Papers, posts, and roadmap.

U-Shape Trajectories of κ_t Separate Successful and Failed LLM Agent Runs on SWE-bench Pro / Qwen3.6-27B

Caio Vicentino · NeurIPS 2026 Mechanistic Interpretability Workshop (draft v2) → ICLR 2027 main · 2026-05-18

We propose cross-probe coherence κ_t — the mean absolute pairwise correlation across N concurrent per-turn behavioral probes within a moving window of agent turns — as a meta-signal for LLM agent monitoring. On 99 SWE-bench Pro trajectories from Qwen3.6-27B we report two distinct findings. (1) Per-trace mean κ̄ separates success from failure at AUROC 0.677 (Mann-Whitney p=0.0009). (2) κ_t exhibits a U-shape over each trajectory: it decreases through an early exploration phase and increases through a late consolidation phase, and the amplitude of this U-shape is markedly larger in successful traces (early-half slope −0.0078/turn vs −0.0007/turn, p=0.0002; late-half slope +0.0149/turn vs +0.0025/turn, p=0.00004). A pre-registered robustness control (C1) found the monolithic per-trace slope is substantially explained by trace-length confound (p=0.56 after length regression), motivating the length-normalized early-half/late-half decomposition. Within-trace turn-order shuffle nulls (C2) confirm the U-shape is genuinely temporal (p<0.0001). The pattern is the inverse of cardiac uncoupling: in ICU literature, cross-vital decorrelation anticipates physiological decompensation; in LLM agents, cross-probe trajectories oscillate during successful reasoning (explore→consolidate) and remain flat during failure. We document the methodological discipline — pre-registered gates that caught both five prior single-probe walk-backs in the 36 hours before this finding and this paper's own headline-confound — that gives the rescued temporal claim its credibility.

An eleven-site empirical map, a unifying operational-constraints framework, and a pre-publication diagnostic battery — derived from four prior honest negatives

Caio Vicentino · TMLR (Survey Certification) → ICLR 2027 main (draft v1) · 2026-05-16

Linear probes on transformer residual streams routinely achieve high predictive AUROC, yet whether a probe direction also levers downstream behavior under intervention is rarely measured systematically. We report a twelve-site causal-authority map of probes in Qwen3.6-27B (reasoning-tuned, 27B parameters), comprising eleven probes evaluated under a unified α-sweep + control-token + onset-timing protocol plus one predictive case study, and identify five distinct empirical causal regimes: causal trajectory-shaping, pushup-asymmetric, pushdown-asymmetric, structurally-locked, and epiphenomenal-via-softmax-temperature. We propose that probe causality is operationally constrained by a five-axis configuration — layer (spatial), trajectory (temporal), magnitude (α), direction (saturation alignment), and decision locus (architectural) — and demonstrate each constraint with a within-paper falsifying experiment that holds the other four fixed. We then consolidate the methodology that surfaced these constraints into a six-item pre-publication diagnostic battery: random-feature baseline, shuffled-source baseline, control-token normalization, structural-rigidity α-sweep, whitespace-stripped flip metric, and onset-timing sweep. Each diagnostic is mapped to a concrete failure mode we shipped or nearly shipped in our own work: over-parameterization at N<100, marginal-fit pathology in sparse top-k prediction, softmax-temperature artifacts that look causal, amplitude-null masquerading as structural-null, tokenization-inflated flip rates, and trajectory-versus-state confusion. Together the diagnostics cost under one GPU-hour per probe. We release the protocol, capture batches, per-probe verdicts, and an open-source SDK that implements the diagnostics, and argue that the field's growing reliance on probe-based monitoring, reward shaping, and alignment auditing should treat probe causality as a conditional property to be measured per deployment configuration, not a global per-probe attribute.

Causal, Cross-Domain, and KV-Cache-Bound — a Subjective-Time Direction with Operational Constraints

Caio Vicentino · NeurIPS 2026 Mechanistic Interpretability Workshop (draft v2.1) · 2026-05-16

We identify a causally functional subjective-time direction in the residual stream of Qwen3.6-27B (open-weights, 27B parameters, hybrid Gated-Delta-Net plus standard attention), validate it across math (GSM8K) and code (SWE-bench Verified) reasoning, and characterize a fundamental operational constraint on its causal effect: the steering intervention works only when applied continuously from generation start. A Ridge regression probe trained on residuals at L11/L31/L55 predicts thinking-phase completion with R²=0.82-0.86 (Spearman ρ ≥ 0.90); three baselines (random-feature, shuffled-target, constant-mean) cleanly fail. Forward-hook steering at L31 with α=+50 from token 1 shortens GSM8K thinking-length in 9/14 prompts vs 2/14 for matched random (Fisher p=0.0092). Cross-domain: 19/20 (95%) probe-clean-termination on SWE-bench Verified across 6 repositories vs 6/20 (30%) random (Fisher p<0.001), at mean 299 thinking-tokens vs unbounded baselines (0/10 terminate even at MAX_NEW_TOK=2048). The mechanism is trajectory-dependent: delayed steering — even at decode step 50 — drops termination from 9/10 to 3/10; by step 200, the rescue effect vanishes entirely (0/10). Two closed-loop variants (probe-as-sensor with threshold trigger + plateau detector) achieve only 1-2/10 termination, confirming that the 'termination basin' is mediated through KV-cache state buildup rather than instantaneous residual perturbation. Phase 2C cross-layer test further establishes that the direction is causal ONLY at L31 — L11 (R²=0.84) and L55 (R²=0.82) are inert despite equivalent probe accuracy. This refines the probe-causality taxonomy with a third category beyond 'causal' / 'epiphenomenal': operationally-constrained causal — directions that lever behavior only under specific application protocols (temporal: from token 1; spatial: specific layer only).

