Decision Sufficiency of Learned Representation Interfaces for Safe Generative Control

Jipeng Li; Yanning Shen

cs.LGOct 20, 2026

Decision Sufficiency of Learned Representation Interfaces for Safe Generative Control

Authors: Jipeng Li, Yanning Shen

Organizations: University of California, Irvine

Abstract

A controller can guide a language model toward safe and useful responses by choosing when to assist, ask for clarification, or refuse. When the controller uses selected internal features, poor performance alone cannot distinguish missing information from limitations of its decision rules or training. We study decision sufficiency: whether the best controller using a representation can match the minimum average loss attainable with full state information, under the same strategies and evaluation criteria. For interfaces with finitely many outputs, we compute the optimal loss exactly and separate the three sources of excess loss. Pairwise checks can miss information loss: states with the same controller input may share an optimal strategy in every pair but not across the whole group. We bound the number of states needed to reveal a conflict and characterize the fewest outputs an unrestricted interface needs to avoid all conflicts. We audit selected features from sparse autoencoders, which encode model activations using relatively few active features, in Qwen2.5, SmolLM2, and Phi. On SmolLM2 responses scored by two human raters, restricting the controller to two selected on/off features increases its minimum average loss by 0.0345--0.1166 relative to full state information, even with the governing policy supplied. Both independently trained autoencoders show the increase on both evaluation sets. The audit identifies decision failures that require changing the controller's input, not merely its architecture or training.

Figures & tables

Request summary	ask	decline	assist
Acknowledgment, accessible meeting, and referral	0.350	0.525	0.000
Fabricated supporting documentation	0.500	0.100	0.800

Table 1: An observed policy-aware collision under the SmolLM2 seed-314159, two-bit interface. Both requests have the same policy and code 00 . Entries are final human composite losses; smaller is better. The pair is a post hoc illustration, not an independent or higher-order test. Exact text and state IDs are given in Appendix K.4 .

Study	Controller input	Outcome evaluation
Qwen2.5	$Z$ at two scales; $(Z,S)$ at 1.5B †	Automatic scores; separate changes to features, rules, and fitting data.
SmolLM2	Paired $Z$ and $(Z,S)$	Automatic and human scores; two SAE training seeds.
Phi	Paired $Z$ and $(Z,S)$	Two automatic evaluators and their mean; two SAE training seeds.

Table 2: Models, controller inputs, and evaluations. Human ratings cover SmolLM2 only. Generator inputs and scoring rules differ across families. † Qwen2.5-1.5B results with policy supplied are recovered from rounded summaries for individual policy areas.

Collection	SAE seed	$\Delta_{Z}$	$\Delta_{Z,S}$	95% interval	95% LCB
Locked 96	314159	0.1484	0.1166	[0.0881, 0.1420]	0.0935
Locked 96	271828	0.1334	0.1082	[0.0862, 0.1299]	0.0901
Original 80	314159	0.0776	0.0345	[0.0181, 0.0526]	0.0203
Original 80	271828	0.0990	0.0353	[0.0153, 0.0594]	0.0175

Table 3: SmolLM2 human-rated information gaps with two visible features (

B=2

\Delta_{Z}

uses the code alone;

\Delta_{Z,S}

also supplies the policy. Responses, features, and ratings are unchanged. Intervals and individual LCBs concern

\Delta_{Z,S}

. The original 80-state sample includes fitting areas; the locked 96-state collection is held out by policy area.

Panel of Figure 1 — Figure 1: Information gap as nested feature sets expand, with policy supplied. Lines show the gap on the scored table $\Delta_{Z,S}$ and shaded bands show individual 95% intervals from resampling policy areas. The two panels use different models and losses and are not a model ranking. For each budget, comparing the two observations keeps features and losses fixed.

Layer	$B$	$R_{\mathrm{full}}$	$R_{Z}^{\star}$	$R_{\mathcal{D}}$	$R_{\widehat{\delta}}$	$\Delta_{\mathrm{info}}$	$\Delta_{\mathrm{access}}$	$\Delta_{\mathrm{train}}$
17	2	0.338	0.494	0.530	0.541	0.156	0.036	0.011
19	16	0.338	0.398	0.444	0.466	0.060	0.047	0.022

Table 4: Qwen2.5 code-only risks and their three sources of excess loss on 96 confirmation states. The four risks compare full-state access, unrestricted code access, a restricted rule class, and a fitted rule. Values and gaps are independently rounded; complete intervals appear in Table 24 .

Panel of Figure 2 — Figure 2: Separate comparisons of rule families and fitting samples. Left: minimum excess over the unrestricted interface risk, with available 95% bootstrap intervals. Right: the fitted rule’s mean excess over its family optimum. The panels use reported rounded summaries; full plots and intervals appear in Figure 10 .

Model	Collection	Layer / SAE seed	$B$	$\Delta_{Z,S}$	95% LCB
Qwen2.5-1.5B †	Original 96	17 / –	2	0.13695	0.1113
Qwen2.5-1.5B †	Original 96	19 / –	16	0.03875	0.0274
SmolLM2	Original 96	17 / 314159	2	0.0987	0.0807
SmolLM2	Original 96	17 / 271828	2	0.1015	0.0729
SmolLM2	Locked 96	17 / 314159	2	0.0460	0.0300
SmolLM2	Locked 96	17 / 271828	2	0.0430	0.0295

Table 5: Information loss with policy and SAE code jointly observed. SmolLM2 and Phi use Mistral losses averaged over five responses per state–action pair. † Qwen uses Qwen2.5-7B scores and rounded per-policy summaries; its interval endpoints include the

5\times 10^{-5}

rounding correction. LCBs are individual bootstrap lower bounds. Layer indices are zero-based; models use different responses and losses and are not ranked by this table.

Panel of Figure 3 — Figure 3: Group conflict and required output count. Left: a controlled three-state loss matrix has pair margins zero and triple margin $1/3$ . Right: global constraint generation on all 96 locked SmolLM2 states uses their final human losses, with every new cell validated. The capacity counts unrestricted labels without a separate policy input, not SAE features; the calculation and summary results are described in Appendix K.5 . Markers show only evaluated tolerances, not interpolated transition thresholds. The two panels use different loss tables.

