Secant: Calibrated Weight Edits, Quantized Files, and Constrained LoRA

Author: Nathan Keys (m00dy, @professor-moody)
Version: v0.3.0 (2026-11-09 — Horizon 1 Edition; body text frozen upon v0.3.0 release tag; subsequent Horizon 2 studies append to dated addenda)

Reading Guide and Terminology¶

A writer is a weight matrix that contributes to a layer’s output. A direction is a vector in that output space; several directions span a subspace. A projection removes or retains the component along that subspace. Leakage measures how much of an adapter or weight update remains along protected directions. It is a numerical measurement, not a direct measure of model behavior.

Throughout the derivations, D stores protected directions as rows, W is a weight matrix, and Delta W is its change. The equations use column-vector activations unless stated otherwise. “B” in a model size means billion parameters; the experiment labels B1, B2, and B3 instead identify loop, refusal, and root-cause directions.

1. Choose Independent Directions and Size Each Edit¶

Several candidate behavior directions can overlap. Removing that overlap lets the linear edits act independently along the resulting directions, up to numerical error. It does not make the behaviors themselves independent. Secant then sizes each edit using the activation measured at the chosen layer.

1.1 Make the Directions Perpendicular¶

Gram-Schmidt subtracts each direction’s overlap with the directions already selected, then scales it to unit length. Secant uses two passes in 64-bit floating point to reduce rounding error.

Let $D = [q_1, \dots, q_k]^\top \in \mathbb{R}^{k \times d_{\text{out}}}$ hold the resulting unit directions as rows. The Python API checks both unit length and perpendicularity through

It rejects dependent directions or a failed tolerance check. Rust compose uses an absolute residual-norm floor and checks pairwise cosines; its acceptance rule differs for unnormalized inputs. The theory guide specifies both contracts. Across 120 seeded Gaussian test bases, the reported maximum Gram-matrix error was $9.99 \times 10^{-16}$.

1.2 Remove a Component or Add a Measured Shift¶

The first operation removes part of a writer’s output along a chosen direction. The second adds a change along that direction using only selected input columns. Both are direct matrix calculations.

For a linear writer matrix $W \in \mathbb{R}^{d_{\text{out}} \times d_{\text{in}}}$ mapping input activations $x \in \mathbb{R}^{d_{\text{in}}}$ to output activations $y = W x \in \mathbb{R}^{d_{\text{out}}}$, Secant implements two closed-form operators:

1. Projector subtraction (projector-subtract):

   $$W' = (I_{d_{\text{out}}} - \gamma q_b q_b^\top) W = W - \gamma q_b (q_b^\top W)$$

   (2)

   At $\gamma = 1$, the edited matrix satisfies $q_b^\top W' = 0$ in exact arithmetic for every input $x$.

2. Target-Shift Calibrated sparse rank-1 column edit (rank1-columns): Given a sparse support $S \subset \{0, \dots, d_{\text{in}}-1\}$ of $|S| = K$ input columns selected by descending reference activation magnitude $|h_{\text{ref},j}|$, let $h_S \in \mathbb{R}^{d_{\text{in}}}$ denote the vector equal to $h_{\text{ref}}$ on $S$ and 0 outside $S$ (with $\|h_S\|_2 > 0$). We define the rank-1 update:

   $$\Delta W = \mathrm{sign}(\Delta_{\text{target}}) \cdot \beta \, q_b \, h_S^\top$$

   (3)

   where the calibrated step size $\beta$ is solved analytically as:

   $$\beta = \frac{|\Delta_{\text{target}}|}{\|h_S\|_2^2}$$

   (4)

Substituting $x = h_{\text{ref}}$ yields a scale-invariant directional shift along $q_b$ regardless of layer width $d_{\text{in}}$ or activation scale $\|h_S\|_2$:

And the Frobenius norm of the perturbation is inversely proportional to the active column energy:

Scope: The target equality holds at the reference input in exact arithmetic, with small numerical error in float64. For other inputs, the exact-arithmetic shift is multiplied by $\langle h_S,x\rangle / \|h_S\|_2^2$. Storage in BF16, F16, or Q8_0 adds rounding error. Neither result guarantees a behavioral change; evaluate held-out prompts separately.

Relation to prior associative-memory and abliteration estimators: Algebraically, the step size $\beta = |\Delta_{\text{target}}| / \|h_S\|_2^2$ is the isotropic ($C = I$, minimum-Frobenius-norm Moore-Penrose pseudoinverse) special case of the rank-1 ROME update $v = (C^{-1} k_*) / (k_*^\top C^{-1} k_*)$ (Meng et al., NeurIPS 2022; extended to multi-edit MEMIT, Meng et al., ICLR 2023) restricted to the sparse top-$K$ column support $S$. Covariance-whitened concept erasure was formalized in LEACE (Belrose et al., NeurIPS 2023), while multi-vector Gram-Schmidt orthogonalization and ridge-regularized multi-direction projection are used in G-Abliteration (Gülmez, Dec 2025), Norm-Preserving Biprojected Abliteration (Lai, Nov 2025), Obliteratus, llm-abliteration, apostate KCRN, and weightless. Secant’s specific contributions in this stage are (1) using activation-calibrated target shifts ($\beta(d_{\text{model}}, \ell) = |\Delta_{\text{target}}(\ell)| / \|h_S(\ell)\|_2^2$ and RMS-relative dosing $\Delta_{\text{target}} = \alpha\,\sigma_{\text{writer}}$) for cross-model-size edit transfer (0.8B to 32.8B across 15 full models, plus 70.6B and 72.7B single-shard evaluations), and (2) coupling two-pass float64 Gram-Schmidt orthonormalization with the upper-triangular $R^{-1}$ cross-projection compensation system ($Q^\top \Delta W = R^{-\top} \Delta_{\text{target}}$) so heterogeneous non-orthogonal edits each realize their exact reference shift simultaneously.

