Ask It Twice: The One Step a Frozen Model Cannot Take

The previous entry closed Phase I with a recommendation: stop trying to make learned updates reason on their own, and start treating them as detachable memory objects selected outside the reasoner. Thirty-one experiments later, that recommendation turned out to be right for a reason nobody had measured yet.

The result, in three numbers

The whole finding is one trace

The evaluation world is a synthetic catalogue: each body contains an element, and each element emits a radiation. Training states each link separately and never states the pair. Asking for the radiation of a body therefore requires joining two stored facts.

That is not a knowledge failure, a capacity failure, or a retrieval failure. Recall over a held-out set spanning both links is 100%. The model knows the second fact perfectly well. It just cannot get from the first to the second without leaving the forward pass.

Every configuration we measured

Seven ways of asking the same questions. Chance is 0.1667.

The best and the worst rows in that table are the same adapter answering the same questions. Everything between them is how the question was issued.

Memory and context fail at opposite ends

Putting the facts in the prompt instead of the weights does not fail the same way. It fails at the first step: asked which element sits on a given body, with that exact sentence visible in its context, the model echoes the body back 36 times out of 48. Given a correct first step, its second step is 0.9167.

The adapter is the mirror image. Its first step is perfect and its second never happens. So the two storage methods are complementary failures, and the composition score that the whole field treats as a reasoning measurement turns out to be, in this setting, retrieval accuracy multiplied through two lookups. When we predicted composition from the two hops independently, the residual was −0.0209.

What transfers, and what does not

The most practically useful result was not about memory at all. We rebuilt everything in an unrelated subject area, swapping astronomical bodies and elements for certified operators and laboratory instruments, with no shared vocabulary and no shared sentence templates, then retrained from scratch.

This also retired an assumption the project had been carrying since the beginning. What we had been calling a replication world was the same task with the names changed — its sentence templates were identical to the original's. It agreed with the original about everything, including the artifacts. Only a genuine change of subject matter tests anything.

Four times, the instrument was the thing at fault

Every threshold in this programme is committed to version control before the measurement that judges it, and failures are reported as failures. That discipline paid for itself in an unglamorous way: on four separate occasions, the thing that failed was our own test harness.

• An answer-format instruction — “reply with a single digit and nothing else” — was enough on its own to make the model answer 0 to “what is 2 plus 3?”. It had been hiding a capability completely, and the failure looked principled: it landed exactly on the majority-class baseline.
• A chaining harness was feeding the second question an entire sentence rather than the entity in it, which silently re-injected the subject.
• A scoring rule counted a refusal as correct because the expected name appeared inside it.
• A metric counted a restatement as an echo, so it read as maximal on the best-performing condition.

All four were caught by small pre-run smoke tests rather than by inspection of the results, which is now standing practice: any guard that reports a failure is first pointed at a question the model is known to answer. A guard that fails its own sanity check is measuring the instrument.

The experiments

Update: it needs no instructions at all — and cannot tell when to stop

Two experiments have since closed the question this post left open, and one of them found a real limit.

The harness needs no subject knowledge. The version above was told how to phrase the second step. It turns out that is unnecessary. Prompt the adapter with a bare entity name — no question, no relation wording — and it returns that entity’s successor. The entire loop reduces to prompt with an entity, extract an entity, prompt again, and it scores 48/48. Asked instead to name its own next lookup, the model scores 0/48: it answers the sub-question rather than stating it, with and without its reasoning channel open. Those are the same behaviour — it treats an entity in the prompt as a retrieval key rather than a topic, so it cannot describe a step it has already taken.

Depth costs nothing. A three-link chain scores 1.0000, with an error-propagation residual of exactly 0.0000. The risk registered in advance — that the third hop passes through a link several chains share, where earlier hops were always unique — did not materialise: the shared intermediate was recovered 24 times out of 24. The adapter follows the relation, not mere association.

So “no domain knowledge required” has to be split: it holds for stepping and fails for stopping. What survives matters, though — live links are never mistaken for endings, zero times in thirty-six. A loop run for a known number of hops will not stop early, so the two- and three-hop results above stand exactly as measured. It is unbounded traversal that is unsafe — though as the next section shows, that turned out to be fixable.

Update: twenty-four rows fixed it

That limit turned out to be an artifact, not a property. Every training row in every world of this programme asserts a positive fact — the model had never once been shown an example where the correct answer is nothing. Adding 24 negative rows to a corpus of 216, four per terminal entity, removed the failure completely.

The doubt was specific and worth stating, because it was the difference between a fix and a trade: the negatives are only ten percent of the corpus, and they attach to a token pattern — a bare entity name — that is identical in form to every live prompt. If the model generalised “bare entity means stop” rather than “these six names mean stop”, stepping would collapse and the loop would be worse than before. It did not: the discrimination is name-specific, and every other entity’s continuation survived untouched.

So the loop is now self-terminating — prompt with an entity, extract an entity, prompt again, stop when it says none. But the same result bounds the fix. Because the model learned six specific names rather than a rule, an unseen terminal should be expected to fabricate, which means every terminal has to be taught explicitly. The property that makes it safe is the property that stops it generalising.

The conclusion: the tax was optional

Two final experiments changed the practical picture, and the second reversed the first.

Capacity was never the ceiling. Doubling the corpus from 24 facts to 48 left recall untouched at 1.0000 — and destroyed the model. General-knowledge accuracy went from 0.42 to 0.0000. Asked “what is 24 × 3?” the adapter answered with a catalogue identifier. Asked for the capital of France, the same. Perfect memory, total collapse: the binding constraint was collateral damage, and it arrived fast.

Then it turned out to be self-inflicted. Every experiment in this programme used the same training recipe, inherited from the very first one, chosen because a smaller configuration “could not compose.” But composing in a single pass has been near zero at every setting we ever measured — the expensive recipe bought nothing. Retraining the identical corpus at a quarter of the size:

A ninefold reduction in damage, at a quarter the size, with recall and chaining untouched. The interference is not zero — one catalogue identifier still leaks into the control set, and the tax does grow with corpus size — but it is an order of magnitude gentler, and the ceiling we spent an experiment discovering was an artifact of a decision made at the start for a benefit that never existed.

What the whole thing adds up to

The programme opened by asking whether a deployed model might acquire new knowledge by changing its own parameters, and reason with it. The first half is confirmed. The second is falsified.

So the answer to the original question is yes, with a precise recipe and two non-optional guards. A 9.68 MB adapter holds the facts at perfect recall, costs zero context tokens, and detaches cleanly. Composition comes from an external loop rather than from the model — prompt with an entity, extract an entity, repeat until the memory says none. A membership check has to sit in front of it, because the memory answers confidently for things it never learned. And terminals have to be taught explicitly, because that behaviour does not generalise.

What does not work is the intuition we started with: that knowledge written into weights becomes knowledge the model can think with. It becomes knowledge the model can retrieve. The thinking happens outside, one hop at a time.

Four things we got wrong

Forty-six predictions were registered before their runs and sixteen were falsified. That ratio is the point — but five of the failures were the instrument rather than the model, and the mistakes were more instructive than the successes.

• A terse answer format hid a capability completely. One instruction was enough to make the model answer 0 to “what is 2 plus 3?”. An experiment scored 0.375 under it and 0.917 without — and the failure was invisible, because 0.375 was exactly the score a principled “model is at chance” result would produce.
• Our replication was not a replication. The second test world was the first one with the names changed — identical sentence templates. It agreed about everything, including the artifacts. Only a genuine change of subject matter tested anything, and when we finally ran one, the prompt-engineering results transferred not at all while the memory results transferred exactly.
• Three experiments probed the wrong depth. Three consecutive attempts to give the memory an explicit address all failed at one layer of the network. A later diagnostic showed that fact identity is legible four layers further up and essentially absent at the layer we had been probing. They were run at the one depth where the signal does not exist.
• The recipe was chosen for a benefit that never existed — the ninefold interference penalty described above.

