Why can a task-preserving rewrite turn a correct answer into a failure while a larger internal change leaves the answer intact? We develop a direction-sensitive, readout-relative account of semantic fragility: heterogeneous language changes can share geometric and readout relationships without sharing an input-independent failure direction. Clean decision reserve, representation transformation, and response alignment provide complementary descriptions of this process. An exact longitudinal-transverse decomposition identifies directional information discarded by scalar transmission. A compact reserve-and-transmission model predicts failures across held-out families and items in Qwen3-32B and Gemma 4 31B, with useful but parameterization-dependent transfer to ReClor. Matched interventions show that orientation carries causal information beyond scalar geometry. Among naturally failed rewrites, attention-component tests on disjoint original items and subsequent answer-order controls favor the natural paired direction over tested random and same-answer-letter donor directions. Yet failures rarely persist across option orders, and current-order corrections use recomputed clean references. Shared predictive regularity thus coexists with context-dependent directional effects. Numerical path integration reduces, but does not eliminate, finite-patch approximation error within a fixed context; a larger discrepancy from the natural rewrite effect remains. A complementary fixed-CoT cue study extends this account to influence unacknowledged in recorded reasoning: readout associations transfer across domains, although the positive-mean causal criterion fails and signed-effect prediction remains post hoc. Together, these results support shared relations among reserve, transformation, and response while distinguishing local causal sensitivity from a complete explanation of natural failure.
Figures & tables
Figure 1: Conceptual starting point: heterogeneous rewrites induce different internal trajectories through a model-specific window. The experiments refine the initial transmission account by testing orientation, readout alignment, and dependence on the current answer layout. Contraction is descriptive rather than a sufficient condition for stability; neither a universal direction nor a deterministic robustness certificate is assumed.
Study
What was fixed
Status and remaining exposure
MMLU geometry
Per-fold fitting and held families/items
Window selection is historical discovery.
ReClor prediction
MMLU score and inherited window
Qwen endpoint comparison is post hoc; Gemma scorers frozen before its inference.
ReClor transverse swaps
Inherited windows, edits, numerical rules
Historical fixed-rule replication on reused stimuli; seven primary direction items.
Finite replay / window trace
L52–54, response and replay protocol
Reused old items; partial-state and finite-precision limits remain.
Initial component validation
Source-family/base selection, matched controls
All three all-pair intervals include zero; revised estimand is separate.
New-item component test
Failure-conditioned selector and L54.attn
Frozen before 250 disjoint items; low failure counts and correlated AI review.
Table 1: Evidence chronology. “Frozen” refers to the specified stage, not to a single preregistration covering the full research program.
Model
Bases
Variants
Failures
Failure rate
Margin
Compact
Qwen3-32B
399
2,394
193
8.06%
0.869
0.953
Gemma 4 31B
428
2,568
185
7.20%
0.787
0.910
Table 2: Historical MMLU cohorts and strict mean held-family/held-item AUROC. Windows were selected in the historical depth analyses. The AUROC columns and grouped out-of-fold results in the text are distinct estimands.
Figure 2: Historical Qwen depth profile, retained from the earlier manuscript. The compact score peaks at L54, using M , D52 , and G52→54,ϵ . This scan selects the later intervention window; it is not a separately nested window-selection test.
Subset
Rows
Failures
Failure rate
AUROC
AP
Concordance
All audited historical
504
40
7.94%
0.957
0.593
0.866
Screen-passed
221
19
8.60%
0.953
0.589
0.875
Screen-rejected
283
21
7.42%
0.961
0.599
0.842
Checklist + stress
168
16
9.52%
0.950
0.606
0.917
Table 3: Frozen Qwen score after retrospective semantic filtering. These audited rows overlap the historical fitting data. The table is a sensitivity analysis under preliminary AI-screening labels, not held-out generalization or independent human verification. Within-item concordance uses only failed–successful pairs.
Figure 3: Historical Gemma depth profile, retained from the earlier manuscript. The useful transition occurs around L38–45 of 60 blocks. It does not coincide with Qwen’s normalized window.
