2026.RA.QKV-Attention-Interface

Tables behind the Q/K/V attention-interface ladder: a four-rung preregistered study asking whether you can make a language-model negotiator more rational by changing what its attention reads rather than what its prompt says. Base model Qwen/Qwen3-8B (frozen, bf16, thinking off) playing one seat in a six-party, five-issue negotiation.

Headline: the interface level was the whole story. The same fair-and-efficient candidate deal — the Nash bargaining solution — delivered as trained input embeddings does nothing (−0.0006 [−0.0321, +0.0300] normalized Nash welfare); delivered as trained per-layer, per-head keys and values it is worth +0.1882 [+0.1497, +0.2266], or 69% of the prompt-text ceiling (+0.2741 on the same panel). Meanwhile re-weighting attention toward decision-relevant text the model already has does nothing a mis-targeted control does not also do. Adding information through a deeper interface works; re-allocating existing information does not.

Amendment 2 is complete and all of it is here — and it closed four doors on the ladder's central puzzle. The channel is acted on roughly three times less often than the same content as text, and four candidate explanations are now eliminated by measurement: decodability (reconstruction 0.9583, and 1.0000 under a binding norm clamp), magnitude (injected values 0.87× real pooled; clamping retains a majority of the effect, retention 0.5644 [0.3096, 0.8068]), addressing (a text line naming the channel does nothing, against an exact-zero placebo), and bandwidth (doubling reserved positions to 76 is behaviourally identical to R1, same placebo). What remains is uptake: for a frozen model, acting on a retrieved payload appears to be a different operation from acting on a read one. R1 also replicated independently, matching its opening-offer tabling rate of 0.6208 to four decimals on a different machine and sharding scheme.

Amendment 2's two earlier rungs, also here. F1 measured this study's own leading mechanistic account and refuted it as stated: the injected values are not globally louder than real tokens' (0.87× pooled), and clamping them to the real distribution costs the reconstruction gate nothing — what remains is a shape mismatch, not a magnitude anomaly. F3 priced the one sweep cell the viability screen had excluded for looking too good, and both co-primary gates fail — the welfare gain was a train-half selection artifact while the deal-rate cost replicated.

Amendment 3 closed the last door, and it reversed the design intuition the whole study started from. The obvious remaining fix was to stop writing the payload into reserved placeholder positions the model's queries ignore and write it at real text instead — the no-advice arm's own semantically empty Candidate package: UNSPECIFIED block, rendered byte-identically so the treatment and its base differ in nothing a reader can see. The channel still works there (+0.1429 [+0.1008, +0.1855], content-specific at +0.0723 against the same encoder fed a wrong deal) and works worse than at the placeholder site (−0.0373 [−0.0723, −0.0029], excluding zero on the wrong side of the frozen gate), while costing a real deal-rate drop (−0.0875 [−0.1458, −0.0292], where the placeholder site in the same games costs exactly +0.0000) and quadrupling the malformed rate. The mechanism check, measured and registered before any scored episode, had already falsified the rung's own prediction: injection destroys 77% of the salience the site had as text (0.0610 bare → 0.0140 injected) while the same operation at reserved positions lifts mass off a 0.0016 floor, and the knockout delta moves the other way again (+0.751 nats against +0.190). So the low-salience site is the better one — a trained payload interferes with real text rather than borrowing its salience — and after varying level, width, addressing, magnitude, attention bias and now site, R1's original configuration is locally optimal among everything tested. Tables: p_*.

Amendments 4 and 5 close the program, and the uptake puzzle turns out to have been about the ENCODER'S TRAINING OBJECTIVE. Every rung above varied the injection side. U1 varied what the encoder is trained to produce — cross-entropy on the exact opening-proposal action naming the encoded deal, rather than on a restatable payload — at R1's identical architecture, site and width, and passes all five preregistered gates: primary +0.2232 [+0.1792, +0.2670], isolation against its own mis-drawn twin +0.1348 [+0.0889, +0.1792], the registered uptake contrast (tabling against KV_r1) +0.1875 [+0.0583, +0.3125], deal rate positive at +0.0417, below-threshold −0.3458. Against text it is −0.0386 [−0.0829, +0.0075] — 0.853 [0.706, 1.030] of the in-panel prompt-text ceiling against R1's 0.69. The registered parity bar was ≥0.90: the point estimate is below it and the interval contains it, so parity is neither excluded nor established and the licensed claim is only that the gap to text is no longer resolvable at this panel's power. U2 varied the reader — a rank-16 q_proj LoRA with R1's encoder frozen — and closed at its guard rather than returning a null: it learned to read (+0.19 held-out tabling logprob/token over the same channel read by the base model, at reconstruction 1.0000) and could not do so without moving its channel-free policy, failing a frozen 0.50/0.05 drift bound at 9.25/3.69 (400 steps) and again at 8.50/3.72 after the single licensed retry at 75 steps — so the reading is cheap and the policy change arrives with it. Verdict: could not be trained inside its own guards at these configurations; reader-side uptake is untested, not refuted. Tables: u_*.