What we are not claiming

The composition is still performed by the harness, not by the model — the loop steps, the model retrieves. What the update above removes is the need to tell the harness anything about the subject; what it adds is a hard boundary on running that loop to unknown depth.

Two calls is also twice the inference, and everything here is a small model on synthetic worlds. Entity extraction assumes a known name format, which is engineering rather than research but is not free.

And there is one assumption underneath all of it that we never tested. Every entity in all forty-six experiments was invented to have zero prior — nonsense consonant clusters, checked for collisions, chosen precisely so the untouched model would score zero and the measurement would mean something. That was the right call, and it means we have never once written knowledge the model already has opinions about. Real facts are about real things. An adapter asserting that some API changed in version four is not filling an empty slot; it is arguing with a prior. Whether the delta wins, the prior wins, or the two collide is unmeasured — and those three outcomes imply completely different products. That question opens the next catalog rather than closing this one.

Why this is the interesting outcome

The goal was permanent, pluggable knowledge without retraining: something you can attach to a frozen model, use, and detach. Storage was solved early and turned out to be the easy half. The hard half was never capacity or interference — it was the step from a retrieved fact to a second lookup keyed on it, and that step does not have to happen inside the model at all.

What that leaves is a working shape at this scale: a frozen model, a small detachable adapter, no facts in the prompt, and one extra call. It beats stuffing the facts into the context, costs no context window, and comes off cleanly when you are done with it. The reasoner stays stable and the knowledge is a component you attach — which is where the last entry said this would end up, arrived at by a different road than expected.

What came next: a second catalog, and a harder answer

The programme above answered its question and stopped. Extending it would have meant re-asking a settled question with more letters, so the follow-on work is a separate catalog that inherits those answers as premises rather than re-opening them.

It starts from the assumption the first programme deliberately controlled away. Every entity in all forty-six experiments was invented to have zero prior — nonsense consonant clusters, chosen precisely so the untouched model would score zero and the measurement would mean something. That was the right call, and it means nothing there tested writing knowledge the model already has opinions about. Real facts are about real things.

First: it really is an update mechanism

Take a fact the model is confidently right about — it answers correctly under three different phrasings — and teach it something else. A nine-fact adapter overwrites it completely, and the original answer does not resurface: 0 occurrences across nineteen facts on two disjoint fact sets.

Then the more useful version. The model has a knowledge cutoff, and past it, it does not say “I don’t know” — it substitutes. It reports that Tokyo hosted the 2024 Olympics, that Tokyo will host 2028, and that David Cameron was Prime Minister in 2024, which is verbatim its own answer for 2010. So a post-cutoff question is not a blank; it is a confidently wrong belief. Correcting twelve of those with a 9.68 MB adapter:

That looked like the good result. It was measured with the wrong instrument.

Then: the cost was in a place we were not looking

Both programmes had measured interference, the damage an attached memory does to everything else, against an unrelated control set of arithmetic, logic and general trivia. Those questions sit a long way from any edited fact, and they put the cost at 0.0833.

Ask instead about the edit’s neighbours, meaning questions on the same topic with different answers, restricted to ones the untouched model already gets right. The number changes entirely.

And restraint makes it worse, not better

The obvious hope was that damage scales with edit size, so that small edits would have a small blast radius and there would be a usable budget somewhere. The opposite holds.

Proportional damage would have predicted 0.077 for a single fact. It measured 1.0000 — wrong by thirteen times, in the wrong direction. The reason was registered before the run: with twelve facts the adapter holds competing entries and has some pressure to tell them apart, which is why 43 % of its damage there lands on a different taught fact. With one fact there is nothing to compete with, so the whole topic returns it.

The adapter is not learning a fact. It is learning a response to a question shape. More facts do not make it surgical; they only split the same captured region between more answers.

Where that leaves it

The first programme’s result is untouched, and it is the one that matters: pluggable memory is excellent for closed-book retrieval of a corpus the model never knew. Invented entities have no neighbourhood to damage, which is exactly why that works and why the measurement was clean.

What the second catalog rules out, at this scale, is the more seductive use: patching a model’s existing knowledge. The edit takes, it survives rephrasing, and it eliminates the old belief, and it takes the surrounding topic with it, at any edit size tried.

Two levers remained, and the second has now been tested. Pairing the edit with rows that explicitly teach four neighbours’ correct answers protects those four perfectly — 4/4, no contamination, with the edit still intact. Three neighbours held out of training recover only to 0.33.

The way they fail is the point. A broken held-out question does not return the edit; it returns one of the pinned answers. Asked about the 1996 Olympics, the model says London, the answer pinned for 2012. Preserving rows do not shrink the captured region, they subdivide it. They are not a containment mechanism; they are more entries competing for the same question shape.

So containment is enumerative: to protect a question you must name it. For a closed, listable domain that is a real recipe with a real cost: four preserving facts took four times the training data of the edit itself. For open-domain knowledge, where you cannot enumerate every question an edit might break, it is not a recipe at all.

One lever was left: whether rank or module scope localises an edit the way they changed unrelated interference ninefold. Five configurations, the same single edit, the same five neighbour questions:

Not a gradient. Five configurations, one number. Rank 1 is the smallest change the setup can express, and it learned the fact and captured the topic just as completely as rank 16, so capacity and specificity never come apart. And every configuration learned its edit, which matters: one that had failed to learn would have shown low interference for the wrong reason and looked exactly like the locality we were hunting.

The lesson is that these are two different phenomena, not one measured at different distances. Damage to unrelated abilities is a spillover you can tune down, which is what the ninefold recipe difference was. Capturing the topic is what the mechanism does.

The line, closed

Every lever has now been tried: edit size (smaller is worse), pinning the neighbours (protects only what you name), rank, and module scope (no effect at all).

Which leaves the distinction sharp, and measured rather than argued: pluggable memory is a store, not an editor. Closed-book retrieval of a corpus the model never knew works, and it works because invented entities have no neighbourhood to capture. That is the same reason the original experiments were clean, and the same reason this one is not.

One question stayed open: everything above runs on a 0.6-billion-parameter model, and denser representations in a larger one might localise an edit.

Scaling up

So we scaled up. A 1.5-billion-parameter model, two and a half times the size, was taught the same single fact from five rows on the same recipe, then asked the same neighbour questions it had previously answered correctly.

That result is not a clean scale test and is not presented as one: the larger model is a different generation and instruction-tuned as well as bigger, so three things changed at once. But the asymmetry is what makes it worth reporting. Had the capture disappeared, the cause would have been ambiguous and we would have learned nothing without a cleaner comparison. It persisted through a size increase, a generation change and instruction tuning together. Surviving three changes is stronger evidence that the mechanism is intrinsic than surviving one would have been.

The same-family comparison at 1.7 billion parameters produced an unplanned finding before it even started: the larger model already knew the fact we had been teaching. Its cutoff is later, so there was nothing left to overwrite and that edit was void. It is wrong about a different Olympic host instead, so that became the edit instead. It is a reminder that what a model needs corrected is a moving target, and that an edit validated on one model can be a no-op on the next.

And there, finally, something changed. Interference fell from 1.0000 to 0.6250: still far too high to call the edit local, since five of eight neighbouring facts were destroyed by five rows of training, but no longer total. Which neighbours survived is the interesting part.

Everything from 2004 back was taken and everything from 2012 forward survived, with a single boundary case in between. That ordering is monotonic in recency, which is a decent proxy for how much text an association has behind it, and it was predicted in writing before the run as the way the “bigger will not help” expectation might turn out to be half wrong.

