as the mechanism predicts\.

### A\.5Theory: Mechanism, Partition, and Scaling Derivations

Section[5](https://arxiv.org/html/2609.22157#S5)states the mechanism, the partition it implies, and the scaling formula in summary form\. This subsection provides the full derivations, followed by the sufficient\-condition bridge connecting the mechanism to the observable predictor\. At the end of each part, an explicit scope statement delineates what is and is not established, so the claims can be read exactly\. Notation follows[Bui et al\. \(2026\)](https://arxiv.org/html/2609.22157#bib.bib11)αℛ\\alpha\_\{\\mathcal\{R\}\}the pre\-eviction signal mass,γ\\gammathe noise\-retention ratio,ρℛ,ρ𝒩\\rho\_\{\\mathcal\{R\}\},\\rho\_\{\\mathcal\{N\}\}the retained\-mass fractions,δt\\delta\_\{t\}the dilution,DDthe head\-agreement drop,σz\\sigma\_\{z\}the pre\-softmax logit\-noise scale,mmthe logit margin,κ:=m/σz\\kappa:=m/\\sigma\_\{z\}, andH,L,TH,L,Tthe head, layer, and length counts\.

##### Mechanism and partition

We adopt as stated the dilution mechanism from[Bui et al\. \(2026\)](https://arxiv.org/html/2609.22157#bib.bib11), which suffices to motivate our gating predictor\. Fix a frozen decoder language modelMM\. A single attention head reads from positionst∈\{1,…,T\}t\\in\\\{1,\\dots,T\\\}, each carrying a valuevtv\_\{t\}and a pre\-eviction probabilityαt\\alpha\_\{t\}with∑tαt=1\\sum\_\{t\}\\alpha\_\{t\}=1\. Partition positions into a relevant setℛ=\{t:rt=1\}\\mathcal\{R\}=\\\{t:r\_\{t\}=1\\\}\(\|ℛ\|=R\|\\mathcal\{R\}\|=R\) and a noise set𝒩\\mathcal\{N\}\(\|𝒩\|=N\|\\mathcal\{N\}\|=N\), withR≪NR\\ll N\. LetUt⊆ℛU\_\{t\}\\subseteq\\mathcal\{R\}denote the*useful*set at steptt\(the positions whose retention preserves the next\-token margin\), and define dilution as the attention mass*outside*UtU\_\{t\}:

δt:=1−∑i∈Utαt,i\.\\delta\_\{t\}:=1\-\\sum\_\{i\\in U\_\{t\}\}\\alpha\_\{t,i\}\.\(6\)Their Proposition 3\.1 establishes that near\-tie distractors \(αt\\alpha\_\{t\}comparable across𝒩\\mathcal\{N\}\) forceδt\\delta\_\{t\}to be large, and their Corollary 3\.2 shows that preferential retention withρU≥ρD\\rho\_\{U\}\\geq\\rho\_\{D\}\(whereρU,ρD\\rho\_\{U\},\\rho\_\{D\}are the retained mass on useful and distractor positions\) reducesδt\\delta\_\{t\}\.

The partition follows from this mechanism\. Defineαℛ:=∑t∈ℛαt\\alpha\_\{\\mathcal\{R\}\}:=\\sum\_\{t\\in\\mathcal\{R\}\}\\alpha\_\{t\}as the pre\-eviction signal mass\. Two regimes emerge:

- •*Dilution\-prone*\(𝒟\\mathcal\{D\}\):αℛ≪1\\alpha\_\{\\mathcal\{R\}\}\\ll 1\. Most attention is on noise; eviction of noise positions monotonically improves the head SNR\.
- •*Capacity\-bound*\(𝒞\\mathcal\{C\}\):αℛ→1\\alpha\_\{\\mathcal\{R\}\}\\to 1\. Attention is concentrated on the few relevant positions\. Imperfect scoring can only*lose*signal; eviction strictly degrades the head\.

The partition we observe on RULER is the empirical projection ofαℛ\\alpha\_\{\\mathcal\{R\}\}onto the task structure: NIAH\-MK3 forces a single concentrated signal \(αℛ→1\\alpha\_\{\\mathcal\{R\}\}\\to 1\), while VT, FWE, QA, and niah\_multivalue all spread signal across many positions \(αℛ≪1\\alpha\_\{\\mathcal\{R\}\}\\ll 1\)\.

##### Context\-length scaling

Fix the task and its relevant\-set sizeRR\. LetT=R\+NT=R\+N\. Assume distractor attention is approximately uniform on𝒩\\mathcal\{N\}:αt≈\(1−αℛ\)/N\\alpha\_\{t\}\\approx\(1\-\\alpha\_\{\\mathcal\{R\}\}\)/Nfort∈𝒩t\\in\\mathcal\{N\}\. Letσv2\\sigma\_\{v\}^\{2\}denote the per\-distractor value\-vector variance under isotropy \(a different object from the pre\-softmax logit noise scaleσz\\sigma\_\{z\}used in App\.[E](https://arxiv.org/html/2609.22157#A5)\)\. Then the head SNR before eviction is

SNR=αℛ2σv2∑t∈𝒩αt2≈αℛ2⋅Nσv2\(1−αℛ\)2\.\\mathrm\{SNR\}=\\frac\{\\alpha\_\{\\mathcal\{R\}\}^\{2\}\}\{\\sigma\_\{v\}^\{2\}\\sum\_\{t\\in\\mathcal\{N\}\}\\alpha\_\{t\}^\{2\}\}\\approx\\frac\{\\alpha\_\{\\mathcal\{R\}\}^\{2\}\\cdot N\}\{\\sigma\_\{v\}^\{2\}\(1\-\\alpha\_\{\\mathcal\{R\}\}\)^\{2\}\}\.Ifαℛ\\alpha\_\{\\mathcal\{R\}\}decreases withTT\(more distractors compete for softmax mass\), the pre\-eviction SNR decreases and the noise floor grows\.

Let the kept set be𝒦\\mathcal\{K\}and defineρℛ:=∑t∈𝒦∩ℛαt/αℛ\\rho\_\{\\mathcal\{R\}\}:=\\sum\_\{t\\in\\mathcal\{K\}\\cap\\mathcal\{R\}\}\\alpha\_\{t\}/\\alpha\_\{\\mathcal\{R\}\}\(the retained fraction of relevant mass\) and analogouslyρ𝒩\\rho\_\{\\mathcal\{N\}\}\. Under noise\-retention ratioγ∈\(0,1\)\\gamma\\in\(0,1\)\(i\.e\.\|𝒦∩𝒩\|=γN\|\\mathcal\{K\}\\cap\\mathcal\{N\}\|=\\gamma N\), the post\-eviction SNR ratioSNRpost/SNRpre\\mathrm\{SNR\}\_\{\\mathrm\{post\}\}/\\mathrm\{SNR\}\_\{\\mathrm\{pre\}\}is a monotone\-increasing function of the*gain argument*

g:=ρℛ2/γg:=\\rho\_\{\\mathcal\{R\}\}^\{2\}/\\gamma\(7\)as derived in Appendix[D](https://arxiv.org/html/2609.22157#A4), Eq\. equation[10](https://arxiv.org/html/2609.22157#A4.E10)\. The squaring survives the renormalisation step, and consequently,ggis not a function ofρℛ/γ\\rho\_\{\\mathcal\{R\}\}/\\gamma\. The accuracy headroom1−Afull\(M,T\)1\-A\_\{\\mathrm\{full\}\}\(M,T\)scales withTTon dilution\-prone tasks\.

The single\-budget improvement event factorises into a headroom indicatorA:=𝟏\[A^\(SNRmax\)<1\]A:=\\mathbf\{1\}\[\\hat\{A\}\(\\mathrm\{SNR\}\_\{\\max\}\)<1\]and a recovery indicatorB:=𝟏\[∃b:SNRpost\>SNRpre\]B:=\\mathbf\{1\}\[\\,\\exists b:\\mathrm\{SNR\}\_\{\\mathrm\{post\}\}\>\\mathrm\{SNR\}\_\{\\mathrm\{pre\}\}\]\. The recovery probability isprecov\(g\):=Prx⁡\[B\]p\_\{\\mathrm\{recov\}\}\(g\):=\\Pr\_\{x\}\[B\], withprecov\(g\)=0p\_\{\\mathrm\{recov\}\}\(g\)=0forg≤1g\\leq 1and non\-decreasing above\. Since the operationalb∗\(x\)b^\{\*\}\(x\)is the argmax over the budget grid, and a calibrated \(nested top\-kk\) scorer ensures recovery budgets are not near\-disjoint, the union\-bound factor reduces to unity\. The per\-input expected accuracy improvement at a single budgetbbthus obeys the exact scaling relation:

ρKV=\(1−Afull\)precov\+Covx\(A,B\),\(1−Afull\)precov≤ρKV≤min⁡\{1−Afull,precov\}\.\\rho\_\{\\mathrm\{KV\}\}=\(1\-A\_\{\\mathrm\{full\}\}\)\\,p\_\{\\mathrm\{recov\}\}\+\\mathrm\{Cov\}\_\{x\}\(A,B\),\\qquad\(1\-A\_\{\\mathrm\{full\}\}\)\\,p\_\{\\mathrm\{recov\}\}\\;\\leq\\;\\rho\_\{\\mathrm\{KV\}\}\\;\\leq\\;\\min\\\{1\-A\_\{\\mathrm\{full\}\},\\,p\_\{\\mathrm\{recov\}\}\\\}\.\(8\)The lower endpoint usesCovx\(A,B\)≥0\\mathrm\{Cov\}\_\{x\}\(A,B\)\\geq 0, which holds because both indicators are monotone in the single driverαℛ\\alpha\_\{\\mathcal\{R\}\}\(Chebyshev’s association inequality\([Harris, 1960](https://arxiv.org/html/2609.22157#bib.bib48)\)\); the upper endpoint is Fréchet–Hoeffding\. Eq\. equation[4](https://arxiv.org/html/2609.22157#S5.E4)\(main text\) predicts three observed effects in one formula: context\-length amplification on dilution\-prone tasks \(Qwen2\.5\-1\.5B VT goesρ=0\.06→0\.19\\rho=0\.06\\to 0\.19asT=4K→16KT=4\\mathrm\{K\}\\to 16\\mathrm\{K\}, in lockstep with1−Afull=0\.18→0\.751\-A\_\{\\mathrm\{full\}\}=0\.18\\to 0\.75\); larger\-model saturation at short context \(Qwen2\.5\-3B 4K VT has1−Afull≈0\.001\-A\_\{\\mathrm\{full\}\}\\approx 0\.00, soρ≈0\\rho\\approx 0\); and re\-entry of larger models into the dilution regime at long context \(Qwen2\.5\-3B 16K FWE has1−Afull=0\.621\-A\_\{\\mathrm\{full\}\}=0\.62andρ=0\.32\\rho=0\.32\)\. Empirically, the ratiosρ/\[\(1−Afull\)⋅precov\]\\rho/\[\(1\-A\_\{\\mathrm\{full\}\}\)\\cdot p\_\{\\mathrm\{recov\}\}\]cluster around0\.25−0\.550\.25\-0\.55on dilution\-prone tasks\.

*Scope\.*This derivation establishes the identity and two\-sided bound with constant11*inside*the deterministic\-SNR surrogate\. It does not establish the surrogate itself \(accuracy as a fixed function of head SNR is assumed\); the covariance is pinned only to a sign, not a value\. Where headroom is driven byαℛ\\alpha\_\{\\mathcal\{R\}\}\-independent factors \(the QA parametric\-knowledge cells\) both bounds pinchρ→0\\rho\\\!\\to\\\!0despite headroom, matching the observed QA exceptions as a sign prediction, not a proof about those tasks\.

##### Connecting the predictor to the mechanism: a sufficient condition for non\-trivial dilution

The mechanism uses the unobservableαℛ\\alpha\_\{\\mathcal\{R\}\}\. Our gating predictor uses the head\-agreement dropDD\(Eq\. equation[3](https://arxiv.org/html/2609.22157#S3.E3)\), which is observable\. We sketch a proof connecting the two in Appendix[E](https://arxiv.org/html/2609.22157#A5), and leave the formal version with explicit, tight constants to future work\. Under noise isotropy, sub\-Gaussian pre\-softmax noise of scaleσz\\sigma\_\{z\}, a bounded logit margin betweenℛ\\mathcal\{R\}and𝒩\\mathcal\{N\}, and good scoring with noise\-retention ratioγ∈\(0,1\)\\gamma\\in\(0,1\), there exist a model\-specific constantc1c\_\{1\}and aγ\\gamma\-dependent constantc2\(γ\)c\_\{2\}\(\\gamma\), with an additionalO⁡\(H\)O\(H\)multiplicative slack absorbed in both, such that

D≥c1⋅log⁡\(1/γ\)⟹𝔼⁡\[δt\]≥c2\(γ\)⋅\(1−Afull\),D\\;\\geq\\;c\_\{1\}\\cdot\\log\(1/\\gamma\)\\;\\Longrightarrow\\;\\mathbb\{E\}\[\\delta\_\{t\}\]\\;\\geq\\;c\_\{2\}\(\\gamma\)\\cdot\(1\-A\_\{\\mathrm\{full\}\}\),\(9\)with probability≥1−β\\geq 1\-\\betaover the pre\-softmax noise, whereδt\\delta\_\{t\}is the dilution term of Eq\. equation[6](https://arxiv.org/html/2609.22157#A1.E6)\. The converse \(capacity\-bound⇒\\RightarrowsmallDD\) holds under the same surrogate given aκ\\kappa\-separation assumptionm≥2σzlog⁡\(2H2LT2/β\)m\\geq 2\\sigma\_\{z\}\\sqrt\{\\log\(2H^\{2\}LT^\{2\}/\\beta\)\}: then late\-layer heads share a common top\-kkset,alate→1a\_\{\\mathrm\{late\}\}\\\!\\to\\\!1, andPr\[D≥τ\]≤β=2H2LT2e−κ2/4\\Pr\[D\\geq\\tau\]\\leq\\beta=2H^\{2\}LT^\{2\}\\,e^\{\-\\kappa^\{2\}/4\}, so observingD≥τD\\geq\\taucertifies the input is not capacity\-bound except on a noise tail\.

###### Lemma 1\(Top\-kkconcentration\)\.

Under \(A1\)–\(A2\) withm≥σz4log⁡\(2H2LT2/β\)m\\geq\\sigma\_\{z\}\\sqrt\{4\\log\(2H^\{2\}LT^\{2\}/\\beta\)\}, the top\-kkset of every head equals its private relevant set jointly with probability≥1−β\\geq 1\-\\beta, fork=\|ℛh\(ℓ\)\|k=\|\\mathcal\{R\}^\{\(\\ell\)\}\_\{h\}\|\.

*Measured margin \(why the bridge does not certify the gate\)\.*The converse is only informative whenβ<1\\beta<1, which needsκ≥10\.11\\kappa\\geq 10\.11at\(H,L,T\)=\(12,28,≈4K\)\(H,L,T\)=\(12,28,\{\\approx\}4\\mathrm\{K\}\)\. We measuredκ\\kappadirectly on Qwen2\.5\-1\.5B RULER 4K NIAH\-MK3: medianκ=3\.33\\kappa=3\.33, about3×3\\timestoo small\. The gap is robust: sweeping the top\-kksplit overk∈\{8,16,32,64\}k\\in\\\{8,16,32,64\\\}givesκ=4\.01,3\.68,3\.33,2\.99\\kappa=4\.01,3\.68,3\.33,2\.99\(monotone, none rescues the bound\); a second architecture gives3\.713\.71\(Mistral\-7B\); and, decisively, a dilution\-prone task givesκ=3\.40\\kappa=3\.40\(VT\), indistinguishable from the capacity\-bound3\.333\.33— so the margin\-to\-noise ratio does not even separate the two classes\. A factor of three inκ\\kappais a factor\>109\>10^\{9\}inβ\\beta\. The bound is therefore*vacuous at the paper’s own parameters*, and the class separation the gate relies on is empirical \(Table[24](https://arxiv.org/html/2609.22157#A1.T24)\), not certified by the surrogate\.

*Sign vs\. ordinal\.*As stated the converse predictsD≤0D\\leq 0on capacity\-bound inputs, which Table[24](https://arxiv.org/html/2609.22157#A1.T24)contradicts in five of seven cells \(measuredDDis mildly positive,\+0\.02\+0\.02to\+0\.07\+0\.07\)\. Relaxing the common\-set idealisation to anO⁡\(1\)O\(1\)needle neighbourhood weakens the conclusion toPr\[D≤o\(1\)\]≥1−β−o\(1\)\\Pr\[D\\leq o\(1\)\]\\geq 1\-\\beta\-o\(1\), which the data satisfy but which no longer distinguishes the classes by sign\. We therefore rely on the ordinal separation only\.

*Scope\.*Establishes the sufficient direction and, under the namedκ\\kappa\-separation and common\-set assumptions, the converse and itse−κ2/4e^\{\-\\kappa^\{2\}/4\}rate; also \(App\. H content\) anO⁡\(H2ε\)O\(H^\{2\}\\varepsilon\)approximate identification ofUtU\_\{t\}withℐ\(ℓ∗\)\\mathcal\{I\}^\{\(\\ell^\{\*\}\)\}underε\\varepsilon\-close heads plus a consensus–usefulness assumption, which degrades exactly in the single\-decisive\-head \(retrieval\-head,[Wu et al\. 2025](https://arxiv.org/html/2609.22157#bib.bib49)\) regime where the paper already declines to apply the bridge\. Does not establish that real attention satisfies the margin assumption \(measured false,κ≈3\\kappa\\\!\\approx\\\!3vs\.≥10\.1\\geq 10\.1needed\), that capacity\-bound heads literally share one common set, that theO⁡\(H\)O\(H\)pairwise\-to\-HH\-wise slack or the heuristiclog⁡\(1/γ\)\\log\(1/\\gamma\)factor are tight, or a stand\-alone necessity proof\. The bridge motivates the mechanism; it does not carry the empirical claims\.

### A\.6Deployment Details

This subsection collects the tables and secondary analyses behind the deployment constraints of Section[6](https://arxiv.org/html/2609.22157#S6)\.

#### A\.6\.1Deferred experiment tables

##### The 8\-cell scaling table

Table[20](https://arxiv.org/html/2609.22157#A1.T20)reports the gatingΔ\\Deltaon the mixed suite across four models and two context lengths\. The pattern matches the context\-length scaling formula: at 4K,Δ\\Deltatracks both1−Afull1\-A\_\{\\mathrm\{full\}\}andαℛ\\alpha\_\{\\mathcal\{R\}\}; at 16K,Δ\\Deltashrinks where the gate misfires \(Qwen 3B 16K\) and grows where headroom returns \(Mistral 16K\)\.

Table 20:Cross\-\(model, context\) gatingΔ\\Delta\. Sameτ=0\.07\\tau=0\.07across cells; columnΔ@τcal\\Delta@\\tau\_\{\\mathrm\{cal\}\}shows the recipe\-calibratedΔ\\Deltaon the four cells where it has been computed \(“–” otherwise\)\.
##### Pre\-registered 32K predictions

Table[21](https://arxiv.org/html/2609.22157#A1.T21)gives the full per\-task predictions and measurements behind the out\-of\-range test of Section[4\.1](https://arxiv.org/html/2609.22157#S4.SS1.SSS0.Px7)\.

Table 21:Pre\-registered 32K predictions vs\. measurements \(Qwen2\.5\-1\.5B,N=100N=100per task\)\. Predicted intervals = 4K/16K ratio band×\\timesmeasured 32K headroom, frozen before the sweep\.

#### A\.6\.2Achieved compression and batching decay

##### Achieved compression of the gated deployment

Table[22](https://arxiv.org/html/2609.22157#A1.T22)reports the per\-model gate\-open fraction and realized kept\-KV behind the compression figures quoted in the abstract and Section[1](https://arxiv.org/html/2609.22157#S1)\. Realized compression atb=0\.0625b=0\.0625ranges from1\.8×1\.8\\timeson Qwen2\.5\-3B, whose gate\-open fraction is lowest at0\.490\.49and whose fallback therefore costs most, to3\.4×3\.4\\timeson Qwen2\.5\-1\.5B and Qwen2\.5\-14B, with a mean of2\.9×2\.9\\times\. The3\.4×3\.4\\timesendpoint alone understates this spread\. We report the range and the mean instead, since the spread is a property of the workload the gate sees rather than measurement noise\.