Amendment 5 gives the study the scope statement it never had: the mechanism is not a Qwen3-8B artifact. R1's recipe verbatim (only --model changed, each model rolling its own text anchor and no-advice control) passes all four frozen gates on both allenai/Olmo-3-7B-Instruct (primary +0.0771 [+0.0505, +0.1022], isolation +0.0435, and a channel statistically indistinguishable from that model's own text arm at −0.0031 [−0.0343, +0.0273] — though that ceiling is a weak +0.0801) and Qwen/Qwen3-4B (primary +0.0830 [+0.0344, +0.1309], isolation +0.0386 with a lower bound of +0.0002, knife-edge). A pre-training mechanics gate is what makes this a transfer claim: re-injecting a span's own captured k_proj/v_proj leaves the logits bit-identical on both models — including on Olmo's no-grouped-query, hybrid sliding/full attention stack — while the same tensors perturbed at 1× their RMS change them. The channel/text ratio (0.42 / 0.69→0.85 / 0.96) varies inversely with how well each model follows prose advice. Tables: g1_*, g2_*, g_mechanics_gate.

Full narrative, every caveat, and a twenty-two-entry controls-catches ledger: raw/note_0029.md (research note 0029, §5e for rung P, entries 1–19) and raw/note_0046.md (its closing sibling, Amendments 4/4a/5, entries 20–22). Preregistration: raw/preregistration.md. The pre-outcome Amendment 3a (the fifth grid case, logged 2026-08-07 before rung P's first scored shard) lives in the rung bundle, raw/p_METHODS.md; the preregistration carries only a back-reference to it, added at close-out and labelled as such.

What is in here

table	rows	contents
r1_episodes	960	one row per R1 campaign episode: arm, instance, seed, outcome metrics
r1_contrasts	12	R1's eight paired contrasts with instance-clustered CIs, plus each gate's verdict as a 0/1 row
r1_arms	4	per-arm descriptives incl. the opening-offer uptake audit
r0_layer_scan	6	six-layer-window ablation recoveries (localizes the circuit to layers 12–23)
r0_concentration	6	top-k-per-layer concentration curve (how many query heads are needed)
r0_group_control	13	the KV-group-structure-matched random control, the selection, the complement, and the superseded size-matched control
r0_salience	5	the five-condition uptake-head attention-mass table, incl. the bare-placeholder floor
r0_validate	80	per-episode generation rows for the ablated-vs-intact tabling endpoint
r2_sweep	13	the 13-cell sweep with eligibility flags (one row per cell)
r2_screen_robustness	7	the viability screen's sensitivity ladder — which cell wins at which tolerance
r2_dose	3	the exogenous diverted share per span set, measured on unbiased prompts
r2_eval	11	R2's held-out contrasts and gate verdicts
f1_vnorm	74	F1 boundary 1 — injected-vs-real K and V norm distributions, per layer and pooled, with the fraction of injected vectors above the real p95/max
f1_derived_displacement	1	the mass×norm delivered-displacement ratio (0.10× of text), carrying its own caveat field — it is a composite of two runs, not a single measured quantity
f1_norm_matched_gates	3	F1 boundary 2 — the p90/p95/p99 norm-matched retrains: reconstruction gate, control, and the clamp_stats proving the clamp binds
f3_contrasts	10	F3 — all contrasts with is_co_primary flagged, plus both gate verdicts
f3_arms	3	F3 per-arm descriptives incl. welfare given a deal (the cancellation mechanism)
f3_episodes	720	F3's held-out episode rows
f1_campaign_*	30	F1 campaign — the norm-matched encoder replayed through R1's four-arm design (1,200 eps). _contrasts carries welfare contrasts, gate verdicts, per-episode tabling contrasts and the retention ratio in one table, distinguished by an endpoint column
f2_pointer_*	26	F2 addressing arm — a text line naming the channel. Includes the placebo's exact-zero tabling effect
f2_capacity_* · f2_capacity_reach_*	15 + 20	F2 bandwidth arm — n_prefix 38 → 76, within-budget and cross-budget views. _tabling_rates carries a cross_budget flag
f3_manipulation_check	8	F3's per-beta attention-mass check, treatment and mis-targeted
r2_manipulation_check	8	attention mass on the targeted spans per beta, for both the treatment and the mis-targeted control — necessary but preregistered as NOT sufficient; no gate reads it
p_contrasts	21	Amendment 3, rung P — all ten welfare/safety contrasts, five gate verdicts, five per-episode tabling contrasts and the text-ceiling fraction in one table, distinguished by an endpoint column
p_arms · p_tabling_rates	5 + 5	rung P's per-arm descriptives and tabling rates over all five arms
p_episodes	1,200	rung P's episode rows
p_kvmass	6	rung P's mechanism check — uptake-head attention mass and knockout delta per condition, with each injected arm compared against its own site left bare (vs_its_own_bare_site) and registered_prediction_holds recording the falsification. Measured, non-gating
p_gate_report	1	the retrained placement encoder: reconstruction gate 1.0000 against a 0.0000 control, the two-locator site audit, and per-row site accounting (rows_without_site: 0)
f1_campaign_episodes · f2_*_episodes	1,200 + 1,200 + 720 + 960	the Amendment 2 campaigns' episode rows, previously only on the cluster
u_contrasts	22	Amendment 4, rung U — the eleven welfare/safety contrasts, five gate verdicts, five per-episode tabling contrasts and the text-ceiling fraction in one table, distinguished by an endpoint column
u_arms · u_tabling_rates	5 + 5	rung U's per-arm descriptives and tabling rates over all five arms
u_sign_watch	5	the registered watch-item: welfare and tabling estimates for the same contrast on one row, so a sign disagreement is read across the whole panel rather than in the cell where it surprises
u_episodes	1,200	rung U's episode rows
u_gate_report	1	rung U1's tabling-trained encoder: reconstruction 1.0000 against a 0.0000 control, plus the paired held-out tabling gate against R1's encoder (+0.1966 [+0.1845, +0.2115])
u_lora_gates	2	rung U2's verdict is licensed by exactly this table — one row per licensed configuration (400 steps, and the single 75-step retry): the two drift statistics against their frozen tolerances beside the reconstruction (1.0000) and tabling (+0.19) readouts the reader passed
u_malformed_adjudication	10	the exploratory in-panel contrasts establishing that U1's malformed cost is objective-driven, not site-driven: identical site and width across all three injected arms, KV_r1 costing nothing detectable, both U1-encoder arms costing 4–5× that and indistinguishable from each other
g1_* (Olmo-3-7B-Instruct) · g2_* (Qwen3-4B)	16 + 4 + 4 + 4 + 960 each	Amendment 5, rung G — one self-contained panel per model, each with its own text anchor and no-advice control (the model is the treatment, so references are never shared). _share_rates carries max_share and the mean worst-off party, the deal-conditional distribution term the below-threshold gate structurally cannot see
g1_gate_report · g2_gate_report	1 + 1	each model's encoder: reconstruction 1.0000 against a 0.0000 control, with the shape (layers / KV heads / head dim / KV groups) read from that model's config and the resulting parameter count
g_mechanics_gate	4	the pre-training gate, two probe rows per model: re-injecting a span's own captured k/v leaves the logits unchanged (identity_max_abs_logit_delta 0.0, tolerance 0.05) and the same tensors at 1× their RMS change them (placebo_max_abs_logit_delta 11.9–30.7). Attention architecture on the row
g1_window_occupancy	5	Olmo's realized prompt lengths per arm (plus pooled) against its 4096-token sliding window — 19.8% of turns over window, arm-uniform, registered as a scoping fact before any outcome existed and gating nothing

