A cheap, now-standard safety filter attaches a linear probe to a frozen LLM’s hidden states to flag jailbreak prompts before generation, reaching near-perfect in-distribution accuracy at negligible cost. We show this single-layer probe is not a usable real-time filter, explain why, and give a fix. Across two model families, five attack types, ten languages, and three sets of hard-but-benign prompts, we find: (i) published probes are badly miscalibrated, so the headline 98–100% detection is an artifact of the chosen threshold (expected calibration error 0.20–0.33, and 0.07–0.20 even after a leakage-controlled retraining); (ii) most of the signal is benign writing style—its "register"—since a model-free style classifier reproduces ~0.92 of the probe’s accuracy; (iii) a 5% false-positive guarantee set on in-distribution benign prompts rises to 68–98% on diverse traffic; and (iv) a single 20-token suffix drops recall to near zero. Going beyond correlational "shortcut" diagnoses, we use concept erasure (LEACE) to causally remove a 3-dimensional register subspace: this cuts ~60 points of over-refusal (false flags on benign prompts) while leaving detection essentially intact (AUC drop ≤0.003), and the same subspace recurs across three architectures (verified against a shuffled-source-label null). Our recipe—register erasure plus deployment-time distribution-free calibration—achieves a guaranteed ≤5% false-positive rate on held-out diverse benign prompts at 0.945–0.961 recall, versus 0.18–0.29 for the un-erased probe. Cheap probing is a measurement instrument, deployable as a filter only via this recipe.

Transformer language models predict the next token by passing through dozens of sequential layers, yet whether adjacent layers operate independently or coordinate their computations—and how this relationship forms during pretraining—remains largely unknown. We view residual updates of adjacent layers as vector fields and introduce a Lie bracket-based inter-layer coordination metric that quantifies how much two layers depend on each other’s outputs. Analyzing pretraining checkpoints of 6 models across 3 architecture families (Pythia, OLMo, Amber), we find that all layer pairs are nearly independent at initialization, but as pretraining progresses, individual layer contributions decrease while coordination systematically increases—concentrating in the middle layers that existing metrics (BI, CKA) classify as “redundant.” The mechanism is Jacobian amplification: middle layers write small updates but respond sensitively to their neighbors, and this amplification co-emerges with coordination (r > 0.99). Block duplication experiments confirm that high-coordination blocks are 2.7–7.9 more robust than low-coordination blocks, verifying that this cooperative structure substantively contributes to model function. Our findings reframe pretraining as a process that builds cooperative circuits between layers rather than strengthening each layer individually.

Latent thought pretraining augments training text with model-generated "thoughts". Because generating them is expensive, the obvious way to scale is to spend the budget only on "high quality" chunks — and the most intuitive quality signal is whether the thought generated before a chunk agrees with the one generated after. We show this intuition backfires. In a controlled 1.1B experiment that compares every allocation rule with a random baseline at its own inclusion rate, keeping only high-agreement chunks raises held-out perplexity above the budget-matched random baseline in every seed (+0.84%; n=5 vs. 3, exact permutation p=0.018). The deficit persists across a second training iteration, though downstream accuracy does not separate the filter from random at the same budget. We trace the cause: importance rises with agreement over most of its range, but the top agreement decile, where prior and posterior coincide or the prior is missing, holds degenerate latents that an agreement-only filter cannot exclude. To diagnose this we introduce PAIR, which pairs agreement with a length-corrected importance weight (raw importance is itself a length artifact, 𝜌=-0.786). Importance routing alone matches random at its budget, the intersection of the two filters is slightly worse than random (+0.3%, p=0.008), and inverting the importance signal collapses perplexity. Budget matching decides these verdicts: against a random baseline at a lower inclusion rate the agreement filter looks 4.9% worse and importance routing 1.2% worse, and an earlier version of this work credited the intersection with a gain that was likewise a budget effect. Intuitive single-axis quality filters do not beat random allocation, and any latent allocation study must compare each rule with a random baseline at its own inclusion rate.