An Honest-Negative on Predicting End-of-Thinking SAE Features in Qwen3.6-27B

Caio Vicentino · NeurIPS 2026 Mechanistic Interpretability Workshop (draft) · 2026-05-16

We train linear probes to predict end-of-thinking sparse-autoencoder (SAE) features in Qwen3.6-27B from residual activations at earlier thinking-phase fractions, across three layers (L11, L31, L55). Naive evaluation reports recall@1024 = 0.83-0.87 at L11/L31 and 0.67-0.72 at L55. We then run a shuffled-source baseline (X_train shuffled, y_train kept, identical recipe) and observe that the baseline reproduces the real recall within ±0.03 at all 12 (layer × source-fraction) sites, with Cohen's d < 0.15. A trivial constant baseline that predicts the top-M most-globally-common features ignoring input strictly exceeds the trained probe (1.000 at L11/L31, 0.991 at L55). The probe is not learning per-prompt predictive structure — it is fitting the marginal distribution of end-of-thinking SAE features and approximating an input-independent constant rule. We name this the marginal-fit pathology, identify five structural conditions that produce it (sparse top-k target + concentrated marginal + N_train << d_target + lazy loss + recall-style metric), contribute the shuffled-source baseline as a Phase 6c-class hard rule for sparse-target probe-prediction work, and reframe predictive-probe agendas — including JEPA-shaped LLM experiments — toward differential metrics (REAL − SHUFFLED) from day one rather than absolute recall.

Two-Tier Verbalization in Natural Language Autoencoders — Three-Model Differential Scaling on Qwen2.5-7B, Gemma-3-12B, and Gemma-3-27B

Caio Vicentino · NeurIPS 2026 Mechanistic Interpretability Workshop (draft) · 2026-05-09

Natural Language Autoencoders (Fraser-Taliente et al. 2026) train an activation-verbalizer (AV) and an activation-reconstructor (AR) end-to-end with GRPO so that round-trip MSE between original and AR-reconstructed activations serves as a learnable explanation-quality reward. We replicate the canonical recipe on three NLA pairs from the kitft release spanning two model families and three scales — kitft/nla-qwen2.5-7b-L20, kitft/nla-gemma3-12b-L32, and kitft/nla-gemma3-27b-L41 — and show that the headline metric, fve_nrm, decouples from semantic content fidelity across all three models, with three differential scaling axes that sharpen the methodological position. On a 50-prompt corpus across 4 categories (chat / code / agent / reasoning) at K=3 samples (N=150 per model), fve_nrm is uniform at high absolute level (Qwen 0.880 / Gemma-12B 0.992 / Gemma-27B 0.982; spreads 0.017 / 0.005 / 0.010) while keyword recall varies 6.5–8.8× across categories (Qwen spread 0.490 → Gemma-12B 0.649 → Gemma-27B 0.654). The trajectory reveals: (a) overall content-fidelity signal-above-floor grows monotonically with NLA training quality (permutation gap +0.27 → +0.38 → +0.43, no ceiling visible); (b) per-category recall spread saturates between 12B and 27B at a training-distribution-imbalance ceiling; (c) Tier 1 fve_nrm peaks at moderate model size then slight regression at 27B, suggesting layer-extraction-dependent quality. Three controls validate on all three: permutation, random Gaussian (collapse to fve_nrm = −0.949 → −0.992 → −1.000 with exact orthogonal cosine, while AV produces increasingly contracted format templates from heterogeneous formats to single 'Educational article' hyper-template attractor), and direction-injection (4/4, 3/4, 3/4 self-category alignment with negation symmetry — agent failure mode model-specific: Gemma-12B agent → code, Gemma-27B agent → chat under format-prior contraction). Two-tier thesis: Tier 1 (format/category) is direction-modulated and what fve_nrm measures; Tier 2 (specific content) is largely unencoded. Better NLA training makes fve_nrm less, not more, informative about per-category Tier 2 quality.