raw/ ships the interpreting prose verbatim: note_0029.md, note_0046.md, preregistration.md, r0_RESULTS.md, r1_RESULTS.md, r2_SWEEP.md, r2_EVAL.md, r2_EVAL_notes.md, f1_RESULTS_vnorm.md, f1_VNORM.md, f3_EVAL.md, f3_EVAL_notes.md, f3_campaign_record.md, f12_ROLLUP.md, f12_METHODS.md, f1_campaign_RESULTS.md, f2_RESULTS.md, p_METHODS.md, p_RESULTS.md, u_METHODS.md, u_RESULTS.md, g_METHODS.md, g1_olmo3_7b_RESULTS.md, g2_qwen3_4b_RESULTS.md, g2_qwen3_4b_notes.md.

Experiment names

experiment_name	what it is
qkv_r0_uptake_circuit	R0 — activation/attention patching on the committed note-0027 episodes (no new rollouts) to find what carries advice from prompt to proposal. Ablating the identified heads' attention onto the advice span cuts real candidate-tabling 47.5% → 2.5% with JSON-parse and propose rates at 1.00 in both conditions. The circuit is redundant: best single query head removes 0.015, ~160 of 1,152 heads needed to cross half, and against KV-group-structure-matched random sets the selection recovers 0.846 [0.760, 0.929] vs 0.635.
qkv_r1_kv_prefix	R1 — the candidate written as trained per-layer K/V at 38 reserved positions (36 layers × 8 KV heads × 128 head_dim; encoder 19,094,236 params, the only trainable parameters). Gate was restatability, not distributional KL: 0.9583 exact reconstruction on held-out games against a 0.0000 no-channel control. Outcome +0.1882 [+0.1497, +0.2266]; isolation vs a mis-drawn deal at identical weights +0.0930 [+0.0474, +0.1390].
qkv_r2_attn_bias_sweep	R2 sweep — 13 cells × 3 seeds × 24 train games (936 episodes) of a training-free additive attention-logit bias toward the threshold line / live-offer table / opponents' proposals.
qkv_r2_exogenous_dose	each span set's size measured on beta=0 (unbiased) prompts — the only safe dose x-axis (see below).
qkv_f1_vnorm	F1 boundary 1 — injected vs real K/V norms at the injection site (k_proj/v_proj output, upstream of QK-RMSNorm and RoPE), 24 held-out games, system_only probe context. Pooled injected V median 5.210 against real 5.984 (0.87×), so the registered "values buy influence with magnitude" account is false as stated. The replacement is a shape mismatch: the encoder's norms are flat with depth while the model's grow >2 orders of magnitude (real median V 0.275 at layer 0 → 55.6 at layer 33), giving 15.9× / 10.0× / 7.4× at layers 0–2, every injected vector above the real p95 through layer 6, a crossing near layer 16, and 0.08–0.30× by layers 33–35. The norm-pinned keys show the same flat profile, which marks this an encoder property (shared init of the per-layer output heads) rather than optimizer exploitation.
qkv_f1_norm_matched	F1 boundary 2 — three retrains clamping injected value norms to the real per-layer p90/p95/p99. All pass reconstruction at 1.0000 against 0.0000 controls, with the p90 clamp demonstrably binding (38.5% of value vectors rescaled, max 26.6× over limit). So payload decodability needs no out-of-distribution value magnitude. Whether the early-layer excess is needed to act is a separate question, measured by a campaign not in this release.
qkv_f3_deal_rate_co_primary	F3 — the excluded cell (beta=2, threshold_only) played on held-out games under a readout that promotes deal rate from a safety gate to a priced cost and makes welfare co-primary. Both co-primary gates FAIL: welfare vs no-bias +0.0015 [−0.0254, +0.0300], and the load-bearing welfare contrast vs the mis-targeted control +0.0128 [−0.0141, +0.0383]. The priced cost does replicate: deal rate −0.0667 [−0.1125, −0.0250]. 720 episodes, 0 fabricated of 17,543 turns.