Section 1 takeaway: Make the directions perpendicular first, solve the upper-triangular $R^{-1}$ compensation system when composing non-orthogonal directions, and size each edit from the measured reference activation. The requested shift is exact at that reference input, up to float64 rounding. Behavior on other prompts has to be measured separately.

2. File Layout and Quantized Block Boundaries¶

A model file has two relevant layouts: the logical rows and columns of a matrix, and the groups of values stored together on disk. Some converters also reorder groups of columns. To edit the intended weights, the plan and checkpoint must agree on that order. To preserve neighboring bytes, the edit must respect the compressed format’s block boundaries.

2.1 Rows and Columns in the Two File Formats¶

The formats list dimensions in different orders, but the linear matrices considered here store each output row contiguously. The following offset is an element index; compressed formats need an additional mapping to block bytes.

In HuggingFace .safetensors, a 2-D linear weight matrix has shape = [d_out, d_in] with input axis shape[1] = d_in contiguous in memory. In ggml / .gguf, ne = [d_in, d_out] lists the contiguous axis first (ne[0] = d_in). Consequently, both formats share the identical row-major element offset for output row $\text{out} \in \{0, \dots, d_{\text{out}}-1\}$ and input column $\text{in} \in \{0, \dots, d_{\text{in}}-1\}$:

2.2 Track Reordered Groups of 128 Columns¶

A panel is a group of 128 adjacent columns. The conversion described below moves whole panels and preserves the order within each one. The symbol $\Pi_{128}$ denotes that reordering. Undoing it requires the inverse mapping, not necessarily a second application of the same mapping.

On Qwen3.5 Gated DeltaNet layers, llama.cpp’s convert_hf_to_gguf.py reorders the input columns ($d_{\text{in}} = n_v \cdot d_v$, with head width $d_v = 128$ and group ratio $r = n_v / n_k$) of blk.N.ssm_out.weight from key-head-major to value-head-major order. Writing a HuggingFace 128-column panel index as $h = k \cdot r + j$ for $k \in \{0,\dots,n_k-1\}$ and $j \in \{0,\dots,r-1\}$, its GGUF panel index is:

Within each 128-column panel $w \in \{0,\dots,127\}$, the intra-panel offset is preserved:

When $r = 1$ (Qwen3.5-0.8B, $n_k = n_v = 16$), $\pi$ is the identity permutation. When $r = 2$ (Qwen3.5-4B, $n_k = 16, n_v = 32$), $\Pi_{128}$ is a non-trivial bijection on the 32 panels of width 128 corresponding to the transpose of a $(16, 2)$ grid into a $(2, 16)$ grid. Because $r \neq n_k$, $\pi$ is not an involution (for example, $\pi(1) = 16$ whereas $\pi(16) = 8$); its inverse is:

2.3 When Reordering Preserves Blocks, and When Editing Adds Error¶

There are two different questions here. Reordering complete blocks can preserve their bytes exactly. Changing their weights usually requires encoding them again, which introduces rounding error.

Proposition 1: complete Q8_0 blocks move without re-encoding. Let $Q_B$ be a deterministic, position-independent encoder that quantizes aligned blocks of $B$ weights independently, and let $D_B$ decode them. Assume rows contain complete blocks. If $B$ divides 128, every panel contains whole blocks. For Q8_0, four 32-weight blocks make one panel, so

Here the right-hand permutation moves encoded blocks as units. The corresponding decoded arrays are identical. This equality concerns panel reordering, not an arbitrary weight edit.

Proposition 2: Q4_K can couple neighboring panels. A 256-weight superblock shares top-level scale and minimum parameters across two 128-column panels. A permutation that splits those pairs need not preserve the encoded result. Pair-preserving permutations, including the identity, are exceptions. Editing one panel can also change its neighbor’s reconstructed values. The standalone secant quant patch therefore accepts Q8_0 only.

Proposition 3: editing before and after quantization can differ. Fix the same additive update $\Delta W$ in both paths and write $\hat Q_B = D_B \circ Q_B$. Path 1 edits the original float weights, then quantizes. Path 2 starts from decoded quantized weights, edits them, then re-encodes the touched blocks. Define

Subtracting the two reconstructed results gives

The implementation copies untouched blocks byte-for-byte, so no assumption that repeated encoding is idempotent is needed there. On touched Q8_0 blocks, an ideal-arithmetic bound including FP16 scale rounding is

where

This bound requires normal-range FP16 scales in all three encodings and excludes the encoder’s float32 arithmetic error. A projector edit recomputes its update from the current weights, so it need not use the same additive delta in both paths. See the quantized-weight guide for these assumptions and the full derivation.

The retained Qwen3.5-0.8B ssm_out experiment reported a target weight component decreasing from 0.5172 to 0.0079 with direct Q8_0 editing (about 98.5% removed). This measures a weight component, not a percentage of prompts. A separate whole-file experiment checked byte preservation outside the selected edits.

