The Model Is Only the Middle

Both samplers use the same current noisy state and ask the denoiser for a clean proposal. Standard DDPM plugs that proposal into a posterior for the next state, whose mean retains a direct dependence on the current noisy state. Tweedie reprojection removes that direct residual, so the next move is guided more directly by the clean proposal. The authors describe this as a limiting case of the generalized DDIM/DDPM family; crucially, it is an inference-only change on the same checkpoint.

The training-side intervention follows the same logic. Self-correction exposes the model to its own intermediate predictions and trains it to recover the original valid target. With λ_simple = 0.1srcTable 1; Table 1 caption, standard DDPM validity on 21-clue Sudoku rises from 31% to 87%; combining self-correction with Tweedie reprojection reaches 98%. The table shows the same direction across every listed configuration: baseline Tweedie beats baseline DDPM, and self-corrected DDPM beats baseline DDPM. The paper’s best idea is this separation of failure modes: sometimes the model needs a sampler that can abandon an old error; sometimes it needs training on the errors it will create.

The clean ablation is the paper’s strongest evidence. Its broader comparison is much less decisive. The Euler–Maruyama (EM) decay baseline already reaches 81%, 96%, and 80% on the 21-clue, Medium, and Hard Sudoku settings without self-correction, versus Tweedie’s 95%, 99%, and 93%. After self-correction, EM decay reaches 98%, 99%, and 98%, while Tweedie reaches 98%, 99%, and 94%. Performance is plainly sensitive to the reverse process; Tweedie is one effective point in that design space.

The discrete references sharpen the limit. The discrete diffusion (D3PM) confidence and remasking rows reach 0.99srcTable 1–1.00srcTable 1 on several Sudoku, Latin-square, and graph-connectivity columns, although they trail on some Sudoku-Extreme columns. The evidence leaves the route comparison open. What it establishes firmly is that one continuous route was being sampled badly.

That also puts the algorithmic novelty in proportion. The paper places Tweedie reprojection inside the generalized DDIM/DDPM family, and the reported comparisons do not include compute-matched standard DDIM choices or probability-flow ordinary differential equation (ODE) solvers. Self-correction is fixed at λ_simple = 0.1, with no reported sensitivity sweep or control against ordinary augmentation, scheduled sampling, extra training, or iterative refinement. The method description also leaves the schedule, reverse-step count, output discretization, and self-correction state-sampling procedure unclear. Because self-correction uses model-generated intermediate states, its training cost matters; function evaluations and wall-clock costs are left unpriced.

Even a real sampler gain has to be measured against what “success” means. Table 1 reports one-hot Sudoku validity, task success rates, pass@1/pass@10srcResults; Table 1, and random-generation/in-painting outcomes. It leaves exact-target solution accuracy, clue fidelity, diversity, and distributional coverage unmeasured. Constraint validity is meaningful evidence for these tasks, yet it cannot alone show that the intended puzzle solution was recovered. The 21-clue setting is especially hard to read: its masks are randomly generated, while uniqueness is explicitly guaranteed for the original Sudoku-Extreme masks.

The scope is clean and compact: five named benchmarks, with graph connectivity trained at N = 12srcResults and evaluated at N = 12 and N = 18srcResults. That is one extrapolation jump. Table 1 averages three independently trained seeds, each with an independent test seed, which is useful; the evaluation sample counts, pairing across samplers, and compute budgets are not reported. These results support a practical diagnosis on synthetic constraints, with broader generalization still ahead of the evidence.

For an engineer, the takeaway is easy to carry. Inspect the clean proposal before replacing the denoiser: if it already contains global structure, the reverse process may be the bottleneck. Tweedie reprojection makes that possibility visible, and self-correction gives the training loop a way to meet the states sampling will create. The paper earns attention as a sampler warning label; its broader claim remains ahead of the evidence.

State-Path formalizes the route as a state path from the observable initial state to the requested outcome. It begins with an entry tool that can run immediately, passes through zero or more bridge tools that create missing inputs, reaches a target that resolves the request, and may finish with a terminal action that commits it. In the receipt task, LookupOrder is the entry, CreateReceipt and GetCustomerEmail are bridges, and SendEmailReceipt serves as both target and terminal.

That distinction turns menu construction into a small planning problem. A menu can fail by omitting a quiet bridge or by displaying a consumer before its producer. State-Path aims to solve both before the online loop begins. The returned menu contains 32srcMethods, formal setup tools, and the agent can invoke only tools in that ordered interface.

