Observationally equivalent causal models can still disagree about what happens under intervention, because interventions create inputs that never occur in observational data. We introduce Interventional Separation Selection (ISS), which repeatedly queries the true system with an admissible intervention on which the surviving candidate models disagree, discards the candidates the outcome contradicts, and stops once no intervention within a cost bound separates the survivors. If the true system is among the candidates, this stopping condition certifies that every survivor agrees with it on every admissible intervention within the bound, a guarantee that no observational learner can give, however much data it sees. The stopping condition depends only on the survivors, so it can be checked without knowing the truth. For continuous variables the candidates form an infinite version space, and mixed-integer linear programs decide the stopping condition exactly over all of it, with agreement holding up to a tolerance. On a three-digit colored MNIST causal abstraction task in which ink hue tracks digit size, plain convolutional networks trained on examples reach zero held-out error, yet disagree with shape-based labels on 26% of single-digit edits, as often as hue-based labels do. Auditing the causal abstractions of networks observed only on such images, ISS certifies what each network perceives with 13.6 interventions per image on average, and each certificate, checked against every admissible intervention, holds whenever the network's true abstraction is among the candidates. When a network bypasses a unit that every candidate abstraction relies on, certificates covering interventions on that unit can be silently void, and twenty random validation interventions refute 69% of them.
Figures & tables
Figure 1: Observationally equivalent models can encode different mechanisms. iss selects a separating intervention (minimum cost by default), observes the environment’s answer, and eliminates inconsistent hypotheses. The loop certifies agreement only when no query within radius R separates any surviving pair in the full version space; with exact answers and the truth in the initial space, every survivor then has zero interventional risk within R .
Figure 2: iss with continuous variables. (a) An observed image, the high-level causal model and a digit drawn at five hues. (b) iss on this image for two networks, both perfect on observed images. Each step shows the intervention iss chose (edited digits framed; a hue edit sets the digit’s hue to the value shown) and the network’s output probability y . Both certificates hold within ε on every admissible intervention of cost at most 0.5 .
Figure 3: (a) Plain CNNs trained on N observed images: held-out error, and error on single-digit edits against the shape world; gray: the floor of Theorem 1 for the α=1 regime, whose missing cells the α<1 learners eventually observe. (b) Cost of certifying radius R with visual interventions, networks in the class. (c) The right digit’s percept in the hue reader of Figure 2 : what the log allows at each admissible hue, and what iss certified within R=0.5 of the observed hue (shaded).
Held-out
In
Intended
iss
Random
Random
Networks ( n )
accuracy
class
risk
int.
cost
sep.
probing
Correct
Trained, α=1 (3)
100.0%
100%
6%
7.6
2.5
3.3
34.4
100%
Trained, α=0.9 (3)
99.5%
93%
2%
13.4
4.0
5.3
43.1
100%
Trained, α=0.5 (3)
98.7%
97%
0%
21.1
6.1
8.3
38.0
100%
Planted (6)
99.2%
95%
3%
13.0
3.7
4.7
27.1
98%
Bypass (3)
100.0%
–
5%
7.9
2.7
3.3
35.4
100%
Table 1: Auditing 18 networks at R=0.5 (visual interventions unless marked; means over 10 observed images each). In class : images at which the true percepts lie in V0 . Intended risk : admissible interventions on which the intended abstraction is off by more than ε . iss : interventions and total cost; Random : total cost. Correct : certificates within ε of the network on every admissible intervention, as all are where the truth lies in V0 .
Appendix figures & tables13 assets
Supplementary material from the paper’s appendix.
Appendix
iss
random
random
probing
Networks
Family
R
∣QR∣
int.
cost
sep.
probing
correct
void
refutes
Trained, α=1
visual
0.5
210
7.6
2.47
3.27
34.4
100%
0%
0%
1.0
752
24.1
14.87
18.52
332.8
100%
0%
0%
white-box
0.5
486
7.6
2.47
3.14
80.3
100%
0%
0%
1.0
2224
24.2
14.92
17.82
839.8
100%
0%
0%
Trained, α=0.9
visual
0.5
221
13.4
4.00
5.34
43.1
100%
0%
0%
Appendix
Table 2: The continuous study, all networks, families and radii (means over observed images). ∣QR∣ is the number of admissible interventions; iss gives the number of interventions and their total cost; the next two columns give the cost of random separating queries and of random probing; then the fraction of minimum-cost certificates that are correct and void, and the fraction of random-probing runs that refute the class.
