cs.LGFeb 19, 2026

The Anxiety of Influence: Bloom Filters in Transformer Attention Heads

Authors: Peter Balogh

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Some transformer attention heads appear to function as membership testers, dedicating themselves to answering the question "has this token appeared before in the context?" We identify these heads across four language models (GPT-2 small, medium, and large; Pythia-160M) and show that they form a spectrum of membership-testing strategies. Two heads (L0H1 and L0H5 in GPT-2 small) function as high-precision membership filters with false positive rates of 0-4% even at 180 unique context tokens -- well above the dhead=64d_\text{head} = 64 bit capacity of a classical Bloom filter. A third head (L1H11) shows the classic Bloom filter capacity curve: its false positive rate follows the theoretical formula p≈(1−e−kn/m)kp \approx (1 - e^{-kn/m})^k with R2=1.0R^2 = 1.0 and fitted capacity m≈5m \approx 5 bits, saturating by n≈20n \approx 20 unique tokens. A fourth head initially identified as a Bloom filter (L3H0) was reclassified as a general prefix-attention head after confound controls revealed its apparent capacity curve was a sequence-length artifact. Together, the three genuine membership-testing heads form a multi-resolution system concentrated in early layers (0-1), taxonomically distinct from induction and previous-token heads, with false positive rates that decay monotonically with embedding distance -- consistent with distance-sensitive Bloom filters. These heads generalize broadly: they respond to any repeated token type, not just repeated names, with 43% higher generalization than duplicate-token-only heads. Ablation reveals these heads contribute to both repeated and novel token processing, indicating that membership testing coexists with broader computational roles. The reclassification of L3H0 through confound controls strengthens rather than weakens the case: the surviving heads withstand the scrutiny that eliminated a false positive in our own analysis.