Table 22:Achieved compression of the gated deployment atτ=0\.07\\tau=0\.07\(SnapKV, 4K mixed suite\)\. Kept\-KV is the mean over inputs of the retained cache fraction; “grid mean” averages the eight nominal budgets of Table[2](https://arxiv.org/html/2609.22157#S4.T2)\. Plain SnapKV keeps exactly the nominal fraction \(0\.06250\.0625atb=0\.0625b=0\.0625; grid mean0\.4530\.453\)\. The gate\-open fraction is a per\-input property, independent ofbb, and sets the compression floor1−popen1\-p\_\{\\text\{open\}\}\.
##### Batching decay under static provisioning

Table[23](https://arxiv.org/html/2609.22157#A1.T23)evaluates the compression decay per model under static batch provisioning, where a batch is provisioned for its largest resident cache\.

Table 23:Compression under static batch provisioning atτ=0\.07\\tau=0\.07\(SnapKV,b=0\.0625b=0\.0625\)\.popenp\_\{\\text\{open\}\}andkopenk\_\{\\text\{open\}\}are from Table[22](https://arxiv.org/html/2609.22157#A1.T22)\. Compression decays toward1×1\\timesas batch size grows because a single gate\-closed sequence forces the whole batch to the full cache\.

#### A\.6\.3Per\-task drop ordering

Table[24](https://arxiv.org/html/2609.22157#A1.T24)reports the mean drop per task \(N=100N=100inputs per task on the Qwen and Mistral columns,N=50N=50on Yi and Llama; Mistral 4K qa\_1 hasN=78N=78and Mistral 16K niah\_multivalueN=98N=98due to run truncation\)\. NIAH\-MK3 is the smallest drop in every Qwen and Mistral cell, while on the two Llama\-architecture models it ranks second\-smallest, so the*ordering*of the partition is fully preserved across Qwen and Mistral and partially preserved on the Llama\-architecture models, even when the absolute threshold needs slight tuning\. This is what gives the calibration recipe in Eq\. equation[5](https://arxiv.org/html/2609.22157#A1.E5)its robustness\.

Table 24:Per\-task mean head\-agreement dropDDacross three architecture families \(Qwen, Mistral, and Llama\-architecture: Yi\-1\.5 and Llama\-3\.1\)\. This table uses the strict\-thirds bins, early=\[0,⌊L/3⌋\)=\[0,\\lfloor L/3\\rfloor\)and late=\[⌊2L/3⌋,L\)=\[\\lfloor 2L/3\\rfloor,L\); the deployed gate uses equal\-size bins and differs by at most0\.0040\.004where3∤L3\\nmid L\(Appendix[F](https://arxiv.org/html/2609.22157#A6)\)\. Bold marks the smallest drop per column\. NIAH\-MK3 is the smallest drop on Qwen and Mistral cells; on Yi\-1\.5 and Llama\-3\.1 it ranks 2nd\-smallest behind niah\_multivalue \(Llama\-arch family artifact; see prose\)\. Yi\-1\.5\-9B serves as a parallel Llama\-class architecture with a distinct training corpus \(different tokenizer, deeper layer geometry\)\.##### Llama\-class cross\-architecture transfer is partial

On Yi\-1\.5\-9B and Llama\-3\.1\-8B \(both Llama\-architecture descendants\), niah\_multivalue ranks smallest byDD\(Yi:D=−0\.013D=\-0\.013; Llama:D=\+0\.064D=\+0\.064\), and NIAH\-MK3 ranks 2nd\-smallest\. On the five Qwen and Mistral cells, NIAH\-MK3 is the smallest\. We attribute the swap to a Llama\-arch artifact: the multi\-value retrieval task happens to have unusually concentrated early\-layer attention on these models, which inverts the early\-vs\-late drop sign\. The capacity\-bound side of the partition \(smallDD, gate closes, full\-KV fallback\) still operates on both models, but the fixedτ=0\.07\\tau=0\.07does*not*transfer as a threshold\. On Llama the mis\-classification is confined to niah\_multivalue, where the wrapper holds full KV instead of compressing, which forfeits the eviction speed\-up but does not damage accuracy, because plain SnapKV is already robust there\. The Llama\-3\.1\-8B gated SnapKVΔ\\Deltais\+10\.9\+10\.9pp on the matrix\-comparable mixed suite, driven almost entirely by NIAH\-MK3 \(\+43\.5\+43\.5pp\) where plain SnapKV collapses to0%0\\%and gated holds∼44%\\sim 44\\%\(still well below the full\-KV1\.001\.00\)\. The other tasks haveΔ≈0\\Delta\\approx 0because Llama’s plain SnapKV is robust on this budget range \(≥0\.86\\geq 0\.86atb=0\.0625b=0\.0625on QA\_1\)\. The NIAH\-MK3 gate\-open fraction on Llama is0\.560\.56despite meanD=0\.071D=0\.071sitting aboveτ\\tau: per\-inputDDdispersion closes the gate on the other∼44%\\sim 44\\%of NIAH\-MK3 inputs, which is what rescues the cell\. This cell does*not*support a per\-input claim over a task\-level policy, since the task\-label oracle outperforms PAGE here under both thresholds \(Section[4\.1](https://arxiv.org/html/2609.22157#S4.SS1.SSS0.Px4)\)\. The dispersion explains the cell’sΔ\\Delta, not an advantage over knowing the label\. On Yi the mis\-classification is broader: atτ=0\.07\\tau=0\.07the gate also stays closed on FWE and VT \(gate\-open fractions0\.000\.00and0\.100\.10\), so most of Yi’s\+39\.0\+39\.0pp comes from the full\-KV fallback firing on tasks where plain SnapKV collapses\. That outcome is accuracy\-preserving but it is*not*evidence that the raw threshold transfers to Yi, since the drop\-vs\-ρ\\rhoprediction is inverted there\. The z\-scored variant of Section[3](https://arxiv.org/html/2609.22157#S3.SS0.SSS0.Px4)resolves this: with a per\-model standardization from an unlabeled pilot, Yi compresses for real \(kept\-KV0\.22−0\.320\.22\-0\.32\) while still gainingΔ=\+0\.145\\Delta=\+0\.145, and Llama improves toΔ=\+0\.174\\Delta=\+0\.174\. We state the fixed\-τ\\taufailure plainly in Section[4\.1](https://arxiv.org/html/2609.22157#S4.SS1.SSS0.Px1)\.

#### A\.6\.4Scaling formula verification

Table[25](https://arxiv.org/html/2609.22157#A1.T25)reports the headroom1−Afull1\-A\_\{\\mathrm\{full\}\}, the observedρ\\rho, and the ratio\. A through\-origin fit on the dilution\-prone rows gives a slope of0\.340\.34\. The Qwen2\.5\-3B 4K FWE row \(ratio0\.040\.04\) is excluded from that fit: atN=100N=100,ρ=0\.01\\rho=0\.01is a single recovery, Wilson\[0\.002,0\.054\]\[0\.002,0\.054\], and is better read as counting noise than as part of the trend\. On NIAH\-MK3 the ratio is≤0\.02\\leq 0\.02regardless of headroom, so the partition is visible in the ratio alone\.

Table 25:Verification of the scaling formula\. The ratioρ/\(1−Afull\)\\rho/\(1\-A\_\{\\mathrm\{full\}\}\)is approximately constant on dilution\-prone tasks across \(model, context\) cells and near zero on NIAH\-MK3 regardless of headroom\.Figure 9:Per\-input recovery rateρ\\rhovs\. accuracy headroom1−Afull1\-A\_\{\\mathrm\{full\}\}across the\(model,context,task\)\(model,context,task\)cells of Table[25](https://arxiv.org/html/2609.22157#A1.T25)\. Dilution\-prone tasks \(filled circles\) lie on a band with a through\-origin fitted slope of0\.340\.34\. NIAH\-MK3 \(open triangles\) lies on theρ=0\\rho=0axis regardless of headroom\. The two populations are visibly separated\.
#### A\.6\.5Cost of the gate and end\-to\-end efficiency

Table[26](https://arxiv.org/html/2609.22157#A1.T26)reports the end\-to\-end efficiency of gated eviction\.

Table 26:End\-to\-end efficiency of gated eviction \(RULER 4K, batch 1, bf16, greedy, 128 decode steps, medians; A100\-80GB\)\. “Gated expected” is the gate\-open\-weighted mix0\.75⋅\(b=0\.125\)\+0\.25⋅full0\.75\\cdot\(b\{=\}0\.125\)\+0\.25\\cdot\\mathrm\{full\}at the measured mixed\-suite gate\-open fraction \(τ=0\.07\\tau\{=\}0\.07\); “gated measured” actually gates each input \(15/2015/20open, matching theN=400N\{=\}400calibration fraction of0\.750\.75\)\. On the 1\.5B model \(2 KV heads\), 4K decode is weight\-bound and eviction buys*memory*\(8×8\\timesplain,2\.9×2\.9\\timesgated expected\), not speed; on Mistral\-7B \(8 KV heads, 513 MiB KV\) eviction already yields a1\.29×1\.29\\timesdecode speedup at 4K\. Measured KV matches the analyticL⋅Hkv⋅d⋅T⋅4L\\cdot H\_\{\\mathrm\{kv\}\}\\cdot d\\cdot T\\cdot 4B formula to0\.10\.1MiB, validating the 16K/32K scaling rows\.ModelConfigDecode tok/sKV cache \(MiB\)Peak decode \(MiB\)Qwen2\.5\-1\.5B\(N=20N\{=\}20\)Full KV37\.9106\.13090SnapKVb=0\.125b\{=\}0\.12537\.813\.2 \(8\.0×8\.0\\times\)2976SnapKVb=0\.0625b\{=\}0\.062537\.56\.6 \(16\.1×16\.1\\times\)2968Gated \(measured,τ=0\.07\\tau\{=\}0\.07\)37\.713\.2 / 110\.5 \(open/closed\)2976Gated \(expected mix\)37\.936\.5 \(2\.9×2\.9\\times\)3004Mistral\-7B\-v0\.3\(N=12N\{=\}12\)Full KV18\.9512\.814429SnapKVb=0\.125b\{=\}0\.12524\.5 \(1\.29×1\.29\\times\)64\.1 \(8\.0×8\.0\\times\)13929

##### Deployment cost at scale

We measured the two\-pass gate on Qwen2\.5\-32B \(64 layers, 40 heads\): the gate costs350350ms at 4K \(145145ms re\-forward\+204\+204ms head\-agreement drop,≈18%\\approx 18\\%of the1\.91\.9s prefill\), and the 16K two\-pass run*OOMs*on a contended 80GB card \(weights\+\+KV\+\+thew×Tw\\times Tattention transient\)\. The drop cost is quadratic in head count: a head\-count sweep gives an exponent of2\.0−2\.42\.0\-2\.4\(per\-model floors2\.12\.1ms on Qwen\-1\.5B,2727ms Mistral\-7B,8787ms Qwen\-32B, extrapolating to≈291\\approx 291ms on a 70B\-class model\), confirming theO⁡\(LH2k\)O\(LH^\{2\}k\)complexity\. Thew×Tw\\times Tattention transient isLHwT⋅2LHwT\\cdot 2bytes \(55GiB at 32K on Qwen\-32B,≈10\\approx 10GiB on 70B\-class\)\. A 70B model at 32K is therefore not viable in a paged\-FlashAttention stack: the two\-pass re\-forward needs contiguous \(non\-paged\) KV and a non\-fused eager kernel, and materializes a per\-sequence transient that paged attention exists to avoid\. PAGE is best read as an offline/prefill\-time gate, not a fused\-serving drop\-in\.

##### Per\-layer ablation

The default gating uses a single key\-mask shared across layers\. A per\-layer variant \(each layer derives its own keep mask from its own attention\) improves the aggregation tasks at 4K \(FWE by1\.8×1\.8\\timesρ\\rho, niah\_multivalue by2\.1×ρ2\.1\\times\\rhoon Qwen2\.5\-1\.5B 4K\) and matches at 16K\. Numbers in Appendix[C](https://arxiv.org/html/2609.22157#A3)\.

##### Random\-eviction control

Uniform\-random scoring at every budget destroys accuracy uniformly on both dilution\-prone and capacity\-bound inputs\. The dilution effect is*not*“any eviction is regularization\.” The control rules out a generic regularization explanation, and the controlled numbers are in Appendix[B](https://arxiv.org/html/2609.22157#A2)\.

#### A\.6\.6Additional limitations

Two further limitations concern which baselines appear where\. DBTrimKV’s pretrained gates exist only for Qwen3 variants, so Section[4\.1](https://arxiv.org/html/2609.22157#S4.SS1.SSS0.Px7)runs on Qwen3\-4B\-Instruct\-2507 rather than the Qwen2\.5\-keyed matrix, which is why DBTrimKV stays a standalone head\-to\-head rather than a matrix row\. The matrix itself covers only training\-free policies for the same reason: trained or learned evictors \(DBTrimKV, CapKV, IndexMem, DynamicKV\) are cited but not included in it\.

The last limitation concerns how confidently NIAH\-MK3 can stand in for the capacity\-bound class generally\. It is the only task where empirical capacity\-boundedness \(accuracy collapse under eviction\) and the gate’s capacity\-bound classification coincide\. On LongBench passage\_count at Qwen2\.5\-14B the gate closes on all inputs \(meanD=−0\.013D=\-0\.013\) yet eviction is empirically*safe*\(accuracy flat under16×16\\timeseviction,ρ=0\\rho=0\): a benign*false positive*\(over\-conservative, costing compression not accuracy\), the dual of the MK2 false negative \(Appendix[A\.2\.5](https://arxiv.org/html/2609.22157#A1.SS2.SSS5)\)\. The head\-agreement drop is therefore a one\-sided predictor, reliable at firing on dilution\-prone inputs, not a perfect classifier\. Multilingual and code tasks remain out of scope\. We expect the mechanism to transfer, since it is architecture\-level, but we have not measured it\.

### A\.7Statistical Validation

#### A\.7\.1Per\-input recovery distributions

The meanρ\\rhohides the shape of the per\-input recovery, so we also report its distribution\. For each inputxxwe form the recovery indicatorr⁡\(x\)=sign⁡\(maxb⁡Agated\(b,x\)−Aplain\(1,x\)\)∈\{−1,0,\+1\}r\(x\)=\\mathrm\{sign\}\\\!\\left\(\\max\_\{b\}A\_\{\\mathrm\{gated\}\}\(b,x\)\-A\_\{\\mathrm\{plain\}\}\(1,x\)\\right\)\\in\\\{\-1,0,\+1\\\}, where the maximum is over the budget sweep andAplain\(1,x\)A\_\{\\mathrm\{plain\}\}\(1,x\)is the full\-cache plain accuracy\. Figure[10](https://arxiv.org/html/2609.22157#A1.F10)pools all\(M,T\)\(M,T\)cells per task, and Figure[11](https://arxiv.org/html/2609.22157#A1.F11)reports the fraction of strictly recovered inputs \(r⁡\(x\)\>0r\(x\)\>0\) within each\(M,T\)\(M,T\)cell\.

##### Whatr⁡\(x\)r\(x\)can and cannot show

The budget sweep includesb=1\.0b=1\.0, and atb=1\.0b=1\.0the gated arm keeps the entire cache and reproduces the plain full\-cache outcome\. We audit this on all1616matrix cells plus the four1616K cells: atb=1\.0b=1\.0,nkept=Tn\_\{\\text\{kept\}\}=TandAgated=AplainA\_\{\\mathrm\{gated\}\}=A\_\{\\mathrm\{plain\}\}on every one of the5,1205\{,\}120rows\. Hencemaxb⁡Agated\(b,x\)≥Agated\(1,x\)=Aplain\(1,x\)\\max\_\{b\}A\_\{\\mathrm\{gated\}\}\(b,x\)\\geq A\_\{\\mathrm\{gated\}\}\(1,x\)=A\_\{\\mathrm\{plain\}\}\(1,x\)andr⁡\(x\)≥0r\(x\)\\geq 0is an*identity*, not a measurement\. The emptyr=−1r=\-1bin is therefore true by construction and carries no information about whether gating ever harms an input\.r⁡\(x\)r\(x\)should instead be read only as an*oracle\-budget recovery*measure, that is, how often some budget in the sweep beats the full cache\. The question it cannot answer, whether a*deployed*gate at a*fixed*budget ever loses an answer the full cache would have got, is answered by the harm rate below\.

##### Fixed\-budget harm rate

Holdingbbfixed makes “worse than the full cache” a real event\. Table[27](https://arxiv.org/html/2609.22157#A1.T27)reportsPrx\[A\(b,x\)<Aplain\(1,x\)\]\\Pr\_\{x\}\[A\(b,x\)<A\_\{\\mathrm\{plain\}\}\(1,x\)\]for the gated and plain arms at matchedbb, pooled over the seven SnapKV\(model,context\)\(\\text\{model\},\\text\{context\}\)cells \(N=500N=500per task and budget\)\.

Table 27:Fixed\-budget harm ratePrx\[A\(b,x\)<Aplain\(1,x\)\]\\Pr\_\{x\}\[A\(b,x\)<A\_\{\\mathrm\{plain\}\}\(1,x\)\], gated / plain at matched nominal budget, pooled over the seven SnapKV cells \(Qwen2\.5\-1\.5B/3B/14B and Mistral\-7B at 4K; Qwen2\.5\-1\.5B/3B and Mistral\-7B at 16K\),N=500N=500per \(task, budget\),τ=0\.07\\tau=0\.07\. Unliker⁡\(x\)r\(x\)above this is not vacuous: the gate can and does harm inputs\. On the capacity\-bound task it cuts harm by29×29\\timesat16×16\\timescompression; on QA\_1 it is exactly inert \(identical rates, the gate opens on every input\); on VT at16×16\\timesboth arms are harmed almost equally, so the gate does not help there\.The1616K Qwen2\.5\-1\.5B cell isgated\_16k\_qwen15b\_sdpa\.jsonl, the SDPA\-prefill run reported throughout the paper\. An earlier aborted eager run left a nine\-row NIAH\-MK3\-only stub under a similar name; pooling that stub instead drops5050inputs per task from FWE, QA\_1 and VT and shifts the column above to0\.029/0\.7960\.029/0\.796,0\.291/0\.4440\.291/0\.444,0\.118/0\.1180\.118/0\.118and0\.751/0\.7560\.751/0\.756\. We state this because the two files are easy to confuse and the released analysis script pins the correct one\.

Figure 10:Per\-input recovery indicatorr⁡\(x\)r\(x\)pooled across model and context cells, faceted by RULER task\. The three dilution\-prone tasks show a non\-trivial right tail atr=\+1r\{=\}\{\+\}1; NIAH\-MK3 is concentrated entirely atr=0r\{=\}0, consistent with the capacity\-bound regime\. Ther=−1r\{=\}\{\-\}1bin is empty by construction, not by measurement, because the budget sweep includesb=1\.0b=1\.0; see the identity argument above and Table[27](https://arxiv.org/html/2609.22157#A1.T27)for the harm rate this figure cannot report\.Figure 11:Fraction of inputs with strict recoveryr⁡\(x\)\>0r\(x\)\>0per task, faceted by\(model,context\)\(\\text\{model\},\\text\{context\}\)cell\. Dilution\-prone bars are non\-trivial in every cell with data, while NIAH\-MK3 stays at or near zero, visualising the partition input by input\.The histograms show thatρ\\rhois not driven by a few outliers: across the three dilution\-prone tasks we recover a few percent to over ten percent of inputs in many cells\. NIAH\-MK3 sits atr=0r\{=\}0on essentially every input, confirming that the capacity\-bound regime is a genuine null rather than a noisy average\. This input\-level view matches the partition diagnosed by the scaling formula and rules out the reading that gating helps only a small number of inputs by chance\. It does not license any claim that gating is harmless: Table[27](https://arxiv.org/html/2609.22157#A1.T27)shows that at a fixed budget the gate harms2\.6%2\.6\\%of NIAH\-MK3 inputs and23\.6%23\.6\\%of FWE inputs at16×16\\timescompression\.

#### A\.7\.2Confidence intervals for the headline numbers

Tables[28](https://arxiv.org/html/2609.22157#A1.T28)and[29](https://arxiv.org/html/2609.22157#A1.T29)report95%95\\%intervals for every headline delta, computed as described in the uncertainty paragraph of Section[4](https://arxiv.org/html/2609.22157#S4)\. Full per\-cell derivations ship with the released logs\.