We investigate how multilingual representations emerge across depth in large language models.Using a unified probing framework, we analyze six multilingual LLMs across five languages (EN/ES/ZH/FR/DE), decomposing behavior into (i) early-layer dynamics, (ii) linear vs. MLP separability, and (iii) token–language alignment that tracks where vocabulary sharing peaks.Across models, we observe a consistent and substantial early jump: accuracy rises by +73.5 to +80.7 points from L0 to L1 on average, indicating that language-relevant signals become accessible immediately after the embedding layer.Moreover, representations are largely linearly separable: for 5/6 models, the mean gap between MLP and linear probes remains within ±0.5 points.Token–language alignment further reveals systematic structure, with peak vocabulary mass exceeding 48% in some models and substantial variation in the depth of peak sharing.These findings provide a compact, cross-model characterization of how multilingual information is organized across depth and introduce simple alignment metrics that complement accuracy-based evaluation.

Most published PEFT improvements over LoRA do not survive paired multi-seed evaluation. We audit four methods — DoRA, PiSSA, AdaLoRA, and rsLoRA — against LoRA across 16 claim cells spanning 125M–7B, using paired seeds, bootstrap confidence intervals, sign-flip permutation tests, and Holm–Bonferroni correction, with adjudication rules committed before the confirmatory runs. Only 2 of 15 confirmatory cells remain supported after correction, and 4 reverse outright. Three findings stand out. (i) DoRA shows no supported gain in any of its seven audited cells. (ii) PiSSA’s +2.6% GSM8K advantage under a common budget reverses under paper-faithful hyperparameters, including in the cleanest claim-matched 7B setting (Gemma-7B, MetaMathQA → GSM8K: Δ = −1.58pp, p ≈ 0.004, 1W/9L). (iii) PiSSA’s in-distribution NLI gain reverses on adversarial OOD yet improves on counterfactual sentiment, so in-distribution audits alone can mislead. A 303-run stability landscape then supplies a mechanism for three of the four variants. The effective adapter learning rate, lr × α/√r, marks a risk boundary near 5×10⁻⁴ on BERT-base/MNLI/AdamW: nothing below it collapsed (40/40 stable), while 11 of 32 configurations above it did. The boundary transfers to 7B (Mistral rsLoRA: 3/10 seeds degrade at α/√r = 4) and predicts DoRA’s α-driven failures at high rank, but it is calibrated rather than universal: a second 7B cell trains stably well above it once dtype is controlled, and we withdraw that cell as supporting evidence. AdaLoRA is excluded from this account: its failure is schedule-driven rather than driven by lr × α/√r. We release all configs, seeds, and scripts, and propose a minimal reporting standard: ≥10 paired seeds, bootstrap CIs, a regime ablation, and disclosure of α/√r.

We audit whether benchmarks for LLM-based recovery of scientific assumptions measure corpus-grounded extraction or pretraining memorization. Using author-defined targets for 10 historical AI breakthroughs (frozen 4-case protocol plus 6 post-hoc stress cases) and a "field-wide paradigmatic assumption" prompt, GPT-4o’s top-10 extractions cover the target in 6/10 cases under a generous any-of-top-K criterion—an upper bound that a 10-rater study corroborates for only ∼0.19 of sampled top-ranked pairs (human–rule 𝜅=0.70, 𝛼=0.634). Controlled stress tests structure the diagnosis: a no-corpus control (field name only) still scores 4/4 on the primary shifts (memorization dominates), while a wrong-corpus control collapses to 0/12 across all 4×3 cross-pairings (corpus can be causally read); a five-LLM canonical sweep (GPT-4o 4/4, Qwen 2/4, Claude 1/4, Llama-3.1 1/4, Mistral 0/4) shows the gap is model-specific rather than closed-vs-open, with format compliance a major but not fully isolable contributor; a Min-K% Prob cross-check actually mis-ranks synthetic non-members as more contaminated than real pre-shift papers, motivating the behavioral framing; and synthetic/niche controls are mixed (causal in 1 of 3 synthetic scenarios, one shows corpus harm). We release an audit kit — five factorable controls (no-corpus, wrong-corpus, pair-level precision, ≥2-LLM, multi-seed; ∼$15) — as a reusable benchmark-validity probe, with all artifacts released.