qkv_r2_attn_bias_eval	R2 held-out — the frozen config (beta=0.5, threshold_only) played once on 24 held-out games × 10 seeds × 3 arms (720 episodes). All load-bearing gates fail.
qkv_p_placement	Amendment 3, rung P — the same payload written at the real-text site (45 positions fixed by the text, against the placeholder run's 38), encoder retrained for the site (fingerprint 8000abedd2a5, gate 1.0000). 1,200 episodes over 5 arms, 0 of 22,680 turns fabricated, injection counted per row (4,318/4,318 and 4,725/4,725, 0 unregistered) and the site located on every row that should have carried it. Three of five gates pass, two fail — including the rung's own directional gate, at −0.0373 [−0.0723, −0.0029]. The KV_r1 arm doubles as a third independent R1 replication (+0.1802 [+0.1380, +0.2205] against the published +0.1882).
qkv_p_placement_mechanism_check · qkv_p_placement_encoder_gate	rung P's two non-gating measurements: the six-condition attention-mass/knockout table, and the retrained encoder's reconstruction gate with its site audit.
qkv_u_uptake	Amendment 4, rung U — five arms (A_text, C_none, KV_r1, KV_u1, KV_u1_shuffled), 24 held-out games × 10 seeds = 1,200 episodes, 0 of 21,606 turns fabricated, one encoder fingerprint c5b67cebd886 serving both U1 arms, one block budget. All five gates pass. The KV_r1 arm is a fourth independent R1 replication and the softest of the four (+0.1267 [+0.0846, +0.1695] against +0.1882 / +0.1722 / +0.1802) — stated rather than explained; a uniform-compression account is rejected in-panel, since this panel's C_none is the highest of the recent panels while its text anchor is not correspondingly compressed.
qkv_u_uptake_u1_encoder_gate · qkv_u_uptake_u2_reader_gate · qkv_u_uptake_malformed_exploratory	rung U's three side tables: U1's encoder gate, U2's two LoRA configurations with their drift statistics, and the exploratory malformed adjudication (explicitly not preregistered — it exists because the rung's methods registered, before the outcome, that a malformed cost must be adjudicated against this panel's own KV_r1 arm).
qkv_g1_olmo3_7b · qkv_g2_qwen3_4b	Amendment 5, rung G — R1's recipe verbatim on a second and third model, 4 arms × 24 held-out games × 10 seeds = 960 episodes each, 0 fabricated turns (of 20,776 and 23,821 attempted), one encoder fingerprint per panel (f5abf0117fd5, f4aa11336bd1), injection counted per row with zero unregistered rows. All four gates pass on both. Encoder capacity is a consequence of holding the recipe fixed: Olmo has no grouped-query attention (32 KV heads, 1 group), so its encoder is 67,517,148 parameters against 19,094,236 on the Qwen models — cross-model capacity is deliberately not matched, because matching it would have confounded generality with a re-tune.
qkv_g1_olmo3_7b_mechanics_gate · qkv_g2_qwen3_4b_mechanics_gate · *_encoder_gate · qkv_g1_olmo3_7b_window_occupancy	rung G's per-model pre-training and post-run measurements: the logit-equivalence gate with its placebo, each encoder's reconstruction gate, and Olmo's sliding-window occupancy.

Thirteen results worth knowing before you use these tables

1. biased_share_of_prompt in r2_sweep is ENDOGENOUS — do not use it as a dose. It moves with the treatment: for all_three it runs 0.2108 → 0.1693 → 0.1420 → 0.2353 across beta 0.5 → 1 → 2 → 4, falling because a stronger bias degrades play so fewer offers accumulate (the spans are made of game state), then rising as degenerate </think> loops lengthen the prompt. The column is retained for accounting and named ..._ENDOGENOUS. Use r2_dose — 0.89% / 12.30% / 19.06% for threshold_only / offers_only / all_three, measured on unbiased prompts.