The construction has three jobs. An encoder builds relation-aware representations from the request, the initial observable state, tool schemas, and statistics from training paths. A retriever selects 32 tools with complementary path roles rather than filling the list with individually relevant matches. A reranker then arranges the selected set so producers precede consumers.

Training trajectories supervise route membership, entry, role, and precedence. For a new request, the target trajectory remains hidden while the constructor builds its menu. The online agent receives the finished interface and keeps its original execution loop and call budget. That separation is the paper’s cleanest systems choice: the intervention sits before the agent acts, in the set and order of tools it is allowed to see.

On ToolBench’s 304srcResults, ToolBench evaluation protocol released tasks, every method supplied an ordered 32-tool menu to the same Qwen2.5-72B-AWQ online executor. The primary setup used deterministic decoding, an eight-call budget, a shared prompt, the same execution wrapper and error handling, and the official ToolEval evaluator. The official menu solved 224srcResults, A.4 tasks; State-Path solved 273srcResults, A.4. That is a net gain of 49 tasks and a 16.1-percentage-point rise in success, from 0.737srcResults, A.4 to 0.898srcResults, A.4. Among the 51srcResults, A.4 tasks where the two menus disagreed, State-Path won 50srcResults, A.4 and lost one.

Those are strong paired numbers for a fixed setup. The route diagnostics support the same explanation: complete-chain coverage rises from 0.510srcResults, Table 3 to 0.704srcResults, Table 3, entry-tool coverage in the top five rises from 0.539srcResults, Table 3 to 0.658srcResults, Table 3, and executable visible-prefix coverage rises from 0.296srcResults, Table 3 to 0.334srcResults, Table 3. On the paper’s static full-chain diagnostic, the 32-tool State-Path menu also reaches 0.704 against 0.691srcResults, Table 3 for the official 128srcResults, Table 3-tool list.

That last comparison has a clear boundary. It says a shorter menu can cover more of the measured chain than the official list, by 0.013 in that diagnostic. It does not establish higher end-to-end success under matched context or generation-token budgets. The core comparison remains a meaningful signal that route-aware selection can change an agent’s outcomes.

The central result changes two things at once: which tools enter the 32-tool menu and where those tools appear. The model receives an ordered serialization, so a producer-first arrangement may help because it makes the route executable, because it changes positional and attention effects, or because both mechanisms work together. The reported experiments do not include a same-tool-set order shuffle or a set-only versus order-only ablation. They support the value of a better menu while leaving the source of the lift less settled.

The scope is narrower than the headline suggests, too. The main end-to-end result comes from one deterministic Qwen2.5-72B-AWQ configuration on 304 tasks, with no repeated seeds or uncertainty estimates. The encoder, retriever, and reranker are evaluated as a package; the reported results give no numerical component-removal test showing which part earns the gain. Calling path composition decisive goes beyond those controls.

For an engineer choosing among thousands of APIs, the practical lesson survives the caveat. A request-specific menu should be checked for an executable entry, the producers of required inputs, the target action, and an order that lets those calls happen. Semantic relevance remains useful for finding candidates; it is a poor stopping rule when the task is a chain.

The core operation is familiar dependency planning. The useful systems move is putting that logic into the pre-execution interface, where a 32-tool budget determines what the executor can see. State-Path is worth treating as a design pattern, while its 16srcIntroduction-point gain stays attached to the exact setup that produced it. When one tool call depends on another, the menu has to know which call comes first.

ResidualAuth gives the stronger requirement a formal name: future-equivalence. Two histories qualify only when every later sequence of grants, revocations, and protected uses has the same validity after both. A future-sufficient representation identifies that equivalence class. The monitor therefore has to preserve every distinction a future probe can expose, rather than merely answer today’s reachability query.

The paper invokes a Myhill–Nerode argument to connect the number of future-distinct states to the minimum state count of an exact online monitor. It claims exponential multiplicity even within one fixed transitive closure, then gives a redundancy–memory law: linear growth without revocation, a logarithmic factor under a one-parent policy, and a quadratic state exponent with dense redundant support.

The counterexample is crisp. The asymptotic claims deserve a narrower reading because they belong to an edge-addressable revocation model with particular rules for grants, regrants, expiry, and cascades. Those choices determine which histories can exist and which revocation probes distinguish them. The empirical work stays within constructed episodes, including a synthetic typed domain-specific language (DSL) stream, so this is a result about a modeled authorization machine rather than a universal statement about every deployed delegation system.