Relation to prior in-place GGUF and SafeTensors editing tools: In October 2026, Kiwimaker (apply_abliteration.py and apply_abliteration_v2.py) demonstrated in-place r+ memory-mapped (np.memmap via gguf.GGUFReader) editing of Q8_0 tensors inside .gguf shards with SHA-256 byte-identity verification of untouched offsets, while empirically skipping Q4_K tensors and dequantizing/re-quantizing full 2-D Q8_0 matrices in float64 via gguf-py. Also in October 2026, SC117 demonstrated byte-level in-place GGUF tensor transplantation (leaving 1,079 of 1,223 tensors byte-identical) and scale-preserving Q2_0 re-encoding against learned GSQ block scales. Existing .safetensors abliteration tools (jim-plus/llm-abliteration, NousResearch sharded_ablate.py, and abliterix) load tensors via safe_open and re-serialize modified shards from scratch via save_file(). Secant’s specific contributions in this stage are (1) in-place zero-copy mmap byte-slice surgery inside .safetensors files at [8 + N + BEGIN, 8 + N + END) without save_file() shard re-serialization, (2) sub-tensor compressed-domain Q8_0 block surgery directly on touched 34-byte block_q8_0 records (crates/secant-core/src/quant.rs) without full-tensor float64 matrix materialization, and (3) Propositions 1 to 3, which formally prove why 32-weight Q8_0 blocks commute with the $\Pi_{128}$ 128-column head-panel permutation ($128 = 4 \times 32$) while 256-weight Q4_K superblocks straddle two 128-column heads and suffer cross-head scale leakage.

Section 2 takeaway: Both file formats use the same element offset, the ssm_out panel reordering has an exact inverse, and Q8_0 blocks fit wholly inside 128-column panels while Q4_K superblocks span two. Editing still re-encodes the touched blocks, so the Proposition 3 bound is the error to expect.

3. Project-Then-Heal: Keep Adapter Updates Out of Protected Directions¶

LoRA fine-tunes a model by adding a small trainable matrix product to a frozen weight matrix. Ordinary LoRA can add back a component that an earlier edit removed. Project-Then-Heal removes protected components from the adapter each time the model computes an output. This is a constraint on selected writers, not a guarantee about all later model behavior.

3.1 Why Projecting the Gradient Is Not Enough¶

A gradient gives a proposed update direction. AdamW rescales its coordinates using past gradients, so the final update can point somewhere else. A direction that was perpendicular before rescaling need not remain perpendicular afterward.

Suppose a writer matrix $W_0 \in \mathbb{R}^{d_{\text{out}} \times d_{\text{in}}}$ has had an orthonormal row basis $D \in \mathbb{R}^{k \times d_{\text{out}}}$ ($D D^\top = I_k$) surgically excised, and we attach a rank-$r$ LoRA adapter $\Delta W = s B A$ ($s = \alpha_{\text{lora}} / r$, $B \in \mathbb{R}^{d_{\text{out}} \times r}$, $A \in \mathbb{R}^{r \times d_{\text{in}}}$).

If one projects only the gradient $g_t = P_\perp \nabla_B \mathcal{L}_t$ using the orthogonal complement projector $P_\perp = I_{d_{\text{out}}} - D^\top D$ and passes $g_t$ into AdamW, the first moment $m_t = \beta_1 m_{t-1} + (1 - \beta_1) g_t$ remains in $\mathrm{col}(P_\perp) = \ker(D)$. However, AdamW’s parameter update multiplies $\hat{m}_t$ by a non-isotropic diagonal preconditioner $\Lambda_t = \mathrm{diag}\big((\sqrt{\hat{v}_t} + \epsilon)^{-1}\big)$:

For a general projector and unequal coordinate scales, the update can have a component in the protected directions:

This is a possible failure of invariance, not a claim that every AdamW step must leak. Compatible scalings and axis-aligned protected directions are exceptions. The first-moment statement above also assumes its initial state lies in the allowed subspace. For a matrix-valued adapter, the diagonal-rescaling argument applies to each column, whose AdamW scales may differ.

This non-commutativity between Euclidean orthogonal gradient projection and AdamW’s diagonal second-moment preconditioner was independently formalized in October 2026 by Chen et al. (GOAL, Appendix M and Table 7), who defined the gradient-step quantity $\mathcal{L}_{i,t}^{\text{Adam}}$ (“residual refusal-subspace leakage after AdamW preconditioning”) and reported $\mathcal{L}_{i,t}^{\text{Adam}} = 3.6\%\text{--}4.7\%$ across three backbone models (Gemma-7B-it, Llama-2-7B-Chat, Llama-2-13B-Chat), averaged over five runs at the end of training with zero weight decay when projecting gradients before AdamW.step(); Yu et al. (CORD, October 2026) likewise noted that subsequent optimizer transformations can disturb gradient-space orthogonalization, while Ghosh et al. (PoLoRA, July 2026) proposed a preconditioned orthogonalized LoRA optimizer. In our reported three-model comparison (measuring relative adapter weight-update leakage $\lVert D \Delta W\rVert_{\mathrm{F}} / \lVert\Delta W\rVert_{\mathrm{F}}$ rather than GOAL’s gradient-step metric), gradient-projected AdamW had 1.56% to 2.98% relative weight-update leakage on the orthogonal target at step 60, and the 15-model H100 comparison (0.8B to 32.8B) reported 0.33% to 1.67%. The training guide gives the tasks, metrics, and learning-rate caveat.

3.2 Apply the Constraint Whenever the Adapter Runs¶

The optimizer can change the adapter’s stored parameters freely. Before those parameters contribute to an output, the layer removes their protected components. Applying the projection twice is a numerical refinement; in exact arithmetic, the second pass changes nothing.

ProjectThenHealLinear instead reparameterizes the LoRA output factor inside the forward computation graph via a twice-applied float64 orthogonal projection:

where each application of $P_\perp$ is evaluated in $\mathcal{O}(k \cdot d_{\text{out}} \cdot r)$ time without allocating a dense $d_{\text{out}} \times d_{\text{out}}$ matrix:

The layer’s forward pass is then:

By associativity, for any parameter state $(\tilde{B}_t, A_t)$ produced by any optimizer (SGD, AdamW, Lion, Muon):

In exact arithmetic $P_\perp^2 = P_\perp$, but in finite-precision IEEE-754 float64, a single pass $P_\perp(\tilde{B})$ can leave $\mathcal{O}(\varepsilon_{\text{mach}} \|\tilde{B}\|)$ residual components along $D$ when columns of $\tilde{B}$ are nearly parallel to $\mathrm{span}(D^\top)$ (analogous to single-pass vs. two-pass Gram-Schmidt). Applying $P_\perp$ twice reduces $\max |D B_{\text{locked}}|$ by $1.8\times$ to $17.7\times$ (median $5.6\times$ across 120 seeded Gaussian bases). Separately, the live-run diagnostic that recomputes an unrounded projected weight update reported $5.21 \times 10^{-18}$ to $9.87 \times 10^{-18}$.