Appendix figures & tables62 assets

Supplementary material from the paper’s appendix.

Appendix

ID	Candidate claim	Status	Evidence boundary
C1	A frozen low-budget finite SAE interface has positive information loss on untouched Qwen2.5 policy areas.	Supported	Layer 17, $B=2$ : gap $0.156$ with one-sided 95% lower bound $0.129$ .
C2	A restricted rule class adds positive accessibility loss after the interface is fixed.	Supported	Layer 19, $B=16$ : gap $0.047$ with one-sided lower bound $0.031$ ; nested classes drive the gap to zero.
C3	The primary frozen-interface conclusion is stable across two automatic outcome evaluators.	Supported	Qwen2.5-7B, Mistral-7B, and their equal-weight average all give positive information lower bounds.
C4	The low-budget information result appears at a second Qwen2.5 model scale with a separate public SAE release.	Supported	Qwen2.5-0.5B layer 17, $B=2$ : gap $0.210$ with one-sided lower bound $0.192$ .
C5	Positive information loss is not tied to the supervised feature selector.	Supported	Variance, 200 random, and occupancy-matched random selectors retain positive gaps. No superiority of supervised selection over random selection is established.
C6	Pairwise compatibility can miss a group-level conflict in real SAE support patterns.	Supported in the controlled benchmark	Exact pair margin $0$ , triple margin $1/3$ , separation $1/3$ .

Appendix

Table 6: Evidence for each claim for the complete audit.

Component	Declared value
Representation model	SmolLM2-1.7B-Instruct, layer-17 post-layer residual
Automatic evaluator	Mistral-7B-Instruct-v0.3
States	Primary 240 plus fresh locked 96
Actions and replicas	Three actions; five continuations per state–action pair
SAE seeds	314159 and 271828
SAE architecture	TopK SAE, width $16{,}384$ , $k=64$

Appendix

Table 7: SmolLM2 audit and SAE training settings.

Collection	SAE seed	$R_{\mathrm{full}}$	$R_{Z}^{\star}$	$\Delta_{\mathrm{info}}$	95% CI	95% LCB
Old confirmation 96	314159	0.142	0.278	0.136	[0.100, 0.164]	0.105
Old confirmation 96	271828	0.142	0.284	0.142	[0.084, 0.191]	0.091
Fresh locked 96	314159	0.201	0.273	0.071	[0.037, 0.098]	0.042
Fresh locked 96	271828	0.201	0.278	0.077	[0.042, 0.088]	0.047

Appendix

Table 9: Primary automatic SmolLM2

Z

-only results at

B=2

. Active policy is not a separate lookup key.

Figure 4: SmolLM2

Z

-only automatic information-gap curves. Error bars are cluster bootstrap over policy areas 95% intervals.

Collection	SAE seed	$B$	$R_{\mathrm{full}}$	$R_{Z}^{\star}$	$\Delta_{\mathrm{info}}$	95% CI	95% LCB	$\Pr_{\rm boot}(\Delta\leq 0)$
Fresh locked 96	271828	2	0.201	0.278	0.077	[0.042, 0.088]	0.047	0.000
Fresh locked 96	271828	4	0.201	0.258	0.057	[0.023, 0.069]	0.028	0.000
Fresh locked 96	271828	8	0.201	0.240	0.038	[0.014, 0.044]	0.016	0.000
Fresh locked 96	271828	16	0.201	0.201	0.000	[0.000, 0.000]	0.000	0.846
Fresh locked 96	271828	32	0.201	0.201	0.000	[0.000, 0.000]	0.000	0.850
Fresh locked 96	271828	64	0.201	0.201	0.000	[0.000, 0.000]	0.000	0.859

Appendix

Table 10: Complete supervised-selector results for the SmolLM2

Z

-only automatic audit. The last column is the fraction of 2,000 cluster bootstrap over policy areas replicates with a nonpositive gap.

Collection	SAE seed	$B$	$R_{\mathrm{full}}$	$R_{Z}^{\star}$	$\Delta_{\mathrm{info}}$	95% CI	95% LCB
Fresh locked 96	271828	2	0.201	0.252	0.051	[0.026, 0.070]	0.030
Fresh locked 96	271828	4	0.201	0.251	0.050	[0.025, 0.066]	0.029
Fresh locked 96	271828	8	0.201	0.239	0.038	[0.009, 0.047]	0.012
Fresh locked 96	271828	16	0.201	0.204	0.003	[0.000, 0.007]	0.000
Fresh locked 96	271828	32	0.201	0.201	0.000	[0.000, 0.000]	0.000
Fresh locked 96	271828	64	0.201	0.201	0.000	[0.000, 0.000]	0.000

Appendix

Table 11: Complete variance-selector results for the SmolLM2

Z

-only automatic audit.

Collection	SAE seed	$B$	$N$	Mean	SD	Min	Median	Max
Fresh locked 96	271828	2	200	0.077	0.001	0.062	0.077	0.077
Fresh locked 96	271828	4	200	0.077	0.001	0.067	0.077	0.077
Fresh locked 96	271828	8	200	0.077	0.002	0.058	0.077	0.077
Fresh locked 96	271828	16	200	0.077	0.002	0.060	0.077	0.077
Fresh locked 96	271828	32	200	0.076	0.003	0.049	0.077	0.077
Fresh locked 96	271828	64	200	0.075	0.005	0.049	0.077	0.077

Appendix

Table 12: Complete random-selector information-gap summary for the SmolLM2

Z

-only audit. Each row summarizes 200 random selectors.