Figures & tables

HeadHit AttnBaselineSelectivity [95% CI]Miss%FP Ratiopp (Hit >> Base)
L0H10.4780.003146 ×\times [105, 201]0.0%0.08≪10−20\ll 10^{-20}
L0H50.4520.00674 ×\times [54, 101]0.0%0.01≪10−20\ll 10^{-20}
L1H110.4780.00953 ×\times [47, 59]0.0%0.29≪10−20\ll 10^{-20}
L3H0 †0.2770.00551 ×\times [42, 61]0.4%0.25≪10−20\ll 10^{-20}
Table 1: Candidate Bloom filter heads in GPT-2 small. Selectivity and FP ratio with bootstrap 95% CIs. All tests significant at Bonferroni-corrected α=3.47×10−4\alpha=3.47\times 10^{-4} . pp -values are asymptotic approximations from the Mann-Whitney UU test; we report them capped at <10−20<10^{-20} as the extreme tail is unreliable at this sample size. † L3H0 was reclassified as a prefix-attention head following confound controls (Section 4.3 ).
Figure 1: Bloom filter selectivity (hit attention / baseline attention) across all 144 heads in GPT-2 small. Four heads (highlighted) show selectivity >30×>30\times ; the remaining 140 heads are at or below 1×1\times . Note that the classification threshold is >3×>3\times (Section 3 ); the gap between the top four (51 ×\times –146 ×\times ) and the fifth-highest head (2.7 ×\times ) renders the threshold choice immaterial.
Figure 2: Hit, baseline, and synonym attention for Bloom filter heads vs. control heads. Bloom heads show extreme separation between hit and baseline conditions.
CategoryCountLayer RangeFunction
Bloom filter heads30–1“Is this token in context?”
Previous-token heads112–6“What came immediately before?”
Induction heads165–11“A B …\ldots A →\to B”
Table 2: Three functional categories of attention heads in GPT-2 small. Zero pairwise overlap. Bloom filter count reflects reclassification of L3H0 (see Section 4.3 ).
Figure 3: Three non-overlapping functional categories of attention heads in GPT-2 small. Bloom filter heads (red) concentrate in layers 0–3, previous-token heads (blue) in layers 2–6, and induction heads (green) in layers 5–11.
Unique tokensL1H11L0H1L0H5L3H0 †Controls
562.7%1.3%0.0%100%100%
2097.3%1.3%0.0%100%100%
50100%1.3%0.0%100%100%
100100%3.3%0.0%100%100%
180100%4.0%0.7%100%100%
Table 3: Capacity analysis with fixed sequence length (200 tokens). L1H11 shows the classic Bloom filter saturation curve. L0H1 and L0H5 maintain near-zero FP rates at all loads. L3H0 shows FP = 100% at all loads including n=5n=5 , indistinguishable from non-Bloom control heads, and is reclassified as a prefix-attention head.
Figure 4: Capacity analysis under controlled conditions (fixed sequence length = 200). Left: L1H11 shows the classic Bloom filter saturation curve ( R2=1.0R^{2}=1.0 , m≈5m\approx 5 bits), with theoretical Bloom filter overlay. L0H1 and L0H5 maintain near-zero FP rates across all loads. Right: L3H0 † (reclassified as prefix-attention head) shows FP = 100% at all load levels, indistinguishable from control head L5H5.
Figure 5: (a) Pairwise phi coefficients between Bloom heads; low values indicate largely independent FP decisions. (b) Distribution of how many Bloom heads fire false positives per probe token. The 0-head and 4-head categories are exact counts; the 1–3 head breakdown is estimated from the aggregate “mixed” category (see text).
Figure 6: Observed vs. independence-predicted false positive rates when AND-combining Bloom heads. At 1–3 heads, observed rates closely track predictions; at 4 heads, the observed rate substantially exceeds the independence prediction, indicating residual higher-order correlation.
Figure 7: Attention and false positive rate as a function of cosine similarity between probe and target token in GPT-2’s embedding space, measured across 100 target words. (a) Attention normalized to exact-repeat level. (b) False positive rate (fraction of probes exceeding 0.1 attention threshold). All four Bloom heads show monotonic decay, but with distinct bandwidths: L0H5 (ultra-precise) reaches noise floor by cosine 0.5, while L1H11 (broad) retains 17% FP rate at that level. Shaded region highlights the “active zone” where hash collisions occur.
HeadSelectivityMiss Rate (%)Repeat Pairs
L0H553.8 ×\times0.035,998
L0H149.3 ×\times0.035,998
L1H1122.6 ×\times0.035,998
L3H0 †15.4 ×\times0.835,998
Bloom mean35.3 ×\times0.2—
Control mean0.6 ×\times——
Table 4: Naturalistic validation on WikiText-103. Selectivity = mean repeated-token attention / mean non-repeated attention. Control heads are layer-matched non-Bloom heads. † Reclassified as prefix-attention head (Section 4.3 ).
ModelTotal HeadsStrong BF%Early/Mid/Late
GPT-2 Small (85M)1443 ∗2.1%3/0/0
GPT-2 Medium (302M)38430.8%3/0/0
GPT-2 Large (708M)720273.8%22/5/0
Pythia-160M14442.8%3/1/0
Table 5: Bloom filter heads across models. Early-layer concentration is universal. ∗ After reclassification of L3H0; originally 4 candidates identified.
 AblationRepeat Δ\Delta PPLNo-repeat Δ\Delta PPLInteraction
ZeroBloom heads+14.3% [+10.4, +18.5]−- 0.3% [ −- 3.4, +3.1]+14.6%
Layer-matched ctrlhigh variance across selections ( σ\sigma = 219%)
Induction (4 heads)+151.5%+212.2%−- 60.8%
MeanBloom heads+9.3% [+7.2, +11.4]+13.0% [+10.2, +16.1]−- 3.7%
Layer-matched ctrlinteraction: −- 0.5% ±\pm 1.7% (10 selections)
Induction (4 heads)+1.5% [ −- 0.3, +3.3]−- 0.1%+1.7%
Table 6: Perplexity change (%) upon head ablation with bootstrap 95% CIs. Interaction = repeat Δ\Delta −- no-repeat Δ\Delta . Induction comparison is head-count-matched (4 heads each).
More in this topic

Attention Head Analysis

Attention head analysis studies how individual Transformer heads route information, support computations, and affect model behavior.