Table 28:95% confidence intervals for the1616gating deltas of Table[2](https://arxiv.org/html/2609.22157#S4.T2)\. Cluster bootstrap over inputs: we resample the\(task,id\)\(\\text\{task\},\\text\{id\}\)pairs with replacement \(10,00010\{,\}000replicates\); each input contributes its per\-budget paired gated−\-plain differences, preserving the pairing and the within\-input correlation across budgets; intervals are2\.5−97\.52\.5\-97\.5percentiles\. All gated outcomes are the exactτ=0\.07\\tau=0\.07post\-hoc reconstruction of Appendix[F](https://arxiv.org/html/2609.22157#A6)\.N=400N=400inputs per cell \(44tasks×\\times100100\),N=200N=200for Qwen2\.5\-14B\.*Every one of the1616intervals excludes zero*; the smallest lower bound is\+0\.093\+0\.093\(Qwen2\.5\-1\.5B, SnapKV\)\. These are1616simultaneous comparisons, so we also adjust for multiplicity\. Under Benjamini\-Hochberg atq=0\.05q=0\.05, with per\-cellpp\-values from the same cluster bootstrap,*all1616cells survive*, the least significant atp≤5×10−4p\\leq 5\\times 10^\{\-4\}against a threshold of0\.0500\.050\. The adjustment does not change any conclusion drawn from this table, which is why we report it\.Table 29:95% CIs for the remaining headline deltas\. Cross\-architecture rows \(Table[16](https://arxiv.org/html/2609.22157#A1.T16)\) use the four\-budget grid and the same cluster bootstrap; 16K rows are the second half of Table[20](https://arxiv.org/html/2609.22157#A1.T20); the DBTrimKV row is Table[19](https://arxiv.org/html/2609.22157#A1.T19)\(N=120N=120inputs, budgets\{128,256,512\}\\\{128,256,512\\\}\)\. The Mistral NIAH\-MK3 showcase entries are Wilson score intervals onN=100N=100\. The only headline delta whose interval includes zero is Qwen2\.5\-3B at 16K, the gate\-misfire cell that Section[4\.1](https://arxiv.org/html/2609.22157#S4.SS1.SSS0.Px3)already reports as a shrunken effect\.
#### A\.7\.3Seed replicates

The intervals above are cluster bootstraps over a fixed set of inputs, so they quantify sampling within one draw and say nothing about the draw itself\. We therefore re\-ran five SnapKV cells under three draws of the RULER split, varying only the shuffle seed \(Table[30](https://arxiv.org/html/2609.22157#A1.T30)\)\. Decoding is greedy, so there is no decoding stochasticity to average over\.

Seed SD ranges from0\.0040\.004to0\.0110\.011against a grand\-meanΔ\\Deltaof\+0\.229\+0\.229, so draw\-to\-draw spread runs roughly an order of magnitude below the effect it measures\. The published SnapKV entries of Figure[8](https://arxiv.org/html/2609.22157#A1.F8)fall inside the replicate range for Qwen2\.5\-1\.5B, Qwen2\.5\-3B and Mistral\-7B\. The Qwen2\.5\-14B entry,\+0\.143\+0\.143, sits0\.0010\.001above the largest replicate, which we attribute toNN: that cell isN=200N=200in Table[2](https://arxiv.org/html/2609.22157#S4.T2)andN=400N=400here\.

Restricted to NIAH\-MK3, where nearly all ofΔ\\Deltalives, the spread widens to0\.009−0\.0450\.009\-0\.045on a much larger effect\. Qwen2\.5\-1\.5B is the loosest cell at0\.0450\.045on a mean near\+0\.45\+0\.45, still an order of magnitude below its own effect\.

All fifteen runs used one host, and the replicates of a cell are never split across machines\. That matters because the reproduction gate \(Appendix[F](https://arxiv.org/html/2609.22157#A6)\) finds a small but real host effect on meanDD, which would otherwise appear in this table as seed variance\.

Table 30:Seed replicates of the SnapKV cells\. Three draws of the RULER 4K split, identical in every other respect: greedy decoding,τ=0\.07\\tau=0\.07,Δ\\Deltaaveraged over budgetsb<1\.0b<1\.0,N=400N=400\(44tasks×\\times100100\)\. The lower block restricts to NIAH\-MK3\.Modelseed 1seed 2seed 3meanSDrange*All four tasks*Qwen2\.5\-1\.5B\+0\.113\+0\.113\+0\.099\+0\.099\+0\.122\+0\.122\+0\.111\+0\.1110\.0110\.022Qwen2\.5\-3B\+0\.255\+0\.255\+0\.267\+0\.267\+0\.275\+0\.275\+0\.266\+0\.2660\.0100\.019Qwen2\.5\-14B\+0\.133\+0\.133\+0\.140\+0\.140\+0\.142\+0\.142\+0\.138\+0\.1380\.0050\.010Mistral\-7B\+0\.187\+0\.187\+0\.194\+0\.194\+0\.183\+0\.183\+0\.188\+0\.1880\.0060\.011Llama\-3\.1\-8B\+0\.078\+0\.078\+0\.071\+0\.071\+0\.078\+0\.078\+0\.076\+0\.0760\.0040\.007*NIAH\-MK3 only*Qwen2\.5\-1\.5B\+0\.454\+0\.454\+0\.398\+0\.398\+0\.486\+0\.486\+0\.446\+0\.4460\.0450\.089Qwen2\.5\-3B\+0\.738\+0\.738\+0\.747\+0\.747\+0\.729\+0\.729\+0\.738\+0\.7380\.0090\.019Qwen2\.5\-14B\+0\.530\+0\.530\+0\.559\+0\.559\+0\.568\+0\.568\+0\.552\+0\.5520\.0200\.037Mistral\-7B\+0\.709\+0\.709\+0\.710\+0\.710\+0\.669\+0\.669\+0\.696\+0\.6960\.0230\.041Llama\-3\.1\-8B\+0\.310\+0\.310\+0\.282\+0\.282\+0\.311\+0\.311\+0\.301\+0\.3010\.0160\.029

## Appendix BRandom\-eviction control

We replace SnapKV scoring with uniform\-random per\-position scoring at every budget on a 4K, 4\-key synthetic NIAH probe \(N=150N=150, Qwen2\.5\-1\.5B\)\. To be clear about provenance, this 4\-key probe is our own construction and is*not*a RULER task: the NIAH\-MKkknames used elsewhere in the paper refer to RULER’sniah\_multikey\_kk\([Hsieh et al\., 2024](https://arxiv.org/html/2609.22157#bib.bib13)\), which tops out at three keys\. The score\-driven sweep retains accuracy at moderate budgets, while the uniform\-random sweep collapses immediately\.

Table 31:SnapKV vs\. uniform\-random scoring at matched budget on the 4K 4\-key synthetic NIAH probe\. Random eviction destroys accuracy long before the budget gets aggressive; the dilution effect requires informed scoring\.The per\-input recovery rateρ\\rhounder random scoring is0\.0270\.027\(vs\.0\.0130\.013under SnapKV\)\. The four “recovered” inputs under random are isolated successes among an otherwise destroyed distribution, and the control rules out a generic regularisation explanation: any\-eviction\-helps is falsified\.

## Appendix CPer\-layer eviction ablation

The default gating uses a single key\-mask shared across layers\. A per\-layer variant derives each layer’s keep mask from that layer’s own last\-window attention with the same total budget per layer \(uniform cache shape\)\. Table[32](https://arxiv.org/html/2609.22157#A3.T32)reportsρ\\rhoon the four dilution\-prone RULER tasks where per\-layer might plausibly help, on Qwen2\.5\-1\.5B at 4K and 16K\.

Table 32:Per\-layer vs\. single\-mask SnapKV on Qwen2\.5\-1\.5B\. Per\-layer wins clearly on aggregation tasks at 4K \(FWE1\.8×1\.8\\times, niah\_multivalue2\.1×2\.1\\times\); ties at 16K and on sequential\-integration tasks\.
## Appendix DProof sketch of the scaling proposition

We expand the sketch from Section[5](https://arxiv.org/html/2609.22157#S5)\.

##### Setup

LetT=R\+NT=R\+NwithRRrelevant andNNnoise positions\. Assume noise isotropy:αt≈\(1−αℛ\)/N\\alpha\_\{t\}\\approx\(1\-\\alpha\_\{\\mathcal\{R\}\}\)/Nfort∈𝒩t\\in\\mathcal\{N\}, withαℛ:=∑t∈ℛαt\\alpha\_\{\\mathcal\{R\}\}:=\\sum\_\{t\\in\\mathcal\{R\}\}\\alpha\_\{t\}\. Letσv2\\sigma\_\{v\}^\{2\}be the per\-distractor value\-vector variance under isotropy \(distinct from the pre\-softmax logit noise scaleσz\\sigma\_\{z\}of App\.[E](https://arxiv.org/html/2609.22157#A5)\)\. The pre\-eviction head SNR is

SNRpre=αℛ2σv2∑t∈𝒩αt2≈αℛ2Nσv2\(1−αℛ\)2\.\\mathrm\{SNR\}\_\{\\mathrm\{pre\}\}=\\frac\{\\alpha\_\{\\mathcal\{R\}\}^\{2\}\}\{\\sigma\_\{v\}^\{2\}\\sum\_\{t\\in\\mathcal\{N\}\}\\alpha\_\{t\}^\{2\}\}\\approx\\frac\{\\alpha\_\{\\mathcal\{R\}\}^\{2\}N\}\{\\sigma\_\{v\}^\{2\}\(1\-\\alpha\_\{\\mathcal\{R\}\}\)^\{2\}\}\.Eviction with noise\-retention ratioγ∈\(0,1\)\\gamma\\in\(0,1\)keeps a fractionρℛ\\rho\_\{\\mathcal\{R\}\}of the relevant mass and a fractionρ𝒩\\rho\_\{\\mathcal\{N\}\}of the noise mass\. After softmax renormalisation over the kept set, the post\-eviction relevant mass isα~ℛ=ρℛαℛ/Z\\widetilde\{\\alpha\}\_\{\\mathcal\{R\}\}=\\rho\_\{\\mathcal\{R\}\}\\alpha\_\{\\mathcal\{R\}\}/ZwithZ=ρℛαℛ\+ρ𝒩\(1−αℛ\)Z=\\rho\_\{\\mathcal\{R\}\}\\alpha\_\{\\mathcal\{R\}\}\+\\rho\_\{\\mathcal\{N\}\}\(1\-\\alpha\_\{\\mathcal\{R\}\}\), and the retained noise positions numberγN\\gamma Nwith per\-position massρ𝒩\(1−αℛ\)/\(ZγN\)\\rho\_\{\\mathcal\{N\}\}\(1\-\\alpha\_\{\\mathcal\{R\}\}\)/\(Z\\gamma N\)\. Substituting,

SNRpost=α~ℛ2σv2∑t∈𝒦∩𝒩α~t2≈ρℛ2αℛ2γNσv2ρ𝒩2\(1−αℛ\)2=ρℛ2ρ𝒩2γ−1⋅SNRpre\.\\mathrm\{SNR\}\_\{\\mathrm\{post\}\}=\\frac\{\\widetilde\{\\alpha\}\_\{\\mathcal\{R\}\}^\{2\}\}\{\\sigma\_\{v\}^\{2\}\\sum\_\{t\\in\\mathcal\{K\}\\cap\\mathcal\{N\}\}\\widetilde\{\\alpha\}\_\{t\}^\{2\}\}\\approx\\frac\{\\rho\_\{\\mathcal\{R\}\}^\{2\}\\alpha\_\{\\mathcal\{R\}\}^\{2\}\\,\\gamma N\}\{\\sigma\_\{v\}^\{2\}\\,\\rho\_\{\\mathcal\{N\}\}^\{2\}\(1\-\\alpha\_\{\\mathcal\{R\}\}\)^\{2\}\}=\\frac\{\\rho\_\{\\mathcal\{R\}\}^\{2\}\}\{\\rho\_\{\\mathcal\{N\}\}^\{2\}\\,\\gamma^\{\-1\}\}\\cdot\\mathrm\{SNR\}\_\{\\mathrm\{pre\}\}\.\(10\)Under good scoring \(ρℛ≥ρ𝒩\\rho\_\{\\mathcal\{R\}\}\\geq\\rho\_\{\\mathcal\{N\}\}withρ𝒩≈γ\\rho\_\{\\mathcal\{N\}\}\\approx\\gammaon a calibrated scorer\), the gain factor reduces toρℛ2/γ\\rho\_\{\\mathcal\{R\}\}^\{2\}/\\gamma, so the post\-eviction SNR strictly exceeds the pre\-eviction SNR\. The renormalisationZZis the step that turns the raw fractions\(ρℛ,ρ𝒩\)\(\\rho\_\{\\mathcal\{R\}\},\\rho\_\{\\mathcal\{N\}\}\)into a usable SNR ratio\. Without it the argument would collapse toρℛ2/γ\\rho\_\{\\mathcal\{R\}\}^\{2\}/\\gammaabsent the squaring\.

##### Factorisation

We work inside the surrogate, where the true accuracy indicator𝟏\[A\(b,x\)\>A\(bmax,x\)\]\\mathbf\{1\}\[A\(b,x\)\>A\(b\_\{\\max\},x\)\]is replaced by the surrogate indicator𝟏\[A^\(SNR\(b,x\)\)\>A^\(SNR\(bmax,x\)\)\]\\mathbf\{1\}\[\\hat\{A\}\(\\mathrm\{SNR\}\(b,x\)\)\>\\hat\{A\}\(\\mathrm\{SNR\}\(b\_\{\\max\},x\)\)\]withA^:\[0,∞\)→\[0,1\]\\hat\{A\}:\[0,\\infty\)\\to\[0,1\]strictly increasing and saturating at11\. This replacement is the surrogate’s content: it asserts that accuracy is a deterministic function of head SNR\. Within the surrogate the improvement event factorises as

𝟏\[A^\(SNRpost\)\>A^\(SNR\(bmax,x\)\)\]=𝟏\[A^\(SNR\(bmax,x\)\)<1\]⋅𝟏\[A^\(SNRpost\)\>A^\(SNRpre\)\]\.\\mathbf\{1\}\[\\hat\{A\}\(\\mathrm\{SNR\}\_\{\\mathrm\{post\}\}\)\>\\hat\{A\}\(\\mathrm\{SNR\}\(b\_\{\\max\},x\)\)\]=\\mathbf\{1\}\[\\hat\{A\}\(\\mathrm\{SNR\}\(b\_\{\\max\},x\)\)<1\]\\cdot\\mathbf\{1\}\[\\hat\{A\}\(\\mathrm\{SNR\}\_\{\\mathrm\{post\}\}\)\>\\hat\{A\}\(\\mathrm\{SNR\}\_\{\\mathrm\{pre\}\}\)\]\.Both monotonicity and saturation are needed: ifA^\\hat\{A\}were not strictly increasing the second indicator could fire without an SNR gain, and ifA^\\hat\{A\}did not saturate at11the caseA^\(SNR⁡\(bmax,x\)\)=1\\hat\{A\}\(\\mathrm\{SNR\}\(b\_\{\\max\},x\)\)=1would not zero out the left\-hand side\. The first indicator is the headroom in the surrogate \(a population\-level proxy for the true full\-cache failure probability1−Afull1\-A\_\{\\mathrm\{full\}\}\)\. The second depends only onρℛ2/γ\\rho\_\{\\mathcal\{R\}\}^\{2\}/\\gammavia Eq\. equation[10](https://arxiv.org/html/2609.22157#A4.E10)onceρ𝒩≈γ\\rho\_\{\\mathcal\{N\}\}\\approx\\gammais folded in\. The transfer from surrogate event to operational accuracy is mediated by the surrogate\-fits\-data assumption: we treatA^\\hat\{A\}as a good fit to the expected accuracy conditional on SNR, and deviations are absorbed into the empirical constant, fitted at0\.340\.34\. Marginalising over the prompt distribution and treating the two indicators as independent gives

ρKV\(𝖳,M,T\)≈\(1−Afull\(M,T\)\)⋅precov\(ρℛ2/γ\),\\rho\_\{\\mathrm\{KV\}\}\(\\mathsf\{T\},M,T\)\\approx\\bigl\(1\-A\_\{\\mathrm\{full\}\}\(M,T\)\\bigr\)\\cdot p\_\{\\mathrm\{recov\}\}\(\\rho\_\{\\mathcal\{R\}\}^\{2\}/\\gamma\),which is Eq\. equation[4](https://arxiv.org/html/2609.22157#S5.E4)\. The boundary conditions onprecovp\_\{\\mathrm\{recov\}\}follow from the surrogate, and both are statements about the gain argumentg=ρℛ2/γg=\\rho\_\{\\mathcal\{R\}\}^\{2\}/\\gammaof Eq\. equation[7](https://arxiv.org/html/2609.22157#A1.E7)rather than aboutρℛ\\rho\_\{\\mathcal\{R\}\}andγ\\gammaseparately\. Atρℛ=0\\rho\_\{\\mathcal\{R\}\}=0no relevant mass survives, soSNRpost=0\\mathrm\{SNR\}\_\{\\mathrm\{post\}\}=0, recovery is impossible andg=0g=0\. Atγ=1\\gamma=1\(no eviction\)SNRpost=SNRpre\\mathrm\{SNR\}\_\{\\mathrm\{post\}\}=\\mathrm\{SNR\}\_\{\\mathrm\{pre\}\}identically, the second indicator never fires, andg=ρℛ2≤1g=\\rho\_\{\\mathcal\{R\}\}^\{2\}\\leq 1\. More generally the second indicator requiresSNRpost\>SNRpre\\mathrm\{SNR\}\_\{\\mathrm\{post\}\}\>\\mathrm\{SNR\}\_\{\\mathrm\{pre\}\}, which by Eq\. equation[10](https://arxiv.org/html/2609.22157#A4.E10)is exactlyg\>1g\>1\. Henceprecov\(g\)=0p\_\{\\mathrm\{recov\}\}\(g\)=0on the whole dead zoneg≤1g\\leq 1, and is non\-decreasing above it\. Stating the two endpoints separately asprecov\(0\)=precov\(1\)=0p\_\{\\mathrm\{recov\}\}\(0\)=p\_\{\\mathrm\{recov\}\}\(1\)=0with monotonicity on\[0,1\]\[0,1\]would forceprecov≡0p\_\{\\mathrm\{recov\}\}\\equiv 0there, which is the dead zone rather than a prediction of no recovery anywhere\.

##### From surrogate to operationalρKV\\rho\_\{\\mathrm\{KV\}\}

The factorisation argues about the improvement event at a single budgetbb, whereas the operationalρKV\\rho\_\{\\mathrm\{KV\}\}\(Eq\. equation[1](https://arxiv.org/html/2609.22157#S3.E1)\) is the per\-input strict\-Pareto frequency over the best budgetb∗\(x\)b^\{\*\}\(x\)\. The two are related by a union bound over the discrete budget gridℬ=\{b1,…,bK\}\\mathcal\{B\}=\\\{b\_\{1\},\\dots,b\_\{K\}\\\}:

Prx\[A\(b∗\(x\),x\)\>A\(bmax,x\)\]\\displaystyle\\Pr\_\{x\}\\bigl\[A\(b^\{\*\}\(x\),x\)\>A\(b\_\{\\max\},x\)\\bigr\]=Prx\[∃b∈ℬ:A\(b,x\)\>A\(bmax,x\)\]\\displaystyle=\\Pr\_\{x\}\\bigl\[\\exists\\,b\\in\\mathcal\{B\}:A\(b,x\)\>A\(b\_\{\\max\},x\)\\bigr\]≤∑b∈ℬPrx\[A\(b,x\)\>A\(bmax,x\)\]\.\\displaystyle\\leq\\sum\_\{b\\in\\mathcal\{B\}\}\\Pr\_\{x\}\\bigl\[A\(b,x\)\>A\(b\_\{\\max\},x\)\\bigr\]\.Under monotone recovery \(precovp\_\{\\mathrm\{recov\}\}non\-decreasing inρℛ2/γ\\rho\_\{\\mathcal\{R\}\}^\{2\}/\\gamma, withρℛ\\rho\_\{\\mathcal\{R\}\}determined by the scorer’s top\-kkat eachbb\), the right\-hand side is bounded byK⋅Prx\[A\(b~,x\)\>A\(bmax,x\)\]K\\cdot\\Pr\_\{x\}\[A\(\\widetilde\{b\},x\)\>A\(b\_\{\\max\},x\)\]for the budgetb~\\widetilde\{b\}that maximises the per\-budget improvement probability\. Under the independence approximation of the previous paragraph, this maximiser term equals Eq\. equation[4](https://arxiv.org/html/2609.22157#S5.E4), so

ρKV\(𝖳,M,T\)≤K⋅\(1−Afull\(M,T\)\)⋅precov\(ρℛ2/γ\)\.\\rho\_\{\\mathrm\{KV\}\}\(\\mathsf\{T\},M,T\)\\;\\leq\\;K\\cdot\\bigl\(1\-A\_\{\\mathrm\{full\}\}\(M,T\)\\bigr\)\\cdot p\_\{\\mathrm\{recov\}\}\\bigl\(\\rho\_\{\\mathcal\{R\}\}^\{2\}/\\gamma\\bigr\)\.This is a one\-sided upper bound at the cost of a multiplicative grid factorKK\.The factor is an artifact of the union step and is not needed\.Appendix[G](https://arxiv.org/html/2609.22157#A7)shows that on any budget grid whose improvement events are nested, which is what a calibrated scorer produces, the correct leading constant is exactly11, and characterises the nested\-versus\-disjoint boundary at which a real factorKKcould appear\. We therefore state the bound with constant11and keep theKKform only to show where the loose version comes from\. It is never binding on our grid\.