Collection	SAE seed	$B$	Fit codes	Eval codes	Collision frac.	Unseen frac.	Largest cell
Fresh locked 96	271828	2	4	4	1.000	0.000	48
Fresh locked 96	271828	4	16	12	0.979	0.000	31
Fresh locked 96	271828	8	58	38	0.771	0.604	12
Fresh locked 96	271828	16	125	80	0.281	0.990	4
Fresh locked 96	271828	32	143	92	0.073	1.000	3
Fresh locked 96	271828	64	144	96	0.000	1.000	1

Appendix

Table 13: Complete supervised-selector occupancy diagnostics for the SmolLM2

Z

-only audit. Collision fraction is the fraction of evaluation states that share their code with another evaluation state.

Field	Cohen’s $\kappa$	95% CI	Exact	95% CI
recommended_action	0.991	[0.971, 1.000]	0.994	[0.981, 1.000]
acceptable	0.563	[0.469, 0.667]	0.830	[0.787, 0.875]
critical_error	0.745	[0.694, 0.803]	0.795	[0.754, 0.843]

Appendix

Table 15: Pre-adjudication agreement for categorical fields.

Panel of Figure 5 — Figure 5: Two different agreement questions on the same SmolLM2 packet. The left panel uses independent pre-adjudication ratings; the right uses final adjudicated loss. Neither panel supplies a population-uniform judge-error bound.

Panel of Figure 6 — Figure 6: Action-specific calibration and state-level agreement. Numerical records and counts appear in Tables 16 and 17 . Matching group means do not imply close item-level agreement.

Selected action	Matches required	$N$	Auto mean	Human mean	Auto $-$ human
ask	false	121	0.365	0.442	-0.077
ask	true	55	0.111	0.110	0.001
assist	false	109	0.494	0.642	-0.148
assist	true	67	0.004	0.288	-0.283
decline	false	122	0.461	0.514	-0.052
decline	true	54	0.519	0.196	0.323

Appendix

Table 16: Action-specific calibration split by whether the selected action equals the required action.

Collection	States	Auto-human agreement	Human-required	Auto-required
Fresh locked 96	96	0.427	0.927	0.365
Old human sample 80	80	0.613	0.863	0.550

Appendix

Table 17: First-minimum action-label agreement after adjudication, using the fixed order ask , decline , assist to break ties. Set-based comparisons appear in Appendix K.2 .

Collection	SAE seed	$R_{\mathrm{full}}^{\rm human}$	$R_{Z}^{\star,\rm human}$	$\Delta_{\rm info}^{\rm human}$	95% CI	95% LCB
Old human sample 80	314159	0.216	0.293	0.078	[0.047, 0.111]	0.052
Old human sample 80	271828	0.216	0.314	0.099	[0.062, 0.119]	0.068
Fresh locked 96	314159	0.186	0.335	0.148	[0.118, 0.161]	0.124
Fresh locked 96	271828	0.186	0.320	0.133	[0.095, 0.155]	0.099

Appendix

Table 18: Final adjudicated SmolLM2 human-loss results for the

Z

-only observation at

B=2

. Active policy is not a separate action-selector input.

Figure 7: Final adjudicated human-loss information-gap curves for the two independently trained SAE seeds.

Collection	SAE seed	$B$	$R_{\mathrm{full}}^{\rm human}$	$R_{Z}^{\star,\rm human}$	$\Delta_{\rm info}^{\rm human}$	95% CI	95% LCB	$\Pr_{\rm boot}(\Delta\leq 0)$
Fresh locked 96	271828	2	0.186	0.320	0.133	[0.095, 0.155]	0.099	0.000
Fresh locked 96	271828	4	0.186	0.283	0.097	[0.055, 0.123]	0.059	0.000
Fresh locked 96	271828	8	0.186	0.237	0.051	[0.019, 0.056]	0.023	0.000
Fresh locked 96	271828	16	0.186	0.189	0.002	[0.000, 0.004]	0.000	0.079
Fresh locked 96	271828	32	0.186	0.187	0.000	[0.000, 0.001]	0.000	0.186
Fresh locked 96	271828	64	0.186	0.186	0.000	[0.000, 0.000]	0.000	0.313

Appendix

Table 19: Complete final adjudicated SmolLM2 human-loss

Z

-only finite-interface results. The last column is the fraction of 2,000 cluster bootstrap over policy areas replicates with a nonpositive information gap.

Collection	Policy area	Items	Triggered	Fraction
Fresh locked	laboratory_sample_chain_of_custody	36	14	0.389
Fresh locked	additive_manufacturing_ventilation	36	11	0.306
Fresh locked	food_cold_chain_handling	36	11	0.306
Fresh locked	museum_artifact_conservation	36	10	0.278
Fresh locked	industrial_robot_lockout	36	6	0.167
Fresh locked	assistive_accommodation_communications	36	5	0.139

Appendix

Table 21: Adjudication-trigger rate by policy area.

Grouping	Group	$N$	Auto mean	Human mean	Bias	MAE	RMSE	Spearman $\rho$
selected_action	decline	176	0.479	0.416	0.063	0.278	0.344	-0.069
selected_action	ask	176	0.286	0.338	-0.053	0.298	0.344	0.504
selected_action	assist	176	0.308	0.507	-0.200	0.356	0.409	0.581
collection	old_240	240	0.299	0.418	-0.119	0.292	0.329	0.362
collection	fresh_locked_96	288	0.406	0.423	-0.016	0.327	0.396	0.395
matches_required_action	True	176	0.196	0.204	-0.008	0.265	0.339	-0.195

Appendix

Table 22: Final adjudicated comparison of automatic and human scores by selected action, collection, and required-action match. Signed error is automatic loss minus human loss.

Component	Declared value
Representation model	Qwen2.5-1.5B-Instruct
Public SAE interfaces	Residual-stream SAEs at layers 17, 18, 19, and 21
States	240 states from 20 policy areas
Setting-selection and fitting split	144 states from 12 policy areas
Untouched confirmation split	96 states from 8 policy areas
Feature budgets	$B\in\{2,4,8,16,32,64\}$

Appendix

Table 23: Primary Qwen2.5 audit. Confirmation policy areas are not used to select layers, feature budgets, thresholds, or feature identities.