Template-locked reasoning decisions and the structural ceiling on text-only CoT monitoring in Qwen3.6-27B

Caio Vicentino · Position paper, May 2026 · 2026-05-09

Chain-of-thought monitoring has emerged as a leading candidate for scalable AI safety oversight: if a long, serial reasoning process must pass through a textual trace, then reading that trace should reveal what the model is thinking. We argue this view is structurally incomplete in instruction-tuned reasoning models. The chat template that activates thinking mode in Qwen3.6-27B injects a fixed <think></think> token pair into the input itself; the decision to think at all is encoded in the prompt before the residual stream encodes anything else. We document this template-lock experimentally (bidirectional α-sweep up to ±200 in the L55 thinking probe direction produces zero behavioral change) and contrast it with three other reasoning loci where decisions are residual-stream-encoded and steerable: capability deployment (+33-40pp pushdown gap across distributions at α=−100), persona (+60pp pushdown at α=−200), and mid-reasoning quality (+30pp pushup at α=+200). We use this evidence to argue for an activation-derived monitorability bound: text-only CoT monitoring cannot, by construction, observe decisions made before the residual stream encodes them. Activation-derived monitoring is the structurally complementary half of any complete monitoring strategy. We discuss implications for the Frontier Model Forum's January 2026 issue brief and Anthropic's 2027 detection goal.

A Five-Class Taxonomy of Probe Causality in Qwen3.6-27B

Caio Vicentino · NeurIPS 2026 Mechanistic Interpretability Workshop (draft) · 2026-05-09

Linear probes routinely achieve high predictive AUROC, yet their causal authority — whether their direction levers downstream behavior — has been only sparsely tested at frontier scale. We map probe causality across 8 probes (5 layers, 5 positions, 3 training-objective classes) on Qwen3.6-27B using a unified protocol combining bidirectional α-sweep up to α=±200, random K-matched control direction, control-token-normalized log-prob shifts, structural-rigidity diagnostic, and whitespace-stripped behavioral flip metric. We document five empirical classes of probe-causality regime and identify a single unifying principle — probes lever in the saturation direction of the baseline residual — that explains all observed asymmetric-lever cases including a falsified prediction. The classes are: (1) surface softmax-temperature artifact (L43 capability), (2) template-locked categorical decision (L55 thinking emission, L31 fabrication-detection), (3) structural fragility at fragile layers (L11/L43 think_start), (4a) pushup-asymmetric lever for reasoning quality at high amplitude (RG L55 mid_think, +30pp gap), and (4b) pushdown-asymmetric lever for capability and persona at high amplitude (5 sites, +30 to +60pp gap). We falsify the naive prediction that continuous-gradient probes lever in the pushup direction by demonstrating that persona — a continuous gradient — levers in the pushdown direction when the test prompt's baseline is in the helpful saturation region.

When Decoder Universality Overstates Causal Equivalence in Gemma-2-2B

Caio Vicentino · NeurIPS 2026 Mechanistic Interpretability Workshop (draft) · 2026-05-08

We provide the first per-feature empirical measurement of the gap between decoder cosine universality and causal-equivalence in cross-model crosscoders. Training a paper-grade BatchTopK crosscoder (73,728 latents, k=100) on Gemma-2-2B base/IT at layer 13, we measure Pearson correlation between two-model KL trajectories under per-feature ablation across 256 probes. Median decoder cosine 0.965 vs median Pearson_CE 0.616, with 38.24% of shared features having cosine > 0.7 yet CE < 0.5. Outliers in both tails — anti-aligned decoders with equivalent causal effect, and aligned decoders with opposite causal effect — show that cosine is neither necessary nor sufficient for causal equivalence. We propose Pearson_CE as a mandatory complementary diagnostic for crosscoder universality claims and release all artifacts under Apache-2.0.

Orthogonal Learning Beyond Task-Specific Detectors in Qwen3.6-27B

Caio Vicentino · NeurIPS 2026 Mechanistic Interpretability Workshop (draft) · 2026-05-08

We report a phase-transition-like dynamic in multi-probe Direct Preference Optimization on a 27B-parameter reasoning model, observable only through fresh probes trained after the fact. Original probes (FabricationGuard at L31, ReasoningGuard at L55) used as the joint preference signal remain invariant across training (variance 7×10⁻⁸, ~40× below within-step noise) despite a 0.234 DPO loss descent and 0.654 logit-difference. A fresh probe re-trained on each checkpoint reveals a smooth, accelerating progression in AUROC from 0.472 → 0.528 with a late-half-to-early-half slope ratio of 2.60 — the construct-then-compress signature of grokking dynamics, but with a compression target orthogonal to the original probes. We argue this is a structural Goodhart phenomenon specific to probe-derived rewards, propose fresh-probe AUROC progression as a complementary safety evaluation, and release training checkpoints, probes, and reproducer code under Apache-2.0.

Mid-Reasoning Capability and Chain-of-Thought Emission in Qwen3.6-27B

Caio Vicentino · NeurIPS 2026 Mechanistic Interpretability Workshop (draft) · 2026-05-08

We train linear probes on residual-stream activations of Qwen3.6-27B and obtain two correlative findings (capability AUROC 0.83 at L43 pre_tool, CoT emission AUROC 0.85 at L55). Three intervention experiments show both are detection-only via two distinct mechanisms: softmax-temperature artifact (L43) and template-locked decision (L55). We contribute three sanity checks (random-K baseline, control-token normalization, structural-rigidity α-sweep) and ship agent-probe-guard, an Apache-2.0 SDK that markets the correlative finding without overclaiming. Cross-environment eval reveals probe weights are coupled to inference setup; v0.3.1 ships a refit() helper.