The obvious reading is that the edit competes with each existing association and wins wherever that association is weak — that the best-attested facts hold out. That reading was tempting enough to write down, so the next experiment measured it directly rather than inferring it from the ordering. It did not survive, and neither did the ordering.

Measuring the thing itself

Recency is only a stand-in for how strongly a model holds a fact. The model will tell you directly: the probability it assigns to the correct answer. Scoring every Olympic host that way, on the untouched model before any edit exists, gives the group difference you would expect — survivors far more confident than the captured. Ranking them individually does not.

So the tidy explanation does not survive contact with the measurement. Something about recent facts appeared to protect them, and it was not simply that the model is surer of them.

The correlation itself came back not measurable — only two neighbours survived, against a pre-registered minimum of four, so no number was computed and none was quoted. That threshold was set before the run precisely because a clean-looking ordering across eight items is exactly the kind of thing that turns out to be coincidence.

The survival curve, and a measure of the wrong thing

Two survivors cannot be correlated against anything. The fix was to stop treating capture as a yes-or-no outcome: train the identical edit at five increasing strengths — one, two, four, eight and twelve passes over the same single sentence — and record the strength at which each neighbour falls. Weak facts should fall early, strong ones late, and the result is a curve instead of a snapshot.

That part worked. Five rungs produced four distinct thresholds against a required three, so the variance problem was solved and the correlations were computable at last.

Three neighbours are already wrong after a single pass — at a strength where the edit itself has not taken, where the model still answers the edited question the old way. Whatever is breaking those three cannot be the new fact overwriting them, because the new fact is not in there yet.

Asking what those neighbours actually say settles it:

Two different failures had been counted as one. A neighbour can go wrong because the adapter is degrading the model generally, or because the taught answer has replaced the true one. Only the second is capture, and only the second is what any of this was about. The original measure — the strength at which a fact stops being answered correctly — quietly unioned them.

Separating the two changes the answer completely:

The conflated measure returns a clean confirmation of the prediction written down beforehand. The correct one returns nothing — both predictors land near 0.3, against a threshold of 0.5 fixed in advance. Same five adapters, same ten questions; the only difference is what was allowed to count as the event.

The dissociation is what proves they are separate: Tokyo 1964 goes wrong at the very first rung and is never captured, while Los Angeles 1984 and Munich 1972 survive intact to the last rung and are captured there. Those rows cannot both exist if damage and capture are the same thing.

So the sentence that stood here in the previous revision — recency predicts which facts survive; measured confidence does not — is retracted. Neither predicts. What is left is thinner and honest: capture is uneven, and nothing measured so far predicts which facts fall. One pre-registered gate also failed outright, so this run’s damage figures are not comparable to the earlier one’s and are not quoted as such.

Writing it up turned up a confound that has been sitting in this whole line of work unexamined: the taught answer is Atlanta and one of the earliest neighbours to break is Athens. They share a prefix. If capture tracks token similarity to the taught answer even partly, several results here need re-reading on a topic whose answers do not begin alike — so the next experiment was built to settle it.

Killing the confound, and losing the explanation

The topic was chosen so that prefix overlap is impossible by construction: national capitals, with Darwin taught as the capital of Australia. The model’s own answer is Canberra, and no neighbour’s answer begins with D or C. If capture needs the taught answer to resemble what it replaces, nothing here should be captured.

Germany and Japan both answered Darwin.

The same run took the explanation away, though. The topic-collapse account predicted this topic should contract the way the Olympics one did. It barely moved.

Same model, same recipe, same strengths — four times the damage on one topic as the other. Collapse is a property of that topic, not of pluggable editing. And the mistakes differ in kind: on capitals they were Cusco for Peru, Osaka for Japan, Gothenburg for Sweden — the right country’s second city every time. That is a loss of precision within each fact, where the Olympics topic lost the separation between facts.

Which points at what distinguishes them, and it is visible before any adapter exists. Asked about the 1980, 1976 and 1968 Olympics, the untouched model answers Munich to all three. That topic is already collapsed in the frozen weights. Asked for sixteen national capitals and sixteen chemical symbols, it gets every single one right.

So the next experiment tested that directly: four topics ranked by how sharply the untouched model separates them, one counterfactual edit each — which also removes a difference between the two runs above that could account for the gap on its own, since the Olympics edit corrected a fact the model had wrong while the capitals edit overwrote one it had right. The damage ordering was predicted in advance.

Both tests passed, and the idea was still wrong

The two registered thresholds cleared comfortably — a damage gap of 0.70 against a required 0.20, and a rank correlation of −0.5443 against a required −0.50. On the arithmetic, the prediction held.

It should not be reported that way, and the pre-registration says why. Written before the run, naming the outcome that would kill the idea:

Chemical symbols: sixteen out of sixteen correct on the untouched model, as sharply separated as anything measured here — and the edit took every single neighbour. The worst result of the four, from the topic the idea says should resist most.

The statistics passed for a reason that does not survive looking at them. Three of the four topics sit at exactly 1.0000, so the correlation is computed across a ceiling and is carried entirely by national capitals being the one topic below it. Remove that row and there is no variance left. The registered arithmetic passed and the hypothesis is recorded as refuted, because reporting it as a confirmation is precisely the failure that writing the thresholds down beforehand is meant to prevent.

What the wrong answers were actually doing

The real result was in the responses, not the scores. Asked for the capital of France, with Darwin taught as the capital of Australia, the model answered Dar es Salaam. Asked for the capital of Illinois, with Waco taught for Texas, it answered Waukeag — which is not a city.

That is not one fact displacing another. The model is generating an answer whose first token has been pulled toward the taught one, then completing whatever that prefix affords — sometimes into a real place, sometimes into a plausible-sounding non-place. Capture is just the case where the completion runs all the way to a full match.

It accounts for the captures, the near-misses and the confabulations under one description, and it explains the earlier failures: no per-fact measurement predicted capture because the bias is not applied per fact. It belongs to the answer slot for a question shape.

That reading came off a transcript after the fact, so it was a hypothesis, not a finding. Testing it needed a manipulation rather than another observation: one topic, one question, four taught answers differing only in first letter — and a test comparing each adapter’s wrong answers against the letters taught to the other three, so a general fondness for any one letter cancels out.

The cleanest result in the second programme

All three thresholds cleared, and the one that matters cleared by the largest margin available. Across 37 wrong answers spanning four adapters trained on the same topic and the same question, not one began with a letter that a different adapter had been taught.

The tokeniser then sharpened that from letters to tokens, which is where it stops being merely suggestive.

The strength of the effect varies in a way that explains itself. A specific taught first token such as Gal or Mid admits few continuations, and nine of ten neighbours were taken over outright. A generic one such as W or Be took over a single neighbour; the rest came back as Wolverine, Wichita, Beaverton and Brassfield, obedient to the prefix but rarely reproducing the taught string.

So capture and confabulation turn out to be one mechanism operating at different token specificities. What a pluggable edit targets is the first token of the answer slot for a question shape, not the fact and not the topic. (A later experiment narrows this further: it is the first token of the response. Here the model answered in bare strings, so the two happened to be the same token.)

What one sentence retires

That statement closes four open threads at once, all of them things that had been measured and left unexplained:

It also explains why the damage is not tunable away. A low-rank update to the attention and feed-forward projections has no representation of this fact only. The smallest thing it can learn is a bias on what the answer to this kind of question starts with — which is why every rank from 1 to 16 and every module scope produced the same number.

The specificity reading was itself post-hoc, so it went under test in turn: six new taught answers spanning a measured range of first-token predictability, ordering registered in advance, and none of them a city the previous run used. It failed. Plano has the second-most generic first token of the six and captured every single neighbour; Odessa, the most specific, captured three. Rank correlation +0.09 against a required −0.50.