Model
Bases
Variants
Failures
−M AUROC
Ratio AUROC
Endpoint AUROC
Qwen3-32B
214
604
15
0.9561
0.9261
0.9782
Gemma 4 31B
240
680
14
–
0.9340
0.9689
Table 4: Frozen MMLU-to-ReClor transfer. “Ratio” uses (M,Din,GW,ϵ) ; “endpoint” uses (M,Din,Dout) . The Qwen endpoint comparison was developed post hoc after the initial ratio result, but uses only historical MMLU fitting labels. Both Gemma forms were frozen before its ReClor evaluation. A dash denotes a value not recovered in the available summary, not zero.
Window
ΔqW
ΔρW2
ΔGW,02
L48–50
0.0396 [0.0247, 0.0548]
0.2516 [0.1629, 0.3455]
0.3250 [0.2145, 0.4388]
L50–52
0.0221 [0.0148, 0.0295]
0.1743 [0.1218, 0.2316]
0.2172 [0.1559, 0.2836]
L52–54
0.0271 [0.0179, 0.0360]
0.3843 [0.2665, 0.5093]
0.4408 [0.3198, 0.5715]
L54–56
0.0083 [ − 0.0008, 0.0171]
− 0.0446 [ − 0.0727, − 0.0172]
− 0.0267 [ − 0.0631, 0.0048]
Table 5: Natural Qwen geometry, evaluation split of 54 mixed-outcome base items. Entries are within-item failure-minus-safe means with archived item-bootstrap 95% intervals. The final window shows that the pattern is not a monotone increase toward the output.
Endpoint scale α
Mean gold-margin change
Failure rescue
1.00
0.000
0.0%
0.75
1.114
17.6%
0.50
2.270
51.3%
0.25
3.48
69.0%
0.00
4.793
80.7%
Table 6: Historical Qwen endpoint contraction on 187 failed variants. Gold-margin changes are relative to the replayed unedited variant, unlike the swap-minus-random contrasts reported later.
Figure 4: Absolute-norm-matched Qwen correction, retained from the earlier manuscript. The natural clean–variant distance is not the update budget: the applied norm is held fixed within each case across layers. Corrective leverage peaks at L54 rather than increasing monotonically to L56.
Dataset
Paired bases
CF←S
CS←F
Mean B
Rescue
Harm
MMLU
44
+1.201
−2.204
+1.702
75.0%
34.1%
ReClor
7
+0.875
−1.446
+1.161
71.4%
28.6%
Table 7: Qwen main-window orientation swaps. Margin columns are control-adjusted contrasts from equation 20 . Categorical columns are the actual swap outcomes on failed and safe receivers. These are numerically eligible, selected mixed-outcome cohorts, not population failure rates. Archived result-summary provenance is recorded in appendix H .
Receiver cohort
Donor family relation
Empirical
Mirror
Failed ( n=24 )
Same family
2.221730
3.277838
Failed ( n=24 )
Cross family
0.924500
2.170946
Safe ( n=24 )
Same family
1.923202
3.696537
Safe ( n=24 )
Cross family
0.813023
2.571439
Table 8: Gemma L38 empirical–mirror entry experiment. Entries are mean reductions in naturally computed, unpatched D45 . Positive values indicate suppression. Each row averages donor conditions within receiver before averaging receiver cases.
Quantity
Mean
95% interval
Natural prompt effect ∣P∣
1.1451
[1.0267,1.2774]
Local finite patch effect ∣Cb∣
0.8995
[0.8031,1.0056]
One-point local error ∣Cb−Jb∣
0.1753
[0.1577,0.1947]
Integrated local error ∣Cb−Ib∣
0.1300
[0.1220,0.1392]
Fine–coarse integral difference
0.00162
[0.00146,0.00180]
Remaining-context discrepancy ∣P−Cb∣
0.3942
[0.3595,0.4326]
Table 9: Finite readout checks on 601 ReClor pairs from 213 original questions. Entries are base-equal means of absolute fixed-competitor margin quantities; nominal 95% intervals use 2,000 original-question bootstrap resamples. The local patch error and the natural-prompt discrepancy measure different targets.