See all 82 papers

Explore similar work

CardsList
Aug 11, 2026

Which Question Is Your Attention Metric Answering? Attention Rows as Compositional Data

Each row of a transformer's attention matrix is a probability distribution over tokens, and in trained models most of that probability lands on a single sink token, usually the first. Standard tools for comparing attention rows (cosine similarity, Jensen--Shannon divergence, Shannon entropy) therefore hinge on a choice papers rarely report: keep the sink, or drop it and renormalize. This choice can reverse conclusions. On ten pretrained models from five families, 17--47% of verdicts about which of two heads is more similar flip with the convention, and the most prominent structure in a standard BERT head-clustering pipeline is an artifact of it. The reason is that one-number summaries mix two questions: how much attention the sink takes, and how the rest is divided among the content tokens. Treating rows as compositional data separates them exactly: the Aitchison distance splits orthogonally into a sink term and a content term, entropy splits by an exact identity, and the content distance is characterized by invariances the transformer itself possesses. The separation matters in practice: most measured entropy collapse during training is the sink growing, not attention sharpening (30% of the drop at 70M parameters, 95% at 1B, 79% at 1.4B), and pruning heads with the wrong channel can inflate perplexity more than a hundredfold. We map where each convention is safe, test a frozen out-of-sample predictor (one confirmation, one abstention, one failure), and release code regenerating every number.

Marios Papamichalis, Regina Ruane

Human Nature Lab, Yale University, New Haven, CT 06511 · Department of Statistics and Data Science, The Wharton School, University of Pennsylvania, 3733 Spruce Street, Philadelphia, PA 19104-6340

Attention Head AnalysisTransformer InterpretabilityAttention EntropyAttention Sinks
AskPDF
May 12, 2026

Precision Tracked Transformer via Kalman Filtering, Kriging and Process Noise

The Transformer is the foundational building block of modern AI, yet offers no principled handling of uncertainty, which is prevalent in real applications: cold-start tokens with sparse histories in sequential recommendation, heterogeneous signal quality in language models, and attention sinks induced by unconstrained softmax. Every token is treated with uniform confidence. We show this uniformity is a degenerate case of our Bayesian Filtering Transformer (BFT): attention becomes precision-weighted kriging, the residual connection becomes a Kalman update with adaptive gain, and the FFN becomes a dynamics model propagating precision via a Jacobian--plus--process-noise rule. Observation precision comes from a parameter-free Restricted Maximum Likelihood (REML) estimator with a conjugate Bayesian prior. BFT replaces any Transformer layer with negligible overhead. On sequential recommendation, BFT applied to three major architectures yields significant gains on six benchmarks, with the largest improvements on cold-start users and rare items where uncertainty is highest. On supervised fine-tuning of large language models with noisy data, BFT improves robustness in two regimes: noisy supervision (token-label corruption in question answering) and noisy context (retrieval-augmented QA with real RAG distractors). A single principled modification -- restoring precision -- unlocks substantial headroom across both classical sequence-modeling and modern LLM regimes.

Bo Long, Deepak Agarwal, Jelena Markovic-Voronov +2

LinkedIn Core AI

Bayesian FilteringTransformerAttention MechanismsLanguage Model Robustness
AskPDF
Jun 6, 2026

Ablation-Reversible Heads Don't Transfer: A Stress Test for Mechanistic Role Claims in Transformers

In mechanistic interpretability, attention heads are commonly elevated to role claims (e.g., "this head represents addition") when they are necessary for a behavior, encode it linearly, and recover that behavior when restored after ablation. We show this evidence is insufficient: across three 7-8B instruction-tuned models and five computation families, heads passing all three checks routinely fail to transfer the computation when their activations are patched into a different prompt under matched controls. We introduce KID (Knowing / Intent / Doing), a role-assignment lens for attention heads, and pair it with a three-stage pipeline: capability-selective screening (CSS), singular value decomposition (SVD), and activation transduction under matched controls. Our results document a preliminary role taxonomy (including prompt-trajectory stabilizers, answer-side logit-bias heads, and soft computation-pattern carriers) and show that the same-answer control (a transduction target sharing the answer string but not the requested computation) is an underused check that exposes broad state transfer masquerading as semantic specificity.

Philip Quirke

Martian

Attention Head AnalysisMechanistic InterpretabilityCausal Interventions in Language ModelsActivation PatchingAttention Head Specialization
AskPDF