3.3 Where the Guarantee Stops¶

Later layers can turn a perpendicular change back toward a protected direction. Saving or merging weights at lower precision can also introduce a component that was absent in the calculation. Check both the stored weights and model responses after those steps.

The exact-arithmetic guarantee $D \Delta W_t = 0$ holds at every protected writer’s output. In a multi-layer transformer, an orthogonal perturbation $\delta h_\ell \in \ker(D)$ emitted at layer $\ell$ subsequently passes through downstream RMSNorm, attention, and MLP matrices $W_{\ell'}$ ($\ell' > \ell$) for which $D W_{\ell'} P_\perp \neq 0$ in general. Empirically on Qwen3.5-0.8B (Step 60), locking L15..L17 reduces direct merged-F32 writer leakage by $4.2 \times 10^7\times$ ($2.49 \times 10^{-10}$ vs. $1.05 \times 10^{-2}$) and cuts downstream pull-back along the B1 loop direction at resid L19 by more than half (+0.276 vs. +0.635 unconstrained).

Relation to prior subspace-projected LoRA and post-abliteration healing: Forward-pass orthogonal projection of LoRA adapters ($\Delta W = P_L B A P_R$) against top singular directions of frozen weights was introduced for continual learning in OPLoRA (Xiong & Xie, AAAI 2026), while SaLoRA (Li et al., ICLR 2025) and Safe LoRA (Hsu et al., NeurIPS 2024) project LoRA updates to preserve safety alignment during downstream fine-tuning. Conversely, existing post-abliteration LoRA capability-healing pipelines (Labonne, June 2024; Obliteratus --auto-finetune; model-unfetter recovery.py) attach unconstrained LoRA adapters that can write back into the excised subspace. Secant’s specific contributions in this stage are (1) bypassing AdamW preconditioner leakage on the effective adapter weight update via forward-pass subspace-locked parameterization, reducing step-60 relative weight-update leakage $\lVert D \Delta W\rVert_{\mathrm{F}} / \lVert\Delta W\rVert_{\mathrm{F}}$ from 0.33%-1.67% under gradient-projected AdamW to the float32 working-dtype floor (1.78e-10 to 8.67e-10) across 15 models (0.8B to 32.8B), (2) inverting safety-projected LoRA for post-surgery capability healing (Project-Then-Heal, locking LoRA out of an excised behavioral subspace $\mathrm{span}(D^\top)$), and (3) twice-iterated float64 idempotent projection $P_\perp(P_\perp(\tilde{B}))$ inside the autograd forward pass ($5.6\times$ median error reduction over single-pass projection).

Section 3 takeaway: Projecting only the gradient can leak once AdamW rescales coordinates. Projecting inside the forward pass makes $D \Delta W = 0$ hold in exact arithmetic for any optimizer at the locked writer. Rounding, merging, and later layers still have to be measured.

4. Experiments and What They Measure¶

The following studies answer three separate questions: whether the edit produces the intended local numerical change, whether the adapter respects protected directions, and whether model answers improve. A pass on one question is not a pass on the others. B1, B2, and B3 label the loop, refusal, and root-cause directions. An arm is one configuration being compared. Leakage metrics are named in each table because maximum absolute entries and norm ratios are not interchangeable.

The numerical results below are retained experimental reports, not fresh runs made for this documentation review. Some raw runners and receipts remain in the lab evidence bank rather than this repository; the guides identify those limits. Results on the two largest checkpoints use one shard each, not full-model fine-tuning.

Summary of Experimental Studies & Model Breadth¶

Cohorts overlap, so these model counts must not be added. The live-healing range uses model-name sizes; the larger H100 tables retain reported parameter counts. The focused Qwen3.5-4B dose-response case study follows the multi-model results in Section 4.6.

4.1 H100 Stage-1: Calibration and Three Adapter Arms Across 15 Models¶

This sweep checks the shift at a reference input and compares three adapter methods on one selected writer per model. It uses one seed per model and a synthetic target plus a real-token cross-entropy term. Public behavioral benchmarks were NOT_RUN in this sweep; the local numerical results do not establish generation quality.

Across 15 full models on H100 (0.8B to 32.8B, receipt irrefutable-15models-stage1-receipt.json), we applied full Target-Shift Calibration ($|\Delta_{\text{target}}| = 7.382$, $K = 128$ columns) to B2 and B3 and ran a 60-step 3-arm comparison on the surgically edited writer:

• Arm A: Unconstrained LoRA + AdamW

• Arm B: Gradient-Projected LoRA ($g_t \leftarrow P_\perp g_t$ before AdamW.step())

• Arm C: ProjectThenHealLinear ($B_{\text{locked}} = P_\perp(P_\perp(\tilde{B}))$)

All 30 calibrated edits realize $\Delta_{\text{target}}$ at $h_{\text{ref}}$ to within <= 7.99e-15 in float64. On the 3-arm healing test (measured by relative leakage $\|D \Delta W\|_{\mathrm{F}} / \|\Delta W\|_{\mathrm{F}}$ at step 60), Gradient-Projected AdamW (Arm B) leaks on 15 of 15 models (0.33% to 1.67%), whereas ProjectThenHealLinear (Arm C) stays at the float32 working-dtype floor (1.78e-10 to 8.67e-10; model by model, $6.5 \times 10^6$ to $3.8 \times 10^7$ times lower than Arm B):

• B2 / B3: refusal / root-cause directions; L: layer; β: calibrated step size.