Held-out family
Output
Pairs
Score
98.33% interval
Grammatical restructuring
L54.attn
82
−0.0694
[−0.1717,0.0309]
Irrelevant insertion
L53.attn
80
0.0297
[−0.0284,0.0912]
Lexical paraphrase
L54.attn
82
0.0943
[−0.1507,0.3456]
Table 10: The original all-pair component validation is negative. Scores average matched-random-adjusted repair and damage effects on the fixed clean-worst-competitor margin. Each family uses one selected module. Nominal 98.33% original-question bootstrap intervals allocate a nominal 95% familywise level across the three primary contrasts.
Family
Eligible
Failures
Effect [interval]
Strict rescue
Grammar
187
6
0.583[0.271,0.872]
2/6
Irrelevant insertion
219
10
1.200[0.571,2.127]
5/10
Lexical paraphrase
215
11
1.369[0.818,1.970]
6/11
Table 11: Frozen L54 attention intervention on disjoint ReClor original items. The effect is the random-adjusted bidirectional score from equation 28 , using the clean-fixed competitor margin. Intervals are nominal 98.33% original-item percentile bootstrap intervals allocated over three family comparisons. Failure counts equal distinct failure-item counts within each family; items can overlap across families. All family counts are below the frozen twenty-failure-item interpretive threshold.
Family; failures/items
Own − random [interval]
Own − same letter [interval]
Rescue
Grammar; 9/8
0.631[0.271,0.936]
0.627[0.444,0.827]
3/9
Irrelevant; 13/11
0.894[0.634,1.244]
0.826[0.552,1.187]
6/13
Lexical; 15/13
1.938[1.145,3.024]
1.934[1.083,3.330]
7/15
Table 12: Option-order controls among strict natural failures whose original item is clean-correct in every order. Effects are differences in bidirectional minimum -margin score. Nominal 99.17% percentile intervals allocate error over six planned family contrasts; 2,000 original-item resamples are used. The small per-family event counts make these exploratory estimates. Draws within a recipient and orders of the same item are correlated.
Quantity
What it measures
What it does not establish
NOT_DISCLOSED
No explicit cue attribution in recorded CoT.
Cue reliance, intent, or absence of internal influence.
Usemantic
Standard-minus-lexical target score with c fixed.
A fresh answer flip, complete cue use, or influence on the original generation of c .
Jtrans,seq
Local signed readout projection of transverse differences.
A task-independent harmfulness score or guaranteed finite-dose effect.
Ctrans(α)
Response to a specified internal patch in lexical-reference replay.
Total prompt effect, unique mediation, or an endogenous concealment mechanism.
Table 13: Operational quantities for the hidden-CoT-motivated axis. None alone establishes unobserved reasoning or intentional concealment. The analysis conditions on nondisclosed continuations rather than training a disclosure classifier from geometry.
Causal quantity
Macro estimate
95% interval
Transverse patch, α=1
−0.002178
[ −0.012131 , 0.009869]
Nonnegative-dose slope
−0.002203
[ −0.012234 , 0.009882]
Transverse patch, α=−0.5
−0.000769
[ −0.008935 , 0.004652]
Transverse minus random, α=1
−0.001956
[ −0.012497 , 0.010982]
Transverse minus longitudinal
−0.002286
[ −0.006876 , 0.002146]
Table 14: Original frozen Qwen math/health causal criteria on 82 bases. Effects are equal-domain macro changes in mean target-token log probability, with saved domain-stratified bootstrap 95% intervals. The last row is an additional protocol contrast, not an independent primary success gate.
Figure 5: Logic development versus frozen math/health mean-effect tests. Points and intervals reproduce saved analysis summaries, not a new bootstrap. Logic uses 25 base items; math/health uses an equal-domain macro estimate over 82 bases. The original positive-mean and specificity claims do not pass the held-domain test. This figure is not a direct statistical test of the difference between the two cohorts.
Figure 6: Three distinct links in the fixed-CoT analysis. Values are equal-domain Fisher aggregates of base-level Spearman correlations, with saved domain-stratified 95% intervals. Only the attribution–prompt-contrast relation is the frozen observational primary. Attribution–patch agreement and total-patch–prompt-contrast association answer different causal-scope questions and must not be reported interchangeably.