2. The below-threshold endpoint is exploitable, and this matters for anyone reusing it. It is scored reached AND any(surplus < 0) — conditional on a closed deal — so it is exactly zero when no deal closes. Under the originally preregistered unscreened selection rule the sweep winner is span_b2_all_three at below-threshold 0.1944 against the reference's 0.5972, which reads like it rivals a real text intervention (0.175) — but its deal rate is 0.4444 against 0.9167 and its welfare is worse (0.0709 against 0.1007). The apparent rationality gain is deal suppression. A viability screen was added before scoring (deal rate and malformed rate within 0.05 of the beta=0 reference). Any selection rule, gate, or reward built on a conjunctive metric that requires an event can be maximized by suppressing the event.

3. Do NOT quote mistargeted_does_not_reproduce: true as evidence of specificity. It appears as a passing gate in r2_eval and it is the one number in the bundle that reads better than it is: it passes only because its interval contains zero, while its point estimate (−0.0417) is half the treatment's with the same sign. The gate that matters is beats_mistargeted, and it fails.

4. R2's negative is control-validated, not underpowered hand-waving. The mis-targeted control (same beta, same token count, aimed at rules boilerplate) moves the endpoint −0.0417 in the same direction as the treatment's −0.0833 with no separation (−0.0417 [−0.1333, +0.0500]), and reproduces the welfare gain exactly (−0.0035 [−0.0303, +0.0248]). The manipulation applied: attention mass on the targeted spans went 0.0028 → 0.1281 across the swept range, a 46× span. A behavioural null with a confirmed manipulation was preregistered as a real negative and explicitly not a partial pass. The control is also conservative: starting from 4× the baseline mass (590 boilerplate tokens against ~26), it diverts more absolute mass at equal beta, so failing to separate from it is demanding rather than lenient.

5. The deal-suppression channel has a ceiling. At beta=4 on the widest span the below-threshold rate returns to 0.5972 — exactly the no-bias reference — with a 1.0000 malformed rate. Total degeneration does not maximize the endpoint; it destroys the episode. The metric is gameable by partially suppressing deals (beta=2 posts 0.1944 at half the deal rate), not by breaking the model outright.

6. Two mechanistic accounts in this study were published and then killed. The salience account (site salience explains the channel's failure) was falsified by R1's positive outcome; the value-norm account was refuted by F1's direct measurement. Both are recorded as errata in raw/note_0029.md rather than quietly dropped, and the narrow surviving claim is stated in each case — e.g. low attention mass at an identified head set does not imply a channel cannot drive behaviour.

7. In p_kvmass, compare an injected arm against ITS OWN site left bare — not against the other site. The rung registered its prediction against the placeholder site's injected mass and that comparison is the less informative one. The column that matters is vs_its_own_bare_site: injecting at the real-text site takes it from 0.0610 to 0.0140 (−0.047, a 77% drop) while injecting at the reserved run takes it from 0.0016 to 0.0172 (+0.0157, a rise off the floor). And do not read the mass as a proxy for causal load: the knockout deltas move the opposite way (0.751 nats for the placement span against 0.190 for the placeholder span), and the behavioural ordering follows neither. This is note 0029 ledger entry 11 applied a second time — the mass number is interpretation, not evidence about the outcome.

8. Rung P's malformed-episode cost is site-driven, not width-driven, and the width reading was pre-registered and wrong. safety_malformed is +0.3000 [+0.2042, +0.4042] at 45 real-text positions, and an earlier rung's width scaling (2.1% / 10.0% / 19.6% at 0 / 38 / 76 injected positions) was expected to explain it. Inside the same panel, 38 placeholder positions cost +0.0333 [−0.0250, +0.0958] — indistinguishable from zero. Seven extra positions cannot buy a factor of four. Overwriting text the model is reading destabilizes output formatting; overwriting semantically empty positions does not.

9. f1_derived_displacement is a cross-run composite, not a measurement. Its 0.10×-of-text figure multiplies F1's norm measurement by R0's separately-run attention-mass measurement. The row carries a caveat field saying so. Do not cite it as a single measured quantity.

10. Do NOT read rung U1 as "the channel reaches parity with text". u1_text_ceiling_fraction is 0.853 [0.706, 1.030] and the registered parity bar was ≥0.90 — the point estimate is below the bar and the interval contains it. The correct statement is parity is neither excluded nor established: the gap to text is no longer resolvable at this panel's power, which is a weaker and different claim. The same caution applies to Olmo's channel_vs_text of −0.0031 [−0.0343, +0.0273]: it is parity against a weak ceiling (that model's text arm is +0.0801 against Qwen3-8B's +0.26–0.27 in the same design), not evidence the channel improved.

11. Rung U2 is a guard failure, not a null — and u_lora_gates is the table that says so. The reader passed reconstruction (1.0000, control 0.0000) and demonstrably learned to read (+0.1948 and +0.1916 held-out tabling logprob/token over the base model reading the same frozen channel). What it failed is the no-channel drift bound, on prompts where it has nothing to read. The single licensed retry cut training 5.3× and left the drift essentially unchanged (the KL bound moved up), which falsifies the over-training hypothesis: the reading is cheap and the policy change arrives with it. Licensed wording: the reader could not be trained inside its own guards at these configurations (r=16, q_proj, lr 1e-4, 400 and 75 steps) — not "uptake is not a reader skill".