• Shift error is measured in float64 at the reference input. A, B, and C are the adapter arms defined above.

Stage-1 calibration

Stage-1 relative leakage at step 60

4.2 H100 Stage-2: Public Benchmarks Across 14 Models¶

Section 4.1 checks the local arithmetic of each edit. This section asks a different question: what the same B2 + B3 edits do to a model’s answers on public benchmarks. The receipt is public-benchmarks/irrefutable-receipt.json (SHA-256 9859ef3e0603318e09b0366e6dae6994b47f7d7cc4456cfff1fff7ddb2253132, status: PASS, completed 2026-11-06T20:41:59Z), with per-item rows in predictions.jsonl (SHA-256 0c2d65e1...86fe). It covers 14 of the 15 Stage-1 models (14 x 1,970 = 27,580 completed five-arm rows). Gemma-2-27B is marked HOLD in the summary receipt because its gated repository returned HTTP 401 on the edited arms (300 base-only records for MATH-500, GSM8K, and MMLU-Pro remain in predictions.jsonl, bringing the file total to 27,880 rows, while Gemma-2-27B has no completed paired benchmark cohort). The aligned edits (layers, column support $S$, $\beta$), model revisions, and seed (20261105) are those of Section 4.1, and the healing results in this receipt are identical to the Stage-1 receipt for all 14 shared models.

Five variants of each model answer the same items: the unedited base; the calibrated edits at 1.0x and 1.5x; and two norm-matched random controls at 1.0x and 1.5x. A random control replaces each aligned direction $q$ with a random unit vector orthogonal to $q$, keeping the same $\beta$, the same input-column support $S$, and therefore the same $\lVert \Delta W\rVert_{\mathrm{F}}$. If a calibrated edit and its random control move a score by similar amounts, the movement comes from the size of the edit, not its direction.

Each model answers the first 100 items of GSM8K, MATH-500 and MMLU-Pro, the first 64 of HumanEval, and the 30 retained sanitizer traces (ASan-30). Decoding is greedy. ASan-30 counts a root cause as correct when the answer names both the bug class and the culprit function, matched by keyword. Every comparison is paired by item: an exact two-sided McNemar test on the discordant pairs, then a Holm correction across the 70 model-by-benchmark cells of each variant. The pooled rows add the discordant pairs over all 14 models. Their 95% intervals use the paired normal approximation, and they treat items from different models as independent, which they are not.

• pp: percentage points; CI: 95% confidence interval; p: exact two-sided McNemar p-value.

• Each result reports change from base, its CI, and p; items are pooled over 14 models.

Pooled calibrated edits

Pooled norm-matched random controls

What this shows:

• Retention. At 1.0x, no calibrated cell changes significantly after Holm correction (0/70). Single cells range from -12 to +19 points, which is what 100-item and 64-item samples produce by chance. Pooled, each benchmark moves by 2.1 points or less.

• One pooled cost, MMLU-Pro. Calibrated edits lower pooled MMLU-Pro by 2.0 points at 1.0x and 2.4 at 1.5x. Random 1.5x lowers it by 2.0, so edit size explains at least part of the cost. Under a Holm correction across all 20 pooled tests, only calibrated 1.5x remains below 0.05 (p = 0.031).

• No measured uplift in the 14-model Stage-2 sweep. The ASan-30 root-cause gain at 1.0x (+2.1 points, p = 0.20) is not significant, and no root-cause cell survives Holm correction. These edits were sized to hit a reference shift, not tuned for this task. This receipt does not reproduce the Qwen3.5-4B thinking-loop root-cause gains reported in Section 4.6 (0/30 to 14/30 at 1.0x and 19/30 at 1.5x under the B1 loop-exit + B2 + B3 composition).

• Edit size matters more than direction on one model. Gemma-2-9B carries the largest B2 step in the sweep ($\beta = 3.72$). It accounts for every Holm-significant cell across the four variants: GSM8K falls 17 points at calibrated 1.5x and 14 at random 1.5x, and HumanEval rises 33 to 34 points under both random controls. The random controls move it as far as the calibrated edits do.

Scope. These are first-N items, not random samples, from one seed, decoded greedily, on a set of checkpoints weighted toward Qwen. The receipt’s standalone secant CLI cross-check is HOLD for 7 of the 14 models; that check is separate from these benchmark results.

Per-model counts, all 14 completed models. Each cell is base / calibrated 1.0x / norm-matched random 1.0x, as correct items out of 100 (GSM8K, MATH-500, MMLU-Pro), passed items out of 64 (HumanEval), and correct root causes out of 30 (ASan-30). The rows are generated from the receipt with jq, not typed. Two rows that are easy to over-read: OLMo-2-13B MATH-500 goes from 33 to 37 under the calibrated edit and also to 37 under the random control. Qwen3-32B MATH-500 goes from 31 to 38 (exact McNemar p = 0.19, Holm p = 1), while GSM8K moves from 53 to 55 calibrated and to 56 random. No cell in this table is a demonstrated uplift.

• Cell order: base / calibrated 1.0x / norm-matched random 1.0x.

• Denominators are shown in the column headers.

Per-model mathematics and knowledge

Per-model code and crash triage

4.3 H100 Regime C: Adversarial Subspace Pull Across 14 Checkpoints¶

This stress test deliberately asks the adapter to learn a change inside the protected subspace. A successful lock must leave that part of the task unfitted, so low leakage comes with a loss floor. The unconstrained and locked numbers below use different metrics and must not be read as a direct ratio.