##### Independence bound via covariance

LetAAandBBdenote the headroom and recovery indicators viewed as Bernoulli random variables under the prompt\-distribution measure\. The exact decomposition isPr⁡\[A⋅B\]=Pr⁡\[A\]Pr⁡\[B\]\+Cov⁡\(A,B\)\\Pr\[A\\cdot B\]=\\Pr\[A\]\\,\\Pr\[B\]\+\\mathrm\{Cov\}\(A,B\), so the independence step incurs only the covariance residual\. Both indicators are monotonically decreasing inαℛ\\alpha\_\{\\mathcal\{R\}\}: largerαℛ\\alpha\_\{\\mathcal\{R\}\}raisesSNRpre\\mathrm\{SNR\}\_\{\\mathrm\{pre\}\}, pushingAfullA\_\{\\mathrm\{full\}\}toward11\(less headroom, soAAtrends to00\) and simultaneously saturatingSNRpost\\mathrm\{SNR\}\_\{\\mathrm\{post\}\}earlier under \(A1\) noise\-isotropy \(less recovery margin, soBBtrends to00\)\. CouplingAAandBBthrough the single scalarαℛ\\alpha\_\{\\mathcal\{R\}\}makes them comonotone in this driver, so Chebyshev’s association \(sum\) inequality\([Harris, 1960](https://arxiv.org/html/2609.22157#bib.bib48)\)givesCov⁡\(A,B\)≥0\\mathrm\{Cov\}\(A,B\)\\geq 0, i\.e\.Pr⁡\[A⋅B\]≥Pr⁡\[A\]Pr⁡\[B\]\\Pr\[A\\cdot B\]\\geq\\Pr\[A\]\\,\\Pr\[B\]\. The lattice\-theoretic FKG inequality is not needed here and does not apply directly: both indicators are monotone functions of one scalar driver, which is the elementary Chebyshev/Harris setting\. Lemma[3](https://arxiv.org/html/2609.22157#Thmlemma3)in App\.[G](https://arxiv.org/html/2609.22157#A7)proves the same step, including the case whereAAcarries an auxiliary driver independent ofαℛ\\alpha\_\{\\mathcal\{R\}\}\. The Cauchy–Schwarz / Bernoulli\-variance bound\|Cov⁡\(A,B\)\|≤Var⁡\(A\)Var\(B\)≤1/4\|\\mathrm\{Cov\}\(A,B\)\|\\leq\\sqrt\{\\mathrm\{Var\}\(A\)\\,\\mathrm\{Var\}\(B\)\}\\leq 1/4then yields an absolute, distribution\-free residual\. Combining with the union\-bound paragraph above,

ρKV\(𝖳,M,T\)≤K⋅\(1−Afull\(M,T\)\)⋅precov\(ρℛ2/γ\)\+K/4\.\\rho\_\{\\mathrm\{KV\}\}\(\\mathsf\{T\},M,T\)\\;\\leq\\;K\\cdot\\bigl\(1\-A\_\{\\mathrm\{full\}\}\(M,T\)\\bigr\)\\cdot p\_\{\\mathrm\{recov\}\}\\bigl\(\\rho\_\{\\mathcal\{R\}\}^\{2\}/\\gamma\\bigr\)\\;\+\\;K/4\.TheK/4K/4term is rigorous but vacuous at ourK≤7K\\leq 7, since a bound of1\.751\.75on a probability says nothing\. BothKKfactors disappear under the sharpened treatment of Appendix[G](https://arxiv.org/html/2609.22157#A7), which replaces this paragraph’s conclusion with the exact identityρKV=\(1−Afull\)precov\+Cov⁡\(A,B\)\\rho\_\{\\mathrm\{KV\}\}=\(1\-A\_\{\\mathrm\{full\}\}\)\\,p\_\{\\mathrm\{recov\}\}\+\\mathrm\{Cov\}\(A,B\)and a covariance term that is signed rather than merely bounded\. The derivation above is included because it isolates the step that introduces the slack, though every empirical claim in the paper rests on the sharpened version\.

## Appendix EProof sketch: sufficient condition for the partition

We sketch a proof of the bridge inequality equation[9](https://arxiv.org/html/2609.22157#A1.E9): under the simplified attention model below, a large head\-agreement dropDDimplies a non\-trivial lower bound on Bui’s dilutionδt\\delta\_\{t\}\([Bui et al\., 2026](https://arxiv.org/html/2609.22157#bib.bib11)\)\. The argument is structured as five numbered steps followed by a converse heuristic, an empirical\-validation paragraph, and an explicit list of what is*not*proved\. We give closed forms for the constantsc1c\_\{1\}andc2\(γ\)c\_\{2\}\(\\gamma\)rather than leave them implicit\. The constants carry anO⁡\(H\)O\(H\)multiplicative slack from the pairwise\-to\-HH\-wise Jaccard step in Step 3, and tightening the constants is left to future work\.

##### Notation reminder

T=R\+NT=R\+Nkey positions partitioned into the relevant setℛ\\mathcal\{R\}\(\|ℛ\|=R\|\\mathcal\{R\}\|=R\) and noise set𝒩\\mathcal\{N\}\(\|𝒩\|=N\|\\mathcal\{N\}\|=N\), withR≪NR\\ll N\. There areLLlayers andHHheads\. For layerℓ∈\{1,…,L\}\\ell\\in\\\{1,\\dots,L\\\}and headh∈\{1,…,H\}h\\in\\\{1,\\dots,H\\\}, the pre\-softmax logits arezh,i\(ℓ\)=\(qh\(ℓ\)\)⊤ki\+ηh,i\(ℓ\)z^\{\(\\ell\)\}\_\{h,i\}=\(q^\{\(\\ell\)\}\_\{h\}\)^\{\\top\}k\_\{i\}\+\\eta^\{\(\\ell\)\}\_\{h,i\}, whereηh,i\(ℓ\)\\eta^\{\(\\ell\)\}\_\{h,i\}is zero\-meanσz\\sigma\_\{z\}\-sub\-Gaussian noise independent across\(ℓ,h,i\)\(\\ell,h,i\)\. The subscriptzzdistinguishes the pre\-softmax logit noise scale used here from the value\-vector varianceσv\\sigma\_\{v\}used in Appendix[D](https://arxiv.org/html/2609.22157#A4)\. We writeαh,i\(ℓ\)\\alpha^\{\(\\ell\)\}\_\{h,i\}for the post\-softmax attention\. Bui’s dilutionδt=1−∑i∈Utαt,i\\delta\_\{t\}=1\-\\sum\_\{i\\in U\_\{t\}\}\\alpha\_\{t,i\}is taken at the decoding query at steptt; we drop thettsubscript and writeδ:=δt\\delta:=\\delta\_\{t\}\.

##### Step 1 \(the surrogate model\)

We use the multi\-head lift of the single\-head surrogate from Appendix[D](https://arxiv.org/html/2609.22157#A4):

1. \(A1\)*Signal coherence\.*For each layerℓ\\elland headhh, there is a head\-private relevant subsetℛh\(ℓ\)⊆ℛ\\mathcal\{R\}^\{\(\\ell\)\}\_\{h\}\\subseteq\\mathcal\{R\}such that fori∈ℛh\(ℓ\)i\\in\\mathcal\{R\}^\{\(\\ell\)\}\_\{h\}the deterministic part of the logit satisfies\(qh\(ℓ\)\)⊤ki≥m\+\(q^\{\(\\ell\)\}\_\{h\}\)^\{\\top\}k\_\{i\}\\geq m\_\{\+\}, and fori∈𝒩i\\in\\mathcal\{N\},\(qh\(ℓ\)\)⊤ki≤m−\(q^\{\(\\ell\)\}\_\{h\}\)^\{\\top\}k\_\{i\}\\leq m\_\{\-\}, withm\+−m−≥m\>0m\_\{\+\}\-m\_\{\-\}\\geq m\>0\. Thismmis the*logit margin*; it is bounded above bylog⁡T\\log Tin the well\-trained regime\.
2. \(A2\)*Sub\-Gaussian noise\.*ηh,i\(ℓ\)\\eta^\{\(\\ell\)\}\_\{h,i\}is zero\-mean andσz2\\sigma\_\{z\}^\{2\}\-sub\-Gaussian, independent across\(ℓ,h,i\)\(\\ell,h,i\)\. This is the standard noise model used in attention\-as\-feature\-aggregation analyses\.
3. \(A3\)*Capacity\-bound vs dilution\-prone regimes\.*In the capacity\-bound regime𝒞\\mathcal\{C\}, all heads at all layers share a common relevant set:ℛh\(ℓ\)=ℛ\\mathcal\{R\}^\{\(\\ell\)\}\_\{h\}=\\mathcal\{R\}for every\(ℓ,h\)\(\\ell,h\)\. In the dilution\-prone regime𝒟\\mathcal\{D\}, late\-layer head subsets diverge: there exists a layer indexℓ∗\>L/2\\ell^\{\*\}\>L/2such that for any head pair\(h,h′\)\(h,h^\{\\prime\}\)at layerℓ∗\\ell^\{\*\},\|ℛh\(ℓ∗\)∩ℛh′\(ℓ∗\)\|/\|ℛh\(ℓ∗\)∪ℛh′\(ℓ∗\)\|≤Jlate\|\\mathcal\{R\}^\{\(\\ell^\{\*\}\)\}\_\{h\}\\cap\\mathcal\{R\}^\{\(\\ell^\{\*\}\)\}\_\{h^\{\\prime\}\}\|/\|\\mathcal\{R\}^\{\(\\ell^\{\*\}\)\}\_\{h\}\\cup\\mathcal\{R\}^\{\(\\ell^\{\*\}\)\}\_\{h^\{\\prime\}\}\|\\leq J\_\{\\text\{late\}\}, while early\-layer heads share their subsets,\|ℛh\(1\)∩ℛh′\(1\)\|/\|ℛh\(1\)∪ℛh′\(1\)\|≥Jearly\|\\mathcal\{R\}^\{\(1\)\}\_\{h\}\\cap\\mathcal\{R\}^\{\(1\)\}\_\{h^\{\\prime\}\}\|/\|\\mathcal\{R\}^\{\(1\)\}\_\{h\}\\cup\\mathcal\{R\}^\{\(1\)\}\_\{h^\{\\prime\}\}\|\\geq J\_\{\\text\{early\}\}, withJearly\>JlateJ\_\{\\text\{early\}\}\>J\_\{\\text\{late\}\}\. BothJearlyJ\_\{\\text\{early\}\}andJlateJ\_\{\\text\{late\}\}are model\-specific population constants of the surrogate, not functions ofLL\.
4. \(A4\)*Identification ofUtU\_\{t\}\.*We identify Bui’s useful setUtU\_\{t\}\(a decoding\-step quantity defined at the residual\-stream level\) with the head\-common signal setℐ\(ℓ∗\):=⋂hℛh\(ℓ∗\)\\mathcal\{I\}^\{\(\\ell^\{\*\}\)\}:=\\bigcap\_\{h\}\\mathcal\{R\}^\{\(\\ell^\{\*\}\)\}\_\{h\}at the divergence layerℓ∗\\ell^\{\*\}\(a single\-layer attention quantity\)\. The identification is a modelling choice \(positions every head agrees are signal\)\. It collapses time\-step and layer\-index axes, and the two coincide in the surrogate by fiat\. We flag it in the “What is not proved” list below\.

The empirical content of \(A3\) is the layer\-dependence we measure: early layers respond to local context \(similarℛh\(ℓ\)\\mathcal\{R\}^\{\(\\ell\)\}\_\{h\}across heads, regardless of task\), late layers respond to task structure \(head divergence on dilution\-prone tasks, head convergence on capacity\-bound tasks\)\. See §[3](https://arxiv.org/html/2609.22157#S3.SS0.SSS0.Px2)for the corresponding operational definitions\.

##### Step 2 \(head\-agreement drop as Jaccard divergence\)

The head\-agreement dropDDin Eq\. equation[3](https://arxiv.org/html/2609.22157#S3.E3)is the early\-late difference of mean pairwise top\-kkJaccard agreement, withkkchosen to be commensurate withRR\(in the experimentsk=32∼\|ℛ\|k=32\\sim\|\\mathcal\{R\}\|\)\. In the high\-SNR limit of the surrogate \(Lemma[2](https://arxiv.org/html/2609.22157#Thmlemma2)below\), each head’s top\-kkset concentrates on its own privateℛh\(ℓ\)\\mathcal\{R\}^\{\(\\ell\)\}\_\{h\}with high probability\. Hence at layerℓ\\ell,

aℓ≈1\(H2\)∑h<h′\|ℛh\(ℓ\)∩ℛh′\(ℓ\)\|\|ℛh\(ℓ\)∪ℛh′\(ℓ\)\|\.a\_\{\\ell\}\\;\\approx\\;\\frac\{1\}\{\\binom\{H\}\{2\}\}\\sum\_\{h<h^\{\\prime\}\}\\frac\{\|\\mathcal\{R\}^\{\(\\ell\)\}\_\{h\}\\cap\\mathcal\{R\}^\{\(\\ell\)\}\_\{h^\{\\prime\}\}\|\}\{\|\\mathcal\{R\}^\{\(\\ell\)\}\_\{h\}\\cup\\mathcal\{R\}^\{\(\\ell\)\}\_\{h^\{\\prime\}\}\|\}\.\(11\)Binning into early third and late third and subtracting,

D=aearly−alate≈J¯early−J¯late,D\\;=\\;a\_\{\\text\{early\}\}\-a\_\{\\text\{late\}\}\\;\\approx\\;\\overline\{J\}\_\{\\text\{early\}\}\-\\overline\{J\}\_\{\\text\{late\}\},\(12\)the difference of mean pairwise Jaccard between layers in the early and late bins\.DDis therefore a direct measurement of the head\-set divergence in \(A3\)\.

###### Lemma 2\(Top\-kkconcentration on the private set\)\.

Under \(A1\), \(A2\) withm≥σz4log⁡\(2H2LT2/β\)m\\geq\\sigma\_\{z\}\\sqrt\{4\\log\(2H^\{2\}LT^\{2\}/\\beta\)\}, the top\-kkset of head\(ℓ,h\)\(\\ell,h\)equalsℛh\(ℓ\)\\mathcal\{R\}^\{\(\\ell\)\}\_\{h\}jointly across allHLHLheads with probability≥1−β\\geq 1\-\\beta, whenk=\|ℛh\(ℓ\)\|k=\|\\mathcal\{R\}^\{\(\\ell\)\}\_\{h\}\|\.

*Proof\.*A standard sub\-Gaussian maximal inequality: for any pair\(i,j\)\(i,j\)withi∈ℛh\(ℓ\)i\\in\\mathcal\{R\}^\{\(\\ell\)\}\_\{h\}andj∈𝒩j\\in\\mathcal\{N\},Pr\[zh,i\(ℓ\)<zh,j\(ℓ\)\]≤exp\(−m2/\(4σz2\)\)\\Pr\[z\_\{h,i\}^\{\(\\ell\)\}<z\_\{h,j\}^\{\(\\ell\)\}\]\\leq\\exp\(\-m^\{2\}/\(4\\sigma\_\{z\}^\{2\}\)\)\. There areR⋅N≤T2/4R\\cdot N\\leq T^\{2\}/4such relevant\-vs\-noise pairs at each layer\-head\. Substituting the thresholdm≥σz4log⁡\(2H2LT2/β\)m\\geq\\sigma\_\{z\}\\sqrt\{4\\log\(2H^\{2\}LT^\{2\}/\\beta\)\}gives a per\-pair tail ofβ/\(2H2LT2\)\\beta/\(2H^\{2\}LT^\{2\}\)\. Union\-bounding over up toT2T^\{2\}pairs per layer\-head and over allHLHLlayer\-heads gives a total tail ofHL⋅T2⋅β/\(2H2LT2\)=β/\(2H\)≤βHL\\cdot T^\{2\}\\cdot\\beta/\(2H^\{2\}LT^\{2\}\)=\\beta/\(2H\)\\leq\\beta\.□\\square

The thresholdm≥σz4log⁡\(2H2LT2/β\)m\\geq\\sigma\_\{z\}\\sqrt\{4\\log\(2H^\{2\}LT^\{2\}/\\beta\)\}is the*margin condition*\. If it holds, every step below holds with probability≥1−β\\geq 1\-\\betaover the noise\.

##### Step 3 \(head\-set divergence forces union expansion\)

For each layerℓ\\elldefine the union of head\-private sets𝒰\(ℓ\):=⋃h=1Hℛh\(ℓ\)\\mathcal\{U\}^\{\(\\ell\)\}:=\\bigcup\_\{h=1\}^\{H\}\\mathcal\{R\}^\{\(\\ell\)\}\_\{h\}and the intersectionℐ\(ℓ\):=⋂h=1Hℛh\(ℓ\)\\mathcal\{I\}^\{\(\\ell\)\}:=\\bigcap\_\{h=1\}^\{H\}\\mathcal\{R\}^\{\(\\ell\)\}\_\{h\}\. The mean pairwise JaccardJ¯ℓ\\overline\{J\}\_\{\\ell\}at layerℓ\\ellis a*pairwise*object, whereas\|𝒰\(ℓ\)\|\|\\mathcal\{U\}^\{\(\\ell\)\}\|and\|ℐ\(ℓ\)\|\|\\mathcal\{I\}^\{\(\\ell\)\}\|areHH\-wise objects, so the ratio\|𝒰\|/\|ℐ\|\|\\mathcal\{U\}\|/\|\\mathcal\{I\}\|is not equal to1−J¯1\-\\overline\{J\}in general\. Inclusion\-exclusion only gives\|𝒰\|/\|ℐ\|≤1\+\(H−1\)\(1−J¯\)\|\\mathcal\{U\}\|/\|\\mathcal\{I\}\|\\leq 1\+\(H\-1\)\(1\-\\overline\{J\}\)in the best case, and the union\-vs\-intersection gap can scale withHHin the worst case\. We therefore avoid anHH\-wise identity and use the weaker pairwise inequality\. Under \(A3\),J¯ℓ∗≤Jlate\\overline\{J\}\_\{\\ell^\{\*\}\}\\leq J\_\{\\text\{late\}\}, so there exists a head pair\(h,h′\)\(h,h^\{\\prime\}\)at layerℓ∗\\ell^\{\*\}with\|ℛh\(ℓ∗\)∩ℛh′\(ℓ∗\)\|≤Jlate⋅\|ℛh\(ℓ∗\)∪ℛh′\(ℓ∗\)\|\|\\mathcal\{R\}^\{\(\\ell^\{\*\}\)\}\_\{h\}\\cap\\mathcal\{R\}^\{\(\\ell^\{\*\}\)\}\_\{h^\{\\prime\}\}\|\\leq J\_\{\\text\{late\}\}\\cdot\|\\mathcal\{R\}^\{\(\\ell^\{\*\}\)\}\_\{h\}\\cup\\mathcal\{R\}^\{\(\\ell^\{\*\}\)\}\_\{h^\{\\prime\}\}\|\. Picking the headh†h^\{\\dagger\}with the largest private residual setℛh†\(ℓ∗\)∖ℐ\(ℓ∗\)\\mathcal\{R\}^\{\(\\ell^\{\*\}\)\}\_\{h^\{\\dagger\}\}\\setminus\\mathcal\{I\}^\{\(\\ell^\{\*\}\)\},

\|𝒰\(ℓ∗\)∖ℐ\(ℓ∗\)\|≥\|ℛh†\(ℓ∗\)∖ℐ\(ℓ∗\)\|≥\(1−Jlate\)⋅maxh⁡\|ℛh\(ℓ∗\)\|\.\|\\mathcal\{U\}^\{\(\\ell^\{\*\}\)\}\\setminus\\mathcal\{I\}^\{\(\\ell^\{\*\}\)\}\|\\;\\geq\\;\|\\mathcal\{R\}^\{\(\\ell^\{\*\}\)\}\_\{h^\{\\dagger\}\}\\setminus\\mathcal\{I\}^\{\(\\ell^\{\*\}\)\}\|\\;\\geq\\;\(1\-J\_\{\\text\{late\}\}\)\\cdot\\max\_\{h\}\|\\mathcal\{R\}^\{\(\\ell^\{\*\}\)\}\_\{h\}\|\.\(13\)This is strictly weaker than treating\(\|𝒰\|−\|ℐ\|\)/\|𝒰\|\(\|\\mathcal\{U\}\|\-\|\\mathcal\{I\}\|\)/\|\\mathcal\{U\}\|as if it were equal to1−J¯1\-\\overline\{J\}, but it is correct, and the slack is absorbed inc1c\_\{1\}below\.