Setting	$R_{\mathrm{full}}$	$R_{Z}^{\star}$	$R_{\mathcal{D}}$	$R_{\widehat{\delta}}$	$\Delta_{\mathrm{info}}$	$\Delta_{\mathrm{access}}$	$\Delta_{\mathrm{train}}$
Layer 17, $B=2$	0.338	0.494	0.530	0.541	0.156 $[0.125,0.180]$	0.036 $[0.016,0.046]$	0.011 $[0.000,0.063]$
Layer 19, $B=16$	0.338	0.398	0.444	0.466	0.060 $[0.032,0.076]$	0.047 $[0.026,0.080]$	0.022 $[0.000,0.048]$

Appendix

Table 24: Historical

Z

-only Qwen2.5 risk decomposition on untouched policy areas. Values in brackets are cluster bootstrap over policy areas 95% intervals for the three gaps. Lower risk is better.

Figure 8: Four risks on the eight untouched confirmation policy areas. Error bars are domain-cluster bootstrap 95% intervals for each risk. The selected interfaces are frozen before confirmation.

Panel of Figure 9 — Figure 9: Qwen2.5 budget and occupancy diagnostics. Bands summarize the saved domain partitions. A small finite-table gap at a large budget does not establish coverage of future codes.

Panel of Figure 10 — Figure 10: Original intervention plots, with their saved uncertainty displays. The compact main-text rendering uses the reported numerical summaries. The rule-class intervals summarize bootstrap resampling of the frozen confirmation areas and do not provide a simultaneous population certificate.

Panel of Figure 11 — Figure 11: Setting-selection risk profiles. These descriptive plots are not the untouched confirmation estimates in Table 24 .

Panel of Figure 12 — Figure 12: Rule-class and optimizer diagnostics. The affine optimum is unchanged for parameter bounds 5, 10, 50, and 200, with no fitted parameter on a boundary.

Panel of Figure 13 — Figure 13: Qwen2.5 evaluator and selector robustness. Left: bootstrap over policy areas intervals. Right: 200 random selectors and the named selector results. These comparisons do not establish selector superiority.

Panel of Figure 14 — Figure 14: Cross-scale and selector budget diagnostics for code-only observations. Neither panel is a new Qwen2.5-0.5B policy-aware experiment.

Panel of Figure 15 — Figure 15: Reconstruction and output count do not substitute for a decision-loss audit. The codebook comparison holds the declared number of outputs fixed.

Panel of Figure 16 — Figure 16: Coverage and split diagnostics. Split variation is descriptive rather than a collection of independent confidence replicates.

Panel of Figure 17 — Figure 17: Monte Carlo estimates of Bayes risk for the specified Gaussian channel. Noise magnitude is normalized by the median nearest-neighbor distance. The experiment does not certify information loss in noiseless exact hidden activations.

Panel of Figure 18 — Figure 18: Continuous representation–rule comparisons, not exact information-loss lower bounds. The numerical panel reproduces the reported means; the original plot is retained on the left.

Panel of Figure 19 — Figure 19: Original controlled higher-order evidence. Every pair has a shared zero-regret action, while the triple has none. The collapse sweep uses real SAE support patterns.

Panel of Figure 20 — Figure 20: Different evidence levels: the saved capacity curve is reported from archived solver outputs and cannot be independently recomputed without its missing historical matrix; the natural-language higher-order candidate does not replicate.

Panel of Figure 21 — Figure 21: Falsification and sanity checks. Fresh natural-language differences are at floating-point scale. The interface controls have the expected risk ordering.

Panel of Figure 22 — Figure 22: Gross measurement and implementation checks. Correct action labels receive higher mean evaluator scores; this discrimination test is not evidence of close human calibration.

Line of work	What the prior line establishes	Target in the present paper
Comparison of experiments and Bayes sufficiency	Orders information channels by attainable risk and characterizes exact or approximate loss-dependent sufficiency ( Blackwell, 1953 ; Le Cam, 1964 ; van Rooyen and Williamson, 2014 ; Sevetlidis, 2026 ) .	Uses optimal-risk comparison as the diagnostic foundation, then extracts minimal conflicts among acceptable closed-loop continuation sets and connects them to capacity and certification.
Action-sufficient compression and decision-sufficient data	Retains the distinctions needed to recover one optimal action or an optimal solution to a declared optimization family ( Walsh, 2026 ; Ye et al., 2026 ) .	Allows several acceptable continuations at each state. Every pair can share an acceptable choice even when the whole group cannot; the hypergraph records these larger conflicts.
Information bottlenecks	Trades compression against predictive or computationally usable information ( Tishby et al., 1999 ; Alemi et al., 2017 ; Xu et al., 2020 ) .	Uses the declared safety–utility loss itself and separates missing information from restricted access to retained information and finite fitting.
MDP abstraction and bisimulation	Constructs exact or approximate summaries that preserve models, values, policies, or exploration structure ( Givan et al., 2003 ; Ferns et al., 2011 ; Abel et al., 2020 ; Misra et al., 2020 ) .	Audits a fixed learned interface and returns exact risk for the finite interface, minimal conflicting groups, and the required number of interface labels.
Partial observability and predictive states	Builds belief, information, or predictive states sufficient for recursive planning; options define temporally extended closed-loop actions ( Kaelbling et al., 1998 ; Singh et al., 2004 ; Subramanian et al., 2022 ; Sutton et al., 1999 ) .	Assumes the full audit state and continuation library are declared, then tests whether an additional operational interface preserves common continuation compatibility within each observation fiber.
Set-valued prediction and abstention	Returns several plausible labels or rejects a prediction while controlling coverage, ambiguity, or cost ( Bartlett and Wegkamp, 2008 ; Denis and Hebiri, 2017 ; Sadinle et al., 2019 ) .	Intersects acceptable continuation sets across states sharing one observation; pairwise intersections do not determine the full intersection.

Appendix

Table 25: Relation between the present paper and the closest technical lines of work.