12. Tabling is NOT an isolation endpoint — this retires an anomaly the study carried for two rungs. Rung P was recorded as a puzzle because its channel arm tabled its own candidate less than its mis-drawn control while winning on welfare. Rung U1 supplies the mechanism (an act-trained encoder makes the model table whatever is encoded, so the mis-drawn arm tables its own payload at 29.6% against the treatment's 35.4% — the rate is content-independent, the welfare is not), and the cross-panel check settles it: across all four panels with an isolation pair (P −0.0375, U1 +0.0583, G2 −0.0125, G1 −0.0125) not one isolation-tabling interval excludes zero, while three of four welfare isolation contrasts do. If you reuse these tables, read content-specificity off welfare, never off opening_offer_is_candidate.

13. Two panel-level cautions on the G tables. (a) Never contrast an arm from one G panel against an arm from another — each model rolls its own reference cells precisely because the model is the treatment; only the within-panel ratio is comparable across models. (b) Comparing levels across model panels is bounded by policy quality. Qwen3-4B is seven- to twentyfold more malformed-prone than Qwen3-8B across every arm (C_none_g 0.3375 against 0.0458), and Olmo's no-advice deal rate is 0.6917 against Qwen3-8B's ~0.90. Within-panel contrasts are unaffected; level comparisons (including the striking collapse of text tabling from 0.6208 at 8B to 0.1583 at 4B) characterize rather than estimate.

Regeneration

Rungs R0 and R1 ran on a B200 pod, R2 on Slurm a6000-class nodes. $OUT is /workspace/large_artifacts/ii_mats/tom_qkv_v1 (pod), mirrored to /nlp/scr/siddharth/ii_mats/rational_agents/tom_qkv_v1.

# R0 — the uptake-circuit diagnostic (reuses the committed note-0027 episodes; no new rollouts)
python -m tom.qkv.run_uptake --stage concentration --out $OUT/r0 --n-scan-prompts 24 --n-mass-prompts 8 --cand-lo 8 --cand-hi 27
python -m tom.qkv.run_uptake --stage validate     --out $OUT/r0 --heads $OUT/r0/concentration.json --n-episodes 40 --max-new-tokens 320
python -m tom.qkv.run_uptake --stage groupcontrol --out $OUT/r0 --heads $OUT/r0/concentration.json --n-random-controls 8
python -m tom.qkv.run_uptake --stage kvmass       --out $OUT/r0 --heads $OUT/r0/concentration.json --n-soft-prompts 24 \
    --soft-injection .../tom_channel_v1/distill/encoder.pt --kv-checkpoint $OUT/r1/free_v1/kv_encoder.pt

# R1 — train the per-layer K/V encoder (reconstruction gate), then the 960-episode campaign
python -m tom.qkv.kv_train --bank instances_nbs_confirmatory_v1 --logged-run .../nbsconfirm_v1_nbs_candidate \
    --out $OUT/r1/free_v1 --parameterization free --d-mid 256 --encoder-hidden 512 --steps 800 --grad-accum 4 \
    --lr 1e-3 --deals-per-game 16 --kl-weight 0.05 --eval-every 200 --max-holdout-probes 24
python -m tom.qkv.run_kv_campaign --bank instances_nbs_confirmatory_v1 \
    --encoder-checkpoint $OUT/r1/free_v1/kv_encoder.pt --out $OUT/r1/campaign --max-pool-episodes 96
python -m tom.qkv.analyze_kv_campaign --campaign $OUT/r1/campaign --out $OUT/r1/analysis

# R2 — sweep on train games, freeze, then score once on held-out games
python -m tom.qkv.run_attn_bias launch --out $OUT/r2/sweep --split train --seeds 0 1 2 --n-shards 3 --max-pool-episodes 8
python -m tom.qkv.run_attn_bias manifest --out $OUT/r2/sweep --seeds 0 1 2
python -m tom.qkv.measure_dose --views-from $OUT/r2/sweep/no_bias__shard0 --out $OUT/r2/analysis_sweep/exogenous_dose.json
python -m tom.qkv.analyze_attn_bias sweep --campaign $OUT/r2/sweep --out $OUT/r2/analysis_sweep --exogenous-dose
python -m tom.qkv.analyze_attn_bias eval  --campaign $OUT/r2/eval  --out $OUT/r2/analysis_eval --notes

# Amendment 2 — F1 boundaries (V-norm measurement, then norm-matched retrains)
python -m tom.qkv.measure_vnorm --encoder-checkpoint $OUT/r1/free_v1/kv_encoder.pt --out $OUT/f1/vnorm
python -m tom.qkv.kv_train --bank instances_nbs_confirmatory_v1 --logged-run .../nbsconfirm_v1_nbs_candidate \
    --out $OUT/f1/nm_p90 --parameterization free --clamp-value-norm-percentile 90   # and 95, 99

# Amendment 2 — F3 (the priced excluded cell, deal-rate-as-co-primary readout)
python -m tom.qkv.analyze_attn_bias preregister --campaign $OUT/r2/sweep --arm span_b2_threshold_only --out $OUT/f3/frozen
python -m tom.qkv.analyze_attn_bias eval --campaign $OUT/f3/eval --out $OUT/f3/analysis_eval \
    --readout f3_welfare_co_primary --notes