Under \(A4\), Bui’s useful set isUt=ℐ\(ℓ∗\)U\_\{t\}=\\mathcal\{I\}^\{\(\\ell^\{\*\}\)\}, so positions in𝒰\(ℓ∗\)∖ℐ\(ℓ∗\)\\mathcal\{U\}^\{\(\\ell^\{\*\}\)\}\\setminus\\mathcal\{I\}^\{\(\\ell^\{\*\}\)\}are attended by some head but not by all, and from the perspective of the next layer’s query they contribute attention mass outsideUtU\_\{t\}\.

##### Step 4 \(bridge to Bui’sδt\\delta\_\{t\}\)

Letα¯\\bar\{\\alpha\}denote the average per\-head, per\-position attention on a position inℛh\(ℓ∗\)\\mathcal\{R\}^\{\(\\ell^\{\*\}\)\}\_\{h\}at layerℓ∗\\ell^\{\*\}\. Under \(A1\) with marginmm, the softmax concentrates andα¯≥\(1−\(N/R\)e−m\)/R\\bar\{\\alpha\}\\geq\(1\-\(N/R\)e^\{\-m\}\)/Ron private positions, tight whenem≫N/Re^\{m\}\\gg N/R\(an earlier draft omitted theN/RN/Rfactor, which is not negligible in the paper’s ownR≪NR\\ll Nregime\)\. Treating per\-head value contributions as additive after the output projection \(a modelling choice we flag below\), the attention mass*outside*ℐ\(ℓ∗\)\\mathcal\{I\}^\{\(\\ell^\{\*\}\)\}contributed by the maximal\-residual head is at least

∑i∈ℛh†\(ℓ∗\)∖ℐ\(ℓ∗\)αh†,i\(ℓ∗\)≥α¯⋅\(1−Jlate\)⋅maxh⁡\|ℛh\(ℓ∗\)\|,\\sum\_\{i\\in\\mathcal\{R\}^\{\(\\ell^\{\*\}\)\}\_\{h^\{\\dagger\}\}\\setminus\\mathcal\{I\}^\{\(\\ell^\{\*\}\)\}\}\\alpha^\{\(\\ell^\{\*\}\)\}\_\{h^\{\\dagger\},i\}\\;\\geq\\;\\bar\{\\alpha\}\\cdot\(1\-J\_\{\\text\{late\}\}\)\\cdot\\max\_\{h\}\|\\mathcal\{R\}^\{\(\\ell^\{\*\}\)\}\_\{h\}\|,\(14\)using Eq\. equation[13](https://arxiv.org/html/2609.22157#A5.E13)\. Under eviction with noise\-retention ratioγ\\gammaand a top\-kkscorer that does not a priori distinguish signal\-side residuals from noise positions \(an additional modelling assumption beyond \(A1\)\-\(A4\) which we make explicit here\), positions in𝒰\(ℓ∗\)∖ℐ\(ℓ∗\)\\mathcal\{U\}^\{\(\\ell^\{\*\}\)\}\\setminus\\mathcal\{I\}^\{\(\\ell^\{\*\}\)\}inherit the same effective per\-position retention rateγ\\gammaas the noise set\. Those retained for only a subset of heads appear as distractors to the remaining heads after the cache is merged\. Conditional on this retention,

𝔼⁡\[δt\]≥α¯⋅\(1−Jlate\)⋅maxh⁡\|ℛh\(ℓ∗\)\|⋅\(1−γ\),\\mathbb\{E\}\[\\delta\_\{t\}\]\\;\\geq\\;\\bar\{\\alpha\}\\cdot\(1\-J\_\{\\text\{late\}\}\)\\cdot\\max\_\{h\}\|\\mathcal\{R\}^\{\(\\ell^\{\*\}\)\}\_\{h\}\|\\cdot\(1\-\\gamma\),\(15\)because the\(1−γ\)\(1\-\\gamma\)fraction of un\-retained positions in the residual private sets no longer balance the heads that did keep them, leaving a residual distractor mass proportional to\(1−γ\)\(1\-\\gamma\)\. This is a new bound derived in our surrogate\. It is structurally analogous to Bui’s Corollary 3\.2 \(which relates pre\- and post\-eviction dilution viaδ′=\(ρD/ρU\)δ/\[\(1−δ\)\+\(ρD/ρU\)δ\]\\delta^\{\\prime\}=\(\\rho\_\{D\}/\\rho\_\{U\}\)\\delta/\[\(1\-\\delta\)\+\(\\rho\_\{D\}/\\rho\_\{U\}\)\\delta\]\), but the input here is the head\-disagreement\-induced distractor set rather than a pre\-existing dilution\.

##### Step 5 \(closing the bridge: solve forDD\)

Eq\. equation[15](https://arxiv.org/html/2609.22157#A5.E15)uses\(1−J¯late\)\(1\-\\overline\{J\}\_\{\\text\{late\}\}\), which we relate to the observableDDvia Eq\. equation[12](https://arxiv.org/html/2609.22157#A5.E12):D=J¯early−J¯lateD=\\overline\{J\}\_\{\\text\{early\}\}\-\\overline\{J\}\_\{\\text\{late\}\}\. SinceJ¯early≤1\\overline\{J\}\_\{\\text\{early\}\}\\leq 1trivially \(Jaccard is bounded by one\),D≤1−J¯lateD\\leq 1\-\\overline\{J\}\_\{\\text\{late\}\}, so substituting gives

𝔼⁡\[δt\]≥α¯⋅D⋅maxh⁡\|ℛh\(ℓ∗\)\|⋅\(1−γ\)\.\\mathbb\{E\}\[\\delta\_\{t\}\]\\;\\geq\\;\\bar\{\\alpha\}\\cdot D\\cdot\\max\_\{h\}\|\\mathcal\{R\}^\{\(\\ell^\{\*\}\)\}\_\{h\}\|\\cdot\(1\-\\gamma\)\.\(16\)The substitution1−J¯late≥D1\-\\overline\{J\}\_\{\\text\{late\}\}\\geq Dholds always; we do not require the strongerJ¯early≈1\\overline\{J\}\_\{\\text\{early\}\}\\approx 1assumption\. The looser the value ofJ¯early\\overline\{J\}\_\{\\text\{early\}\}, the larger the gap between1−J¯late1\-\\overline\{J\}\_\{\\text\{late\}\}andDD, and the looser this bound is relative to its tightest form\.

Thelog⁡\(1/γ\)\\log\(1/\\gamma\)factor on the right\-hand side of Eq\. equation[9](https://arxiv.org/html/2609.22157#A1.E9)is a heuristic amplification term, not a rigorous consequence of the steps above\. The intended argument is that after eviction the cache retainsγN\\gamma Nnoise positions, and the maximum ofγN\\gamma Nsub\-Gaussian logits concentrates nearσz2log⁡γN\\sigma\_\{z\}\\sqrt\{2\\log\\gamma N\}\. The multiplicative penalty on the head signal\-to\-noise budget should scale with the post\-eviction noise floor relative to the pre\-eviction floor\. A careful Taylor expansion of2log⁡N−2log⁡γN\\sqrt\{2\\log N\}\-\\sqrt\{2\\log\\gamma N\}gives a difference of orderlog⁡\(1/γ\)/2log⁡N\\log\(1/\\gamma\)/\\sqrt\{2\\log N\}, notlog⁡\(1/γ\)\\log\(1/\\gamma\)itself, so the log factor therefore captures only the worst\-case noise\-tail shift at smallNNand not the asymptotic regime\. We retain thelog⁡\(1/γ\)\\log\(1/\\gamma\)factor in Eq\. equation[9](https://arxiv.org/html/2609.22157#A1.E9)as a convenient packaging of the eviction amplification, but we flag this as gap \(G5\) in the list below\. Readers willing to drop the factor entirely can read Eq\. equation[9](https://arxiv.org/html/2609.22157#A1.E9)asD≥c1D\\geq c\_\{1\}withc1=1/Jearlyc\_\{1\}=1/J\_\{\\text\{early\}\}\. This is the conservative no\-amplification reading, and it is also empirically consistent with theτ=0\.07\\tau=0\.07threshold we calibrate \(Section[3](https://arxiv.org/html/2609.22157#S3.SS0.SSS0.Px4)\)\.

Two heuristic observations close the bridge to\(1−Afull\)\(1\-A\_\{\\mathrm\{full\}\}\)\. Both are leading\-order estimates rather than rigorous bounds, and we flag them in the gap list\. \(i\) Under \(A1\) noise\-isotropy and the high\-SNR regime, the average per\-position mass on a relevant position satisfiesα¯≈αℛ/R\\bar\{\\alpha\}\\approx\\alpha\_\{\\mathcal\{R\}\}/R, and under \(A3\) the head\-private sets collectively cover most ofℛ\\mathcal\{R\}in the dilution\-prone regime so thatmaxh⁡\|ℛh\(ℓ∗\)\|≈R\\max\_\{h\}\|\\mathcal\{R\}^\{\(\\ell^\{\*\}\)\}\_\{h\}\|\\approx R\. The product is thereforeα¯⋅maxh⁡\|ℛh\(ℓ∗\)\|≈αℛ\\bar\{\\alpha\}\\cdot\\max\_\{h\}\|\\mathcal\{R\}^\{\(\\ell^\{\*\}\)\}\_\{h\}\|\\approx\\alpha\_\{\\mathcal\{R\}\}as an order\-of\-magnitude estimate\. \(The set containmentℛh\(ℓ∗\)⊆ℛ\\mathcal\{R\}^\{\(\\ell^\{\*\}\)\}\_\{h\}\\subseteq\\mathcal\{R\}alone gives the reverse inequalityα¯⋅maxh⁡\|ℛh\(ℓ∗\)\|≤αℛ\\bar\{\\alpha\}\\cdot\\max\_\{h\}\|\\mathcal\{R\}^\{\(\\ell^\{\*\}\)\}\_\{h\}\|\\leq\\alpha\_\{\\mathcal\{R\}\}, so the leading\-order substitution is the honest reading and is flagged in the gap list\.\) \(ii\) Combining the headroom factorisation of Appendix[D](https://arxiv.org/html/2609.22157#A4)\(Eq\. equation[4](https://arxiv.org/html/2609.22157#S5.E4)\) with the strictly increasing accuracy surrogate gives\(1−Afull\)≤C⋅αℛ\(1\-A\_\{\\mathrm\{full\}\}\)\\leq C\\cdot\\alpha\_\{\\mathcal\{R\}\}on dilution\-prone tasks for a constantCCdepending only on the slope ofA^\(⋅\)\\hat\{A\}\(\\cdot\)near the operating SNR\.

Combining \(i\) \(as a leading\-order estimate\) and \(ii\) with Eq\. equation[16](https://arxiv.org/html/2609.22157#A5.E16)yields the operational bridge

𝔼⁡\[δt\]≳\(1−γ\)C⋅D⋅\(1−Afull\),\\mathbb\{E\}\[\\delta\_\{t\}\]\\;\\gtrsim\\;\\frac\{\(1\-\\gamma\)\}\{C\}\\cdot D\\cdot\(1\-A\_\{\\mathrm\{full\}\}\),\(17\)where≳\\gtrsimdenotes leading\-order in the surrogate\. The substitutionα¯⋅maxh⁡\|ℛh\(ℓ∗\)\|≈αℛ\\bar\{\\alpha\}\\cdot\\max\_\{h\}\|\\mathcal\{R\}^\{\(\\ell^\{\*\}\)\}\_\{h\}\|\\approx\\alpha\_\{\\mathcal\{R\}\}is the source of the≳\\gtrsimrather than≥\\geq\. The conservative rigorous reading replacesαℛ\\alpha\_\{\\mathcal\{R\}\}on the right\-hand side withα¯⋅maxh⁡\|ℛh\(ℓ∗\)\|≤αℛ\\bar\{\\alpha\}\\cdot\\max\_\{h\}\|\\mathcal\{R\}^\{\(\\ell^\{\*\}\)\}\_\{h\}\|\\leq\\alpha\_\{\\mathcal\{R\}\}and drops the bridge to\(1−Afull\)\(1\-A\_\{\\mathrm\{full\}\}\)entirely\. We use≳\\gtrsimfor the operational reading\.

Eq\. equation[17](https://arxiv.org/html/2609.22157#A5.E17)is the load\-bearing bridge between the observableDDand Bui’s dilution under the empirical headroom proxy\. Eq\. equation[9](https://arxiv.org/html/2609.22157#A1.E9)in Section[5](https://arxiv.org/html/2609.22157#S5)packages this relationship as a threshold inequality\. SubstitutingD≥τD\\geq\\uptauinto Eq\. equation[17](https://arxiv.org/html/2609.22157#A5.E17)gives𝔼⁡\[δt\]≳\(\(1−γ\)τ/C\)⋅\(1−Afull\)\\mathbb\{E\}\[\\delta\_\{t\}\]\\gtrsim\(\(1\-\\gamma\)\\uptau/C\)\\cdot\(1\-A\_\{\\mathrm\{full\}\}\), so any chosen thresholdτ\\uptauonDDproduces a correspondingc2=\(1−γ\)τ/Cc\_\{2\}=\(1\-\\gamma\)\\uptau/C\. Choosingτ=c1log⁡\(1/γ\)\\uptau=c\_\{1\}\\log\(1/\\gamma\)withc1=1/Jearlyc\_\{1\}=1/J\_\{\\text\{early\}\},

c1=1Jearly,c2\(γ\)=\(1−γ\)⋅log⁡\(1/γ\)C⋅Jearly\.\\boxed\{c\_\{1\}\\;=\\;\\frac\{1\}\{J\_\{\\text\{early\}\}\},\\qquad c\_\{2\}\(\\gamma\)\\;=\\;\\frac\{\(1\-\\gamma\)\\cdot\\log\(1/\\gamma\)\}\{C\\cdot J\_\{\\text\{early\}\}\}\.\}\(18\)JearlyJ\_\{\\text\{early\}\}enters the threshold as a model\-specific scale that makesc1c\_\{1\}commensurate with the empirical Jaccard floor across heads\. On our test modelsJearly∈\[0\.4,0\.7\]J\_\{\\text\{early\}\}\\in\[0\.4,0\.7\], givingc1∈\[1\.4,2\.5\]c\_\{1\}\\in\[1\.4,2\.5\]\. The empiricalτ=0\.07\\tau=0\.07is well below this, consistent with the constants being loose \(per theO⁡\(H\)O\(H\)slack in Step 3 and the heuristic substitution in observation \(i\) above\)\. Both constants carry anO⁡\(H\)O\(H\)multiplicative slack from the pairwise\-to\-HH\-wise step of Step 3, and thelog⁡\(1/γ\)\\log\(1/\\gamma\)factor inc1log⁡\(1/γ\)c\_\{1\}\\log\(1/\\gamma\)is heuristic per gap \(G5\)\. The conservative no\-amplification reading drops thelog⁡\(1/γ\)\\log\(1/\\gamma\)factor and gives the thresholdD≥c1=1/JearlyD\\geq c\_\{1\}=1/J\_\{\\text\{early\}\}with ratec2\(γ\)=\(1−γ\)/\(C⋅Jearly\)c\_\{2\}\(\\gamma\)=\(1\-\\gamma\)/\(C\\cdot J\_\{\\text\{early\}\}\)directly\.

##### The converse direction \(heuristic, sufficient\-side only\)

The partition predictor’s operational claim is the contrapositive:*smallDD⇒\\Rightarrowlow dilution⇒\\Rightarroweviction is risky*\. We sketch two arguments and flag that neither is a separate necessity proof\.

The first is a comment on the sufficient\-side lower bound: under \(A3\) for the capacity\-bound regime𝒞\\mathcal\{C\}\(ℛh\(ℓ\)=ℛ\\mathcal\{R\}^\{\(\\ell\)\}\_\{h\}=\\mathcal\{R\}for all\(ℓ,h\)\(\\ell,h\)\), the union and intersection coincide, so the right\-hand side of Eq\. equation[15](https://arxiv.org/html/2609.22157#A5.E15)is zero\. Since Eq\. equation[15](https://arxiv.org/html/2609.22157#A5.E15)is a*lower*bound on𝔼⁡\[δt\]\\mathbb\{E\}\[\\delta\_\{t\}\], a zero right\-hand side does not boundδt\\delta\_\{t\}from above\. It only says the sufficient lower bound becomes vacuous\.

The second is an upper bound onδt\\delta\_\{t\}that does provide some necessary\-side content, but only inside the surrogate\. Under \(A1\) with marginmmsatisfying the threshold of Lemma[2](https://arxiv.org/html/2609.22157#Thmlemma2), and \(A3\) regime𝒞\\mathcal\{C\}so thatUt=ℛU\_\{t\}=\\mathcal\{R\}for every head, the pairwise top\-kkJaccard between heads is≥Jearly\\geq J\_\{\\text\{early\}\}at every layer \(no late\-layer divergence\), so\|𝒰\|/\|ℐ\|→1\|\\mathcal\{U\}\|/\|\\mathcal\{I\}\|\\to 1and there is no residual distractor mass\. The attention mass on𝒩\\mathcal\{N\}for any single head is bounded by the sub\-Gaussian tailO\(exp\(−m2/\(4σz2\)\)\)O\(\\exp\(\-m^\{2\}/\(4\\sigma\_\{z\}^\{2\}\)\)\)by Lemma[2](https://arxiv.org/html/2609.22157#Thmlemma2), and Bui’s dilution isδt≤O\(exp\(−m2/\(4σz2\)\)\)\\delta\_\{t\}\\leq O\(\\exp\(\-m^\{2\}/\(4\\sigma\_\{z\}^\{2\}\)\)\)in the surrogate\. This is the surrogate\-level converse; lifting it to real attention requires both a lower bound onmmfor capacity\-bound tasks \(which we have not verified\) and the surrogate identification \(A4\) ofUtU\_\{t\}withℐ\(ℓ∗\)\\mathcal\{I\}^\{\(\\ell^\{\*\}\)\}\. The boxed Eq\. equation[9](https://arxiv.org/html/2609.22157#A1.E9)/equation[18](https://arxiv.org/html/2609.22157#A5.E18)is the sufficient direction only\.

##### Empirical validation

Table[24](https://arxiv.org/html/2609.22157#A1.T24)reports the mean head\-agreement dropDDacross the five dilution\-prone tasks \(qa\_1, qa\_2, vt, niah\_multivalue, fwe\) and the capacity\-bound task \(NIAH\-MK3\) on Qwen 1\.5B, Qwen 3B, and Mistral\. In every \(model, context\) cell, NIAH\-MK3 has the smallest drop \(including the cell where it is negative, Qwen 3B 16K\)\. The*ordering*of tasks byDDis preserved across architectures, and the partition between dilution\-prone and capacity\-bound is exactly the partition predicted by Eq\. equation[17](https://arxiv.org/html/2609.22157#A5.E17): cells withD≈0D\\approx 0have𝔼⁡\[δt\]\\mathbb\{E\}\[\\delta\_\{t\}\]bounded by the noise floor, and the per\-input recovery rateρ\\rhoin Table[1](https://arxiv.org/html/2609.22157#S4.T1)is≤0\.02\\leq 0\.02on all such cells\. The bridge inequality is therefore empirically consistent with both directions on this task suite\. We do not promote this to a formal claim because the sample size per cell isN=20N=20inputs, the constants in Eq\. equation[18](https://arxiv.org/html/2609.22157#A5.E18)are not tight, and the necessity direction is not proved\.