So the mechanism holds and its magnitude stays unpredictable. That makes five predictors of how much an edit destroys — association strength, recency, topic separation, first-token specificity — registered and failed, against one that survived: what the edit biases. Which leaves the practical question, and it is a different question: if you cannot predict the damage, can you prevent it reaching anything?

Trying to fence the edit in

The damage lands on questions of the same shape as the edited one. So gate the adapter: attach it only for questions it owns, answer, detach. The first attempt used the edited model’s own embeddings to decide ownership, and it failed completely — all ten neighbours scored closer to the edited question than its own weakest paraphrase did.

That conclusion carried a caveat, written into the report at the time: mean-pooled hidden states from a generative model squeeze everything into a narrow band, and a purpose-built encoder might do better. The caveat turned out to be the finding.

A retrieval encoder one-fiftieth the size of the model being edited ranks every paraphrase above every neighbour, with a threshold band 0.10 wide. Building a better encoder out of the frozen model itself did not work — it came out worse than naive pooling. What matters is having been trained for retrieval, not how the states are pooled.

Does the fence hold in practice?

Running the real pipeline — embed, gate, attach only on a pass, answer, detach — across four topics and their adapters. The first run reported gated damage identical to ungated damage, topic for topic, to four decimal places. That is not a gate; it is a bug. Attaching an adapter modifies the model in place, so the “answer without the adapter” path was still running through it. Rebuilt as two passes with a fingerprint assertion between them.

One registered threshold failed here, and the reason is worth stating rather than smoothing: pooled damage came to 0.1000 against a required 0.05. Three of those four errors were the frozen model’s own pre-existing mistakes, present with no adapter anywhere — because this run, unlike the earlier one, forgot to filter the neighbours for questions the model already got right. That is a design error on my part, and the test is recorded as failed rather than rescored against the corrected measure.

The limitation, stated exactly

A single fixed threshold across all four topics does not exist, and the margin by which it fails is exact:

So the threshold is a per-edit parameter, which makes the deployable artefact the procedure that sets it rather than the gate. That procedure was registered and tested: take three paraphrases and five neighbours, things whoever writes an edit already has, and put the threshold at the midpoint between them. Then check it on three further paraphrases and five further neighbours it never saw.

31 of 32 held-out questions gated correctly. The narrowest calibration band in the whole programme was 0.0166 wide, and a midpoint estimated from three paraphrases still generalised perfectly to eight unseen questions.

The single error is worth its own sentence, because of which kind it is. A paraphrase was blocked; no neighbour was ever admitted. Every mistake the procedure made was the gate being too cautious: the edit fails to fire, so the model answers from its untouched weights. Nothing gets corrupted. That is the safe direction to fail in, though one error is one error, and establishing it as a property would take a run built to measure it.

Where this leaves it

Pluggable editing now has an end-to-end safety procedure. Calibrate on eight questions; gate; attach only on a pass; detach and check the base weights are unchanged. Thirty-three times less collateral damage, the edit fully intact, on a gate model one-fiftieth the size of the thing it guards.

It fixes nothing about the mechanism. The adapter still biases the first token of an entire question shape, exactly as before — the gate just makes sure that shape never reaches it. This is containment, and it works precisely because it is containment rather than a cure.

Chemical symbols were named in advance as the hard case and were the hard case both times: the topic that collapses most completely when ungated, and the one with the tightest gate.

A safety claim, and then the test that broke it

One property made the whole thing deployable. Across eight topics the gate’s mistakes were lopsided: it blocked legitimate paraphrases at 16.7% and admitted neighbours at 2.5%. Those are very different failures. A blocked paraphrase means the edit does not fire and the model answers from untouched weights: the user gets a stale answer and nothing is corrupted. An admitted neighbour means the adapter fires on a question it does not own, which is the damage all of this exists to prevent.

Errors 6.7× more likely to be the harmless kind is a good property to have. It was also, it turns out, a property of the questions rather than of the gate.

Every topic tested so far had something in common: the thing being substituted, whether Australia, Texas or gold, carries a decent share of the sentence. So the next set was built to remove that, deliberately, using the shape that had produced the only false positive ever seen here: How many moons does Mars have? A short entity buried in a long fixed template. Eight topics like it — sides of a polygon, legs on an animal, strings on an instrument, days in a month.

The asymmetry inverts. Where the entity does not carry the sentence, the gate admits neighbours more often than it blocks paraphrases, and the safety argument that made the procedure recommendable does not hold.

Being wrong about your own rejected rule

There is a second half to this, and it is the part worth sitting with. An earlier run had proposed an admission test — refuse any edit whose calibration band is narrower than 0.10 — and it was rejected. The reasoning at the time: the rule prevented no demonstrated harm, reduced only the harmless error kind, and threw away a quarter of perfectly good edits. That was a fair reading of the evidence available.

Applied unchanged to the adversarial topics, the rejected rule catches every single one of the six harmful errors, at a cost of one unnecessary refusal.

What it actually costs

The corrected procedure adds one step: refuse an edit whose calibration band is empty or narrower than 0.10. On the adversarial set that means accepting one edit out of eight.

Which is not a gate on a workflow. It is a near-total refusal, and the honest way to say it is that pluggable editing is not safely available for templated short-entity questions at all — counts, measurements, list memberships. What the procedure contributes there is the ability to detect that and decline, rather than to make it work. On ordinary topics acceptance runs at four in eight with containment intact.

So the method works where the question shape carries enough signal to tell one question from its neighbours, and correctly refuses where it does not. That is a narrower claim than the one two experiments ago, and it is the one the evidence supports.

Two loose ends, tightened

The refusal threshold of 0.10 was inherited from an eight-topic split and had never been fitted properly. With twenty-three topics now measured under one procedure, it could be — by choosing the smallest threshold that admits no failing topic on half the corpus, then testing it on the other half.

That fit returned 0.0116 and let through two harmful errors on the held-out half. It had landed seven ten-thousandths above the nearest failure it had seen, and the unseen half contained a worse one. A minimal fit to a small sample has no margin. Across all twenty-three topics, nothing with a band above 0.0342 ever produced a harmful error — so the inherited 0.10 clears the widest observed failure threefold, where the fitted value cleared it by a third. The inherited number stands, now for a measured reason rather than an inherited one.

The other loose end was whether an author could tell in advance that an edit would be unusable, without doing the calibration at all. The obvious candidate: how much of the sentence the entity occupies. It does not work — correlation 0.26. The counterexample was written into the prediction beforehand and is the one the data produced: How many letters are in the word rhythm? has the smallest entity share in the whole corpus and the widest, safest band, because “the word rhythm” is distinctive in a way “Venus” is not. Token share and distinctiveness are simply different things. There is no shortcut; run the calibration, it costs eight embeddings.

What twenty-four experiments came to

Ninety predictions registered before their runs, twenty-seven falsified. The failures did more work than the confirmations, and several were caught by routine checks rather than insight — a measure that scored 0.61 and passed while counting the wrong event; a gate whose damage figures matched the ungated ones to four decimal places, because attaching an adapter modifies the model in place; a hypothesis that cleared both its thresholds while the case named in advance as its refutation sat in the results.

Four published conclusions were withdrawn. Two fell to replication; one went when a measure turned out to be counting something other than what it named; and the last, semantic gating cannot confine an edit, went when the caveat written into its own report turned out to be the finding.

The word that had gone untested: skillsets

The goal all of this started from was permanent memory or skillsets in a pluggable fashion — plural. Every experiment to this point had attached exactly one adapter. Twenty-eight in, that finally got tested, and three things came out of it.

Two adapters do coexist. Compose one taught the capital of Australia and one taught the 2012 Olympic host, and both edits survive intact. But the obvious way to combine them — add them at full strength — is wrong: the model started returning empty strings, seven answers in ten. Halving the weights restored generation completely and brought both edits back to perfect. Summing adapters at full weight breaks the model before it breaks anything semantic.