# Amendment 3 — rung P (placement: the payload written at the C_none block's real text), Slurm a6000
sbatch --export=ALL,OUT=$OUT/p/place_v1 $OUT/p/place_train.sbatch          # encoder, R1's recipe with --site support_span
sbatch --export=ALL,PLACE=$OUT/p/place_v1 $OUT/p/kvmass_place.sbatch       # the non-gating mechanism pre-check
PLACE=$OUT/p/place_v1 $OUT/p/launch_campaign.sh                            # 25 shards, 1,200 episodes
python -m tom.qkv.analyze_f_campaign --manifest $OUT/p/analysis_p/selected_manifest.json --view p \
    --out $OUT/p/analysis_p --bootstrap-draws 10000 --wandb-run-name p_analysis

# Amendment 4 — rung U (uptake: the writer's objective, then the reader), Slurm a6000
python -m tom.qkv.kv_train --bank instances_nbs_confirmatory_v1 --logged-run .../nbsconfirm_v1_nbs_candidate \
    --out $OUT/u/u1_v1 --objective tabling_primary --reference-encoder $OUT/r1/free_v1/kv_encoder.pt \
    --reconstruction-weight 1.0 --tabling-deals-per-game 8 --site placeholder --parameterization free \
    --d-mid 256 --encoder-hidden 512 --steps 800 --grad-accum 4 --lr 1e-3 --deals-per-game 16 --kl-weight 0.05
python -m tom.qkv.lora_train --encoder-checkpoint $OUT/r1/free_v1/kv_encoder.pt --out $OUT/u/u2_v2 \
    --site placeholder --objective tabling_primary --lora-rank 16 --lora-alpha 32 --lora-targets q \
    --steps 75 --lr 1e-4 --drift-prompts 64 --drift-scored-positions 16 \
    --drift-max-abs-logit-delta 0.50 --drift-max-token-kl 0.05      # v1 is identical with --steps 400
$OUT/u/launch_campaign.sh && $OUT/u/score_view.sh                    # 25 shards, 1,200 episodes, one scored view

# Amendment 5 — rung G (R1's recipe verbatim on two other models), Slurm a6000, per model
sbatch --export=ALL,MODEL=Qwen/Qwen3-4B,OUT=$OUT/g/qwen3_4b/mechanics $OUT/g/g_mechanics.sbatch   # MUST pass first
sbatch --export=ALL,MODEL=Qwen/Qwen3-4B,OUT=$OUT/g/qwen3_4b/encoder_v1 $OUT/g/g_train.sbatch
MODEL=Qwen/Qwen3-4B ENC=$OUT/g/qwen3_4b/encoder_v1 OUT=$OUT/g/qwen3_4b/campaign TAG=qwen3_4b $OUT/g/g_launch.sh
ROOT=$OUT/g/qwen3_4b/campaign OUT=$OUT/g/qwen3_4b/analysis TAG=qwen3_4b $OUT/g/g_score.sh
python -m tom.qkv.window_occupancy --root $OUT/g/olmo3_7b/campaign --model allenai/Olmo-3-7B-Instruct \
    --window 4096 --out $OUT/g/olmo3_7b/analysis/window_occupancy.json      # non-gating, measured post-run

# this dataset
python -m tom.qkv.upload_hf --artifacts $OUT --out-dir /tmp/hf_qkv --push

Figures in the lane writeup are generated from these same JSON bundles, never hand-typed: python tom/writeup/make_figures.py --only salience ladder r2dose.

Weights & Biases

stage	run
R0 concentration / validate / soft / spec	17lj34w3 · ky016mvn · gkrf91bz · 0kflizw5
R0 group control (reported, 8 draws, per-layer matched)	iiyktz60 — superseded 5-draw run vnarmktl
R0 salience (reported, with bare-placeholder control)	4ae96zya — superseded simvsvox
R1 encoder training / campaign	06whz5uz · msgmv9oo
R2 sweep analysis (reported)	5nzftbdb — superseded tzsh2glb · yudew759 · crcrre4h
F1 campaign (norm-matched replay)	qnt59gxf
F2 pointer / capacity / capacity-reach	eainuhdo · 61b4g10b · 0r6qhp5y
F1 boundary 1 (V-norm measurement)	thyteffd
F3 held-out evaluation (reported)	jfxdum6v — group f3-eval with 18 shard runs; supersedes 5y8es5iz (identical numbers, run without --notes)
R2 held-out evaluation (reported)	29qjn2u6 — supersedes the first scored pass 9tii25bg and one regeneration; every number is byte-identical across all three, only the narrative prose changed
Rung P analysis (reported, scored once)	exolxai7 — the 25 campaign shard runs are listed per arm in p/analysis_p/selected_manifest.json under per_arm.<arm>.wandb_urls
Rung U1 encoder training + gate	ja7a654b
Rung U2 reader, both licensed configurations	z8gweg1y (400 steps) · 1zybrsd0 (the 75-step retry) — both failed the drift gate; kept because the verdict is licensed by both
Rung U panel analysis (reported)	b2h9e64l
Rung G2 (Qwen3-4B) mechanics / encoder / panel	st4iowuf · g3vc9rn6 · tniz4wip — the panel run supersedes an earlier scoring pass skf38nc6, which is still cited in that rung's own RESULTS.md provenance table
Rung G1 (Olmo-3-7B-Instruct) mechanics / encoder / panel	rwwpqbiq · t0m77oe4 · uiqszdic