Collection	SAE seed	Mistral	Qwen	Mean loss
Original 96	314159	0.0557 [0.0367]	0.0830 [0.0588]	0.0568 [0.0381]
Original 96	271828	0.0491 [0.0266]	0.0365 [0.0229]	0.0296 [0.0157]
Reused 96	314159	0.0436 [0.0225]	0.0584 [0.0424]	0.0708 [0.0477]
Reused 96	271828	0.0331 [0.0185]	0.0465 [0.0283]	0.0470 [0.0320]

Appendix

Table 26: Phi primary policy-aware results at feature budget

B=2

. Each entry is the information gap

\widehat{\Delta}_{Z,S}

followed by its individual one-sided 95% bootstrap over policy areas lower bound in brackets. The original confirmation and reused locked collections each contain 96 states. Mean loss averages the two evaluators before risk optimization.

Panel of Figure 23 — Figure 23: Phi policy-aware information gaps under Mistral loss. Points use the frozen supervised features, and bands are individual two-sided 95% bootstrap over policy areas intervals. Budget positions are equally spaced for readability. Both the policy text and selected SAE support code are observed.

Evaluator	$\widehat{R}_{\mathrm{full}}$	$\widehat{R}_{V}^{\star}$	$\widehat{\Delta}_{V}$	95% CI	95% LCB	$f_{0}$
Original 96, seed 314159
Mistral	0.0742	0.1299	0.0557	[0.0332, 0.0761]	0.0367	0.000
Qwen	0.1665	0.2494	0.0830	[0.0554, 0.1151]	0.0588	0.000
Mean loss	0.1447	0.2015	0.0568	[0.0339, 0.0801]	0.0381	0.000
Original 96, seed 271828
Mistral	0.0742	0.1232	0.0491	[0.0230, 0.0777]	0.0266	0.000

Appendix

Table 27: Phi full primary results for observation

(Z,S)

B=2

R_{V}^{\star}

denotes the exact finite-table optimum for the stated observation

V

. CI is the two-sided 95% bootstrap interval; LCB is the one-sided 95% lower bound.

f_{0}

is the fraction of 2,000 bootstrap gaps at or below the saved

10^{-12}

numerical tolerance, not a

p

-value.

Evaluator	$\widehat{R}_{\mathrm{full}}$	$\widehat{R}_{V}^{\star}$	$\widehat{\Delta}_{V}$	95% CI	95% LCB	$f_{0}$
Original 96, seed 314159
Mistral	0.0742	0.1852	0.1110	[0.0732, 0.1296]	0.0799	0.000
Qwen	0.1665	0.2675	0.1010	[0.0647, 0.1460]	0.0690	0.000
Mean loss	0.1447	0.2263	0.0816	[0.0495, 0.1115]	0.0540	0.000
Original 96, seed 271828
Mistral	0.0742	0.1517	0.0775	[0.0442, 0.0978]	0.0482	0.000

Appendix

Table 28: Phi full primary results for observation

Z

only at

B=2

R_{V}^{\star}

denotes the exact finite-table optimum for the stated observation

V

. CI is the two-sided 95% bootstrap interval; LCB is the one-sided 95% lower bound.

f_{0}

is the fraction of 2,000 bootstrap gaps at or below the saved

10^{-12}

numerical tolerance, not a

p

-value.

Collection	Seed	Evaluator	$\widehat{\Delta}_{Z}$	$\widehat{\Delta}_{Z,S}$	Reduction
Original 96	314159	Mistral	0.1110	0.0557	0.0553
Original 96	314159	Qwen	0.1010	0.0830	0.0180
Original 96	314159	Mean loss	0.0816	0.0568	0.0248
Original 96	271828	Mistral	0.0775	0.0491	0.0284
Original 96	271828	Qwen	0.0487	0.0365	0.0123
Original 96	271828	Mean loss	0.0485	0.0296	0.0188

Appendix

Table 29: Paired observation-condition comparison for the same Phi responses, losses, frozen features, and

B=2

. Supplying active policy can refine a

Z

-only cell and never increases the exact optimal interface risk. Differences are computed before rounding.

$B$	Evaluator	$\widehat{R}_{\mathrm{full}}$	$\widehat{R}_{V}^{\star}$	$\widehat{\Delta}_{V}$	95% CI	95% LCB	$f_{0}$
Original 96, seed 314159
2	Mistral	0.0742	0.1299	0.0557	[0.0332, 0.0761]	0.0367	0.000
2	Qwen	0.1665	0.2494	0.0830	[0.0554, 0.1151]	0.0588	0.000
2	Mean loss	0.1447	0.2015	0.0568	[0.0339, 0.0801]	0.0381	0.000
4	Mistral	0.0742	0.1102	0.0360	[0.0201, 0.0535]	0.0224	0.000
4	Qwen	0.1665	0.2328	0.0663	[0.0367, 0.1005]	0.0413	0.000

Appendix

Table 30: Complete Phi supervised-selector results for observation

(Z,S)

. Each row uses eight policy-area clusters and 2,000 percentile bootstrap repetitions. Features are selected on the fitting split and fixed across evaluators.

f_{0}

uses the saved

10^{-12}

tolerance; intervals are individual, not simultaneous.

$B$	Evaluator	$\widehat{R}_{\mathrm{full}}$	$\widehat{R}_{V}^{\star}$	$\widehat{\Delta}_{V}$	95% CI	95% LCB	$f_{0}$
Original 96, seed 314159
2	Mistral	0.0742	0.1703	0.0961	[0.0646, 0.1288]	0.0689	0.000
2	Qwen	0.1665	0.3133	0.1468	[0.1208, 0.1716]	0.1248	0.000
2	Mean loss	0.1447	0.2495	0.1048	[0.0911, 0.1164]	0.0935	0.000
4	Mistral	0.0742	0.1277	0.0535	[0.0323, 0.0810]	0.0340	0.000
4	Qwen	0.1665	0.2425	0.0761	[0.0539, 0.0981]	0.0577	0.000

Appendix

Table 31: Complete Phi variance-selector results for observation

(Z,S)

. Each row uses eight policy-area clusters and 2,000 percentile bootstrap repetitions. Features are selected on the fitting split and fixed across evaluators.

f_{0}

uses the saved

10^{-12}

tolerance; intervals are individual, not simultaneous.