The formal distinction then becomes a controlled interface test. Each condition uses matched pairs with identical current reachability and opposite labels after the same hidden continuation; pair-complete accuracy requires both arms to be correct. Four open-weight models—Qwen3.6-35B-A3B, Gemma-4-26B-A4B-it, Ministral-3-14B-Instruct-2512srcResults and Abstract, and Mistral-Small-4-119B-2603srcResults and Abstract—saw 16srcResults and Abstract matched pairs per condition. A fixed 256srcIntroduction and Results-token event summary solved 0–2/16 pairs across the models, a content-matched sham tool solved 0/16, and an authenticated read solved 15srcResults and Abstract–16/16.

That pattern isolates a useful systems lesson. The authenticated read returned a trusted current-query decision, so it functioned as an oracle-like upper bound; the content-matched sham supplied no comparable signal. The 256-token object was a deterministic extract of visible events. The comparison therefore says most about whether the interface exposes usable authorization information, and less about whether a model can reconstruct grant provenance on its own.

Failure of that one summary establishes a limitation of that summary. It cannot establish an information-theoretic limit at 256 tokens: the study explicitly treats token caps as interface constraints rather than measurements of the information budget in Theorem 3. The runs used temperature zero and one seeded pass per episode. With 16 pairs, a single pair has a large effect on the headline. That makes the result a sharp diagnostic of a failure mode, with a small denominator.

The online-memory diagnostic removes the trusted query and asks stateless calls to maintain direct-grant state while the eventual continuation remains hidden. Calls received only the previous model-written memory and the next eight public typed-DSL events; no chat history or hidden state crossed calls. The held-out audit was described as 1,024srcResults evaluation pairs disjoint from 32srcResults calibration pairs, with fresh-ID regrants mixed into grant, revoke, expiry, and cascade events.

Exact state representation fit the tested budgets: capped ledger serializations solved all 128srcAbstract and Results four-coordinate pairs at both 768srcAbstract and Results and 1,024 tokens. Factually supported model-written memories sufficient for every prespecified continuation solved at most 1/128 pairs per model at either cap. The endpoint demanded that both arms be parseable, replayable, gold-supported, and correct on every prespecified probe, so a single failed continuation turns a pair into a failure. This is a stringent test of worst-case online state maintenance in that protocol; it does not estimate how agents perform with other memory formats, prompts, or update policies.

The final intervention moves the trust decision out of the model. A hard execution gate reduced eight observed unauthorized effects to zero without changing the preceding attempts. That result is small, but its architectural point is clean: authorization state, the information exposed to a model, the model’s ability to maintain that state, and the mechanism that commits an external effect are separate controls.

The practical prescription is concrete: preserve direct-grant provenance, restrict redundant delegation where policy allows, or obtain an authenticated query-specific decision after an update. Keep the execution check as a separate layer. Treat current reachability as a useful cache, not the ledger, whenever a revocation can name the edge that supplied access.

That observation dictates the compiler. GPU-CFR walks the game during construction and emits flat edge and information-set arrays, precomputed indices, and depth-level execution blocks. Each iteration then follows CFR’s existing numerical loop: a forward reach pass, a backward value pass, counterfactual aggregation, regret accumulation, regret matching, and average-strategy update. Static chance folding moves strategy-independent chance work into construction, while the depth schedule and dual-lane reach buffer reduce the framework work that remains. The regret rule stays intact.

Because shapes, indices, and buffer addresses stay fixed, the authors capture the iteration as a CUDA Graph and replay it with a single graph launch. The same compiled tensor dataflow runs on CPU with eight threads pinned to physical cores. The contribution is concentrated in the execution plan: topology is paid for once, and the iteration is left with numerical state to update.

Table 2 makes the mechanism concrete. On the heads-up no-limit (HUNL) turn subgame, with 83,040 information sets and 433,610 states, the reference path uses 100srcResults, Table 2 execution blocks and 1,742srcResults, Table 2 ATen operations per iteration. GPU-CFR uses 8 blocks and 96srcResults, Table 2 operations, an 18.1srcResults, Table 2× reduction. Across the eight-game suite, the table reports a maximum regret difference of 0.0srcResults, Table 2 in every row, from 54srcResults, Table 2-information-set Kuhn to 275,983srcResults, Table 2-information-set Battleship. Alongside the paper’s claim that the optimized CPU path reproduces reference iterates bitwise, that is a useful correctness check: the reported execution rewrite leaves the tested regret state unchanged.