In a separate adversarial stress test across 12 full models (7.2B to 32.8B) and 2 single-shard runs (70.6B, 72.7B), we trained LoRA for 60 AdamW steps toward a synthetic target $Y_{\text{target}} = Y + 1.5\,v_{B2}$ that deliberately lies inside the protected subspace $\mathrm{span}(D^\top)$. Under this adversarial pull, unconstrained LoRA placed 8.42% to 52.55% of its output factor norm $\|B\|_{\mathrm{F}}$ into $\mathrm{span}(D^\top)$, whereas ProjectThenHealLinear held $\max |D B_{\text{locked}}|$ (evaluated in float64 on the F32 working factor) to 4.82e-10 to 1.08e-9 at step 60 across all 14 checkpoints.

• UNC rel. B: fraction of the unconstrained output-factor norm in the protected subspace.

• PTH max abs B: maximum absolute entry of D B after projection, evaluated in float64 on the F32 factor. The two columns use different metrics.

• Full model: the full checkpoint was loaded, with the adapter test on a selected writer. Shard only: one writer from a single checkpoint shard, without full-model fine-tuning or generation.

The retained Regime C sources are h100_scaleup_6models_complete_receipt.json, h100_r1_olmo_receipt.json, and h100_gated_and_70b_receipt.json in the H100 evidence bank. The table uses the first Phi-4 run under experiments and the successful top-level Qwen3-32B rerun. The 70B row is DeepSeek-R1-Distill-Llama-70B, as named in the receipt; the attempted Llama-3.3-70B-Instruct download returned HTTP 403 and is not a completed result. Both large-model rows remain shard-only retained evidence with incomplete producing-run provenance.

Verification & Diagnostic Notes on Regime C:

• Non-linear dose saturation at extreme shifts: On 20 of 24 full-model edits in Regime C, raising the dose from $1.0\times$ to $1.5\times$ scaled the realized shift linearly (1.49x to 1.50x). Four edits (Phi-4 B2, OLMo-2-13B B3, Gemma-2-9B B3, Gemma-2-27B B3) showed sub-linear scaling (1.04x to 1.18x) due to downstream RMSNorm normalization.

• Outlier-dimension diagnostic (Phi-4): In Regime C’s uncalibrated capture on Phi-4 (L32), peak $\mathrm{SNR}_{\text{proj}}$ reached 27,362.3 with $\mathrm{SNR}_{\text{trace}} = 60.4$, and the uncalibrated edit inverted sign (-3.399). Always pair $\mathrm{SNR}_{\text{proj}}$ with $\mathrm{SNR}_{\text{trace}}$ and verify the signed shift on held-out prompts (as done in Stage-1 L12 calibration, where Phi-4 achieves 4.4e-15 shift error).

4.4 Live Causal-LM Healing Across Eight Models: Regime A and RMS-Relative Dosing¶

The two early Regime A runs and six H100 RMS-relative runs all train ProjectThenHealLinear on real causal-LM text. They cover eight models from 0.8B to 14B by model-name size. The 24,000 benchmark rows belong to the six-model RMS-relative study, across all of its evaluated arms; they are not 24,000 healed-arm rows or an eight-model common benchmark.

• PTH: ProjectThenHealLinear. Max abs: maximum absolute entry of D ΔW; relative: Frobenius norm ratio of D ΔW to ΔW. These are different metrics and cannot be compared as one leakage range.

• The early runs recompute an unrounded float64 projected delta; the H100 runs use a float64 adapter. Neither label means that every operation in the language model uses float64.

• R1-Llama-8B abbreviates DeepSeek-R1-Distill-Llama-8B.

4.4.1 Early Live Runs: Perplexity and Storage Precision¶

The two early short runs compare a constrained adapter with ordinary LoRA after a weight edit. Perplexity measures prediction quality on held-out text; lower is better. The Qwen run reached its best held-out value at step 20, then both arms overfit the small training batch. The float64 leakage column recomputes an unrounded projected delta; it is not a claim that the whole model ran in float64.

Both arms train on real causal-LM completions after a byte-verified surgical edit, evaluated on the identical writer-level metric $\max |D \Delta W|$:

• PTH: ProjectThenHealLinear; UNC: unconstrained LoRA.

• Max leakage: maximum absolute entry of D ΔW, evaluated identically for the two arms. PPL: held-out perplexity.

Early live runs: training and edit

Early live runs: leakage and held-out quality

Storage Precision Boundary (F32/F64 vs. BF16): When merged weights are quantized down to 16-bit BF16 (7 stored fraction bits, 8-bit significand precision, $\mathrm{ulp} \approx 7.8 \times 10^{-3}$, unit roundoff $\approx 3.9 \times 10^{-3}$), rounding error alone introduces $\sim 10^{-4}$ to 10^-3 subspace leakage. secant heal therefore stores healed LoRA adapters in F32 or F64.

4.4.2 Six-Model H100 Sweep: RMS-Relative Dosing and Live Healing¶

A fixed shift such as $\lvert\Delta_{\text{target}}\rvert = 1.0$ means different things in different layers, because writer outputs differ in scale. RMS-relative dosing measures that scale first and sizes the shift against it:

over $N = 24$ positive reference activations (4 domains times 6). Across 6 models spanning 4B to 14B parameters (24,000 benchmark rows total, archived experiment receipt identifier h100-scaleup-20261105/domain-uplift-rms, per-model manifest SHA-256 digests listed below), $\sigma_{\text{writer}}$ varies by 13.4x, from 5.847 on layer 21 of DeepSeek-R1-Distill-Llama-8B to 78.148 on layer 24 of Qwen3-8B. An unscaled unit shift of 1.0 therefore represents 17.10% of the writer norm on DeepSeek-R1-Distill-Llama-8B, 2.48% on Qwen2.5-Coder-7B-Instruct (40.355), 1.45% on Qwen3-14B (68.757), 1.34% on Qwen2.5-Math-7B-Instruct (74.607), and 1.28% on Qwen3-8B (78.148). That explains why the earlier unscaled unit shift left greedy accuracy unchanged on Qwen2.5-Math-7B-Instruct (GSM8K 87%, MATH-500 43%, largest change in any complete cell 1 point, with mean normalized shift at most 0.19%).