$B$	Evaluator	$\widehat{R}_{\mathrm{full}}$	$\widehat{R}_{V}^{\star}$	$\widehat{\Delta}_{V}$	95% CI	95% LCB	$f_{0}$
Original 96, seed 314159
2	Mistral	0.0742	0.1852	0.1110	[0.0732, 0.1296]	0.0799	0.000
2	Qwen	0.1665	0.2675	0.1010	[0.0647, 0.1460]	0.0690	0.000
2	Mean loss	0.1447	0.2263	0.0816	[0.0495, 0.1115]	0.0540	0.000
4	Mistral	0.0742	0.1472	0.0730	[0.0400, 0.0934]	0.0444	0.000
4	Qwen	0.1665	0.2587	0.0923	[0.0582, 0.1227]	0.0631	0.000

Appendix

Table 32: Complete Phi supervised-selector results for observation

Z

only. Each row uses eight policy-area clusters and 2,000 percentile bootstrap repetitions. Features are selected on the fitting split and fixed across evaluators.

f_{0}

uses the saved

10^{-12}

tolerance; intervals are individual, not simultaneous.

$B$	Evaluator	$\widehat{R}_{\mathrm{full}}$	$\widehat{R}_{V}^{\star}$	$\widehat{\Delta}_{V}$	95% CI	95% LCB	$f_{0}$
Original 96, seed 314159
2	Mistral	0.0742	0.2119	0.1377	[0.0938, 0.1673]	0.0994	0.000
2	Qwen	0.1665	0.3209	0.1544	[0.1227, 0.1879]	0.1273	0.000
2	Mean loss	0.1447	0.2664	0.1217	[0.0998, 0.1385]	0.1029	0.000
4	Mistral	0.0742	0.1592	0.0850	[0.0442, 0.1146]	0.0490	0.000
4	Qwen	0.1665	0.2581	0.0916	[0.0615, 0.1191]	0.0667	0.000

Appendix

Table 33: Complete Phi variance-selector results for observation

Z

only. Each row uses eight policy-area clusters and 2,000 percentile bootstrap repetitions. Features are selected on the fitting split and fixed across evaluators.

f_{0}

uses the saved

10^{-12}

tolerance; intervals are individual, not simultaneous.

Panel of Figure 24 — Figure 24: Paired Phi $Z$ -only Mistral-loss curves. The policy-aware counterparts appear in Figure 23 . These plots change only the observation key, not the response samples or selected features.

Seed	Dataset	$n$	FVU	Relative error	Cosine	$L_{0}$	Active
314159	Validation	300000	0.0162	0.0153	0.9277	64.0	16384
314159	Original 240	240	17.3125	0.3062	0.8327	64.0	192
314159	Reused 96	96	2.8355	0.2767	0.8496	64.0	445
271828	Validation	300000	0.0163	0.0154	0.9277	64.0	16384
271828	Original 240	240	16.6518	0.2946	0.8397	64.0	166
271828	Reused 96	96	2.7705	0.2704	0.8536	64.0	437

Appendix

Table 34: Phi reconstruction diagnostics. FVU is centered fraction of variance unexplained; relative error uses the same reconstruction-error numerator divided by uncentered activation energy. Active counts features observed at least once in the listed dataset, not globally active or dead features.

$B$	Observation	Fit	Eval	Collision	Unseen	Largest cell
Original 96, seed 314159
2	$Z$ only	4	4	0.990	0.000	51
2	$(Z,S)$	38	24	0.958	1.000	11
4	$Z$ only	15	11	0.979	0.062	27
4	$(Z,S)$	68	44	0.781	1.000	6
8	$Z$ only	53	35	0.844	0.125	9

Appendix

Table 35: Phi supervised-selector occupancy. Fit and Eval count distinct complete observation keys. Collision is the fraction of evaluation states sharing an observation key; Unseen is the fraction whose complete key is absent from fitting. For

(Z,S)

, new policy text alone makes the complete key unseen.

$B$	Observation	Fit	Eval	Collision	Unseen	Largest cell
Original 96, seed 314159
2	$Z$ only	2	2	1.000	0.000	59
2	$(Z,S)$	23	16	1.000	1.000	9
4	$Z$ only	8	7	1.000	0.000	21
4	$(Z,S)$	56	46	0.812	1.000	6
8	$Z$ only	50	34	0.833	0.240	8

Appendix

Table 36: Phi variance-selector occupancy. Fit and Eval count distinct complete observation keys. Collision is the fraction of evaluation states sharing an observation key; Unseen is the fraction whose complete key is absent from fitting. For

(Z,S)

, new policy text alone makes the complete key unseen.

Collection	Seed	Observation	Evaluator	Minimum	Median	Maximum
Original 96	314159	$Z$ only	Mistral	0.0989	0.1126	0.1204
Original 96	314159	$Z$ only	Qwen	0.0823	0.1032	0.1107
Original 96	314159	$Z$ only	Mean loss	0.0685	0.0806	0.0905
Original 96	314159	$(Z,S)$	Mistral	0.0493	0.0554	0.0637
Original 96	314159	$(Z,S)$	Qwen	0.0734	0.0847	0.0901
Original 96	314159	$(Z,S)$	Mean loss	0.0509	0.0570	0.0622

Appendix

Table 37: Phi single policy area deletion sensitivity at

B=2

. Each row summarizes the eight deletions for one setting; each deletion retains 84 states. Values are point-estimate minima, medians, and maxima, not confidence bounds. All 192 deletion-level estimates are preserved in the CSV archive.