Domain
Bases
Positive/negative
Correct signs
Accuracy
Balanced acc.
Math
20
10/10
19/20
95.00%
95.00%
Health
62
17/45
54/62
87.10%
87.45%
Pooled
82
27/55
73/82
89.02%
89.93%
Table 15: Post hoc prediction of finite transverse patch-effect signs on nondisclosed bases. These are not hidden-reasoning detection scores. The independent unit is the base, after averaging its continuations. “Positive/negative” counts describe the actual patch effects.
Appendix figures & tables6 assets
Supplementary material from the paper’s appendix.
Appendix
Family
Qwen3-32B
Gemma 4 31B
Checklist
7.02%
7.24%
Compound
5.01%
4.91%
It-cleft
9.52%
9.81%
Red-herring
7.77%
5.37%
Stress
7.27%
5.84%
Wh-cleft
11.78%
10.05%
Appendix
Table 16: Historical failure rates by family on model-specific clean-correct items. Each retained base has all six variants. These published transformations are not all independently verified semantic equivalents.
Model
Layer
Margin + current D
Margin + trajectory
Compact
Qwen
32
0.870
0.869
–
40
0.869
0.869
0.869
48
0.874
0.875
0.877
50
0.885
0.900
0.906
52
0.895
0.921
0.923
54
0.918
0.949
0.953
Appendix
Table 17: Historical strict mean LOFO AUROC by probe endpoint. “Compact” uses clean margin, the preceding displacement, and local gain. The first probe has no local-gain predecessor.
Family
Contraction slope
95% interval
Checklist
4.04
[2.39, 6.09]
Compound
3.03
[2.38, 3.66]
It-cleft
5.47
[4.21, 6.87]
Red-herring
4.54
[3.29, 5.92]
Stress
4.71
[3.51, 5.92]
Wh-cleft
5.59
[4.41, 6.93]
Appendix
Table 18: Historical Qwen failure-side contraction slopes and absolute-norm layer details. Slope intervals are archived bootstrap 95% intervals. The layer experiment’s binary late-window contrasts are not significant under its small fixed update budget.
Signed local attribution-to-intervention agreement.
Total patch effect versus Usemantic
0.6182
Association of a different intervention with the prompt contrast.
Mean transverse α=1 patch effect
−0.002178
Frozen positive-mean causal criterion failed.
Sign-rule pooled accuracy
89.02%
Post hoc signed patch-effect prediction, not hidden-reasoning detection.
Appendix
Table 19: Distinct comparisons in the fixed-CoT monitorability axis. All displayed aggregate correlations use equal-domain Fisher aggregation of base-level Spearman correlations. These quantities must not be interchanged in an abstract or figure.
Frozen selection group
Memberships
Failures
Failure rate
Low-risk controls
482
12
2.49%
Initial beam (round 0)
964
121
12.55%
Beam after round 1
964
151
15.66%
Beam after round 2
964
174
18.05%
Final beam (round 3)
964
193
20.02%
Appendix
Table 20: Candidate outcomes revealed only after search freeze. Counts are selection memberships, not independent observations. Three duplicate memberships account for the difference between 4,338 memberships and 4,335 unique candidates.
Predictor
Full frozen set AUROC
Final beam AUROC
Frozen (M,D52,G52→54,ϵ) score
0.905
0.886
Incoming displacement
0.797
0.772
Local gain
0.776
0.748
Small clean margin ( −M )
0.740
0.709
Absolute token-length change
0.535
0.531
Appendix
Table 21: Prospective candidate ranking after outcome reveal. Predictor values were frozen before candidate correctness was known. The final beam is a restricted comparison after all three search rounds.
Language model robustness studies how reliably language models preserve correct, safe behavior under input changes, distribution shifts, and adversarial pressure.