Runtime claims go further. On one NVIDIA A100 80GB, the paper reports 29.8srcAbstract; Conclusion–80.4srcAbstract; Conclusion× speedups over Kim and Sandholm’s prior GPU implementation, with a 44.1srcAbstract; Conclusion× median, and 14srcAbstract; Conclusion–258×srcAbstract; Conclusion over LiteEFG on the four largest games. Those are steady-state measurements: GPU runs used CUDA events after 50srcResults, timing protocol warm-up iterations, timing rows ran 1,000srcResults, timing protocol CFR+ iterations, and tree construction and graph capture were measured separately. Training-call rows began after solver construction. The figures measure repeated-iteration throughput; a one-off solve would also carry construction, capture, and however many iterations it needs to converge.

The core systems result is credible. The operation reduction, fixed-address replay, and reported CPU parity line up: a compiler can remove a large amount of per-iteration framework work from a fixed CFR tree. The aggregate table also sets the boundary of the causal story. It demonstrates the combined design; it cannot assign the runtime margin among static chance folding, depth scheduling, the dual-lane buffer, and CUDA Graph replay individually.

Baseline configuration matters just as much. GPU-CFR’s CPU arm used eight pinned threads, while LiteEFG 0.1.5 used a single-threaded C++ backend. The reported 14–258srcAbstract; Conclusion× margin is therefore a result about those configured implementations and resources. It says something useful about the delivered path, while the GPU-versus-CPU comparison remains resource-dependent. The GPU arm was compared with Kim and Sandholm’s noregret CuPy sparse-product implementation on the same A100; that named comparison is informative, but it cannot establish a universal first-place ranking.

The timing protocol also measures iteration throughput rather than time to a common solution quality. The Methods section defines exploitability as exact NashConv divided by two, but a faster iteration becomes a faster solve only when the compared paths reach a comparable stopping point. The bitwise CPU check supports numerical correctness; it does not substitute for a time-to-exploitability comparison.

The demonstrated suite is eight fixed games, and the GPU timing uses one A100. Fixed topology, chance behavior, shapes, and buffer addresses make repeated solves of one game the natural operating point. A changing subgame or chance model would bring recompilation and graph recapture into the cost, so the measured suite leaves dynamic-workload behavior, billion-state scaling, and portability across GPU generations outside its envelope.

That still leaves a useful result. When the same two-player zero-sum perfect-recall tree will be solved many times, GPU-CFR offers a practical compile-once execution pattern and a credible GPU baseline. Its reported 80.4× maximum belongs to the steady state of this setup, rather than serving as a universal exchange rate between CPUs and GPUs. The durable lesson is about representation: for CFR, the execution plan can matter as much as the regret update.

Let P denote a problem’s chance of success on one rollout, and let Y be its number of successes in n conditionally independent attempts. The aggregate count probabilities are mixtures of Binomial(n, P) laws. Equivalently, they determine E[P], E[P²], through E[Pⁿ]—with the zeroth moment fixed at one. Pass@k is 1 minus E[(1−P)^k], a polynomial in P of degree k. The first n moments therefore identify pass@k for k≤n; higher-degree terms need information the experiment never measured.

The qualification matters. Boundary or rank-deficient moment sequences can pin down the mixing distribution and extend pass@k uniquely. The paper’s result is generic, and its model is specific: conditional binomial sampling is doing the work. Correlated or adaptive rollouts pose a different identification problem, so the theorem’s scope is the stated sampling experiment.

The paper made the identification claim constructive. The authors gave exact latent-distribution constructions with the same fixed-n count law and incompatible high-k behavior: one separates polynomial from exponential decay in failure, while another keeps the left-tail exponent fixed and changes its leading constant. Those examples show why “the usual estimator is undefined” is too small a diagnosis. The issue is an entire family of compatible futures.

The underlying mathematics sits in familiar finite-moment territory: a binomial mixture observed at one depth exposes finitely many moments, and Hausdorff geometry supplies extremal bounds. The paper’s value is the translation into pass@k, the exact constructions, and the reporting discipline. For even n, its principal-representation calculation finds the endpoints of the family by optimizing E[(1−P)^k] over distributions on [0,1] matching those moments. The result is a sharp population interval rather than a support-grid approximation.

That distinction matters in practice. An identified interval measures what the fixed-rollout law permits at population level; a confidence interval measures uncertainty in estimating that law from finite tasks. The paper kept those questions separate, described a conservative one-coordinate finite-task confidence certificate, and recommended reporting direct estimates, identified sets, and model-conditioned forecasts as different kinds of evidence.