##### What is*not*proved

We report the gaps explicitly to clarify the scope\.

1. 1\.The constantsc1,c2\(γ\)c\_\{1\},c\_\{2\}\(\\gamma\)in Eq\. equation[18](https://arxiv.org/html/2609.22157#A5.E18)are loose\.The pairwise\-to\-HH\-wise step in Step 3 loses tightness: the union\-vs\-intersection gap can scale withHHin the worst case, soc1c\_\{1\}is honest only up to anO⁡\(H\)O\(H\)multiplicative slack\. A tight version would replace the pairwise inequality with a full higher\-order union\-intersection identity and track the layerwise covariance of head subsets\.
2. 2\.The pairwise Jaccard is not the same object as theHH\-wise union/intersection ratio\.Eq\. equation[13](https://arxiv.org/html/2609.22157#A5.E13)uses the weaker inequality “some head has a large private residual set,” which is correct but discards information when many heads share the same residual\.
3. 3\.Observation \(i\) in Step 5 is a leading\-order estimate, not a rigorous inequality\.The exact reverse inequalityα¯⋅maxh⁡\|ℛh\(ℓ∗\)\|≤αℛ\\bar\{\\alpha\}\\cdot\\max\_\{h\}\|\\mathcal\{R\}^\{\(\\ell^\{\*\}\)\}\_\{h\}\|\\leq\\alpha\_\{\\mathcal\{R\}\}holds \(set containment\), so the substitutionα¯⋅maxh⁡\|ℛh\(ℓ∗\)\|≈αℛ\\bar\{\\alpha\}\\cdot\\max\_\{h\}\|\\mathcal\{R\}^\{\(\\ell^\{\*\}\)\}\_\{h\}\|\\approx\\alpha\_\{\\mathcal\{R\}\}used in Eq\. equation[17](https://arxiv.org/html/2609.22157#A5.E17)relies on \(A1\)\+\(A3\) jointly to push the high\-SNR approximationmaxh⁡\|ℛh\(ℓ∗\)\|≈R\\max\_\{h\}\|\\mathcal\{R\}^\{\(\\ell^\{\*\}\)\}\_\{h\}\|\\approx R\. Eq\. equation[17](https://arxiv.org/html/2609.22157#A5.E17)therefore uses≳\\gtrsimrather than≥\\geq\.
4. 4\.The identification of Bui’sUtU\_\{t\}with the head\-common signal setℐ\(ℓ∗\)\\mathcal\{I\}^\{\(\\ell^\{\*\}\)\}\(A4\) is a modelling choice, not a derived equality\.Bui’sUtU\_\{t\}is defined at the residual\-stream level; ourℐ\(ℓ∗\)\\mathcal\{I\}^\{\(\\ell^\{\*\}\)\}is an intersection over per\-head attended sets at a single layer\. The two coincide in the surrogate by fiat\.
5. 5\.Thelog⁡\(1/γ\)\\log\(1/\\gamma\)factor in Step 5 is heuristic\.The sub\-Gaussian maximum overγN\\gamma Nretained\-noise positions shifts noise\-tail scale byO⁡\(log⁡\(1/γ\)/log⁡N\)O\(\\log\(1/\\gamma\)/\\sqrt\{\\log N\}\), notlog⁡\(1/γ\)\\log\(1/\\gamma\)\. We retain the cleanerlog⁡\(1/γ\)\\log\(1/\\gamma\)packaging in Eq\. equation[9](https://arxiv.org/html/2609.22157#A1.E9)as a worst\-case bound at smallNN, and we offer the conservative readingD≥c1D\\geq c\_\{1\}\(no log term\) as a strict alternative for readers who reject the surrogate\-level amplification argument\.
6. 6\.The converse direction is conditional on a margin assumption we have not verified\.In Step 5 we usedm≥σz4log⁡\(2H2LT2/β\)m\\geq\\sigma\_\{z\}\\sqrt\{4\\log\(2H^\{2\}LT^\{2\}/\\beta\)\}to get Lemma[2](https://arxiv.org/html/2609.22157#Thmlemma2); the surrogate\-level converse additionally requires that capacity\-bound tasks satisfy this margin condition for the*common*relevant setℛ\\mathcal\{R\}\. We do not test this on real attention weights; doing so is a clean follow\-up\.
7. 7\.The converse paragraph above is an upper bound on the sufficient\-condition argument, not a separate necessary\-condition proof\.Eq\. equation[9](https://arxiv.org/html/2609.22157#A1.E9)with constants from Eq\. equation[18](https://arxiv.org/html/2609.22157#A5.E18)is the sufficient direction only; the empirical content of necessity is reported but not formalised\.
8. 8\.The assumption that heads share a commonℛ\\mathcal\{R\}in capacity\-bound tasks \(A3, regime𝒞\\mathcal\{C\}\) needs verification\.Our evidence is the small empiricalDDon NIAH\-MK3 across cells; whether the underlying mechanism is actually “all heads agree on the same needle position” or some weaker form of agreement \(heads agreeing on a length\-O⁡\(1\)O\(1\)neighborhood of the needle\) is open\. The difference between these is invisible to top\-kkJaccard but matters for the rigorous proof\.
9. 9\.Step 4 implicitly assumes the scorer does not distinguish signal\-side residual positions from noise positions a priori\.The\(1−γ\)\(1\-\\gamma\)factor in Eq\. equation[15](https://arxiv.org/html/2609.22157#A5.E15)applies the noise\-retention ratioγ\\gammato positions in𝒰\(ℓ∗\)∖ℐ\(ℓ∗\)⊆ℛ\\mathcal\{U\}^\{\(\\ell^\{\*\}\)\}\\setminus\\mathcal\{I\}^\{\(\\ell^\{\*\}\)\}\\subseteq\\mathcal\{R\}, which are signal\-side\. The retention rate there equalsγ\\gammaonly when a top\-kkscorer is symmetric across signal vs noise on these residuals; under \(A1\) noise\-isotropy this is the leading\-order assumption\.
10. 10\.The output\-projection averaging in Step 4 treats per\-head value contributions as additive\.The single\-head SNR analysis of Appendix[D](https://arxiv.org/html/2609.22157#A4)is lifted to multi\-head by summing attention masses across heads\. A precise lift would use the value\-vector subspace decomposition of the output projection; under non\-orthogonal value subspaces this can shift the constants byO⁡\(H\)O\(H\)in the worst case rather thanO⁡\(1\)O\(1\)\.
11. 11\.The assumed accuracy functionA^\(SNR\)\\hat\{A\}\(\\mathrm\{SNR\}\)is treated as task\-agnostic\.The constantCCin Eq\. equation[17](https://arxiv.org/html/2609.22157#A5.E17)depends on the slope ofA^\\hat\{A\}near the operating SNR, and on tasks whereA^\\hat\{A\}is steep \(precise retrieval\) versus shallow \(aggregation\),CCdiffers by an order of magnitude\.

The sketch is therefore a*structural*proof of the sufficient direction: the form of the bound and the dependence on\(H,γ\)\(H,\\gamma\)are derived from the surrogate, while the numerical values of the constants, theHH\-tightness, thelog⁡\(1/γ\)\\log\(1/\\gamma\)factor, and the necessity direction are flagged as future work\.

## Appendix FReproduction notes

The seed replicates above bound one source of variation; this section documents the remaining implementation details that matter for exact reproduction\. The cache slicing uses explicitposition\_idsto preserve RoPE alignment, since the naive attention\-mask trick produces a silent position shift on evicted positions\. Long\-context \(16K\) runs use SDPA for prefill and switch to eager for thew×Tw\\times Tobservation\-window scoring pass to avoid theO⁡\(T2\)O\(T^\{2\}\)attention\-matrix allocation on 80GB\. Head agreement uses Jaccard similarity of top\-3232key sets per head pair, averaged over pairs\. The deployed gate takes the early bin as the first⌊L/3⌋\\lfloor L/3\\rfloorlayers and the late bin as the*last*⌊L/3⌋\\lfloor L/3\\rfloor, i\.e\.\[0,⌊L/3⌋\)\[0,\\lfloor L/3\\rfloor\)and\[L−⌊L/3⌋,L\)\[L\-\\lfloor L/3\\rfloor,L\), so the two bins are equal in size and, when3∤L3\\nmid L, the middle band is one layer wider than a strict partition into thirds\. Table[24](https://arxiv.org/html/2609.22157#A1.T24)instead reports the strict\-thirds variant\[⌊2L/3⌋,L\)\[\\lfloor 2L/3\\rfloor,L\)for the late bin\. The two agree whenever3\|L3\\mid L\(Qwen2\.5\-3B,L=36L=36\) and differ by at most0\.0040\.004in meanDDelsewhere \(Qwen2\.5\-1\.5BL=28L=28:0\.0440\.044vs0\.0400\.040; Llama\-3\.1\-8BL=32L=32:0\.0710\.071vs0\.0730\.073\), which changes no gate decision atτ=0\.07\\tau=0\.07\. Every gated number in the paper uses the equal\-size convention that the released code implements\. Decoding is greedy throughout, so the gated outcome of any input is exactly reproducible from its recorded head\-agreement drop plus the plain\-eviction and full\-KV outcomes\. We use this identity to evaluate gate thresholds post\-hoc, and one matrix cell \(Qwen2\.5\-3B 4K SnapKV, executed atτ=0\.04\\tau=0\.04\) is reported atτ=0\.07\\tau=0\.07via this exact re\-evaluation\. A pipeline audit verifies that eviction at budget1\.01\.0matches clean prefill\-decode token\-for\-token up to a trailing\-period mismatch on one of six audited examples, and the released logs include the audit script\.

## Appendix GSharpened deferred proofs

This appendix upgrades three results that Appendices[D](https://arxiv.org/html/2609.22157#A4)and[E](https://arxiv.org/html/2609.22157#A5)left as sketches: \(i\) the leading constant and a two\-sided bound for the scaling formula equation[4](https://arxiv.org/html/2609.22157#S5.E4); \(ii\) the necessary \(converse\) direction of theDD\-to\-dilution bridge; and \(iii\) the status of the useful\-set identification \(A4\)\. Each subsection ends with an explicit “What this does and does not establish” paragraph so the paper’s claims can be scoped exactly\. Throughout we keep the notation of Appendices[D](https://arxiv.org/html/2609.22157#A4)–[E](https://arxiv.org/html/2609.22157#A5):αℛ\\alpha\_\{\\mathcal\{R\}\}is the pre\-eviction signal mass,γ\\gammathe noise\-retention ratio,ρℛ,ρ𝒩\\rho\_\{\\mathcal\{R\}\},\\rho\_\{\\mathcal\{N\}\}the retained mass fractions,δt\\delta\_\{t\}Bui’s dilution equation[6](https://arxiv.org/html/2609.22157#A1.E6),DDthe head\-agreement drop equation[3](https://arxiv.org/html/2609.22157#S3.E3),σz\\sigma\_\{z\}the pre\-softmax logit\-noise scale,mmthe logit margin,H,L,TH,L,Tthe head, layer and length counts, andA^\(⋅\)\\hat\{A\}\(\\cdot\)the strictly increasing,\[0,1\]\[0,1\]\-valued, unit\-saturating accuracy surrogate\.

### G\.1Item 1: the exact leading constant and a two\-sided scaling bound

The sketch in Appendix[D](https://arxiv.org/html/2609.22157#A4)obtainsρKV≤K⁡\(1−Afull\)precov\+K/4\\rho\_\{\\mathrm\{KV\}\}\\leq K\\,\(1\-A\_\{\\mathrm\{full\}\}\)\\,p\_\{\\mathrm\{recov\}\}\+K/4by a union bound over theKK\-point budget gridℬ=\{b1,…,bK\}\\mathcal\{B\}=\\\{b\_\{1\},\\dots,b\_\{K\}\\\}followed by a covariance residual\. We show that the grid factorKKis an artifact of an unnecessary union step, that the correct leading constant is exactly11, and that a distribution\-free*two\-sided*bound holds with explicit endpoints; the only genuinely unresolved quantity is a covariance, for which we give matching, attainable bounds\.

##### Events

We work inside the surrogate of Appendix[D](https://arxiv.org/html/2609.22157#A4), where the per\-input improvement event at a single budgetbbfactorises \(their displayed identity\) into a headroom indicator and a recovery indicator\. Fix the prompt distribution and, for a random promptxx, define the two Bernoulli random variables

A⁡\(x\)\\displaystyle A\(x\):=𝟏\[A^\(SNR\(bmax,x\)\)<1\]\\displaystyle:=\\mathbf\{1\}\\bigl\[\\hat\{A\}\(\\mathrm\{SNR\}\(b\_\{\\max\},x\)\)<1\\bigr\]\(headroom\),\\displaystyle\\text\{\(headroom\)\},B⁡\(x\)\\displaystyle B\(x\):=𝟏\[∃b∈ℬ:SNRpost\(b,x\)\>SNRpre\(x\)\]\\displaystyle:=\\mathbf\{1\}\\Bigl\[\\exists\\,b\\in\\mathcal\{B\}:\\ \\mathrm\{SNR\}\_\{\\mathrm\{post\}\}\(b,x\)\>\\mathrm\{SNR\}\_\{\\mathrm\{pre\}\}\(x\)\\Bigr\]\(recovery\)\.\\displaystyle\\text\{\(recovery\)\}\.\(19\)The operational recovery rate isρKV=Prx\[A\(b∗\(x\),x\)\>A\(bmax,x\)\]\\rho\_\{\\mathrm\{KV\}\}=\\Pr\_\{x\}\[A\(b^\{\*\}\(x\),x\)\>A\(b\_\{\\max\},x\)\]withb∗\(x\)=arg⁡maxb⁡A⁡\(b,x\)b^\{\*\}\(x\)=\\arg\\max\_\{b\}A\(b,x\)\(Eq\. equation[1](https://arxiv.org/html/2609.22157#S3.E1)\)\. Becauseb∗b^\{\*\}is the argmax over the grid, “improvement atb∗b^\{\*\}” is exactly “improvement at someb∈ℬb\\in\\mathcal\{B\},” and the single\-budget surrogate factorisation gives

\{A\(b∗\(x\),x\)\>A\(bmax,x\)\}=⋃b∈ℬ\(A\(x\)∩Bb\(x\)\)=A\(x\)∩\(⋃b∈ℬBb\(x\)\)=A\(x\)∩B\(x\),\\bigl\\\{A\(b^\{\*\}\(x\),x\)\>A\(b\_\{\\max\},x\)\\bigr\\\}\\;=\\;\\bigcup\_\{b\\in\\mathcal\{B\}\}\\bigl\(A\(x\)\\cap B\_\{b\}\(x\)\\bigr\)\\;=\\;A\(x\)\\cap\\Bigl\(\\bigcup\_\{b\\in\\mathcal\{B\}\}B\_\{b\}\(x\)\\Bigr\)\\;=\\;A\(x\)\\cap B\(x\),\(20\)whereBb\(x\)=\{SNRpost\(b,x\)\>SNRpre\(x\)\}B\_\{b\}\(x\)=\\\{\\mathrm\{SNR\}\_\{\\mathrm\{post\}\}\(b,x\)\>\\mathrm\{SNR\}\_\{\\mathrm\{pre\}\}\(x\)\\\}andB=⋃bBbB=\\bigcup\_\{b\}B\_\{b\}\. The headroom event does not depend onbb, so it pulls out of the union: the union over budgets lives*inside*BB\. We setprecov:=Prx⁡\[B\]p\_\{\\mathrm\{recov\}\}:=\\Pr\_\{x\}\[B\]\(recovery at the best budget\) and notePrx⁡\[A\]=1−Afull\\Pr\_\{x\}\[A\]=1\-A\_\{\\mathrm\{full\}\}by definition of the surrogate headroom\.

###### Theorem 1\(Exact leading constant; two\-sided scaling bound\)\.

With the definitions in equation[19](https://arxiv.org/html/2609.22157#A7.Ex9)–equation[20](https://arxiv.org/html/2609.22157#A7.E20)andprecov:=Prx⁡\[B\]p\_\{\\mathrm\{recov\}\}:=\\Pr\_\{x\}\[B\], the surrogate per\-input recovery rate satisfies the*exact*identity

ρKV=\(1−Afull\)precov\+Covx\(A,B\)\.\\rho\_\{\\mathrm\{KV\}\}\\;=\\;\(1\-A\_\{\\mathrm\{full\}\}\)\\,p\_\{\\mathrm\{recov\}\}\\;\+\\;\\mathrm\{Cov\}\_\{x\}\\\!\\bigl\(A,B\\bigr\)\.\(21\)The content here is not the identity equation[21](https://arxiv.org/html/2609.22157#A7.E21), which is merely the definition of covariance for two Bernoullis, but the observation that onceprecovp\_\{\\mathrm\{recov\}\}is defined as the*union*probabilityPrx⁡\[⋃bBb\]\\Pr\_\{x\}\[\\bigcup\_\{b\}B\_\{b\}\]\(the quantityb∗b^\{\*\}actually selects\) rather than the single\-budgetmaxb⁡Prx⁡\[Bb\]\\max\_\{b\}\\Pr\_\{x\}\[B\_\{b\}\], the budget\-grid factorKKof Appendix[D](https://arxiv.org/html/2609.22157#A4)is absorbed intoprecovp\_\{\\mathrm\{recov\}\}rather than multiplying it;KKreappears insideprecovp\_\{\\mathrm\{recov\}\}whenever the recovery budgets are near\-disjoint \(Corollary[1](https://arxiv.org/html/2609.22157#Thmcorollary1)\(ii\)\)\. The covariance is bounded, by

0≤Covx\(A,B\)≤min⁡\{1−Afull,precov\}−\(1−Afull\)precov,0\\;\\leq\\;\\mathrm\{Cov\}\_\{x\}\(A,B\)\\;\\leq\\;\\min\\\{1\-A\_\{\\mathrm\{full\}\},\\,p\_\{\\mathrm\{recov\}\}\\\}\-\(1\-A\_\{\\mathrm\{full\}\}\)\\,p\_\{\\mathrm\{recov\}\},\(22\)where the lower bound requires the association hypothesis of Lemma[3](https://arxiv.org/html/2609.22157#Thmlemma3)below, and the upper bound \(Fréchet\) is unconditional\. Equivalently,

\(1−Afull\)precov≤ρKV≤min⁡\{1−Afull,precov\}\.\\boxed\{\\;\(1\-A\_\{\\mathrm\{full\}\}\)\\,p\_\{\\mathrm\{recov\}\}\\;\\leq\\;\\rho\_\{\\mathrm\{KV\}\}\\;\\leq\\;\\min\\\{\\,1\-A\_\{\\mathrm\{full\}\},\\ p\_\{\\mathrm\{recov\}\}\\,\\\}\.\\;\}\(23\)The lower bound is attained iffA⟂BA\\perp B; the upper bound is attained iffAAandBBare Fréchet–Hoeffding comonotone \(one event a\.s\. contains the other\)\.