Closing the L55 thinking-emission causality experiment

Caio Vicentino · Internal eval document (companion to NeurIPS MI 2026 draft) · 2026-05-08

Phase 8 single-shot bidirectional steering with bf16 amplitude diagnostic delivers a structural-rigidity null that converges with Phase 7 on the higher-order claim: probes detect; mid-layer steering doesn't lever. Two epiphenomenal mechanisms documented (softmax-temp + template-lock), three methodology contributions consolidated (random-K baseline, control-token normalization, structural-rigidity α-sweep). Includes Phase 8 redux confirming structural lock isn't dilution.

An Operational Checklist for Causal Claims in Mechanistic Interpretability

Caio Vicentino · NeurIPS 2026 Mechanistic Interpretability Workshop (draft v0.1) · 2026-05-19

Mechanistic interpretability papers routinely make causal claims — that a linear probe is a causal lever, that a circuit mediates a behavior, that an SAE feature implements a concept — but rarely state the identification assumptions that make these claims falsifiable. A recent position paper (Bohnet et al., 2026) proposed a disclosure norm: state whether a claim is causal, name the identification strategy, enumerate assumptions, and demonstrate how conclusions shift if assumptions fail. We operationalize this norm as six diagnostics, each runnable in under one GPU-hour per probe, and demonstrate each on a published-or-near-published causal claim from our own prior work where the diagnostic would have falsified the claim if not run. One of the six — trace-length-controlled slope decomposition — has not previously been published as standalone methodology. We position the resulting checklist as the minimum-viable operational layer beneath theoretical frameworks for causal abstraction (Geiger et al., 2024) and causal scrubbing (Anthropic), and ship an open-source Python module, a Colab demonstration on a toy probe, and an integration with the ProbeBench leaderboard.

Paper #1, the foundation of the WANDERING arc — a probe-free, cross-architecture detector of agents that never stop

Caio Vicentino · Zenodo · CC-BY-4.0 · DOI 10.5281/zenodo.20368600 · the foundation of the WANDERING arc · 2026-05-24

A long-horizon coding agent fails in a distinctive way we call WANDERING: it stays internally confident it has solved the task yet never emits a termination action, exhausting its turn budget — a ~34% blind spot for probe-based agent monitoring. We test six detector designs across three signal channels on Qwen3.6-27B SWE-bench Pro trajectories and find that tool-use entropy collapse — the agent cycling the same tool calls in its final turns — is the load-bearing, probe-free signal, supporting three deployment tiers: forensic (35% recall / 0% false-positive), advisory (cross-layer, 80% recall with ~15-turn lead), and autonomous (tool-entropy, 70% recall / 5% false-positive). The signature is cross-architecture within SWE-bench — Llama-70B (collapse ratio 0.41, p<1e-15) and a GPT-5 router (0.71, p=8.9e-35) match Qwen — but a cross-task test on METR MALT is null (ratio 1.007, p=0.81), so we scope the claim to multi-turn code-execution agent tasks with rich action spaces. Mechanistically (§13), the mid-layer 'task is done' verdict is consolidated while the edge layers (L11/L55) fail to translate it into the finish action, producing the final-turn tool loop. This is the foundation of the WANDERING arc — every downstream result (the residual nulls, the behavioral rescue, the verdict feature, and the late lever) builds on this detector.

Three causal nulls and a dose-dependent destabilization at WANDERING's strongest detector locus

Caio Vicentino · Zenodo · CC-BY-4.0 · DOI 10.5281/zenodo.20490278 · 2026-06-01

We report three causal tests of the Tool-Entropy WANDERING mechanism hypothesis (mid-layer verdict consolidated, edge-layer alignment fails) on Qwen3.6-27B SWE-bench Pro trajectories, and all three are null on rescuing WANDERING. A forced-finish counterfactual rules out silent success (Fisher p=0.71); always-on L55 SUCCESS-donor steering is behaviorally inert (p=1.00); and re-targeting the injection to L11 — the edge layer the companion classification paper flags as WANDERING's strongest discriminator — across a norm-matched magnitude sweep does not rescue either (paired McNemar p=0.73). The one robust effect is the opposite of a rescue: at high magnitude the L11 hook destabilizes the model into invalid tool calls (0/20 → 12/20). We also surface a load-bearing methodological finding: WANDERING is not run-stable at temperature 1.0 (the same instances flip finish 7/20 with no intervention), so every intervention test must be paired and the unpaired 0/20 baseline manufactures a false positive.

60 multi-channel features, a mid-to-edge mechanism, and a residual-blind / behavior-legible response signal

Caio Vicentino · Zenodo · CC-BY-4.0 · DOI 10.5281/zenodo.20490284 · 2026-06-01

WANDERING — an LLM agent stays internally confident it has solved a task yet never emits a termination action and exhausts its turn budget — is a 34% blind spot in probe-based agent monitoring. We characterize it mechanistically on N=99 Qwen3.6-27B SWE-bench Pro trajectories: 60 multi-channel features (text, tool-use, per-layer residual, temporal) classify SUCCESS/LOCKED/WANDERING at macro-F1 0.636 (z=5.88, p=0.001), after a transparent walk-back from a leaky 0.987 baseline. Stability selection independently recovers a mid-to-edge mechanism (LOCKED→L43, WANDERING→L11), and an LLM-judge bridge to a human taxonomy co-locates ≈60% of both LOCKED and WANDERING into one category, matching a mechanistically weak boundary (p=0.035). Finally, the residual signature does not predict which agents flip to finish under a companion L11 injection run (LOO-AUC 0.619), but tool-entropy collapse depth does (AUC 0.768): response to intervention is residual-blind but behavior-legible.