Collisions have a winner, not a blend. Two adapters taught different answers to the same question — Waco and Galveston — produce Galveston four times out of four. No averaging, no third answer. Which is what a single-token slot predicts, and it means a losing adapter in a library is silently ignored: present, and having no effect at all.

And an adapter damages topics it has never seen. That one was not being looked for. Measuring a baseline turned up the Olympics adapter degrading national capitals at 0.40 — worse than the capitals adapter damages its own topic.

A full damage matrix, and a distinction nobody had drawn

Nine of the twelve off-diagonal cells are non-zero. The chemical-symbols adapter is the most destructive thing measured — and chemical symbols are the only topic nothing touches, three zeroes in a column. Being destructive and being vulnerable turn out to be entirely separate properties, which is why the tidy hypothesis of the day (that damage follows the type of answer) died: it predicts a symmetric matrix, and this one is not.

The sharpest thing in the table is not in it. Across every off-diagonal cell in this matrix and a wider one after it — zero of the wrong answers were the taught string. On its own topic an adapter captures: neighbours come back saying Darwin. Off its topic it only degrades: Berlin becomes Bremen, and Darwin appears nowhere. Two different phenomena, and twenty-six experiments had been treating them as one. (On this model. A later run on a smaller one finds the boundary leaks — see the end.)

Predicting the direction backwards

Which topics suffer? The obvious guess is the ones the model is unsure of, on the grounds that a confidently-held fact ought to resist. That guess was written down before the run, and it was wrong by a correlation of −0.74, the largest relationship measured anywhere in this work. The topics whose answers are most locked-in turn out to be the most fragile.

The earlier finding says as much, if anyone had thought to apply it. The adapter biases the first token, so a topic whose continuation is forced once that token lands is one where a single token carries the whole answer, and perturbing it changes everything downstream. A topic with more freedom after the first token can absorb the hit. The mechanism was three experiments old and predicted the direction; it simply was not consulted.

The obvious confound, that “low entropy” really meant “short answer”, was tested and refuted. Answer length correlates with the entropy measure at 0.05.

Something useful falls out

If damage is a shift in the first-token distribution, it should be visible in the logits before generating a single word. That is the pre-deployment screen an earlier experiment had gone looking for and failed to find.

It ranks risk; it does not certify safety. One topic sits at the very bottom of the divergence ranking and is among the most damaged anyway, so a low reading is a good sign rather than a guarantee. And chemical symbols’ immunity is still unexplained — it is not that adapters barely disturb them, because the topic that disturbs least is damaged most.

What this all means for a library of skills: not a shelf of adapters left loaded. Composition compounds the damage, and even one resident adapter degrades domains it knows nothing about. The workable shape is exactly one adapter attached, per question, detached immediately — which is the same discipline the gate already imposed, now required for a second independent reason.

Chasing an anomaly, and knowing when to stop

One topic had refused to fit anything. Chemical symbols were the only subject in either damage matrix that nothing touched, and two accounts had already failed on it: the topic sits mid-range on answer uncertainty, and it is not the least-perturbed topic either. A third was tried — perhaps what matters is not how far the distribution moves but how much movement it can absorb before the top answer changes.

It ranked seventh of eight, the opposite of the prediction.

The pre-registration had already said what to do in that case: record the immunity as unexplained rather than propose a fourth predictor, because at some point chasing one stubborn data point is just fitting noise. So that is where it stands.

The failed attempt exposed something more useful, though. A diagnostic column showed that the measure had never looked at the answer at all: on four topics, across ten questions the model gets right, the most likely next token was never the answer’s first token, because the model answers in sentences.

Measuring the right place, and being wrong about which place that is

The obvious repair: find where the answer actually sits inside the response and measure there. Feed the model its own opening — “The capital of Germany is” — and look at what it wants to say next.

That measure came out three and a half times worse than the sloppy one it was meant to replace. One cell shows why.

An adapter that destroys three-fifths of a topic barely disturbs the answer position. Which is impossible — unless the damage is not happening there.

Feeding the model a prefix it would never have written asks it a question it never faces, and conditions away the very divergence doing the damage. An adapter’s damage begins at the first token it emits, because that is where the response forks.

Which rescues the earlier screen for a better reason than it was built on. Measuring at the first generated token started as a convenience, then looked like a mistake, and turns out to be the informative position. The thing that looked like a bug was the measurement working.

It also narrows the mechanism finding from earlier. That experiment had its model answering in bare strings — Waco, Galveston — so the response’s first token and the answer’s first token were the same token and the distinction never surfaced. On topics answered in sentences they separate, and it is the response that governs.

Something that finally worked

Every attempt to reduce the damage so far had gone after the training recipe — rank 1 through 16, attention-only through everything, one fact against twelve, explicitly naming the neighbours to protect. All of it produced the same number. This time the intervention came from the mechanism instead: if the damage starts where the response forks, take away the adapter’s choice of how to open. Hand it the model’s own phrasing — “The capital of Germany is…” — and let it only finish the sentence.

The prediction attached to it was still wrong, and interestingly so. The idea was that this should fail in one specific place: damage to an adapter’s own topic is aimed squarely at the answer, so constraining the wrapper around it should not help. Measured by which cells improved, that came out backwards.

Measured by which kind of error improved, it is exactly right — and the partition was the mistake, not the idea.

The chemical-symbols adapter on its own topic is the clean case: ten replacements in, ten replacements out, not one recovered — in the same run where every one of its cross-topic cells fell to zero. State capitals is the mirror image: nine ordinary errors, seven of them fixed.

So the two failure modes come apart under intervention as well as under measurement. Being wrong about a fact is a formatting accident and can be designed away. Being overwritten is aimed, and cannot.

A caveat written down before the run, now with a number attached: handing the model “The capital of Germany is…” leaks a great deal about the answer, so 0.0454 is an upper bound on what format control alone is worth. That confound cuts one way only — it should help the model answer correctly — which makes overwriting surviving it 76% of the time the stronger half of the result.

Which starts to complete the picture: gate the adapter to protect the topic you edited, and pin the response format to protect everything else. Except that the caveat above needed settling before any of that could be believed.

How much of that was the hint?

Handing the model “The capital of Germany is…” does two things at once. It fixes the shape of the reply, which is the thing being tested. It also all but names the answer. Those had to be separated, and conveniently they predict opposite results: if the damage really comes from the model choosing how to open, then a frame carrying no information at all should work nearly as well. If the benefit came from the hint, a contentless frame buys nothing.

So: “The answer is” — identical across all eight topics, naming nothing.

The contentless frame recovers 69% of the benefit. So the mechanism holds up: most of what was gained came from denying the adapter its choice of opening, not from the hint. But the hint was doing about a third of the work, which means the deployable number is 60%, not 86%, and the earlier claim has been corrected rather than footnoted.

Overwriting, meanwhile, survives the contentless frame even better — 88% of replacements persist, against 76% under the informative one. Which orders correctly: the informative prefix occasionally hands the true answer enough of a nudge to win. Nothing about response format touches the aimed part of the damage.

And it does not always help

Of twenty-eight cross-topic cells, fifteen improved, eleven were unchanged and two got worse. Both of the two belong to the least destructive adapter in the set, which fits: forcing a bare frame onto a topic the model would rather answer in a sentence can introduce errors that free generation avoids.

So the two tools that exist do different jobs, and neither does the third. Gating protects the topic you edited and format control protects everything else, but nothing protects the edited topic itself from being overwritten. That remains the irreducible price of editing a frozen model this way.

One model, thirty-three experiments

Something had been quietly accumulating. Every result from the mechanism onward — the first-token finding, the damage matrix, the logit screen, format control — came from a single 1.7-billion-parameter model. The earlier storage work had been done on a model a third that size, and the two were being written up as one continuous story across checkpoints that had never been compared.