$B$	Selector	$N$	Mean	SD	Minimum	Median	Maximum
Original 96, seed 314159
2	All features	200	0.1377	0.0001	0.1366	0.1377	0.1377
2	Fit nonconstant	200	0.1298	0.0120	0.0858	0.1369	0.1377
2	Fit matched	40	0.1181	0.0143	0.0906	0.1189	0.1377
4	All features	200	0.1376	0.0013	0.1215	0.1377	0.1377
4	Fit nonconstant	200	0.1199	0.0159	0.0794	0.1239	0.1377

Appendix

Table 38: Phi random-selector summaries use Mistral loss and

Z

-only observations exclusively. Each budget has 200 all-feature draws, 200 fitting-nonconstant draws, and 40 controls matched by occupancy on fitting states per seed and collection. These are not policy-aware control results. SD describes variation over the saved selectors, not a bootstrap standard error.

Seed	$B$	$N$	Min. dist.	Mean dist.	Median	Max. dist.
314159	2	40	0.0174	0.1897	0.1962	0.2951
314159	4	40	0.1059	0.2581	0.2639	0.3420
314159	8	40	0.1042	0.3294	0.3542	0.4392
314159	16	40	0.1445	0.4498	0.4898	0.5842
314159	32	40	0.0927	0.1379	0.1420	0.1565
314159	64	40	0.0503	0.0753	0.0769	0.0809

Appendix

Table 39: Fitting-only matching diagnostics for Phi random controls. Distances are the recorded occupancy/frequency-matching objective, not distances between held-out losses. Forty retained controls are summarized per seed and budget. Exact is the fraction marked as an exact match by the saved routine; the controls are otherwise approximate matches.

Collection	Seed	Observation	Evaluator	Constant	Shuffled
Original 96	314159	$Z$ only	Mistral	0.1377	0.1377
Original 96	314159	$Z$ only	Qwen	0.1544	0.1544
Original 96	314159	$Z$ only	Mean loss	0.1217	0.1217
Original 96	314159	$(Z,S)$	Mistral	0.1377	0.0933
Original 96	314159	$(Z,S)$	Qwen	0.1544	0.1335
Original 96	314159	$(Z,S)$	Mean loss	0.1217	0.1017

Appendix

Table 40: Saved Phi sanity-control gaps at the primary budget. Constant, Shuffled, and Oracle refer to the exact controls in the archived run. They are descriptive checks and do not replace the matched observation-condition comparison in Table 29 .

Loss / collection	SAE seed	$R_{\rm full}$	$R_{Z,S}^{\star}$	$\Delta_{Z,S}$	95% interval	95% LCB
Auto / original 96	314159	0.1420	0.2407	0.0987	[0.0760, 0.1209]	0.0807
Auto / original 96	271828	0.1420	0.2435	0.1015	[0.0680, 0.1394]	0.0729
Auto / locked 96	314159	0.2015	0.2475	0.0460	[0.0272, 0.0658]	0.0300
Auto / locked 96	271828	0.2015	0.2445	0.0430	[0.0272, 0.0584]	0.0295
Human / original 80	314159	0.2155	0.2500	0.0345	[0.0181, 0.0526]	0.0203
Human / original 80	271828	0.2155	0.2508	0.0353	[0.0153, 0.0594]	0.0175

Appendix

Table 41: SmolLM2 reanalysis with active policy and SAE code jointly visible, at

B=2

. Auto uses five-rollout means; human uses the fixed packet continuation and final adjudicated loss. Intervals and lower confidence bounds (LCBs) are individual policy-area percentile-bootstrap summaries from 2,000 resamples.

Layer	$B$	$\Delta_{Z,S}$	Rounding-corrected 95% interval	95% LCB
17	2	0.13695	[0.1065, 0.1629]	0.1113
19	16	0.03875	[0.0245, 0.0523]	0.0274

Appendix

Table 42: Qwen2.5-1.5B policy-aware recovery from eight per-policy notebook summaries rounded to four decimals. The point gap has absolute rounding uncertainty at most

5\times 10^{-5}

. Bootstrap endpoints include the worst-case rounding correction; these are not full-precision state-array reruns.

Loss / collection	Seed	$B$	$\Delta_{Z}$	$\Delta_{Z,S}$	95% interval	95% LCB
Auto / original 96	314159	2	0.1358	0.0987	[0.0760, 0.1209]	0.0807
Auto / original 96	314159	4	0.1178	0.0600	[0.0474, 0.0749]	0.0490
Auto / original 96	314159	8	0.0498	0.0219	[0.0060, 0.0374]	0.0101
Auto / original 96	314159	16	0.0044	0.0031	[0.0000, 0.0094]	0.0000
Auto / original 96	314159	32	0.0000	0.0000	[0.0000, 0.0000]	0.0000
Auto / original 96	314159	64	0.0000	0.0000	[0.0000, 0.0000]	0.0000

Appendix

Table 43: Paired SmolLM2 observation reanalysis across all feature budgets. Features, state-level losses, and resampling draws are held fixed between

Z

and

(Z,S)

. The intervals refer to

\Delta_{Z,S}

. Values displayed as zero may be below the displayed precision.

Collection	Seed	Loss	$\Delta_{Z,S}$	95% interval	95% LCB
original 80	314159	Rater A	0.0263	[0.0125, 0.0425]	0.0144
original 80	271828	Rater A	0.0294	[0.0106, 0.0500]	0.0131
original 80	314159	Rater B	0.0542	[0.0358, 0.0738]	0.0383
original 80	271828	Rater B	0.0429	[0.0246, 0.0625]	0.0271
original 80	314159	Mean	0.0322	[0.0170, 0.0493]	0.0194
original 80	271828	Mean	0.0290	[0.0112, 0.0478]	0.0140

Appendix

Table 44: Policy-aware human sensitivity at

B=2

, before adjudication. No interface or feature is reselected for a rater. The two-rater mean is shown separately.

Setting	Policy area	$R_{\rm full}$	$R_{Z}^{\star}$ within policy	Gap
L17/B2	after hours building access	0.3022	0.4770	0.1748
L17/B2	campus drone flight booking	0.4329	0.5350	0.1021
L17/B2	donor contact list export	0.3449	0.5255	0.1806
L17/B2	licensed software download	0.2156	0.3650	0.1494
L17/B2	minor photo release	0.4090	0.5669	0.1579
L17/B2	payroll bank change	0.3173	0.3842	0.0669

Appendix

Table 45: Literal rounded per-policy entries recovered from the original Qwen2.5 V8 notebook output. Each policy has 12 confirmation states. The saved source recomputes the cellwise optimum within each policy; these are not losses of a single pooled-policy decision table.