The predictive signal is residual; the causal lever is behavioral — the first positive of the WANDERING arc

Caio Vicentino · Zenodo · CC-BY-4.0 · DOI 10.5281/zenodo.20490286 · 2026-06-01

A multi-turn coding agent fails in a distinctive way we call WANDERING: it keeps acting but never emits the finish action, exhausting its turn budget. A companion line of work detects WANDERING from a residual-stream signature and a tool-entropy signal, but three pre-registered residual interventions (SUCCESS-direction injection at L55 and at L11) all fail to rescue it. We ask whether the missing lever is not the locus but the modality. On the same 20 WANDERING Qwen3.6-27B SWE-bench Pro trajectories, gated by the same live tool-entropy collapse detector, a transient behavioral interruption — one fresh user turn at the collapse point — roughly doubles finalization (30%→70%, paired McNemar p=0.021), while residual L11 injection stays inert (p=0.63). The lever is the interruption itself, not its content: a content-neutral message rescues as well as a re-plan (p=1.0). SWE-bench Pro Docker evaluation suggests the interruption also raises task solve-rate (~23%→50%, cross-session). For long-horizon agents the predictive signal lives in the residual stream but the causal lever lives in behavior.

A pre-registered negative — companion note to the WANDERING arc: context rot leaves a real residual trace that is operationally redundant

Caio Vicentino · Zenodo · CC-BY-4.0 · DOI 10.5281/zenodo.20500053 · companion note to the WANDERING arc · 2026-06-01

Does the residual stream carry an earlier or better detector of long-horizon agent WANDERING than the cheap probe-free tool-entropy signal — does the geometry rot before the behavior does? We pre-register and test this on the same 99 Qwen3.6-27B SWE-bench Pro trajectories. Stage 1 (raw residual geometry, no SAE) finds a real but weak fingerprint, representational velocity-freezing: trajectories that will WANDER settle toward an attractor sooner (smaller per-turn state change early), directionally consistent across all five layers (4/5 raw p<0.05, length-controlled), with one mid-network layer clearing a pre-registered trend-and-divergence conjunction (p=0.015) — but nothing survives multiple-comparison correction. Stage 2 (the decisive predictive test) shows the fingerprint adds nothing: early velocity at L31 reaches AUROC 0.695, statistically indistinguishable from the fair early behavioral baseline (tool_entropy_first10, 0.688; paired bootstrap Δ=+0.008, 95% CI [−0.170,+0.211]) and clearly below the deployed late detector (0.888); as a sharp alarm at ≤5% false-positive it catches only 1–3 of 20 WANDERING — far fewer than the deployed detector, with too few overlapping detections to measure a lead-time advantage. The residual fingerprint of context rot is real but downstream-redundant — strengthening the arc: for this failure mode, watching the cheap behavior is as good as or better than reading the residual stream.

The mechanistic capstone of the WANDERING arc — detection ≠ control at the level of one named SAE feature

Caio Vicentino · Zenodo · CC-BY-4.0 · DOI 10.5281/zenodo.20532769 · capstone of the WANDERING arc · 2026-06-03

A long-horizon coding agent fails by WANDERING — acting indefinitely without emitting the finish action. Does it internally represent a 'task is done' verdict, and is that representation the causal lever for termination? Using a full-stack sparse autoencoder on Qwen3.6-27B over 99 SWE-bench Pro trajectories: (i) an SAE feature at layer 23 (#22358), selected anti-circularly from SUCCESS only, is present at the WANDERING final turn but not LOCKED (AUROC 0.81, length-controlled, partial-r 0.55); (ii) it interprets in-domain as a 'subtask completed and verified' feature (completion-language enrichment 50% vs 6%); (iii) it predicts the actual finish action (AUROC 0.91); yet (iv) clamping it to the SUCCESS level at the WANDERING decision point produces no change in P(finish) (Δ = −0.001, indistinguishable from a random-feature clamp at +0.002), and ablating it in SUCCESS does not significantly reduce finishing (−0.008, n.s.). The agent represents 'I'm done' as a clean, interpretable, predictive feature — but that representation is not what makes it stop. This extends the detection-vs-control asymmetry to the level of a single named feature and sharpens the arc's residual nulls one level deeper; the only known WANDERING rescue remains a behavioral interruption. Every stage is CPU-only except the causal test.