On the public 10,000srcAbstract; Introduction; Contributions-rollout-per-problem release of Brown et al., the paper constructed n=16srcAbstract; Introduction; Contributions and n=64srcAbstract; Introduction; Contributions counterfactuals across four configurations spanning MATH, GSM8K, and CodeContests. At n=16 and k=1,000srcAbstract; Contributions; Conclusion, the reported ambiguity in failure probability ranged from 1.5srcAbstract; Contributions; Conclusion× to more than 2,600srcAbstract; Contributions; Conclusion× across the configurations. At n=64, one GSM8K configuration was nearly point-identified because the full count law isolated the component controlling failure at the target budget. A controlled stress test showed why simple summaries are inadequate: it held target failure, intermediate-window share, and hard-task dispersion fixed while allowing sharp-set widths to change by orders of magnitude.

These numbers are useful as a picture of moment geometry. They came from counterfactual n=16 and n=64 analyses of a 10,000-rollout release under the pooled model. The resulting intervals are population compatibility ranges, rather than universal error bars for a fresh 16-rollout benchmark; finite-task uncertainty is a separate layer. The paper’s smoothing comparison was also conditional: under a Jeffreys-smoothed latent-probability convention, it reported a conditional Beta–Binomial forecast understating residual GSM8K failure by at least 85×srcAbstract; Introduction. The raw zero-atom and Jeffreys-smoothed conventions assign different meanings to zero counts, so that comparison is best read as a warning about estimands and assumptions rather than a blanket verdict on Beta–Binomial forecasting.

The practical consequence is simple. If a team evaluates n rollouts per problem and publishes a forecast at k>n, it should put three objects side by side: direct pass@k estimates for k≤n, the sharp identified set under the stated sampling model, and the forecast conditional on its tail assumptions. That format lets a reader see whether a narrow curve comes from data, from moment geometry, or from a modeling choice.

Parametric inference-time scaling laws still have a legitimate role; their assumptions should appear beside the forecast. The paper left the choice among extrapolations open while establishing the question every extrapolation has to answer: how much of its tail is in the count law, and how much was supplied by the model? Under this model, more benchmark tasks sharpen the moments already visible; they do not create the missing ones. For fixed-rollout pass@k, that is the line between measuring a curve and choosing one.

The paired design gives the warning substance. The general-capability portion used six OpenLLM Leaderboard benchmarks. For user-facing risks and reliability, it used Bias Benchmark for Question Answering (BBQ), AITA-NTA, and AA-Omniscience. To make interface runs tractable, the authors distilled 28,659srcResults, general-capability benchmark description general-benchmark items to 858srcResults, general-capability benchmark description Metabench items, then sampled 200srcResults, user-facing risk-task description items each for BBQ and AA-Omniscience and 100srcResults, user-facing risk-task description original–flipped AITA pairs. The same sampled items went through both conditions, holding question content fixed.

That is a sensible way to keep the question fixed while bringing a costly web interface into the experiment. The authors identify routing, session personalization, tool invocation, temporal drift, and output extraction as confounds. They also varied exposed system prompts, sampling parameters, and reasoning settings; the abstract says these controls shifted behavior in some cases without reliably erasing the API–interface difference. The question is well chosen: an API call and a browser chat can share a model name while exposing different operating conditions.

Commercial providers do not generally reveal the exact checkpoint behind each interface response. The authors matched each deployed chat product to the closest available API identifier using provider documentation, interface model names, and public release information, and they call the match approximate.

That comparison puts a deployed product beside a documented API configuration; it does not guarantee the same checkpoint under two access paths. System prompts, routing, tool access, safety policies, output filters, and reasoning settings can all affect the response. The observed gap may belong to the deployment layer, a checkpoint mismatch, or both. The design supports a narrower conclusion: the sampled interface products and API configurations behaved differently. It cannot identify the interface switch itself as the cause.

A 3.4-point difference across nine benchmarks and seven systems depends on weighting, repeat protocol, and account-level replication; the number alone does not show how broad the effect is. The same caution applies to the 2.1-point test–retest figure. With heterogeneous tasks, selected samples, and approximate model matching, a pooled mean is best read as a warning signal, with limited claim to universal model status.

Selection and composition reinforce that caution. Metabench’s 858 items are a sparse distillation described as highly informative, while the risk tasks use fixed samples; the authors say those comparisons estimate differences on the sampled set rather than full-benchmark scores. Data collection used five ChatGPT Enterprise accounts, three Claude Pro accounts, and three Google AI Pro accounts, with visible settings and subscription plans held constant within each provider. The paper says the differing tiers and account counts mean it avoids direct provider or model comparisons, yet the headline average is still framed across the seven-system audit. That makes the pooled number harder to interpret than a result reproduced within a single matched system.