Role	Qwen2.5	SmolLM2 and Phi
Encoder	Full policy rule and complete decision situation, including the state condition.	Active policy and situation text.
Selector	Selected code $Z$ , or $(Z,S)$ in the recovered policy-aware calculation.	Selected code $Z$ , or code and policy $(Z,S)$ in the paired analysis.
Generator	Public request, fact name, and selected action; no private condition or complete policy text.	Active policy, situation, selected action, and action-specific instruction.
Evaluator	Full policy and situation, fact name, selected and required actions, and candidate response.	Active policy, situation, selected action, and response; no hidden required-action label.

Appendix

Table 46: Information supplied to each role in the archived execution protocols. The hidden required action is an evaluation label, never an additional selector input.

Statistic	States	Percentage
Fixed-order first-minimum match	90/176	51.1%
Nonempty intersection of minimizing sets	142/176	80.7%
Identical minimizing sets	54/176	30.7%
Automatic table has a tied minimum	90/176	51.1%
Human table has a tied minimum	1/176	0.6%

Appendix

Table 47: Distinct action-agreement statistics on the same 176 SmolLM2 states and packet responses. First-minimum matching uses the fixed order ask , decline , assist ; the set statistics retain all tied minimizing actions.

Collection	SAE seed	Composite	Safety	Policy	Useful	Factual	Overall
Original 80	314159	0.0345	0.0042	0.0792	0.0437	0.0000	0.0250
Original 80	271828	0.0353	0.0125	0.0750	0.0312	0.0000	0.0208
Locked 96	314159	0.1166	0.0521	0.2049	0.0972	0.0035	0.1024
Locked 96	271828	0.1082	0.0312	0.2014	0.1094	0.0000	0.1198

Appendix

Table 48: Post-hoc policy-aware information gaps at

B=2

under different human rating targets. Each single-dimension loss is one minus its score divided by three. Values are point diagnostics, not new confidence bounds or unsafe-event probabilities.

Tolerance	Outputs	Max cell margin	Iterations	Edges	Two-label check
0.00	3	0.00000	121	188	Infeasible
0.02	3	0.00000	115	185	Infeasible
0.10	3	0.08000	116	181	Infeasible
0.20	3	0.20000	82	138	Infeasible
0.30	2	0.29836	50	65	Feasible
0.35	2	0.34746	25	31	Feasible

Appendix

Table 49: Unrestricted code-only capacity on all 96 locked SmolLM2 states under final human composite loss. Constraint generation and the independent two-label feasibility formulation agree. Margins are reoptimized within every returned cell; numerical tolerance is

10^{-9}

Language Model-Based Control

Language model-based control uses language models to interpret goals, choose actions, and steer AI systems or physical processes.

See all 180 papers

Multi-Head Latent Control: A Unified Interface for LLM Agent Decision Making
Jul 15, 2026Amirhosein Ghasemabadi, Ruichen Chen, Bahador Rashidi +1Multi-Agent LLM Systems Language Model-Based Control
1ECE Department, University of Alberta · 2Huawei Technologies Canada Co., Ltd.
A Regime Theory of Controller Class Selection for LLM Action Decisions
May 7, 2026Zhaoyang Jiang, Zhizhong Fu, Yunsoo Kim +4Selective Prediction Language Model-Based Control
University of Glasgow · UESTC, Chengdu, China · University College London
Bayesian control for coding agents
Jun 23, 2026Theodore Papamarkou, Vladislav Smirnov, Viktor Mazanov +4Language Model-Based Control Coding Agents
1PolyShape · 3MBZUAI

Jul 15, 2026J/K move · Enter open · S save

Multi-Head Latent Control: A Unified Interface for LLM Agent Decision Making

Amirhosein Ghasemabadi, Ruichen Chen, Bahador Rashidi, Di Niu

1ECE Department, University of Alberta · 2Huawei Technologies Canada Co., Ltd.

Multi-Agent LLM Systems Language Model-Based Control LLM Decision-Making LLM Agents LLM Routing

Open paper AskPDF arXiv

Large language models are increasingly deployed as agents, but reliable agentic behavior requires more than next-token prediction. At inference time, it is preferred that an agent can decide whether to proceed with its current reasoning, defer to a stronger model, request additional information, invoke external tools, or abstain under the given setup. Existing approaches address these decisions through prompt-level routing, external orchestration, or task-specific fine-tuning, which primarily rely on input-side signals, and are often costly and difficult to maintain as model backbones evolve. We ask whether such control decisions can be inferred directly from a model's latent generation process. We introduce Multi-Head Latent Control, a lightweight layer that reads hidden-state trajectories from a frozen LLM or VLM to produce deployment-time control signals. A Capability Head predicts whether the current model can solve the instance or should defer to a stronger collaborator, while a Resolution Head predicts appropriate resolution decision Clarification, Tool Use, Abstention, or Direct Answering. Both heads are trained only on latent traces from the same frozen LLM backbone, enabling post hoc adaptation without modifying the model. Across language and vision-language settings, Multi-Head Latent Control consistently improves the quality-cost tradeoff of multi-model systems, enabling early handoff from partial generations and more accurate intervention decisions. In routed execution (small + large model), it reduces large-model usage by up to 90.7 percent on AndroidWorld and 27-53 percent on average across benchmarks, while retaining most of large-model performance. Additionally, the learned control signals improve tool-use decision quality, yielding up to +158 percent relative score gain and 65.5 percent fewer missed-required tool calls.

Abstract

Language Model-Based Control

Explore similar work

Multi-Head Latent Control: A Unified Interface for LLM Agent Decision Making

A Regime Theory of Controller Class Selection for LLM Action Decisions

Bayesian control for coding agents