α=1
α=0.99
α=0.9
N
held-out
edits
held-out
edits
held-out
edits
100
5.0%
27.4%
6.3%
27.8%
14.3%
28.3%
300
0.0%
26.4%
0.3%
26.3%
3.9%
25.5%
1,000
0.0%
26.4%
0.1%
26.1%
1.4%
22.6%
3,000
0.0%
26.3%
0.0%
25.5%
1.1%
16.1%
10,000
0.0%
26.4%
0.1%
23.7%
0.9%
8.7%
Appendix
Table 3: Plain CNNs trained on N images with continuous hue (mean of three seeds): held-out error on observed images, and error against the shape world on every single-slot edit of cost at most 1 (a recolor to any hue of the grid, or a swap). The shape and color worlds disagree on 26.6% of these edits.
Figure 4: iss on MNIST. (a) An observed image and the high-level causal model; image edits set Ds and Cs , and the percepts Zs are the network’s one-bit units. (b) Two networks whose logs fit the same cells, audited on this image: the intervention iss chose at each step (edited digits framed), the network’s answer y and the number ∣V∣ of surviving candidates. Both certificates hold on all 21 interventions of cost at most 2 , checked on the networks.
Figure 5: (a) Plain CNNs trained on N observed images: held-out error, and error on single-variable interventions against the shape world, for three values of α ; the gray line is the floor of Theorem 1 for the α=1 regime; under α<1 the missing cells occur in the data and the floor vanishes with N . (b) Variables changed to certify radius R with visual interventions, over the 40 networks in the class. (c) Mechanism cells never seen in the auditor’s log after N images.
Held-out
In
Intended
Cost to certify
Networks ( n )
accuracy
Reads
class
risk
iss
optimum
random
Correct
Trained, α=1 (5)
100.0%
color
100%
0.52
9.2
7.0
26.2
100%
Trained, α=0.99 (5)
99.7%
shape (84%)
92%
0.06
9.0
7.1
26.5
99%
Trained, α≤0.9 (10)
98.6%
shape (98%)
100%
0.01
9.0
7.0
26.4
100%
Planted (20)
99.0%
as planted (98%)
100%
0.33
8.2
6.9
25.3
100%
Bypass (10)
100.0%
color
100%
0.52
9.0
7.0
26.4
100%
Appendix
Table 4: Auditing 50 networks at R=2 (visual interventions unless marked; means over 50 observed images). In class : images at which one of the 64 candidates matches the network. Intended risk : fraction of interventions of cost at most 2 that the intended abstraction mispredicts. Cost to certify : variables changed by iss , by a learner told the truth (optimum), and by random probing. Correct : certificates that hold on every intervention within the radius.
small, green
small, red
large, green
large, red
Percept reads
(D,C)=(0,0)
(0,1)
(1,0)
(1,1)
shape
0
0
1
1
color
0
1
0
1
and (both)
0
0
0
1
or (either)
0
1
1
1
Appendix
Table 5: The four completions of a percept’s table. The log fixes the two diagonal cells; the two off-diagonal cells are never observed.
Held-out
Percept
Truth in V0
Networks
n
accuracy
accuracy
p^
Reads
visual
white-box
Trained, α=1
5
100.0% (100.0%)
100.0%
0.00%
color
100%
100%
Trained, α=0.99
5
99.7% (99.7%)
99.8%
0.18%
shape (84%)
92%
92%
Trained, α≤0.9
10
98.6% (97.6%)
99.1%
0.82%
shape (98%)
100%
100%
Planted
20
99.0% (98.0%)
99.3%
0.65%
as planted (98%)
100%
100%
Bypass
10
100.0% (100.0%)
99.6%
0.38%
color
100%
0%
Appendix
Table 6: The audited networks. Held-out accuracy is on the observed regime (ink matches size) against the shape world’s label, as a mean with the minimum in parentheses; percept accuracy is the agreement of the bits with the digits’ sizes there; p^ is the fraction of logged percepts that disagree with the fitted cells. Reads summarises the truth’s tables over all observed images, and the last two columns give the fraction of observed images at which some member of V0 matches the network on every query of the visual and of the white-box family.