What survives is a useful change in practice. API benchmarks remain useful for comparing API configurations; their meaning shrinks when readers use them as proxies for a deployed chat product. The deployed system—its prompts, routing, tools, and policies—needs evaluation at the surface where users will meet it.

An engineer or buyer can apply that rule immediately: run the task on the interface that will carry the work, with the same scoring rule used to justify the choice. The paper’s strongest case is a warning about scope. Read the score at the surface where the decision will be made.

At each step, the attack maintains a residual pair of weight and bias gradients, (G, h). A degree-one neuron gives G[:, j] / h[j] = x_i. To subtract x_i, the server needs y_i, which it recovers from the residual bias: under softmax cross-entropy, the bias sensitivity combines a known Jacobian term with the row associated with the unknown class. A forward pass through the known model, one backward pass, and Jacobian–vector products let the server test candidate labels and choose the one whose residual fits; the sample’s contribution can then be removed. The calculation assumes the attacker knows the model and loss, and it recovers labels alongside inputs.

The code-inspired part is the construction of the first layer. The authors target a robust-soliton distribution of activation degrees, aiming to create degree-one seeds for the cascade. Soliton-Free uses no auxiliary data; Soliton-Data uses one auxiliary batch. The experiments use 1,000 first-layer ReLU neurons and evaluate independent and mirrored weight constructions. Activation degrees still depend on the data and weights, so the analogy supplies a strategy for arranging the attack rather than a general recovery guarantee.

Across eight image and tabular benchmarks, ImageNet carries the headline. Table II’s Passive row reports 99.7%srcResults, Table II, ImageNet Passive row recovery at B=64srcResults, experimental setup and 94.7%srcResults, Table II, ImageNet Passive row at B=128srcResults, Table II, ImageNet Passive row. The active Soliton-Data variants report 92.5%srcResults, Table II, ImageNet SD-Ind and SD-Mir rows and 97.0%srcResults, Table II, ImageNet SD-Ind and SD-Mir rows at B=350srcResults, Table II, ImageNet SD-Ind and SD-Mir rows under the independent and mirrored constructions, respectively; at B=400srcResults, Table II, ImageNet SD-Ind and SD-Mir rows they fall to 89.6%srcResults, Table II, ImageNet SD-Ind and SD-Mir rows and 84.1%srcResults, Table II, ImageNet SD-Ind and SD-Mir rows. Under the tested MLP and arithmetic, those rates show the cascade reaching well beyond the isolated-sample regime.

The curve is sharply conditional. Passive ImageNet recovery drops to 17.5%srcResults, Table II, Passive rows at B=256srcResults, Table II, Passive rows, while at B=128 the corresponding rates are 1.9%srcResults, Table II, Passive rows on EMNIST, 1.7%srcResults, Table II, Passive rows on MNIST, and 47.5%srcResults, Table II, Passive rows on HARUS. Table II reports an average, certificate-admitted recovery rate across random seeds. It does not establish the share of trials in which every sample in a batch was recovered, so a 94.7% entry cannot carry the paper’s stronger whole-batch reading by itself.

The ground-truth-free certificate is a useful piece of the design. A candidate vector comes from the ratio, its label is selected from the residual-bias equation, and the recovery is admitted when the candidate’s predicted contribution remains consistent with the observed residual. No ground-truth target batch is needed for that check. The logical claim is narrower than uniqueness: consistency with the assumed gradient equations can certify a candidate under the model, while the reported work gives no uniqueness argument or false-positive experiment. It also leaves the matching tolerance, duplicate handling, and aggregation rule for the recovery rate unspecified.

The baseline story is narrower than the headline, too. On ImageNet, the trap-weight independent baseline reports 100%srcResults, Table II, ImageNet TW-Ind row at B=64 and B=128, so the Passive row does not beat every active condition in the table. The table contains no direct SPEAR comparison even though the introduction names SPEAR as a prior passive, non-isolation analytic attack based on low-rank gradient structure, and the roughly half-recovered B=100srcResults, Table II, ImageNet TW-Ind row result cited from earlier work is not reproduced under matched conditions. “Exceeds the bound” is therefore a precise claim about bypassing the isolation-based ceiling, with a smaller comparison case than the paper’s broad framing suggests.