###### Proof\.

Identity equation[21](https://arxiv.org/html/2609.22157#A7.E21)is the definition of covariance applied to the two Bernoulli variables in equation[19](https://arxiv.org/html/2609.22157#A7.Ex9), usingρKV=Prx⁡\[A∩B\]=𝔼x\[AB\]\\rho\_\{\\mathrm\{KV\}\}=\\Pr\_\{x\}\[A\\cap B\]=\\mathbb\{E\}\_\{x\}\[AB\]from equation[20](https://arxiv.org/html/2609.22157#A7.E20)and𝔼x\[A\]=1−Afull\\mathbb\{E\}\_\{x\}\[A\]=1\-A\_\{\\mathrm\{full\}\},𝔼x\[B\]=precov\\mathbb\{E\}\_\{x\}\[B\]=p\_\{\\mathrm\{recov\}\}\. For equation[22](https://arxiv.org/html/2609.22157#A7.E22), the upper endpoint is the Fréchet–Hoeffding inequalityPr⁡\[A∩B\]≤min⁡\{Pr⁡\[A\],Pr⁡\[B\]\}\\Pr\[A\\cap B\]\\leq\\min\\\{\\Pr\[A\],\\Pr\[B\]\\\}, valid for any two events; subtracting the product gives the stated covariance bound and the right side of equation[23](https://arxiv.org/html/2609.22157#A7.E23)\. The lower endpointCovx\(A,B\)≥0\\mathrm\{Cov\}\_\{x\}\(A,B\)\\geq 0is Lemma[3](https://arxiv.org/html/2609.22157#Thmlemma3)\. Attainment: independence gives equality in the lower bound by construction; comonotonicity \(A⊆BA\\subseteq BorB⊆AB\\subseteq Aa\.s\.\) givesPr⁡\[A∩B\]=min⁡\{Pr⁡\[A\],Pr⁡\[B\]\}\\Pr\[A\\cap B\]=\\min\\\{\\Pr\[A\],\\Pr\[B\]\\\}, the upper endpoint\. ∎

###### Lemma 3\(Association of headroom and recovery\)\.

Suppose the noise\-isotropy assumption \(A1\) of Appendix[D](https://arxiv.org/html/2609.22157#A4)holds, so that bothAAandBBare non\-increasing functions of the single scalar driverαℛ\(x\)\\alpha\_\{\\mathcal\{R\}\}\(x\)\(equivalently,𝔼⁡\[A∣αℛ\]\\mathbb\{E\}\[A\\mid\\alpha\_\{\\mathcal\{R\}\}\]and𝔼⁡\[B∣αℛ\]\\mathbb\{E\}\[B\\mid\\alpha\_\{\\mathcal\{R\}\}\]are non\-increasing inαℛ\\alpha\_\{\\mathcal\{R\}\}and monotone in the same direction\)\. ThenCovx\(A,B\)≥0\\mathrm\{Cov\}\_\{x\}\(A,B\)\\geq 0\.

###### Proof\.

IfA=f⁡\(αℛ\)A=f\(\\alpha\_\{\\mathcal\{R\}\}\)andB=g⁡\(αℛ\)B=g\(\\alpha\_\{\\mathcal\{R\}\}\)withf,gf,gboth non\-increasing, Chebyshev’s association \(sum\) inequality gives𝔼⁡\[fg\]≥𝔼⁡\[f\]𝔼\[g\]\\mathbb\{E\}\[fg\]\\geq\\mathbb\{E\}\[f\]\\mathbb\{E\}\[g\], i\.e\.Cov≥0\\mathrm\{Cov\}\\geq 0\. IfAAdepends on an auxiliary driverζ\\zetaindependent ofαℛ\\alpha\_\{\\mathcal\{R\}\}\(e\.g\. a parametric\-knowledge covariate\), writeCov⁡\(A,B\)=Cov⁡\(𝔼⁡\[A∣αℛ\],B\)\\mathrm\{Cov\}\(A,B\)=\\mathrm\{Cov\}\(\\mathbb\{E\}\[A\\mid\\alpha\_\{\\mathcal\{R\}\}\],B\)by the tower rule andB=g⁡\(αℛ\)B\\\!=\\\!g\(\\alpha\_\{\\mathcal\{R\}\}\); the same monotone\-in\-a\-common\-scalar argument applies to the conditional mean, so the sign is preserved\. ∎

The monotonicity ofAAinαℛ\\alpha\_\{\\mathcal\{R\}\}is immediate \(larger signal mass⇒\\RightarrowlargerSNRpre\\mathrm\{SNR\}\_\{\\mathrm\{pre\}\}⇒\\Rightarrowsmaller headroom\)\. The monotonicity ofBBfollows from Eq\. equation[10](https://arxiv.org/html/2609.22157#A4.E10): the attainable SNR gain from removing noise mass shrinks asαℛ→1\\alpha\_\{\\mathcal\{R\}\}\\to 1\(less noise to remove\), so recovery is less likely at largerαℛ\\alpha\_\{\\mathcal\{R\}\}\.

##### Where the grid factorKKcomes from, and why it is not real

TheKKflagged in Appendix[D](https://arxiv.org/html/2609.22157#A4)comes from the stepPrx⁡\[⋃bBb\]≤∑bPrx⁡\[Bb\]≤KmaxbPrx\[Bb\]\\Pr\_\{x\}\[\\bigcup\_\{b\}B\_\{b\}\]\\leq\\sum\_\{b\}\\Pr\_\{x\}\[B\_\{b\}\]\\leq K\\max\_\{b\}\\Pr\_\{x\}\[B\_\{b\}\]followed by identifyingmaxb⁡Prx⁡\[Bb\]\\max\_\{b\}\\Pr\_\{x\}\[B\_\{b\}\]withprecovp\_\{\\mathrm\{recov\}\}\. Definingprecovp\_\{\\mathrm\{recov\}\}as the union probabilityPrx⁡\[⋃bBb\]\\Pr\_\{x\}\[\\bigcup\_\{b\}B\_\{b\}\]instead, which is the quantity the operationalb∗\(x\)b^\{\*\}\(x\)actually selects, removes the union step entirely\. The overcount incurred by the discarded step is, exactly,

∑b∈ℬPrx⁡\[Bb\]−Prx⁡\[⋃bBb\]=∑j≥2\(−1\)j∑\|S\|=j,S⊆ℬPrx⁡\[⋂b∈SBb\]≥0,\\sum\_\{b\\in\\mathcal\{B\}\}\\Pr\_\{x\}\[B\_\{b\}\]\\;\-\\;\\Pr\_\{x\}\\Bigl\[\\textstyle\\bigcup\_\{b\}B\_\{b\}\\Bigr\]\\;=\\;\\sum\_\{j\\geq 2\}\(\-1\)^\{j\}\\\!\\\!\\\!\\sum\_\{\|S\|=j,S\\subseteq\\mathcal\{B\}\}\\\!\\\!\\Pr\_\{x\}\\Bigl\[\\textstyle\\bigcap\_\{b\\in S\}B\_\{b\}\\Bigr\]\\;\\geq\\;0,\(24\)the inclusion–exclusion tail\. Its size is what makes the union bound tight or loose:

###### Corollary 1\(Tightness characterisation of the budget\-grid bound\)\.

Letp♯:=maxb⁡Prx⁡\[Bb\]p^\{\\sharp\}:=\\max\_\{b\}\\Pr\_\{x\}\[B\_\{b\}\]be the single\-budget recovery probability\.

1. *\(i\)**\(Monotone gain profile⇒\\RightarrownoKKfactor\.\)*If the SNR gaing⁡\(b,x\):=ρℛ\(b,x\)2/γ⁡\(b,x\)g\(b,x\):=\\rho\_\{\\mathcal\{R\}\}\(b,x\)^\{2\}/\\gamma\(b,x\)is monotone inbbfor a\.e\.xx\(as it is for a calibrated scorer, since keeping more tokens raises bothρℛ→1\\rho\_\{\\mathcal\{R\}\}\\to 1andγ→1\\gamma\\to 1sog↓1g\\downarrow 1\), then the events\{Bb\}\\\{B\_\{b\}\\\}are nested andprecov=Prx⁡\[⋃bBb\]=p♯p\_\{\\mathrm\{recov\}\}=\\Pr\_\{x\}\[\\bigcup\_\{b\}B\_\{b\}\]=p^\{\\sharp\}\. The genuine leading factor is11; the union boundKp♯K\\,p^\{\\sharp\}overcounts by\(K−1\)p♯\(K\-1\)p^\{\\sharp\}\.
2. *\(ii\)**\(Disjoint gain profile⇒\\RightarrowKKis real\.\)*If instead the\{Bb\}\\\{B\_\{b\}\\\}are pairwise disjoint \(each input recovers at exactly one budget\) and rare \(Kp♯≪1Kp^\{\\sharp\}\\ll 1\), thenprecov=∑bPrx⁡\[Bb\]p\_\{\\mathrm\{recov\}\}=\\sum\_\{b\}\\Pr\_\{x\}\[B\_\{b\}\]is genuinelyΘ⁡\(K\)\\Theta\(K\)times larger thanp♯p^\{\\sharp\}; recovery at the best budget really isKK\-fold more frequent than at a fixed budget, and the factorKKis not slack but signal\.

In both cases Theorem[1](https://arxiv.org/html/2609.22157#Thmtheorem1)holds with constant11onceprecovp\_\{\\mathrm\{recov\}\}is the union probability; the two regimes differ only in how much largerprecovp\_\{\\mathrm\{recov\}\}is than the single\-budgetp♯p^\{\\sharp\}\.

###### Proof\.

\(i\) Ifg⁡\(⋅,x\)g\(\\cdot,x\)is monotone then\{b:g⁡\(b,x\)\>1\}\\\{b:g\(b,x\)\>1\\\}is an interval anchored at the aggressive end of the grid, soBb\(x\)⊆Bb′\(x\)B\_\{b\}\(x\)\\subseteq B\_\{b^\{\\prime\}\}\(x\)wheneverb′b^\{\\prime\}is more aggressive thanbb; theBbB\_\{b\}are nested and their union equals the loosest single event, of probabilityp♯p^\{\\sharp\}\. \(ii\) For disjoint eventsPr⁡\[⋃bBb\]=∑bPr⁡\[Bb\]\\Pr\[\\bigcup\_\{b\}B\_\{b\}\]=\\sum\_\{b\}\\Pr\[B\_\{b\}\]exactly; rareness makes this≈Kp♯\\approx Kp^\{\\sharp\}\. ∎

Because our scorers are calibrated \(the top\-kkretention curve is monotone inbb\), the operative regime is Corollary[1](https://arxiv.org/html/2609.22157#Thmcorollary1)\(i\) and the constant is11\. This is the statement Appendix[D](https://arxiv.org/html/2609.22157#A4)defers to; theKKandK/4K/4terms there serve only to isolate the step that introduces the slack\.

##### What this does and does not establish

*Establishes:*inside the deterministic\-SNR surrogate, the scaling law holds as the*exact*identity equation[21](https://arxiv.org/html/2609.22157#A7.E21)with leading constant precisely11\(no budget\-grid inflation\), and the two\-sided bound equation[23](https://arxiv.org/html/2609.22157#A7.E23)with fully explicit, distribution\-free endpoints; the only free quantity is the covarianceCovx\(A,B\)∈\[0,min⁡\{Pr⁡A,Pr⁡B\}−Pr⁡APrB\]\\mathrm\{Cov\}\_\{x\}\(A,B\)\\in\[0,\\ \\min\\\{\\Pr A,\\Pr B\\\}\-\\Pr A\\Pr B\], and both endpoints are attainable, so no tighter distribution\-free constant exists\.*Does not establish:*\(a\) the surrogate itself, that accuracy is a deterministic \(or fixed\-conditional\) function of head SNR, is assumed, not proven, so the constant “11” is exact only relative to that surrogate; \(b\) the covariance is pinned only to an interval, not a value, because it depends on the joint law of headroom and recovery, which is task\- and model\-specific; Lemma[3](https://arxiv.org/html/2609.22157#Thmlemma3)fixes its*sign*\(non\-negative\) under single\-driver monotonicity but not its magnitude; \(c\) when headroom is driven partly by anαℛ\\alpha\_\{\\mathcal\{R\}\}\-independent factor \(parametric\-knowledge failures, e\.g\. the QA cells in Table[1](https://arxiv.org/html/2609.22157#S4.T1)\), recovery collapses \(precov→0p\_\{\\mathrm\{recov\}\}\\\!\\to\\\!0\) so both bounds pinchρKV→0\\rho\_\{\\mathrm\{KV\}\}\\\!\\to\\\!0despite headroom, consistent with the observed QA exceptions, but a prediction of the sign structure, not a proof about those tasks\. The empirically observed ratio band\[0\.25,0\.55\]\[0\.25,0\.55\]is thus an estimate ofprecov\+Cov/\(1−Afull\)p\_\{\\mathrm\{recov\}\}\+\\mathrm\{Cov\}/\(1\-A\_\{\\mathrm\{full\}\}\), not of a universal constant\.

### G\.2Item 2: the necessary direction \(capacity\-bound⇒\\RightarrowsmallDD\)

Appendix[E](https://arxiv.org/html/2609.22157#A5)proves the sufficient direction \(largeDDforces largeδt\\delta\_\{t\}\) and states that the converse “capacity\-bound⇒\\RightarrowsmallDD” needs “a margin condition we have not verified\.” We state that condition precisely and prove the converse under it, in both a deterministic and a probabilistic \(contrapositive\) form, with explicit margin dependence\.

##### The margin condition, made precise

Recallzh,i\(ℓ\)=\(qh\(ℓ\)\)⊤ki\+ηh,i\(ℓ\)z^\{\(\\ell\)\}\_\{h,i\}=\(q^\{\(\\ell\)\}\_\{h\}\)^\{\\top\}k\_\{i\}\+\\eta^\{\(\\ell\)\}\_\{h,i\}withσz\\sigma\_\{z\}\-sub\-Gaussian noise \(A2\), and the logit marginm=m\+−m−m=m\_\{\+\}\-m\_\{\-\}\(A1\)\. Define the*margin\-to\-noise ratio*κ:=m/σz\\kappa:=m/\\sigma\_\{z\}\.

###### Assumption 1\(κ\\kappa\-separation of the capacity\-bound relevant set\)\.

For an input in the capacity\-bound regime𝒞\\mathcal\{C\}, the deterministic logit gap between every common relevant position and every noise position at the late layer bin exceeds

m≥2σzlog⁡\(2H2LT2/β\),i\.e\.κ≥2log⁡\(2H2LT2/β\)\.m\\;\\geq\\;2\\,\\sigma\_\{z\}\\sqrt\{\\log\\\!\\bigl\(2H^\{2\}LT^\{2\}/\\beta\\bigr\)\},\\qquad\\text\{i\.e\.\}\\qquad\\kappa\\;\\geq\\;2\\sqrt\{\\log\\\!\\bigl\(2H^\{2\}LT^\{2\}/\\beta\\bigr\)\}\.\(25\)

This is exactly the threshold of Lemma[2](https://arxiv.org/html/2609.22157#Thmlemma2); naming it as an assumption isolates the one quantity the converse needs\. It is the precise form of the informal “separation between the relevant\-token logit margin and the noise scale\.”

###### Theorem 2\(Capacity\-bound⇒\\Rightarrowsmall head\-agreement drop\)\.

Adopt the surrogate \(A1\)–\(A3\) of Appendix[E](https://arxiv.org/html/2609.22157#A5)and Assumption[1](https://arxiv.org/html/2609.22157#Thmassumption1)\. Suppose the input is capacity\-bound in the sense that the late\-layer heads share a common relevant set: there is a setℛ⋆\\mathcal\{R\}\_\{\\star\}withℛh\(ℓ\)=ℛ⋆\\mathcal\{R\}^\{\(\\ell\)\}\_\{h\}=\\mathcal\{R\}\_\{\\star\}for every headhhand every layerℓ\\ellin the late bin, and top\-kkis taken atk=\|ℛ⋆\|k=\|\\mathcal\{R\}\_\{\\star\}\|\. Then, over the pre\-softmax noise,

Pr\[alate=1\]≥1−β,hencePr\[D≤aearly−1≤0\]≥1−β,\\Pr\\bigl\[\\,a\_\{\\mathrm\{late\}\}=1\\,\\bigr\]\\;\\geq\\;1\-\\beta,\\qquad\\text\{hence\}\\qquad\\Pr\\bigl\[\\,D\\leq a\_\{\\mathrm\{early\}\}\-1\\leq 0\\,\\bigr\]\\;\\geq\\;1\-\\beta,\(26\)and therefore, for*every*thresholdτ\>0\\tau\>0,

Pr\[D≥τ\]≤β=2H2LT2exp\(−m24σz2\)=2H2LT2e−κ2/4\.\\Pr\\bigl\[\\,D\\geq\\tau\\,\\bigr\]\\;\\leq\\;\\beta\\;=\\;2H^\{2\}LT^\{2\}\\,\\exp\\\!\\Bigl\(\-\\tfrac\{m^\{2\}\}\{4\\sigma\_\{z\}^\{2\}\}\\Bigr\)\\;=\\;2H^\{2\}LT^\{2\}\\,e^\{\-\\kappa^\{2\}/4\}\.\(27\)

###### Proof\.

By Lemma[2](https://arxiv.org/html/2609.22157#Thmlemma2), under equation[25](https://arxiv.org/html/2609.22157#A7.E25)the top\-kkset of every late\-bin head\(ℓ,h\)\(\\ell,h\)equals its private setℛh\(ℓ\)\\mathcal\{R\}^\{\(\\ell\)\}\_\{h\}jointly with probability≥1−β\\geq 1\-\\beta; call this eventEE\. OnEE, since all late\-bin heads shareℛ⋆\\mathcal\{R\}\_\{\\star\}, every head’s top\-kkset is exactlyℛ⋆\\mathcal\{R\}\_\{\\star\}, so every pairwise top\-kkJaccard equals11at every late\-bin layer, whenceaℓ=1a\_\{\\ell\}=1for each late\-bin layer andalate=1a\_\{\\mathrm\{late\}\}=1\. This proves the first claim of equation[26](https://arxiv.org/html/2609.22157#A7.E26)\. ConsequentlyD=aearly−alate=aearly−1≤0D=a\_\{\\mathrm\{early\}\}\-a\_\{\\mathrm\{late\}\}=a\_\{\\mathrm\{early\}\}\-1\\leq 0onEEbecauseaearly≤1a\_\{\\mathrm\{early\}\}\\leq 1\(Jaccard is bounded by11\), giving the second claim\. Finally,\{D≥τ\}\\\{D\\geq\\tau\\\}forτ\>0\\tau\>0is disjoint fromEE\(onEE,D≤0D\\leq 0\), soPr\[D≥τ\]≤Pr\[Ec\]≤β\\Pr\[D\\geq\\tau\]\\leq\\Pr\[E^\{\\mathrm\{c\}\}\]\\leq\\beta; substituting the value ofβ\\betafrom Lemma[2](https://arxiv.org/html/2609.22157#Thmlemma2)yields equation[27](https://arxiv.org/html/2609.22157#A7.E27)\. ∎

Equation equation[27](https://arxiv.org/html/2609.22157#A7.E27)is the explicit margin dependence: the probability that a capacity\-bound input produces a drop as large as any fixedτ\\taudecays ase−κ2/4e^\{\-\\kappa^\{2\}/4\}in the margin\-to\-noise ratio\. The bound is only informative whenβ=2H2LT2e−κ2/4<1\\beta=2H^\{2\}LT^\{2\}e^\{\-\\kappa^\{2\}/4\}<1, which for realistic\(H,L,T\)\(H,L,T\)requires a large margin\-to\-noise ratio \(κ≳10\\kappa\\gtrsim 10atH=16,L=28,T=4096H\{=\}16,L\{=\}28,T\{=\}4096\)\. We state plainly what that costs\. Assumption[1](https://arxiv.org/html/2609.22157#Thmassumption1)is in direct tension with the informal margin capm≤log⁡Tm\\leq\\log Tof Appendix[D](https://arxiv.org/html/2609.22157#A4): atT=4096T=4096that cap givesm≤8\.3m\\leq 8\.3nats, soκ=m/σz≥10\.2\\kappa=m/\\sigma\_\{z\}\\geq 10\.2forcesσz≤0\.81\\sigma\_\{z\}\\leq 0\.81, a sub\-unit pre\-softmax logit\-noise scale\.

##### The margin\-to\-noise ratio, measured

Rather than leave that as an assumption, we measured it\. On Qwen2\.5\-1\.5B at RULER 4K, NIAH\-MK3, over2020inputs and roughly10,74410\{,\}744\(layer, head, query\) triples per input, we take the top\-kkpre\-softmax logits at each site as the relevant setℛ\\mathcal\{R\}and the remainder as noise𝒩\\mathcal\{N\}, and reportκ=\(ℛ¯−𝒩¯\)/sd⁡\(𝒩\)\\kappa=\(\\overline\{\\mathcal\{R\}\}\-\\overline\{\\mathcal\{N\}\}\)/\\mathrm\{sd\}\(\\mathcal\{N\}\)\. At this cell’s\(H,L,T\)=\(12,28,≈3956\)\(H,L,T\)=\(12,28,\{\\approx\}3956\)the bound needsκ≥10\.11\\kappa\\geq 10\.11forβ<1\\beta<1\. The measured median isκ=3\.33\\kappa=3\.33, roughly three times too small, though individual heads reach77\.6677\.66\.