So the four adapters were retrained on the smaller model, identical recipe, and the same measurements repeated.

Twice the collateral damage, less than half the protection — and the clean boundary, the one that had held across forty-four cells without a single exception, leaks. Adapters on the smaller model do plant their taught answer in topics they were never trained on.

That was named beforehand as the most expensive thing that could happen, because the capture-versus-degradation split underpins a good deal of what came before it. What survives is the distinction: roughly fifty-five cross-topic errors, seven of them overwrites, so ordinary degradation is still the dominant failure on both models. What does not survive is the claim that the line is absolute. It was a property of that checkpoint, not of the method, and the earlier write-ups have been corrected to say so rather than left standing.

There is a hint in which cells leaked, though three cells is not a finding: every one of them was between topics answered with city names, and the chemical-symbols adapter neither leaked outward nor was leaked into. That is precisely the “damage follows the type of answer” idea that was tested and refuted on the larger model — showing up again on the smaller one, where the boundary is porous enough to see it.

Worth stating what that run did not establish: the first-token mechanism itself was not retested, and it is the claim everything else rests on. So it was.

The load-bearing claim, retested

Same script, same four adapters, same thresholds written down months of experiments ago, with only the model swapped. A transfer test that quietly relaxes its own bars proves nothing, so nothing was relaxed.

The mechanism does not merely survive on the smaller model — it shows up more purely. Specificity 1.0000 against 0.7568; the rate of answers starting with a letter some other adapter was taught stays at exactly zero, as before.

And notice what is missing. On the larger model, the adapters taught awkward openings produced Wolverine, Wichita, Beaverton — near-misses, obedient to the prefix but not quite the taught word. Here there are none. Every row wins outright.

The obvious reading: scale does not change the mechanism, it buys partial resistance to it. The bigger model pushes back a little and produces those near-misses; the smaller one does not push back at all. Two points, though, and two points define a line whether or not one exists — so a third was needed.

The third point, which broke the line

A 1.5-billion-parameter model was already sitting on the machine — from a different family, which makes it useful for separating “bigger resists more” from “this particular lineage resists”. And there was a reason to expect trouble: an experiment much earlier had measured that same model at maximum interference, identical to the smallest one. So the prediction written down was that it would behave like the small model and the scale story would collapse.

It collapsed, but not that way.

The 1.5B model resists most — and it is smaller than the 1.7B. Overwriting does not track parameter count at all, so “scale buys resistance” is simply wrong and has been corrected rather than softened.

The earlier measurement that prompted the prediction was not wrong either; it was misread. It recorded how often neighbouring facts came out damaged, and that is still high here at 0.75. What is low is how often they come out as the taught word. This model is wrecked and rarely overwritten — it invents instead:

Which is a distinction this project introduced a dozen experiments ago and then failed to apply to its own older data. Reading “damage” as “overwriting” is precisely the conflation that had already been caught once.

What actually holds

Across three models and two families, one thing is constant: when the bias appears, it is aimed. Wrong answers begin with the letter that adapter was taught, and essentially never with a letter taught to one of the others — a cross-contamination rate of about one percent. What varies enormously is how hard the bias binds: from every wrong answer being the taught word, to fewer than half even starting with the right letter.

So the honest version is narrower than the tidy one. The mechanism is real, aimed and specific everywhere it has been looked for. Whether it resolves into the taught word or merely into something that sounds like its opening depends on the model — and not on how big it is.

No such suspect

The obvious next candidate was instruction tuning: perhaps a model taught to follow instructions holds its answers more firmly. That called for the one comparison that isolates it: the same family at the same size, tuned and untuned. So the untuned half was downloaded.

It cannot answer anything. Asked for the capital of Texas, it replied with a Chinese phrase meaning “second-tier city”, repeated seventeen times. None of the ten questions survived; nothing was measurable.

Which prompted a check that should have come first, and it turned up an error in the premise rather than in the run. The models being called untuned were nothing of the sort. The releases used throughout are the post-trained ones; separate base versions exist and were never touched. All three models in the comparison were instruction-following, so tuning cannot be what distinguishes them — a fact that settles the question more firmly than any measurement would have.

A smaller thing worth keeping: the untuned model ships a chat template and still cannot follow it. The presence of the machinery is not evidence of the training.

Closing a line instead of extending it

Three explanations had by now been offered for why different models are overwritten to wildly different degrees: how distinctive the taught word’s opening is, how large the model is, and whether it was instruction-tuned. All three are dead.

The rule written down beforehand was that a fourth would not be proposed. Why some checkpoints are almost entirely overwritten and others barely at all is recorded as unexplained, and that is where it stays. Past three failed accounts, inventing a fourth stops being investigation and starts being curve-fitting.

What survives is the part that has never wavered: across every model looked at, the bias is aimed — wrong answers begin with the letter that particular adapter was taught and essentially never with a letter taught to another. How hard it binds varies, and nothing tested predicts it.

The failed run also fixed the boundary of everything here. This whole apparatus — every question, every measurement — goes through a chat template and a system instruction. A model without that training produces nothing scoreable. So every result in both programmes is a result about post-trained models, and not one claim has been tested on a raw checkpoint.

Something improved

The cross-model story had been uniformly discouraging. The clean boundary leaks on the smaller model; the resistance to overwriting is absent there; pinning the response format buys less than a quarter of what it buys on the larger one. Which left the piece a reader would actually use first — the cheap check that predicts, before deploying anything, how much damage an adapter will do — still tested on exactly one model.

The prediction written down was that it would fail: twelve measurements instead of thirty-two, and a damage range so compressed that most of it sits near the ceiling. Nothing can rank what barely varies.

The reasoning behind the prediction was wrong in a specific way worth keeping. The damage is compressed, yes — but the signal is not. It spans a factor of twenty, and the three cells with little damage are exactly the three with little signal. A predictor does not need its target to vary widely, only to be ordered.

What that does not license: reading 0.81 as better than 0.66. One comes from twelve points and the other from thirty-two, and rank correlations on twelve points move around. The defensible claim is that the check clears its original bar on a second model, not that it improves as models shrink. The caution registered beforehand survives the result going the right way.

So of the three tools, the cheapest one travels best. The gate never touches the model at all, so it ought to be indifferent to which one is being used, but that is a reasoned argument rather than a measurement, and this project has now been wrong about enough reasoned arguments to keep the distinction visible. So it was measured.

Measuring the argument

The gate decides what to let through using only a small encoder and the text of the question. Nothing about the model being protected enters into it, so its decisions cannot depend on which model that is. Checking anyway found exactly zero disagreements — which proves nothing and was included so that a hidden dependence would surface rather than be assumed away.

The interesting half was what the gate is worth. Same decisions, but on the smaller model every mistake costs more, since an adapter that slips through overwrites everything rather than merely half of it. The expectation was a much weaker result.

Twenty-seven times less damage, against thirty-three on the larger model. Barely a drop — and the reason exposes a hole in the reasoning behind the prediction.

The gate let through nothing on two topics and one question on the third. With a single admission in the entire run, the cost of an admission has almost nothing to multiply. The argument had been about the numerator and forgot the denominator entirely. Which also means these ratios are mostly measuring how much the gate rejects — a property of the encoder and the questions, not of the model — so the two numbers landing close together is less surprising than it was made to sound beforehand.

A shape, finally

With that, every piece has been measured on two models rather than one, and they sort cleanly:

The tools that never touch the model carry over; the ones that depend on how it behaves internally do not. That is nearly a tautology once written down, and it was not obvious in advance — but it is the practical shape of the whole thing. Lean on the parts that sit outside. Measure anything that depends on the model itself, per model, every time.