Each of the 6 models was evaluated on one H100 (torch 2.8.0+cu128, greedy left-padded batches of 16, max_new_tokens = 512, 100 items each of MATH-500, GSM8K, MMLU-Pro, and HumanEval). Every model ran at least 8 arms at $\alpha = 1.0$: base, four single-domain edits (security, math, science, code), their 4-domain Gram-Schmidt orthogonal union (composed), a seeded norm-matched random control orthogonal to $\mathrm{span}(D)$ on the identical column support, and composed_healed (the 4-domain composition followed by a rank-4, 60-step float64 ProjectThenHealLinear healing pass). Qwen2.5-Math-7B-Instruct and Qwen3-4B additionally ran a 14-arm dose sweep over $\alpha \in \{0.25, 0.5, 1.0, 2.0\}$.

• L: writer layer; σ: RMS writer output norm; rel. leakage: norm ratio for the float64 adapter delta.

• Benchmark cell order: base / composed / random / composed + PTH, all at α = 1.0. Each benchmark has 100 items.

• Manifest hashes below are abbreviated source identifiers, not complete verification digests.

RMS calibration and live healing

RMS sweep: held-out benchmark counts

On Qwen2.5-Math-7B-Instruct (manifest.json SHA-256 49181d79...7cc1, 14 arms, predictions.jsonl SHA-256 f5036530...b90c), the full dose sweep across $\alpha \in \{0.25, 0.5, 1.0, 2.0\}$ realized every reference target to within 1e-4 relative error:

• α: dose relative to the RMS writer output norm. Slash-separated results follow the arm or dose order shown.

Qwen2.5-Math-7B dose sweep: mathematics

Qwen2.5-Math-7B dose sweep: knowledge and code

What the 6-model sweep shows, and what it does not:

• Unhealed composed edits match norm-matched random controls. Across all 6 models, composed_rms_1p0x stays within noise of random_rms_1p0x on GSM8K and MATH-500. Even when GSM8K rises from 18 (base) to 30 under composed_rms_1p0x on Qwen3-8B (unadjusted p = 0.017), random_rms_1p0x also rises to 30 (unadjusted p = 0.029). Both perturbations slightly shorten <think> chains on a model where 98 to 100 of 100 completions hit the 512-token cap; without the random control, that truncation shift would be misread as domain uplift.

• composed_healed (ProjectThenHealLinear) raises in-domain scores on the specialist models while keeping relative subspace leakage at 3.18e-17 to 5.07e-17. On Qwen2.5-Math-7B-Instruct, composed_healed_rms_1p0x raises GSM8K from 87 to 93 (6 gains, 0 losses vs. both base and composed_rms_1p0x, exact McNemar p = 0.031 unadjusted, Holm 1.0 across 110 tests). On Qwen2.5-Coder-7B-Instruct, composed_healed_rms_1p0x raises HumanEval from 36 to 42 (12 gains, 6 losses vs. base, p = 0.238; 11 gains, 5 losses vs. composed_rms_1p0x, p = 0.210; Holm 1.0) and partially recovers the unhealed edit’s MMLU-Pro drop (35 -> 29 unhealed vs. 31 healed). On DeepSeek-R1-Distill-Llama-8B, composed_healed_rms_1p0x raises HumanEval from 5 (base) and 4 (random_rms_1p0x) to 12 (10 gains, 3 losses vs. base, p = 0.092, Holm 1.0) by closing </think> before 512 tokens on 6 additional problems (93 truncated vs. 99 on base). On Qwen3-14B, math_rms_1p0x (16/100, p = 0.039 unadjusted) and composed_healed_rms_1p0x (15/100, p = 0.146) lift MMLU-Pro over base and random_rms_1p0x (9/100 each), while composed_healed_rms_1p0x increases GSM8K <think> truncation from 72 to 86 of 100 (46 -> 37).