The bound is therefore*vacuous at the paper’s own parameters*, not merely at parameters we consider implausible, and Corollary[2](https://arxiv.org/html/2609.22157#Thmcorollary2)inherits that vacuity, so the gate has no proved mis\-fire bound at realistic\(H,L,T\)\(H,L,T\)\. This conclusion is robust to the choice of split: sweepingk∈\{8,16,32,64\}k\\in\\\{8,16,32,64\\\}gives medianκ=4\.01\\kappa=4\.01,3\.683\.68,3\.333\.33,2\.992\.99, monotone decreasing inkk, so no choice of split in this range rescues the bound, and the largest value seen is0\.40×0\.40\\timesthe requirement\. The result also holds across architectures: repeating at the deployedk=32k=32on a second architecture givesκ=3\.71\\kappa=3\.71\(Mistral\-7B\), and on a dilution\-prone taskκ=3\.40\\kappa=3\.40\(VT\)\.

That last number is worth stating separately, because it bears on what the surrogate can explain rather than only on whether its bound binds\.κ\\kappaon the dilution\-prone task is indistinguishable fromκ\\kappaon the capacity\-bound one \(3\.403\.40against3\.333\.33\), so the margin\-to\-noise ratio does not discriminate the partition at all\. Assumption[1](https://arxiv.org/html/2609.22157#Thmassumption1)is thus false at our parameters rather than loose, and it is not the quantity that separates the two classes\. The magnitude of the gap is unchanged by any of this: a factor of three inκ\\kappais a factor ofe\(10\.112−3\.332\)/4\>109e^\{\(10\.11^\{2\}\-3\.33^\{2\}\)/4\}\>10^\{9\}inβ\\beta\.

##### The sign prediction, and how the statement should be repaired

As stated, Theorem[2](https://arxiv.org/html/2609.22157#Thmtheorem2)predictsD≤0D\\leq 0on capacity\-bound inputs with probability at least1−β1\-\\beta, and Table[24](https://arxiv.org/html/2609.22157#A1.T24)contradicts that in five of seven cells: measuredDDon NIAH\-MK3 is mildly*positive*\(\+0\.040\+0\.040Qwen2\.5\-1\.5B 4K,\+0\.060\+0\.060Mistral 4K,\+0\.053\+0\.053Mistral 16K,\+0\.019\+0\.019Yi,\+0\.073\+0\.073Llama\), and negative only on Qwen2\.5\-3B at both contexts \(−0\.004\-0\.004,−0\.021\-0\.021\)\. The prediction therefore holds on one model at two contexts and fails elsewhere\. One might try to rescue the theorem by reading it as a constraint on the drop*ordering*rather than its sign\. That reading is not licensed: Theorem[2](https://arxiv.org/html/2609.22157#Thmtheorem2)concerns one input class in isolation and says nothing about how classes rank against each other\.

The repair is available inside the theorem’s own assumptions, and we take it\. Clause \(a\) of the summary below already concedes that real capacity\-bound inputs need not satisfy𝒞⋆\\mathcal\{C\}\_\{\\star\}exactly: late\-layer heads may agree on anO⁡\(1\)O\(1\)neighbourhood of the needle rather than share one common relevant set, which weakens the deterministic stepalate=1a\_\{\\mathrm\{late\}\}=1toalate=1−o⁡\(1\)a\_\{\\mathrm\{late\}\}=1\-o\(1\)\. Carrying that through Eq\. equation[26](https://arxiv.org/html/2609.22157#A7.E26)replaces the conclusionD≤aearly−1≤0D\\leq a\_\{\\mathrm\{early\}\}\-1\\leq 0with

Pr\[D≤o\(1\)\]≥1−β−o\(1\),\\Pr\\bigl\[\\,D\\leq o\(1\)\\,\\bigr\]\\;\\geq\\;1\-\\beta\-o\(1\),\(28\)which the measured\+0\.04\+0\.04to\+0\.06\+0\.06satisfies\. We therefore state the converse in the form of Eq\. equation[28](https://arxiv.org/html/2609.22157#A7.E28)rather than the sign form, and note that the relaxed statement is correspondingly weaker: it no longer forbids a small positive drop on capacity\-bound inputs, so it does not by itself distinguish the two classes\. The class separation the gate relies on is empirical \(Table[24](https://arxiv.org/html/2609.22157#A1.T24)\) and stands on its own\.

###### Corollary 2\(Probabilistic converse / contrapositive\)\.

Let𝒞⋆\\mathcal\{C\}\_\{\\star\}denote the capacity\-bound event of Theorem[2](https://arxiv.org/html/2609.22157#Thmtheorem2)\(late\-layer heads share a common relevant set\)\. Under Assumption[1](https://arxiv.org/html/2609.22157#Thmassumption1), for anyτ\>0\\tau\>0

Pr\[𝒞⋆∧D≥τ\]≤β=2H2LT2e−κ2/4\.\\Pr\\bigl\[\\,\\mathcal\{C\}\_\{\\star\}\\ \\wedge\\ D\\geq\\tau\\,\\bigr\]\\;\\leq\\;\\beta\\;=\\;2H^\{2\}LT^\{2\}e^\{\-\\kappa^\{2\}/4\}\.\(29\)Equivalently, ifPr\[D≥τ\]\>0\\Pr\[D\\geq\\tau\]\>0thenPr\[𝒞⋆∣D≥τ\]≤β/Pr\[D≥τ\]\\Pr\[\\mathcal\{C\}\_\{\\star\}\\mid D\\geq\\tau\]\\leq\\beta/\\Pr\[D\\geq\\tau\]: observing a dropD≥τD\\geq\\tauimplies the input is*not*capacity\-bound, except on a noise\-tail event of probability≤β\\leq\\beta\. This is the a\-priori guarantee the gate needs: firing onD≥τD\\geq\\taumis\-fires on a genuinely capacity\-bound input only with probability≤β\\leq\\beta\.

###### Proof\.

On𝒞⋆\\mathcal\{C\}\_\{\\star\}, Theorem[2](https://arxiv.org/html/2609.22157#Thmtheorem2)givesD≤0<τD\\leq 0<\\tauexcept onEcE^\{\\mathrm\{c\}\}; hence𝒞⋆∩\{D≥τ\}⊆Ec\\mathcal\{C\}\_\{\\star\}\\cap\\\{D\\geq\\tau\\\}\\subseteq E^\{\\mathrm\{c\}\}andPr\[𝒞⋆∩\{D≥τ\}\]≤β\\Pr\[\\mathcal\{C\}\_\{\\star\}\\cap\\\{D\\geq\\tau\\\}\]\\leq\\beta\. The conditional statement is Bayes’ rule\. ∎

##### What this does and does not establish

*Establishes:*under the explicitκ\\kappa\-separation Assumption[1](https://arxiv.org/html/2609.22157#Thmassumption1), the converse holds cleanly in the surrogate\. Capacity\-bound inputs haveD≤0D\\leq 0with probability≥1−β\\geq 1\-\\beta\(Theorem[2](https://arxiv.org/html/2609.22157#Thmtheorem2)\), with the failure probability decaying ase−κ2/4e^\{\-\\kappa^\{2\}/4\}\. The operational contrapositive \(Corollary[2](https://arxiv.org/html/2609.22157#Thmcorollary2)\) bounds the gate’s capacity\-bound misfire probability by the sameβ\\beta\. This upgrades the informal “margin condition” to a named assumption with a proof and a convergence rate\.*Does not establish:*\(a\) that*real*capacity\-bound tasks satisfy𝒞⋆\\mathcal\{C\}\_\{\\star\}, i\.e\. that late\-layer heads literally share one common relevant set rather than merely agreeing on anO⁡\(1\)O\(1\)neighbourhood of the needle, top\-kkJaccard cannot distinguish these, and the difference is invisible toDDbut would weaken the deterministicalate=1a\_\{\\mathrm\{late\}\}=1step toalate=1−o⁡\(1\)a\_\{\\mathrm\{late\}\}=1\-o\(1\)\(the conclusionPr\[D≥τ\]≤β\+o\(1\)\\Pr\[D\\geq\\tau\]\\leq\\beta\+o\(1\)survives, but𝒞⋆\\mathcal\{C\}\_\{\\star\}is then an idealisation\); \(b\) that Assumption[1](https://arxiv.org/html/2609.22157#Thmassumption1)holds on real attention weights: it does not, and we now measure that directly,κ\\kappais2\.992\.99to4\.014\.01across four choices of the top\-kksplit, a second architecture \(Mistral\-7B,3\.713\.71\), and a dilution\-prone task \(VT,3\.403\.40\), against the10\.1110\.11the bound requires, so the assumption is false at these parameters; \(c\) a bound onaearlya\_\{\\mathrm\{early\}\}from below, so the theorem controls the upper tail ofDDbut not how negativeDDbecomes\. The converse is therefore proved*conditionally on the margin assumption and the common\-set model of capacity\-bound*; both are stated explicitly\.

### G\.3Item 3: the A4 useful\-set identification

Assumption \(A4\) of Appendix[E](https://arxiv.org/html/2609.22157#A5)identifies Bui’s useful setUtU\_\{t\}\(a residual\-stream, decoding\-step object\) with the head\-common signal setℐ\(ℓ∗\)=⋂hℛh\(ℓ∗\)\\mathcal\{I\}^\{\(\\ell^\{\*\}\)\}=\\bigcap\_\{h\}\\mathcal\{R\}^\{\(\\ell^\{\*\}\)\}\_\{h\}\(a single\-layer attention object\), and the text flags it as “a modelling choice, not a derived equality\.” We show that a clean exact equality cannot be proven, but a*quantitative approximate*identification can: under a named consensus–usefulness assumption plusε\\varepsilon\-closeness of heads, the two sets induce dilution values that agree up toO⁡\(ε\)O\(\\varepsilon\), with an explicit constant\. We therefore replace the “derived equality” language with a proved approximation plus a named residual assumption\.

##### Set\-up

At the divergence layerℓ∗\\ell^\{\*\}write the head\-private top\-kksetsℛh:=ℛh\(ℓ∗\)\\mathcal\{R\}\_\{h\}:=\\mathcal\{R\}^\{\(\\ell^\{\*\}\)\}\_\{h\}, their intersectionℐ:=⋂hℛh\\mathcal\{I\}:=\\bigcap\_\{h\}\\mathcal\{R\}\_\{h\}and union𝒰:=⋃hℛh\\mathcal\{U\}:=\\bigcup\_\{h\}\\mathcal\{R\}\_\{h\}\. For a set𝒮\\mathcal\{S\}define its induced dilutionδ⁡\(𝒮\):=1−∑i∈𝒮αt,i\\delta\(\\mathcal\{S\}\):=1\-\\sum\_\{i\\in\\mathcal\{S\}\}\\alpha\_\{t,i\}, so Bui’s isδ\(U\):=δ⁡\(Ut\)\\delta^\{\(U\)\}:=\\delta\(U\_\{t\}\)and ours isδ\(I\):=δ⁡\(ℐ\)\\delta^\{\(I\)\}:=\\delta\(\\mathcal\{I\}\)\. Letα¯max:=maxi⁡αt,i\\bar\{\\alpha\}\_\{\\max\}:=\\max\_\{i\}\\alpha\_\{t,i\}\.

###### Assumption 2\(ε\\varepsilon\-closeness of heads\)\.

The late\-layer heads areε\\varepsilon\-close in their top\-kksets:maxh,h′⁡\|ℛh△ℛh′\|≤εk\\max\_\{h,h^\{\\prime\}\}\\,\|\\mathcal\{R\}\_\{h\}\\,\\triangle\\,\\mathcal\{R\}\_\{h^\{\\prime\}\}\|\\leq\\varepsilon k, equivalently pairwise Jaccard≥\(1−ε/2\)/\(1\+ε/2\)=1−O⁡\(ε\)\\geq\(1\-\\varepsilon/2\)/\(1\+\\varepsilon/2\)=1\-O\(\\varepsilon\)\.

###### Assumption 3\(Consensus–usefulness, CUA\)\.

The useful set is sandwiched between the head\-consensus and head\-union sets:ℐ⊆Ut⊆𝒰\\mathcal\{I\}\\subseteq U\_\{t\}\\subseteq\\mathcal\{U\}\. The right inclusion \(Ut⊆𝒰U\_\{t\}\\subseteq\\mathcal\{U\}\) holds whenever routing to the residual stream is through attention only, so a position no head attends to cannot affect the next\-token margin\. The left inclusion \(ℐ⊆Ut\\mathcal\{I\}\\subseteq U\_\{t\}\) is the substantive content: a position every head attends to is margin\-preserving\.

###### Proposition 1\(Quantitative approximate identification\)\.

Under Assumptions[2](https://arxiv.org/html/2609.22157#Thmassumption2)–[3](https://arxiv.org/html/2609.22157#Thmassumption3),

\|δt\(U\)−δt\(I\)\|≤∑i∈𝒰∖ℐαt,i≤H⁡\(H−1\)εkα¯max=O⁡\(H2ε\),\\bigl\|\\,\\delta^\{\(U\)\}\_\{t\}\-\\delta^\{\(I\)\}\_\{t\}\\,\\bigr\|\\;\\leq\\;\\sum\_\{i\\in\\mathcal\{U\}\\setminus\\mathcal\{I\}\}\\alpha\_\{t,i\}\\;\\leq\\;H\(H\-1\)\\,\\varepsilon\\,k\\,\\bar\{\\alpha\}\_\{\\max\}\\;=\\;O\\\!\\bigl\(H^\{2\}\\varepsilon\\bigr\),\(30\)where the last step usesα¯max=Θ⁡\(1/k\)\\bar\{\\alpha\}\_\{\\max\}=\\Theta\(1/k\)in the high\-SNR softmax\. In particular, asε→0\\varepsilon\\to 0\(heads perfectly agree\) the two dilution values coincide:δt\(U\)→δt\(I\)\\delta^\{\(U\)\}\_\{t\}\\to\\delta^\{\(I\)\}\_\{t\}\.

###### Proof\.

By Assumption[3](https://arxiv.org/html/2609.22157#Thmassumption3),Ut△ℐ⊆𝒰∖ℐU\_\{t\}\\triangle\\mathcal\{I\}\\subseteq\\mathcal\{U\}\\setminus\\mathcal\{I\}, becauseℐ⊆Ut⊆𝒰\\mathcal\{I\}\\subseteq U\_\{t\}\\subseteq\\mathcal\{U\}forces every element ofUt△ℐ=Ut∖ℐU\_\{t\}\\triangle\\mathcal\{I\}=U\_\{t\}\\setminus\\mathcal\{I\}to lie in𝒰∖ℐ\\mathcal\{U\}\\setminus\\mathcal\{I\}\. Sinceδ⁡\(𝒮\)\\delta\(\\mathcal\{S\}\)is a signed sum of attention masses over𝒮\\mathcal\{S\},\|δt\(U\)−δt\(I\)\|=\|∑i∈Utαt,i−∑i∈ℐαt,i\|≤∑i∈Ut△ℐαt,i≤∑i∈𝒰∖ℐαt,i\|\\delta^\{\(U\)\}\_\{t\}\-\\delta^\{\(I\)\}\_\{t\}\|=\\bigl\|\\sum\_\{i\\in U\_\{t\}\}\\alpha\_\{t,i\}\-\\sum\_\{i\\in\\mathcal\{I\}\}\\alpha\_\{t,i\}\\bigr\|\\leq\\sum\_\{i\\in U\_\{t\}\\triangle\\mathcal\{I\}\}\\alpha\_\{t,i\}\\leq\\sum\_\{i\\in\\mathcal\{U\}\\setminus\\mathcal\{I\}\}\\alpha\_\{t,i\}, the first inequality of equation[30](https://arxiv.org/html/2609.22157#A7.E30)\. For the cardinality bound, for each headhh,\|ℛh∖ℐ\|≤∑h′≠h\|ℛh∖ℛh′\|≤∑h′≠h\|ℛh△ℛh′\|≤\(H−1\)εk\|\\mathcal\{R\}\_\{h\}\\setminus\\mathcal\{I\}\|\\leq\\sum\_\{h^\{\\prime\}\\neq h\}\|\\mathcal\{R\}\_\{h\}\\setminus\\mathcal\{R\}\_\{h^\{\\prime\}\}\|\\leq\\sum\_\{h^\{\\prime\}\\neq h\}\|\\mathcal\{R\}\_\{h\}\\triangle\\mathcal\{R\}\_\{h^\{\\prime\}\}\|\\leq\(H\-1\)\\varepsilon kby Assumption[2](https://arxiv.org/html/2609.22157#Thmassumption2)\. Since𝒰∖ℐ=⋃h\(ℛh∖ℐ\)\\mathcal\{U\}\\setminus\\mathcal\{I\}=\\bigcup\_\{h\}\(\\mathcal\{R\}\_\{h\}\\setminus\\mathcal\{I\}\),\|𝒰∖ℐ\|≤∑h\|ℛh∖ℐ\|≤H⁡\(H−1\)εk\|\\mathcal\{U\}\\setminus\\mathcal\{I\}\|\\leq\\sum\_\{h\}\|\\mathcal\{R\}\_\{h\}\\setminus\\mathcal\{I\}\|\\leq H\(H\-1\)\\varepsilon k\. Bounding each mass byα¯max\\bar\{\\alpha\}\_\{\\max\}gives the middle inequality;α¯max=Θ⁡\(1/k\)\\bar\{\\alpha\}\_\{\\max\}=\\Theta\(1/k\)gives theO⁡\(H2ε\)O\(H^\{2\}\\varepsilon\)order\. ∎

##### What this does and does not establish

*Establishes:*the identification ofUtU\_\{t\}withℐ\(ℓ∗\)\\mathcal\{I\}^\{\(\\ell^\{\*\}\)\}is not an exact derived equality, but under the named Assumptions[2](https://arxiv.org/html/2609.22157#Thmassumption2)–[3](https://arxiv.org/html/2609.22157#Thmassumption3)the two sets induce*dilution values*that agree up toO⁡\(H2ε\)O\(H^\{2\}\\varepsilon\)in attention mass \(Proposition[1](https://arxiv.org/html/2609.22157#Thmproposition1)\), with an explicit constantH⁡\(H−1\)kα¯maxH\(H\-1\)k\\bar\{\\alpha\}\_\{\\max\}; so wherever heads areε\\varepsilon\-close, usingℐ\(ℓ∗\)\\mathcal\{I\}^\{\(\\ell^\{\*\}\)\}in place ofUtU\_\{t\}perturbs Bui’sδt\\delta\_\{t\}by a controlledO⁡\(ε\)O\(\\varepsilon\)term rather than by an uncontrolled amount\.*Does not establish:*\(a\) the substantive left inclusionℐ⊆Ut\\mathcal\{I\}\\subseteq U\_\{t\}\(CUA\); it is named as Assumption[3](https://arxiv.org/html/2609.22157#Thmassumption3), justified by the additive\-routing picture, and shown in Remark[1](https://arxiv.org/html/2609.22157#Thmremark1)to fail precisely in the single\-decisive\-head \(capacity\-bound\) regime, so it is an assumption about the model’s read\-out, not a theorem; \(b\) any control of theH2H^\{2\}prefactor, which is a worst\-case union count and is loose when residuals overlap across heads \(the sameO⁡\(H\)O\(H\)\-slack issue as Step 3 of Appendix[E](https://arxiv.org/html/2609.22157#A5)\); \(c\) a bound whenε\\varepsilonisΘ⁡\(1\)\\Theta\(1\)\(genuinely divergent heads, the dilution\-prone late layers themselves\), there the approximation is vacuous andℐ\\mathcal\{I\}andUtU\_\{t\}are related only through the CUA sandwich, not quantitatively\. The honest scoping is thus:A4 is a named modelling assumption \(CUA\), under which we prove anO⁡\(H2ε\)O\(H^\{2\}\\varepsilon\)approximate identification of the dilution values, not a derived equality; the word “derived equality” in Appendix[E](https://arxiv.org/html/2609.22157#A5)should be read as this approximation\.

## Appendix HUse of large language models

Large language models were used as general\-purpose assistants during this project: for literature search and triage, for drafting and copy\-editing prose, and as coding aids when writing and analyzing the experiment scripts\. All research ideas, hypotheses, experimental designs, and claims are the authors’ own\. Every reported number was produced by the released code on the stated models and data, and the authors verified the experiments and their reporting\. LLMs were not used as a source of scientific facts or citations without verification against primary sources\.
PAGE: 分区感知门控KV-Cache淘汰

相似文章

PagedAttention：KV Cache的虚拟内存（15分钟阅读）

PuzzleKV：基于页面的低秩分解用于KV缓存压缩

ReST-KV：基于逐层输出重构与时空平滑的鲁棒 KV Cache 驱逐方法

基于顿悟感知的KV缓存淘汰方法（无需注意力矩阵）

LKV：通过端到端学习多头预算与 Token 选择优化大模型 KV 缓存淘汰机制

提交意见反馈