The first positive of the WANDERING arc — the termination lever is late (L51–63), ~30 layers downstream of the verdict

Caio Vicentino · Zenodo · CC-BY-4.0 · DOI 10.5281/zenodo.20534219 · the first positive of the WANDERING arc · 2026-06-03

After five papers locating where control over a long-horizon agent's termination is NOT — not the residual, not the right locus, not the named verdict feature — this paper locates where it IS. On 99 Qwen3.6-27B SWE-bench Pro trajectories, reconstructed faithfully at the decision point and gated for behavioral fidelity (P(finish): SUCCESS 0.59 ≫ WANDERING 0.07 ≫ LOCKED 0.005), a layer-resolved logit-lens shows the finish decision is invisible through layer 31 and emerges only in the last ~12 of 64 layers (L51–L63), ~30 layers downstream of the mid-layer verdict (L23). Activation patching confirms it causally: injecting the SUCCESS late-block state into WANDERING raises P(finish) (+0.13 at L55, +0.15 at L59; donor-specific — the LOCKED donor moves it the other way), while every mid-layer and verdict-feature intervention is null. Critically, the effect survives a real generation: patching the late block at the decision point alone makes the agent emit a well-formed finish call in 42% of WANDERING decision points (5/12; exact one-sided McNemar p=0.031 vs a 0/12 baseline and a 0/12 LOCKED-donor null) — but only with a task-matched donor; a coarse class mean is not significant (25%, p=0.125). The first internal causal lever of the arc, it reframes the knowledge–action gap on agents as a LAYER gap: the decision is known mid-stream but only writable late. Released with decision-locator, a model-agnostic tool that finds and steers the commitment layer for any tool-calling decision on any open model. Honest scope: single model, single task family, n=12; the positive depends on the task-matched donor.

The circuit-breaker capstone — the late lever generalizes finish→edit, brakes a real commit (96%), and replicates across two model families

Caio Vicentino · Zenodo · CC-BY-4.0 · DOI 10.5281/zenodo.20634838 · prepared for BlackboxNLP 2026 (EMNLP) · 2026-06-10

Paper #6 showed control of a coding agent's finish decision lives not at the mid-layer verdict but in a late, task-matched action-commitment block ~30 layers downstream. This paper asks whether that late lever is specific to termination, and whether it can BRAKE an action — the mechanism a safety circuit-breaker needs. On Qwen3.6-27B over 99 SWE-bench Pro trajectories, using a second decision (commit a file edit vs continue reversible exploration), with n=60 deterministic decision points per condition and generation-confirmed outcomes: (1) GENERALIZATION — injecting a task-matched edit-donor into the late block makes a stuck-in-exploration agent emit a real edit call (0.23→0.77 at L59; position control 0.08, cross-task 0.48). (2) THE BRAKE — injecting an explore-donor at a commit decision collapses the real edit rate 0.48→0.02 (96% suppression) at L55, with a same-class control intact (0.55) and the opposite donor boosting to 0.92. (3) The mechanism is MONOTONIC and BIDIRECTIONAL: exact paired McNemar on all 14 per-point conditions yields seven contrasts surviving Holm–Bonferroni (worst p=7.6e-5), with elicit c=0 (the edit-donor only turns commits on) and brake b=0 (the explore-donor only turns them off) — the lever moves exactly in the donor's direction with ~zero off-direction noise. (4) CROSS-ARCHITECTURE: the late-commitment geometry and donor-specific writability replicate across two model families and two scales (Mistral-7B and the scale-matched Mistral-Small-24B, where the mid-inert/late-write dissociation is cleanest, fidelity 0.955 vs 0.007). The brake re-routes to reversible exploration (+0.17 bash above its no-brake floor) and the lift survives a full valid-tool-call re-parse. We frame the bidirectional late lever as a mechanistic circuit-breaker. Honest scope: an existence proof, not a universal law; demonstrated on a semi-irreversible (undoable) edit — a genuinely irreversible action (send_transaction) is the named next step.

The safety capstone — the late brake works on a genuinely irreversible send_transaction, generalizes across six irreversible actions and three architectures, and redirects to safety

Caio Vicentino · Zenodo · CC-BY-4.0 · DOI 10.5281/zenodo.20679287 · 2026-06-13

AI agents now take irreversible actions — sending crypto, deleting files, dropping database tables, deploying to production, sending email. Paper #7 showed that a single late-layer activation patch can BRAKE a coding agent's committal action, collapsing a real file edit (0.48→0.02), but an edit is reversible; the named open question was whether the brake works on a genuinely irreversible action. We answer it, and generalize it twice. On a simulated wallet agent (Qwen3.6-27B, no real funds, n=24), injecting a task-matched safe-action donor at a late layer collapses a committed send_transaction (0.998→0.00 emission, exact McNemar b=24,c=0, p≈1.2e-7) and — the safety-critical property — the agent redirects 100% to a safe read-only action (get_balance), never to another transfer. The brake is direction-specific: a same-class donor does not suppress, and a random donor destroys the output into incoherence rather than producing a safe redirect. It is a LAW ACROSS ACTIONS: on six diverse irreversible-action domains (crypto transfer and ERC-20 approval, file deletion, table drop, production deploy, email send), the brake yields 100% generation-confirmed suppression AND 100% redirect-to-safe wherever the agent will commit the action. It is a LAW ACROSS ARCHITECTURES: the same battery replicates on Llama-3.1-8B and Mistral-Small-24B (17 of 18 model×action cells valid, the brake working in all 17; the one invalid cell is a model that refuses to commit a production deploy at all). The brake locus is a depth-relative late property (~80–98% of depth), model- and action-specific — the hardest actions are only fully braked at the final layer. Honest scope: actions are simulated and the intervention is a white-box, inference-time activation patch, so this establishes that the brake MECHANISM generalizes to irreversible actions and architectures — not a deployable defense (a single white-box direction is not robust to an adaptive adversary, and a last-layer brake leaves almost no margin). Code, per-action data, and an adversarial pre-publication evaluation (88/88 numeric checks recomputed from the public ledgers) are released.