The word nobody had tested

The question that started all of this asked for memory or skillsets. Forty experiments later, everything measured had been facts — finite lists of question and answer. Nothing had required the model to do something to an input it had never seen, which is the only thing that distinguishes a skill from a lookup table.

The first attempt was unmeasurable, and instructively so. The rule chosen — take the first letter of one word and the last letter of another — turned out to be beyond the model entirely: told the rule outright, in plain language, it scored zero. It got the first letter right nearly every time and could never find the last. So an adapter was trained and then deliberately never evaluated, because a failure there would have been indistinguishable from “no arrangement of this model can do this at all”.

The second attempt used a rule the model can execute: answer everything in a fixed shape — a prefix, then the answer in capitals, inside double brackets. Twenty-four questions trained; twelve different ones held back. And one precaution that turned out to matter enormously: every question was checked against the untouched model first, and only ones it already answered correctly were kept.

So yes — a procedure can be bolted on. Nothing in the prompt says anything about the format; the adapter carries it, and applies it to questions that were never part of its training.

Looking closer splits that number in two. The wrapper — the prefix and the brackets — appears on every single held-out answer. The capitalisation only manages ten of twelve, and both misses are otherwise perfect: VD: <<Mount Everest>>. An adapter carries the shape of a procedure faithfully; the parts requiring the model to actually transform characters stay as unreliable as they were, which is exactly what the failed first attempt predicted.

And the bill

A quarter of the held-out answers are wrong, from an adapter whose entire job was to change the shape of the output. That is the same mechanism this whole investigation has been circling: the thing being adjusted is what the answer starts with, and content rides along with it. The threshold set beforehand was 0.75; it landed on exactly 0.75. A coin flip, and reported as one.

So both halves of the original question now have measured answers. Memory of genuinely new things works cleanly — nothing to disturb, nothing disturbed. Skills work too, and cost a quarter of the content. Which is an argument for the gate rather than against the skill: keep the adapter away from every question that isn’t its own, and the tax only lands where it was invited.

Scope, stated plainly. The aimed-and-specific finding now covers three models across two families. The near-miss trade-off and the failed specificity predictor are 1.7B phenomena, and the pattern actually inverts on the 1.5B. The logit screen, the response-fork account and format control remain untested elsewhere and are still one model’s results.

Where forty experiments landed

The question at the start was whether a frozen model can be handed knowledge, or a capability, as a file you attach and remove — because retraining is not on the table. Both halves now have measured answers.

The mechanism underneath all three is one sentence: what an adapter changes is how the model starts its reply. Not the fact, not the subject — the first token out of its mouth, for every question shaped like the one it was trained on. Everything else follows. Why nothing predicted which facts would break, why no rank or module setting helped, why one fact was worse than twelve, why chemical symbols shattered where capitals held.

And the damage cannot be tuned away. Five different properties were proposed to predict how much a given edit would destroy — how confidently the model held a fact, how recent it was, how sharply it separated the subject, how distinctive the taught word’s opening was, how large the model was. Four are dead. Two further mysteries were abandoned deliberately after three failed explanations each, on a rule written down beforehand: past three, inventing a fourth stops being investigation.

What does work is refusing to let the damage reach anything. A retrieval encoder one-fiftieth the model’s size decides whether a question belongs to the adapter, and the adapter is attached only if it does. That gate and the screen that predicts damage both live entirely outside the model, and both carry across checkpoints. Everything that depends on the model’s internals does not. Nearly a tautology once written down; not obvious beforehand.

What got built

None of that is worth much unassembled, so it was assembled. A frozen 1.7-billion-parameter model that answers questions about this server — its VPN topology, which service runs where, what broke after a reboot and why — from a 17 MB file, offline, with the base weights checked unchanged afterwards. Thirty-eight facts it cannot otherwise know, perfect recall, and every out-of-scope question answered without the adapter ever being loaded.

Its first run failed, on the one criterion that mattered: the untouched model already knew eight of the forty-five things it was being taught. Which is the whole point of measuring that. Without it the system would have shipped claiming perfect recall on a list padded with questions it never needed to be told.

Trying to pay the tax elsewhere

The clearest hypothesis followed from this project’s oldest finding. A single forward pass performs exactly one retrieval: ask once and you get the halfway step, ask twice and you get the answer. If that is true of reasoning, it may be true of the skill tax as well: an adapter asked to supply both a format and a fact is being asked for two things in one pass, and it pays for the second in errors.

So: split the work. Get the content from the untouched model, then apply the procedure in a second call with the adapter attached. If the quarter of wrecked answers is the cost of asking one pass to do two jobs, that architecture should recover them, and the same trick that fixed multi-hop reasoning would fix skills too.

It was run. It does not work, and one line explains why.

The untouched model got all twelve held-out questions right. Every answer was handed over. The adapter wrecked the same three regardless. Pacific, supplied as “the largest ocean is the Pacific Ocean”, came back as PALE BLUE.

So the tax is not a matter of asking one pass to do two things. The multi-hop analogy was wrong: reasoning fails because a second lookup never happens, and a second call supplies it. Here there is nothing left to look up, since the answer is already on the page, and it gets overwritten anyway. An adapter does not read the context and then decide. It bends what comes out, and a correct answer sitting right there does not outrank the bend.

One thing did improve, and it is the same split this project keeps finding. Format compliance went to perfect: the extra context fixed both of the casing slips from before. Help the model and the shape gets better; the content does not move at all. The prediction written down beforehand had this exactly backwards: the format was named as the fragile part and it was the only part that improved.

Which closes the question rather than leaving it open. The skill tax cannot be architected away. It is the same mechanism as everything else here, and it has the same and only remedy: keep the adapter away from the questions whose answers you cannot afford to lose.

The comparison I had avoided

Forty-one experiments in, none of this had ever been measured against the obvious alternative: just putting the fact in the prompt. The reason it had been set aside — the goal was memory in the weights, not a longer prompt — is a reason, not a result. So it was measured. Same retriever, same model, same questions; the only thing that changes is where the knowledge sits.

The prompt wins. It matches on the questions the adapter was trained on, does better on rephrasings, causes no damage at all so needs no gate protecting it, and changing a fact is editing a text file rather than retraining. What the adapter buys is a shorter prompt — about 38% — and that is the whole of it.

And there is a sharper way to put it, which was written down before the run. The gate is a retriever. It embeds the question, searches the fact list, and decides whether to attach. A system that has already looked up the relevant fact in order to decide something could simply use the fact. On a list this size the adapter is doing work the lookup already made unnecessary.

Two corrections, reaching backwards

The first run of that comparison had the adapter apparently damaging questions it should never have seen. It hadn’t. Attaching an adapter modifies the model in place, so the “answer without it” branch was still running through it — a bug diagnosed and written up twenty-three experiments earlier, and reintroduced in a fresh piece of code.

The second is worse, because it is not a bug but a bias. Every one of the prompt-based “wrong” answers had retrieved the right fact and answered correctly — in its own words.

Scored on whether the answer contains the right content rather than the right characters, the prompt’s score moves from 0.92 to 0.97. Every accuracy figure in this project used string matching, and any of them setting an adapter against something that answers in its own words is tilted the same way.

What that comparison cannot settle is the case for adapters, which is size. The cost of putting facts in a prompt grows with how many you retrieve; the cost of an adapter does not. Thirty-eight facts is nowhere near enough to find where those two lines cross, and that crossing is the entire argument.

Scaling it up

The argument for an adapter over a prompt has always been size. Prompt cost grows with the number of facts you retrieve; adapter cost does not. Somewhere out there the two lines ought to cross, and forty-two experiments had never gone looking for the place.

So: the same corpus at forty, a hundred and twenty and three hundred and sixty invented facts, an adapter trained on each, measured against a retriever that puts only the facts it fetches into the prompt.