Every experiment uses a two-layer, fully connected multilayer perceptron (MLP) with 1,000 first-layer neurons, softmax cross-entropy, one simulated FedSGD round, and 64-bit floating-point arithmetic. The reported passive protocol specifies random initialization—first-layer weights with σ=0.5srcResults, experimental setup, Xavier-uniform second-layer weights, and zero biases—followed by a single simulated round; no training step or trained checkpoint is part of that protocol. Passive here means no attack-side parameter manipulation in that setup, so the rates do not establish the same behavior on a normally trained federated model.

The active results carry extra assumptions. The soliton constructions alter first-layer parameters, and Soliton-Data consumes an auxiliary batch; client-side detectability of that installation is unmeasured. FedAvg, deep or convolutional networks, clipping, noise, quantization, secure aggregation, and differential privacy receive no experimental treatment. The attack also needs an individual client gradient and a copy of the model to evaluate its Jacobian.

That scope leaves a concrete warning. A server that sees an individual gradient and knows the model can treat degree-one first-layer structure as an attack surface. The practical takeaway is simple: audit that structure before treating “updates rather than raw data” as a privacy guarantee.

The answer is a population field with a low-rank memory. In Fourier space, the exact multiplier contains the characteristic function of the rank-r product distribution and the matrix resolvent (I + σ²TTᵀ/r)⁻¹ acting on T. A scalar smoothing factor would preserve the direction of each frequency; this resolvent depends on direction. It can therefore introduce a nonconservative component into the update, so the average trajectory can depart from gradient descent even though the perturbation covariance is the identity.

That warning has a precise boundary. At the population level, EGGROLL is exact on every quadratic objective, at every rank and perturbation radius. For smooth objectives, the first local finite-rank correction is O(σ²/r) and appears through third derivatives. A rank-one sampler can therefore behave exactly on a broad algebraic class while changing the dynamics of a nonlinear objective.

This is a better explanation of rank-one success than identity covariance alone. The method can preserve the right mean behavior for quadratics while exposing higher-order differences elsewhere. Those differences can include local stability changes; empirical success therefore depends on the objective and training regime.

The variance calculation is the paper’s cleanest bridge to scale. Under a local affine objective, rank-one perturbations add a relative variance surcharge of 2(m+n+1)/(mn+1) compared with dense Gaussian evolution strategies. For a 4096 ×srcAbstract; Results reference to Eq. (95) and Appendix E.3 4096 matrix, that is 0.098%srcAbstract; Results reference to Eq. (95) and Appendix E.3. The extra contribution grows with m+n, while the common dense-Gaussian term grows with mn. Wide transformer matrices can therefore make the sampling penalty very small even when the mean field remains finite-rank.

The qualification is the point. An affine objective is a local model. In the transformer audit, the authors perturbed a 16 ×srcResults, Section 10.1.2 16 sub-block of one attention or multilayer-perceptron matrix in Qwen3-0.6B, evaluated next-token loss on a fixed minibatch, used 8,192srcResults, Section 10.1.2 directions across four radii and three perturbation seeds, and compared ranks 1, 2, 4, and 8 with dense Gaussian evolution strategies. The reported measurements recovered the predicted finite-rank variance trend. This is good mechanism-level evidence with a deliberately narrow reach. Full-model post-training adds nonlinear, long-horizon dynamics that this sub-block audit does not measure.

LOO-ROLL is the practical consequence. Standard EGGROLL uses two forward evaluations for an antithetic direction. LOO-ROLL uses one, then forms each direction’s score baseline from the other directions. Before score standardization, the held-out perturbation is independent of that baseline, so the expected finite-rank field is preserved. The saved evaluation can buy another independent direction.

At equal evaluation cost, the paper reports approximately half the estimator mean-squared error (MSE) in transformer blocks. In matched-wall-time post-training runs, it reports seven improvements in ten paired settings, three unresolved comparisons, and five gains surviving Holm correction. On GSM8K, the reported accuracy moves from 38.1%srcAbstract; Conclusion to 63.0%srcAbstract; Conclusion at 0.6B and from 65.9%srcAbstract; Conclusion to 80.0%srcAbstract; Conclusion at 8B. Three unresolved comparisons are weaker than an equivalence result; the empirical headline is promising, though its attribution matters.

Yet the comparison has a built-in attribution problem. Replacing two antithetic evaluations with one changes the estimator and doubles the number of independent directions at the same evaluation budget. The observed gain can come from the leave-one-out baseline, the larger direction sample, or both. The result supports a useful budget-reallocation recipe; it leaves the incremental value of the baseline itself unresolved.

Score standardization creates a second boundary. The field-preservation statement is explicitly made before standardization, while the practical runs use standardized scores. A batch-dependent transformation can change the estimator’s weighting, so the pre-standardization guarantee does not directly certify the update used in training. The GSM8K figures show that the overall configuration can work; they leave LOO-ROLL’s incremental effect difficult to isolate.