Large language models demonstrate strong performance on mathematical reasoning benchmarks, yet remain surprisingly fragile to meaning-preserving surface perturbations. We systematically evaluate three open-weight LLMs, Mistral-7B, Llama-3-8B, and Qwen2.5-7B, on 677 GSM8K problems paired with semantically equivalent variants generated through name substitution and number format paraphrasing. All three models exhibit substantial answer-flip rates (28.8%-45.1%), with number paraphrasing consistently more disruptive than name swaps. To trace the mechanistic basis of these failures, we introduce the Mechanistic Perturbation Diagnostics (MPD) framework, combining logit lens analysis, activation patching, component ablation, and the Cascading Amplification Index (CAI) into a unified diagnostic pipeline. CAI, a novel metric quantifying layer-wise divergence amplification, outperforms first divergence layer as a failure predictor for two of three architectures (AUC up to 0.679). Logit lens reveals that flipped samples diverge from correct predictions at significantly earlier layers than stable samples. Activation patching reveals a stark architectural divide in failure localizability: Llama-3 failures are recoverable by patching at specific layers (43/60 samples), while Mistral and Qwen failures are broadly distributed (3/60 and 0/60). Based on these diagnostic signals, we propose a mechanistic failure taxonomy (localized, distributed, and entangled) and validate it through targeted repair experiments: steering vectors and layer fine-tuning recover 12.2% of localized failures (Llama-3) but only 7.2% of entangled (Qwen) and 5.2% of distributed (Mistral) failures.
Shou-Tzu Han, Rodrigue Rizk, KC Santosh
Department of Computer Science, University of South Dakota
Language models are usually judged by a single accuracy score, which does not reveal how their performance degrades as inputs are perturbed. We present a graded, multi-family, failure-aware framework for stress-testing reasoning models. It perturbs each problem along a multi-level severity ladder across seven families: six that preserve the answer, paraphrase, input noise, formatting, irrelevant context, context load, and conflicting instructions, and a Knowledge Boundary family that removes answerability so that refusal becomes the correct response. Every test is validity-gated and labeled by its measured severity, and each model is summarized by per-level Accuracy, a magnitude-weighted Stability, and a per-family Collapse Point defined relative to the model's own baseline. Instantiated on the same 100 seed problems used by GSM-Symbolic, expanded into 4,473 gated tests and run on four models spanning capability tiers, the framework exposes structure that an aggregate score hides: the level at which a model fails is family-specific rather than global, and two stressors expose consistent weaknesses across all models: conflicting instructions and questions built on an impossible premise. Recognition of unanswerability is otherwise uneven, reliable on missing information and fabricated evidence but weak on impossible premises. These failure points are invisible to standard accuracy reporting.
When a language model fails on surface-perturbed input (typos, OCR noise, homophones), "which layer is responsible" has three natural operationalizations: where representations diverge most (sensitivity), where restoring clean activations recovers the prediction (causality), and where a small adapter can repair the damage (compensatory capacity) - and we show these three layer maps dissociate. Across a five-model panel we identify two propagation regimes - spike-and-suppress (Phi-3.5, Gemma-2-9B) and late-accumulation (Llama-3, Mistral, Qwen2.5-7B) - and on the two models meeting an 80% identity-patch gate, sensitivity and causality are anti-correlated (rho = -0.72 to -0.88). Within-family scaling on Qwen2.5 (1.5B to 14B) shows the late-accumulation signature strengthening monotonically with scale, corroborated on a second family. We propose cascade disruption as the mechanism behind the dissociation: adapters placed at causally implicated early layers break intact downstream computation, making diagnostic-flagged sites the worst adapter placements. A fixed-harness layer sweep across four models (3.8-8B) confirms the core prediction on chain-of-thought GSM8K - the flagged sites are the most damaging adapter windows on every adjudicable model - and is sign-consistent but strongly attenuated on a multiple-choice control, consistent with damage that compounds with generation length. The sweep yields practical guidance: a training-free LRD pre-screen and a default-deepest placement rule, though absolute gains over no-adapter baselines remain small. Finally, apparent gains from a representation-stability loss reverse under an adequate generation budget - truncated chain-of-thought had been scored as empty - a methodological warning for any intervention evaluated on chain-of-thought tasks.