Figure 6: A bypass network audited with visual and interchange interventions on the image of Figure 4 . Yellow frames mark edited digits and blue frames patched bits. (a) Steps 1–4 are those of the color reader in Figure 4 ; at steps 5 and 6 the flipped pointer bit changes nothing, and the answers are misread as facts about the left digit. (b) Two admissible interventions within the radius on which every survivor is wrong.
ISS
info
random
random
correct
Networks
R
int.
cost
/cost
sep.
probing
opt.
k⋆
⌈log2C⌉
ISS / worst
Visual interventions
Trained, α=1
1
2.8
2.8
2.8
2.8
5.0
2.8
1.0
2.8
100% / 100%
2
6.0
9.2
9.2
11.4
26.2
7.0
2.0
6.0
100% / 100%
3
6.0
9.2
9.2
15.5
35.5
7.0
2.0
6.0
100% / 100%
Trained, α=0.99
1
2.9
2.9
2.9
2.9
5.0
2.9
1.0
2.9
100% / 100%
Appendix
Table 7: Certification at radius R , averaged over observed images. ISS is the minimum-cost rule (number of interventions and total cost); the next three columns give the total cost of the other rules; opt. is the optimum of a learner told the truth, k⋆ the truth-specific bound of Theorem 3 (b) and ⌈log2C⌉ the query bound (both averaged; blank where the truth is not in V0 ). The last two columns give the fraction of correct certificates for the minimum-cost rule and for the worst of the four rules.
Runs (all rules, radii, families, networks)
60,000
Runs whose truth lies in V0
53,496
truth eliminated (Theorem 2 (a))
0
halted without a certificate
0
certificate contradicted within the radius (Theorem 2 (c))
0
cost above (∣V0∣−1)R (Theorem 3 (a))
0
cost below the optimum of a learner told the truth
0
Appendix
Table 8: The claims of Theorems 2 and 3 checked on every run whose truth lies in V0 (all rules, radii, families and networks).
α=1
α=0.99
α=0.9
N
held-out
r=1
r=2
held-out
r=1
r=2
held-out
r=1
r=2
100
4.0%
0.48
0.52
2.1%
0.49
0.52
15.5%
0.43
0.47
300
0.0%
0.50
0.52
0.3%
0.50
0.52
7.6%
0.44
0.47
1,000
0.0%
0.50
0.52
0.3%
0.49
0.52
4.3%
0.37
0.38
3,000
0.0%
0.50
0.52
0.2%
0.48
0.51
2.6%
0.21
0.25
10,000
0.0%
0.50
0.52
0.2%
0.45
0.46
1.6%
0.08
0.11
Appendix
Table 9: Plain CNNs as observational learners (mean of three seeds). Held-out is the error on the observed regime; r=1,2 give the interventional risk against the shape world over all edits of cost at most r of 1,000 observed images. The floor of Theorem 1 is 0.25 at r=1 and 0.36 at r=2 ; the shape and color worlds disagree on 0.50 and 0.52 of these edits.
Truth
minimum-cost rule
random separating
Family
R
in V0
certified
correct
void
refuted
validation
void
validation
visual
1
100%
100%
100%
0%
0%
–
0%
–
2
100%
100%
100%
0%
0%
–
0%
–
3
100%
100%
100%
0%
0%
–
0%
–
white-box
1
0%
100%
49%
51%
0%
100%
51%
100%
2
0%
100%
0%
100%
0%
93%
100%
93%
Appendix
Table 10: Bypass networks. Truth in V0 : some member of the class matches the network on every query of the family. A certificate is void when it halts with agreement but a survivor contradicts the network within the radius; refuted runs eliminate every hypothesis during learning; validation is the fraction of void certificates refuted by 20 random admissible queries within the radius.
ISS
random
random
Networks
Family
R
int.
cost
opt.
sep.
probing
⌈log2C⌉
correct
Trained, α=1
visual
1
3.9
3.9
3.9
3.9
10.3
3.9
100%
2
10.0
16.1
12.3
19.7
118.4
10.0
100%
3
12.0
22.1
18.0
35.5
549.5
12.0
100%
white-box
1
3.9
3.9
3.9
3.9
24.3
3.9
100%
2
10.0
16.1
12.3
20.1
511.2
10.0
100%
Appendix
Table 11: The four-way pointer: two pointer digits select one of four value digits, so V0 has 212=4,096 members and the visual and white-box families have 298 and 3,535 queries of cost at most 3 . 20 networks, 500 observed images; columns as in Table 7 .