One late-layer direction both decodes whether an irreversible action is task-authorized and, steered, controls the commit — on two architecture families. Detect and control coincide.

Caio Vicentino · Zenodo · CC-BY-4.0 · DOI 10.5281/zenodo.20683623 · 2026-06-13

A safety circuit-breaker for a tool-using agent must, at the moment the agent is about to emit an irreversible action, answer two questions: is the action authorized by the trusted task, and can we stop it if not. We show both live in a single linear direction at a late layer. (1) DETECTION: a linear probe separates authorized from unauthorized irreversible-action commits at AUROC ~1.0 on Qwen3.6-27B; the capacity confound is ruled out four ways (one-dimensional difference-of-means, regularization sweep, PCA to 32 dims, commit-state matching), a random direction is at chance at the clean late locus, and the direction is domain-general (train on five actions, detect the held-out sixth at 1.0) and origin-robust (train on injection, detect held-out model-internal at 0.89). (2) CONTROL: steering along d = mean(authorized) - mean(unauthorized) monotonically moves the commit (emit range 0.67 vs 0.03 for a random direction) — the SAME direction detects and controls. (3) ACROSS ARCHITECTURES: the full result replicates on gpt-oss-20b (a different-family MoE): detection AUROC 1.0, cross-action transfer 1.0, steering range 0.65 vs -0.25. (4) A BEHAVIORAL FINDING: both models obey explicit prohibition (commit 0.00) but self-commit irreversible actions from a benign task — the residual risk is unprompted over-eagerness, not defiance, the model-origin failure no input-provenance or text filter can see. This sharpens the arc's detect != control refrain: at the late action-commitment locus they coincide, contrasting the mid-layer verdict feature that predicts but does not cause. Honest scope: AUROC=1.0 is a ceiling whose capacity origin is ruled out but whose surface-lexical component is not fully isolated; actions are simulated; the method is white-box. Pre-registrations, per-run data, figures, the model-agnostic runner, and an adversarial evaluation that recomputes every number (35/35) are released.

The authorization direction reads the authorization the model FEELS, not the one the user GRANTED — on 21 realistic over-reaches it allows 100%; an external task-grounded check catches all

Caio Vicentino · Zenodo · CC-BY-4.0 · DOI 10.5281/zenodo.20685263 · 2026-06-14

The authorization direction (paper #9) detects and controls an agent's commitment to unauthorized irreversible actions at AUROC ~1.0. This paper asks what that internal monitor actually reads — and shows it reads the authorization the model FEELS, not the one the user GRANTED. On 21 realistic over-reach scenarios, where the agent in good faith commits an irreversible action the task did not authorize, the internal probe allows 100% of them (CI [0.845, 1.0]); a simple external task-grounded check catches all. Internal monitors inherit the model's own judgment error: they are structurally blind to the over-reach the model itself does not represent as unauthorized. The implication for interpretability-based oversight is a limit, not a technique: felt is not granted.

CoT is causal for the answer — and for the agent's action — only when it changes the outcome; that causal content consolidates in the same late band (L51–63), a readable monitoring locus

Caio Vicentino · Zenodo · CC-BY-4.0 · DOI 10.5281/zenodo.20752895 · 2026-06-18

In a 27B reasoning agent (Qwen3.6-27B), chain-of-thought is causal for the answer — and for the agent's downstream action — only when the reasoning changes the outcome; when the model already knows the answer, the CoT is performative (44/60 Tier-A cases). The causal content of the reasoning consolidates in the same late layer band (L51–63) that carries action commitment, with the largest reasoning-to-answer transfer at L59 (+2.72), confirmed against a logit-lens control that rules out mere output-format consolidation. Faithfulness is CONDITIONAL, and the late state is a readable, causal locus for monitoring reasoning agents. First paper of the interpretability-as-audit phase of the arc; every number recomputes from public ledgers (37/37).

The synthesis of the arc: interpretability locates a real causal control surface — the late action band — but does not secure it, via five orthogonal limits

Caio Vicentino · Zenodo · CC-BY-4.0 · DOI 10.5281/zenodo.20764857 · 2026-06-19

Across fifteen studies on long-horizon tool-using agents, mechanistic interpretability locates a real, causal control surface — the late action-commitment band (L51–63 in Qwen3.6-27B) — but does not secure it. Five orthogonal limits, each established by pre-registered experiments in the arc: detect is not control (a perfect verdict feature does not cause termination); felt is not granted (internal authorization monitors inherit the model's judgment error); form is not granted; control is not robust control (the late brake collapses under an adaptive white-box attack, ASR 0 to 1.0); and intervention is easy exactly where it is unneeded. Locating where behavior is decided is necessary but nowhere near sufficient for securing it. The implication: use interpretability to AUDIT and MONITOR a fixed model in a non-adversarial regime, not to defend against an adversary optimizing against a known locus.