The lines do not cross. They separate. At three hundred and sixty facts the adapter can no longer recover fifteen percent of what it was trained on, because rank-4 capacity is finite and more facts crowd it. Retrieval held at 1.0000 the whole way, and the measured drop across a ninefold increase was zero.

That zero is the part I got wrong, and I had written the prediction down. More facts in the pool should mean more chances to fetch the wrong one, and that slow decay was the mechanism by which the adapter would eventually come out ahead. It never started. Token cost stayed flat for both, which rather gives the game away: “context doesn’t scale” is a statement about stuffing an entire corpus into the window, and nobody builds it that way.

So the conclusion loses its hedge. It used to read for a corpus this size, the prompt does the same job with none of the tax. Over a ninefold range, retrieval never missed a question and the adapter mislaid fifteen percent of its own.

Can a memory describe itself?

Then a question arrived from outside the project. What if you trained the adapter on facts about itself, so it could report what it holds and admit when it holds nothing?

Half of that is impossible, and the impossible half is worth stating carefully. A model cannot detect that an adapter is loaded. It has no channel through which to observe its own weights; the adapter changes the function that computes the next token and never appears in the input. There is nothing there to notice. What you can do is tell it about itself at build time, in the same rows that carry everything else.

Twelve such rows went in: scope, size, provenance, subject, and four denials naming things the store does not cover. It looked like a clean win.

All four registered thresholds passed, including the one I had predicted would fail. The denials even generalised to topics the adapter had never been asked about.

Eight identical answers

Which was the problem. Eight different questions came back with the same string, character for character: “outside my scope”. Judgements do not do that. Templates do, and this project had already established that an adapter biases the opening of a response according to a question’s shape.

The corpus showed how it had happened. Every denial row was phrased does your detailed knowledge cover X? and every affirmation do you know about X? Form and meaning lined up perfectly across all six rows, so phrasing alone was enough to tell them apart, and scope never had to be represented at all.

Crossing the two takes eight questions. Ask the denial phrasing about facts it demonstrably holds; ask the affirming phrasing about things it does not.

It disowns its own VPN configuration and lays claim to Roman emperors. Scope contributed nothing to the outcome and phrasing contributed everything, with no partial credit anywhere in the grid. The denial had never carried any information at all.

Rebuilding the corpus

Two readings were available. Either adapters cannot represent scope, or this corpus never asked them to. Those point in opposite directions, so the way to settle it was to rebuild the training data with form and meaning crossed, then test on subjects that appeared nowhere in it.

The two effects swapped places. Asked about DNS and SSH in the phrasing that used to trigger automatic denial, it says yes. Asked about Roman emperors and cricket in the phrasing that used to trigger automatic agreement, it says no. None of those four subjects were in the training data, so what transferred was the distinction itself and not the wording.

Going back to check the thresholds

A later project, building fresh measurement code, found four of its own tests reporting signal where none existed. Each was a number chosen because it looked reasonable — a correlation bar of 0.10, a “close enough to chance” band of ±0.05, a capability gate at 10% — and each sat at or below the noise floor of the statistic it was judging. Two of them passed when run on a model containing nothing at all.

This project registered a hundred and fifty-five thresholds, chosen the same way. So the obvious question: does any conclusion here rest on one that could not have separated a real effect from luck?

The first answer is about the record

Of the 123 thresholds recorded in the stored result files, 120 have no recoverable sample size. The files record what was measured and whether it passed. They do not record how much data the judgement rested on.

That is a real gap in a project that was otherwise careful. Predictions were registered before runs, model weights were fingerprinted before and after every attach, experiments that could not be measured were reported as unmeasurable rather than negative. And then the artefact left behind cannot answer “out of how many?” without going back to the code that produced it. A threshold without its sample size is not auditable.

The headline claims hold

Recovering the sample sizes by hand for the results this project actually leans on:

Both rest on every single item in every cell falling the same way, and perfect separation across sixteen to twenty binary trials is not something chance produces. The scaling result needs its claim stated precisely rather than defended: the single worst cell — the adapter at 0.85 against retrieval at 1.00 — is seventeen right out of twenty against twenty out of twenty, which is thin on its own. What the conclusion rests on is the trend across three corpus sizes, and that is how the report already worded it.

One verdict that was too strong

The recency test measured a correlation of 0.294 against a threshold of 0.5, across eight topics. A correlation on eight points has a null band of roughly ±0.70. The threshold sat inside the noise, so the test could not have detected an effect in either direction.

It was reported as falsified. That is the safe direction — a test too weak to find an effect cannot manufacture one, and the conclusion drawn was that recency does not predict damage — so nothing published needs withdrawing. But unmeasurable was the honest word. Reporting it as falsified implies the hypothesis was tested and lost, when what actually happened is that the experiment was too small to test it.

Finishing it: the answer, and two more of the same mistake

Recovering sample sizes from the harness code closes the question. No passing claim rests on a threshold below its true noise floor. But getting to that required throwing away my own analysis twice.

The first attempt computed one chance table at fifty-fifty odds and applied it to every experiment. That is right for a coin flip and wrong for almost everything here. Asking whether a wrong answer begins with a particular letter has odds near one in twenty-six; asking whether a model produced one specific correct string out of a vocabulary has odds near zero. A uniform fifty-fifty floor would have condemned perfectly sound results as noise.

The second attempt fixed that and then re-made it one level down, by matching on words. Tests with “survives” or “compliance” in the name got treated as two-outcome decisions — but “does the edit survive” means “does the model return the exact taught string”, which is not a coin flip either. One such test reads six out of eight. Under a coin-flip null that is unremarkable, probability 0.14. Under the real one it is close to impossible by chance.

What is left after proper classification is a handful of genuinely two-outcome decisions — does the gate admit or block, does the model refuse or answer. The passing ones clear their floors comfortably; one reads seventy-two out of seventy-four. The failing ones fail in the safe direction, because a test too weak to detect an effect cannot invent one.

One rule came out of it worth keeping: a perfect score on a two-outcome decision needs at least six trials to be distinguishable from luck. Four out of four has a one-in-sixteen chance of happening anyway.

The other 120 thresholds cannot be checked without re-reading the code that produced them, which is the honest limit of the exercise and the reason the record-keeping problem is listed first.

Closing this out

Forty-six experiments, a hundred and fifty-five predictions written down before the runs that judged them, forty-four of them wrong. Nine reports carry corrections that later experiments forced on them — including the single most-cited result in the project, which needed two. A programme where nothing ever needed correcting would be a programme that was not checking.

The thing that keeps striking me, looking back, is what the failures had in common. The model could do every individual step. Ask it one hop and it answers; ask it two hops as two questions and it answers both perfectly. What it could not do was know its own state — that a second hop remained, that it had finished, that a question was outside what it had been given, that it did not know something and was about to invent an answer instead.

Every piece of scaffolding built here was a prosthetic for that. The two-call loop is a memory of an unfinished thought. The gate is a sense of what belongs to you. The forced stop is knowing when to be quiet. All of it bolted on from outside, because none of it exists inside.

Which is where the next thing starts. A small model, built from scratch, with those signals as native trained outputs rather than external machinery: depth that the model chooses per question, a channel that reports whether it actually knows, and self-improvement as verified rounds rather than continuous drift. It will be worse than a free 600-million-parameter download at nearly everything, and that is not the point. It is called Sounder — a sounding line measures the depth before you commit, and sound is also what you hope the answer is.

Continues from Inference Should Learn, which covers Phase I. Forty-six experiments across two programmes, 155 predictions registered before their runs, 44 falsified and 3 unmeasurable. Run on two Jetson Orin boards against frozen Qwen3 0.6B/1.7B and Qwen2.5-1.5B-Instruct, greedy decoding, fixed seed, base weights fingerprinted before and after every attach and unload.