Mechanistic interpretability often evaluates explanations by intervening on a model: swapping hidden states, patching activations, ablating components, or comparing a compressed model to the original one. These experiments are usually summarized by a point estimate, even though the evaluation may be monitored while it runs or adapted toward suspected failures. This makes it hard to tell whether a reported fidelity or patching effect is a stable causal claim or a consequence of finite sampling and evaluation choices. We introduce Certified Interventional Fidelity (CIF), a statistical layer for interventional interpretability evaluations. CIF first writes the quantity being reported as a causal estimand: an expectation of a bounded score over a stated input distribution and a stated intervention distribution. It then provides confidence intervals and anytime-valid confidence sequences for this estimand, including under adaptive intervention sampling via bounded mixture importance weighting. We instantiate CIF with Hoeffding-style sequences and variance-adaptive betting sequences, the latter reducing certification cost by 10-30x in our experiments. On MNIST abstractions and GPT-2 Small IOI circuits, CIF certifies high-fidelity claims, shows when apparent method differences are not statistically supported, and makes sensitivity to the intervention distribution explicit.
Amir Asiaee
Department of Biostatistics, Vanderbilt University Medical Center, Nashville, TN 37232, USA
Interventional data is widely regarded as the gold standard for teaching models causal reasoning. We test this assumption in a fully controlled synthetic environment pitting observational correlation against causal effect, and find it fails instructively. In Simpson's-paradox worlds, where the two have systematically opposite signs, increasing the fraction of interventional samples in pretraining does not improve causal direction: the magnitude of the model's do()-response grows monotonically, yet its sign is copied from the observational context. What governs whether interventional evidence is used is not the training mixture but the evidence type present in the context at inference time. Under an identical training recipe, a purely observational context induces systematic sign reversal in 29/50 worlds, a mixed context in 19/50, while aligned interventional probes alone yield 41/50 correct. Erasing observational evidence from the context immediately releases the suppressed causal interpolation ability (ratio_true = +0.56); a four-state content manipulation shows the switch is content-mediated and graded. The suppression is stable across training seeds (11/11 strong reversals persist on a matched-protocol second seed) and robust as a rate at 0.93B parameters (31.8% vs. 6% reversals in the matched probe-only arm), even as absolute gains shrink four-fold. An external audit on CLadder exposes a learned positive-effect prior with a two-layer structure: sign-randomized retraining removes it in-distribution but not out-of-distribution. We summarize: the capability lives in the weights; the switch lives in the context, and activation patching localizes the switch to the middle layers' observational rows. We further quantify the sampling noise floor of probe-based causal evaluation and an evidence-averaging protocol that cuts sign errors from 26% to 9%.
Generative models can reproduce an observational distribution while encoding an incorrect causal structure. We study a sequential game in which a structural causal generator proposes observational and interventional distributions, while an adversarial experimentalist selects interventions intended to maximally falsify the generator. The discriminator is therefore not merely a real-versus-synthetic classifier: it is indexed by an intervention and tests whether the generator reproduces the corresponding post-intervention law. We introduce Adversarial Causal Intervention Falsification (ACIF), formulate oracle and implementable versions of the game, and distinguish three objects that are often conflated: observational fit, interventional equivalence over an admissible query class, and point identification of a structural causal model. For finite model and intervention classes, we prove: (i) an exact reduction of the adversarial objective to a worst-intervention integral probability metric; (ii) identification up to interventional equivalence, with point identification under a separating intervention family; (iii) existence of mixed-strategy equilibria; (iv) finite-sample uniform convergence and margin-based model-selection guarantees; and (v) a logarithmic elimination guarantee for a disagreement-driven sequential design under a balanced-separation condition. We also give a complete linear-Gaussian example in which two observationally indistinguishable causal directions are separated by a single well-chosen intervention. The framework clarifies what an adversarial causal discriminator can and cannot certify, and provides a principled bridge between causal generative modeling, active causal discovery, and experimental design.