Audit the TRANSFORMATION: a SOTA capability-guided FA-to-linear-attention selection is structurally blind to the agent-commitment circuit — collapses commitment worse than random while its benchmarks register nothing; two named heads restore it

Caio Vicentino · Zenodo · CC-BY-4.0 · DOI 10.5281/zenodo.21175758 · 2026-07-03

Efficiency-driven model transformations increasingly decide which internal components to keep using causal, capability-guided criteria. We audit a HydraHead-style head-level FA-to-linear-attention selection criterion against the named, causally-verified commitment circuit of Qwen3.6-27B. Retrieval-criticality and commitment-writing are anti-aligned: the commit writers carry zero retrieval criticality (kappa=0, stable under doubled probe samples) and are dropped at any FA budget, while the layer's strongest retrieval heads are the circuit's opposers. Ablating the criterion's non-retained late-band heads collapses task-appropriate commitment (P(edit) 0.474 to 0.167; 18/0 monotonic flips, exact McNemar p=7.6e-6) — worse than all five size-matched random selections — while the capability probes that define the criterion register nothing (and, having failed their positive control, could not have). Restoring the two named writer heads (0.5% of FA heads) recovers baseline exactly; two random heads at identical severity do not (p=1.5e-5). Capability-causal is not safety-causal: audit the transformation with the circuits you care about. Fully reproducible (59/59 checks from the public ledger; under 6 GPU-hours).

Consequence training makes a world model's remaining errors confident, most of all where it knows the world best

Caio Vicentino · Zenodo · CC-BY-4.0 · DOI 10.5281/zenodo.23146970 · 2026-10-04

An agent that predicts the consequences of its actions can chain those predictions and plan without acting, but errors compound and checking the real state costs time. With V42, the first release candidate of the open one-pass consequence model Ekbasis-27B, a rule that looks at the real state when the chain's confidence falls below 0.9, plus Trickle-style scheduled checks, keeps 197 of 200 fresh long chains exact at 17.9 looks per 100 actions. The checks are needed because of a pre-registered finding: 58.1% of the model's errors in the families it was trained on carry confidence of at least 0.9, against 27.8% in families it never saw, and the same questions answered by the model before consequence training show almost none (1.9% and 0.5%); corrected 2026-10-06: 5,318 of the 15,008 questions overlap the training data, and without them the finding holds (50.5% against 27.8%). Recalibration and smoother losses do not fix it. Training on errors mined inside the model's own chains does, cutting silent wrong steps by 71–97%, but every such fine-tune failed a release criterion, most of them by forgetting rare work-losing git commands; an exact weight interpolation halfway back to V42 keeps the gain without the cost and is the released Ekbasis-27B. Every analysis is pre-registered and re-run from the saved outputs.

Pre-registered studies on demo apps, real self-hosted apps and a real terminal

Caio Vicentino · Zenodo · CC-BY-4.0 · DOI 10.5281/zenodo.23197341 · 2026-10-06

Agents called Ekbasis-27B, an open one-pass consequence model, before consequential actions, in studies whose plans were hashed before the runs. On real, unmodified Gitea, Nextcloud and Roundcube driven through a real browser, with the truth read from the apps, Claude Sonnet 5.5's harmful runs fell from 25.0% to 4.2% in a pre-registered secondary contrast with one run per task (95% CI over tasks [−37.5, −6.2]; over the 9 task families [−47.8, 0.0]), mostly on tasks whose request itself names the harmful action, with more runs stopping short. The pre-registered hypotheses for Claude Haiku 4.5 failed there: warned, it mostly did what the request said. A pre-registered follow-up on 32 fresh tasks offered a safer way checked by Ekbasis and asked the user when there was none: with a simulated user that reads every question perfectly, Haiku's harmful runs fell from 72.9% to 2.1%, and in a secondary arm Sonnet's from 50.0% to 8.3%. Asking before every consequential click without Ekbasis did as well (the user's scripts had been checked to object to its question on each harmful path), and the Ekbasis guard asked 43% as many questions where the plan's bar was a quarter, so that hypothesis failed. On our own demo apps harmful runs fell for all five models tested (24/60 to 0/60 for Sonnet) and a placebo did not help Sonnet; Haiku and Qwen 9B alone had done about as well as Sonnet (corrected in v2: GLM's runs alone are not comparable, because its harness loaded an unrelated skill). Three further studies failed their bars where the agent alone was at the ceiling or the policy stated the consequences. In a real terminal, a Claude Code hook kept planted user work in 9/9 sessions against 5/9 and 7/9 without it in two small studies. In the one-pass format Ekbasis was trained on it was more accurate than Qwen-AgentWorld-35B-A3B on all 12 of our question suites; allowed to reason, AgentWorld won 1, showed no resolved difference on 9 and lost 2. The tasks are ours and are released with the app setups, adapters, judges, per-run data and scripts.