Read at the right scale, EGGROLL, Unrolled is a strong analysis with a plausible engineering proposal. Its durable result is the separation of two questions that identity covariance had blurred: what mean field does structured noise define, and how much sampling variance does it add? The answers are concrete. The mean field can carry a finite-rank resolvent and alter local dynamics; the population field is exact for quadratics; the affine calculation explains why the variance surcharge can be small in wide matrices.

LOO-ROLL extends that analysis into a practical recipe, yet the full training claim is narrower than its headline. The core finite-rank characterization earns confidence. The experiments support the narrower claim that one evaluation per direction plus a leave-one-out baseline can make a fixed budget more productive. They leave the contributions of the baseline, the extra directions, and score standardization unresolved.

Treat rank as both a search-geometry choice and a memory knob, and judge an estimator by the number of independent directions its budget buys. When rank one looks surprisingly good, ask what field it follows and what the evaluation budget actually purchased. That is the useful conclusion to carry from this paper.

Across nine behavioral evaluations from six independent scenario sources, the study covers demographic bias, sycophancy, capability, reward hacking, misuse and lying under pressure, agentic policy violation, and agentic misalignment. It evaluates 15srcResults, models and prediction methods methods on 12srcResults, models and prediction methods model or inference entries: six small-to-mid-size models and three frontier bases, each run with and without low-effort reasoning. Configurations are selected on development data from the small-model pool, then frozen for frontier evaluation; headline results use a frozen test split. That is a sensible guard against tuning the comparison to the largest systems.

On the reported headline figures, a direct self-report given only a description of the situation predicts the model’s behavior at r = 0.04srcAbstract; Introduction, results summary. Giving it the model’s measured behavior on other conditions raises the figure to 0.19srcAbstract; Introduction, results summary; showing the exact evaluation questions raises it to 0.24srcAbstract; Introduction, results summary. The same item-informed question about “capable AI agents in general” reaches 0.28srcAbstract; Introduction, results summary, while other models’ self-reports reach 0.35srcAbstract; Introduction, results summary when predicting the target.

Those values are best read as a pattern rather than a fine-grained leaderboard. With 15 methods, nine evaluations, and multiple prompt forms, nearby correlations should be read with their paired uncertainty and the many comparisons in mind. The central result is the broader one: in the reported aggregate, the self-report has no demonstrated special edge.

The paper’s language is strongest where its design is most limited. The generic-agent question is answered by the target model itself, so the control changes the framing without removing the model’s learned expectations or the common structure of the items. Shared item difficulty and grading artifacts can also make a generic answer predictive. The control is valuable for testing whether first-person wording adds signal; it cannot cleanly separate a generic theory from an internal self-model.

The narrower result is still valuable: in these elicitation formats, self-reports provide little demonstrated predictive information unique to the model speaking. The experiment leaves open whether a model represents its own tendencies in a form these prompts fail to access. A weak privileged channel is an evaluation finding; internal representations require a different kind of evidence.

That caveat matters because the paper estimates that the model-specific share of reliably measurable variance ranges from about 0.04 on Capability to about 0.97srcIntroduction, RQ1 results on agentic policy evaluations. Some tasks contain almost no individual signal to recover, while others contain a great deal. The aggregate result should therefore be read as a statement about the reporting channel, rather than as evidence that model-specific behavior is generally absent.

One secondary finding is more immediately operational. The paper reports that first-person framing shifts answers in a flattering direction, understating harmful behavior relative to asking about a generic capable agent. The wording that sounds most like introspection can therefore soften the forecast. That effect gives developers a reason to compare first-person prompts with generic controls before trusting a model’s account of what it would do.

Scale does not rescue the self-specific story. The frontier runs show no detectable change in the pattern, but the comparison has three frontier bases against six smaller models and varies model family, lab, and inference setup at the same time. Treat it as evidence about the tested systems and prompting setup. A clean scaling law is a stronger claim.

That leaves a practical rule for evaluation. When a model predicts that it will cave to pushback, misuse a tool, or lie under pressure, use the answer to form a hypothesis about assistant behavior and to choose what to measure. Do not let the answer substitute for measuring the model that will actually run.

The paper also reports that fine-tuning on a model’s own behavioral record produces narrow self-prediction gains, changes the behavior being predicted, and does not transfer broadly. A predictor trained on a record can move the target it is meant to forecast. Treat the prose as a prior, and the system’s behavior as the evidence.