Cluster paths

/nlp/scr/siddharth/ii_mats/rational_agents/tom_qkv_v1/r0/                  # R0 JSON bundles + interface specs
/nlp/scr/siddharth/ii_mats/rational_agents/tom_qkv_v1/r1/free_v1/          # encoder checkpoint, gate report, reconstruction transcripts
/nlp/scr/siddharth/ii_mats/rational_agents/tom_qkv_v1/r1/campaign/         # 960 episodes + transcripts
/nlp/scr/siddharth/ii_mats/rational_agents/tom_qkv_v1/r1/analysis/         # results.json, episode_rows.csv
/nlp/scr/siddharth/ii_mats/rational_agents/tom_qkv_v1/r2/sweep/            # 936 sweep episodes
/nlp/scr/siddharth/ii_mats/rational_agents/tom_qkv_v1/r2/analysis_sweep/   # frozen_config.json, exogenous_dose.json, SWEEP.md
/nlp/scr/siddharth/ii_mats/rational_agents/tom_qkv_v1/r2/eval/             # 720 held-out episodes
/nlp/scr/siddharth/ii_mats/rational_agents/tom_qkv_v1/r2/analysis_eval/    # results.json, manipulation_check.json, RESULTS.md
/nlp/scr/siddharth/ii_mats/rational_agents/tom_qkv_v1/f{1,2,3,12}/         # Amendment 2 — norm measurement, retrains, campaigns
/nlp/scr/siddharth/ii_mats/rational_agents/tom_qkv_v1/p/place_v1/          # Amendment 3 — placement encoder, gate report, transcripts
/nlp/scr/siddharth/ii_mats/rational_agents/tom_qkv_v1/p/kvmass/            # the mechanism check (kvmass.json)
/nlp/scr/siddharth/ii_mats/rational_agents/tom_qkv_v1/p/campaign/          # 1,200 episodes + transcripts, per-shard site accounting
/nlp/scr/siddharth/ii_mats/rational_agents/tom_qkv_v1/p/analysis_p/        # results.json, f_extra.json, episode_rows.csv, RESULTS.md
/nlp/scr/siddharth/ii_mats/rational_agents/tom_qkv_v1/u/METHODS.md         # Amendment 4 — frozen tolerances, decision log, Amendment 4a
/nlp/scr/siddharth/ii_mats/rational_agents/tom_qkv_v1/u/u1_v1/            # U1 encoder, gate report, reconstruction + tabling probe rows
/nlp/scr/siddharth/ii_mats/rational_agents/tom_qkv_v1/u/u2_v{1,2}/        # U2 adapters and their FAILED drift-gate reports (both kept)
/nlp/scr/siddharth/ii_mats/rational_agents/tom_qkv_v1/u/campaign/         # 1,200 episodes + transcripts, per-shard injection accounting
/nlp/scr/siddharth/ii_mats/rational_agents/tom_qkv_v1/u/analysis_u/       # results.json, f_extra.json, exploratory_malformed.json, RESULTS.md
/nlp/scr/siddharth/ii_mats/rational_agents/tom_qkv_v1/g/METHODS.md        # Amendment 5 — design, arms, frozen readouts, stage-1 addendum
/nlp/scr/siddharth/ii_mats/rational_agents/tom_qkv_v1/g/{olmo3_7b,qwen3_4b}/mechanics/    # the per-model pre-training gate
/nlp/scr/siddharth/ii_mats/rational_agents/tom_qkv_v1/g/{olmo3_7b,qwen3_4b}/encoder_v1/   # per-model encoder + reconstruction gate
/nlp/scr/siddharth/ii_mats/rational_agents/tom_qkv_v1/g/{olmo3_7b,qwen3_4b}/campaign/     # 960 episodes each + transcripts
/nlp/scr/siddharth/ii_mats/rational_agents/tom_qkv_v1/g/{olmo3_7b,qwen3_4b}/analysis/     # results.json, f_extra.json, RESULTS.md (+ window_occupancy.json on Olmo)

Source episodes reused by R0 (read-only, from the channel study): .../tom_channel_v1/campaign/{A_text,B_soft,C_none}/, 240 episodes each.

Related datasets

This is the third dataset in one arc, and the three are meant to be read together:

• 2026.RA.ToM-Hidden-Preference-Probe — can a listener's frozen representations be read for its opponent's hidden preferences? Preregistered negative.
• 2026.RA.NBS-Channel-Comparison — can known-useful advice be delivered through input-level virtual tokens? Preregistered negative, and the direct parent of this study.
• this dataset — the same delivery question moved to the attention interface. The negative reverses at depth, and the residual gap to text then turns out to have been about what the encoder was trained to produce rather than about retrieval; the mechanism ports across model family, scale and attention architecture.

One methodological thread runs through all three, and it is sharpened here. The channel study showed a channel can satisfy an optimized proxy (a distillation-KL training objective, three quarters of the distributional gap closed) while carrying zero behavioural payload. This study shows a channel can drive behaviour substantially while a measured proxy (attention mass at an identified head set — 0.0146 against 0.1309 for text) says it is barely attended to. One proxy you optimize against, one you measure and interpret, and each fails in the direction its own kind fails. Neither substitutes for an outcome contrast against a matched-capacity control.