• Direct heal-the-base (base_lora_1p0x) and healed-random (random_healed_rms_1p0x) controls isolate the LoRA adaptation pass from the subspace lock (lora-controls-20261109). To separate the effect of the 60-step AdamW LoRA fine-tuning pass on HEAL_TEXTS from the linear weight edit and the subspace lock, we ran two additional 60-step LoRA control arms across all four benchmarks (MATH-500, GSM8K, MMLU-Pro, HumanEval, n = 100 each, 400 items per model) using the identical optimizer hyperparameters (rank = 4, steps = 60, lr = 3e-3, seed = 20261106) and training texts: base_lora_1p0x (heal-the-base, unconstrained LoRA on the unedited base checkpoint) and random_healed_rms_1p0x (healed-random, ProjectThenHealLinear attached to random_rms_1p0x locking the 4-row random basis $D_{\text{rand}}$). On Qwen2.5-Math-7B-Instruct (qwen25_math_7b/receipt.json), both base_lora_1p0x (46 MATH-500, 93 GSM8K, 20 MMLU-Pro, 0 HumanEval, 159/400 pooled) and random_healed_rms_1p0x (46 MATH-500, 93 GSM8K, 18 MMLU-Pro, 0 HumanEval, 157/400 pooled) match composed_healed_rms_1p0x (44 MATH-500, 93 GSM8K, 17 MMLU-Pro, 0 HumanEval, 154/400 pooled; GSM8K $b = 3, c = 3$, exact two-sided McNemar $p = 1.0000$; pooled $p = 0.4244$ and 0.7011). Thus the 87% -> 93% GSM8K gain on Qwen2.5-Math-7B-Instruct is completely accounted for by the 60-step AdamW LoRA pass on the calibration texts rather than the linear domain edit or the lock, while ProjectThenHealLinear reduces relative leakage into the protected domain subspace $D_{\text{domain}}$ from 4.75% (base_lora_1p0x) and 4.58% (random_healed_rms_1p0x) down to 5.08e-17 (composed_healed_rms_1p0x) without costing any of that 93% accuracy. By contrast, on Qwen2.5-Coder-7B-Instruct (qwen25_coder_7b/receipt.json), neither base_lora_1p0x (39 MATH-500, 82 GSM8K, 31 MMLU-Pro, 37 HumanEval, 189/400 pooled) nor random_healed_rms_1p0x (42 MATH-500, 84 GSM8K, 38 MMLU-Pro, 35 HumanEval, 199/400 pooled) reproduces the 42 / 100 HumanEval score of composed_healed_rms_1p0x (45 MATH-500, 80 GSM8K, 31 MMLU-Pro, 42 HumanEval, 198/400 pooled; HumanEval +5 net items over base_lora_1p0x, discordant (6, 11), exact two-sided McNemar $p = 0.3323$; +7 net items over random_healed_rms_1p0x, discordant (7, 14), $p = 0.1892$; MATH-500 +6 net items over base_lora_1p0x, discordant (0, 6), $p = 0.03125$; pooled $p = 0.2717$ and 1.0000), though at $n = 100$ the difference remains within single-benchmark sample noise while ProjectThenHealLinear reduces $D_{\text{domain}}$ leakage from 3.69% to 3.34e-17. None of the individual paired McNemar tests survives Holm-Bonferroni correction across the full multi-arm test family.

• Calibration is exact at the reference inputs only. On benchmark prompts the composed edit’s mean prefill shift along each direction is 0.5% to 14.8% of the base output norm, not 1.0x. The random control’s shifts along its own directions agree with these to within 0.01% of the base norm.

4.5 H100 ASAN-120: Paired Vulnerability and Patched-Benign Twins, 9 Models × 7 Arms¶

Vulnerable-only benchmarks such as ASan-30 cannot distinguish a genuine C/C++ vulnerability detector from a rubber-stamping model that labels every snippet VULNERABLE. To measure both sensitivity (TPR) and patched-twin specificity (TNR), we constructed ASAN-120 (archived benchmark artifact h100-scaleup-20261105/asan120/asan120_paired_benchmark.json, SHA-256 4276cbd2...20eb): 60 vulnerable C/C++ functions paired with 60 minimally patched benign twins across 12 CWE bug classes (5 matched pairs per class: CWE-122 heap overflow, CWE-121 stack overflow, CWE-416 use-after-free including std::vector reallocation, CWE-190 integer overflow, CWE-195 sign conversion, CWE-193 off-by-one, CWE-476 null dereference, CWE-415 double free, CWE-908 uninitialized read under MSan, CWE-617 assert-only check elided under -DNDEBUG, CWE-843 type confusion, and CWE-674 unbounded recursion). Every pair was compiled and executed across a 4-way compiler matrix (gcc -O0, gcc -O2, clang -O0, clang -O2 with ASan+UBSan and -DNDEBUG, plus clang MSan for CWE-908; validation.json SHA-256 adfe3d82...c9ca, 60/60 PASS): each vulnerable twin is silent on a legitimate driver and triggers the expected sanitizer fault on a crafted driver, while each patched twin is silent on both.

Across 9 models (0.8B to 32.8B) and 7 steering arms (base, calibrated_1p0x, random_1p0x, composed_rms_0p5x, random_rms_0p5x, composed_rms_1p0x, random_rms_1p0x; 63 arms, 7,560 completions on H100, greedy batch 16, max_new_tokens = 1536, restored = True bit-exact after every arm, receipt asan120-receipt.json / asan120_results.json SHA-256 cc5a7d40...bb9b, 0 re-score mismatches), each item is scored for binary verdict (TPR on the 60 vulnerable snippets, TNR on the 60 patched twins, balanced accuracy $\mathrm{BA} = (\mathrm{TPR}+\mathrm{TNR})/2$, Matthews correlation $\mathrm{MCC}$, and pair where both twins in a pair are classified correctly) and strict root-cause recall (RC), which credits a vulnerable item only when the model outputs VULNERABLE, names the gold CWE bug class (class), and names the faulting sink symbol (sink). Unclosed <think> chains (cap) are scored as errors (0 credit on RC).

• Cell order: base / c0.5 / r0.5 / c1.0 / r1.0; c is composed RMS editing and r is its norm-matched random control. The suffix is the RMS-relative dose.

• TPR: vulnerable-item sensitivity; TNR: patched-twin specificity; BA: balanced accuracy; MCC: Matthews correlation.

• RC: strict root-cause recall (verdict + class + sink); pair: both twins correct; parsed: parsed-answer fraction; cap: unclosed think-chain fraction.

• A single value or range in the last table retains the original summary across arms; cap is shown only where reported.

ASAN-120: verdict quality and specificity

ASAN-120: root cause and paired controls

What the paired ASAN-120 evaluation establishes:

• Patched benign twins expose one-sided rubber-stamping in non-reasoning models (0.8B to 8B). Without <think> chain-of-thought reasoning, all five non-reasoning checkpoints collapse to near-chance balanced accuracy (BA = 0.475 to 0.533, RC <= 0.067): Qwen3.5-0.8B (TNR = 1.000, TPR = 0.000), Qwen2.5-7B (TNR = 0.850-0.867, TPR = 0.100-0.117), and Mistral-7B-v0.3 (TNR = 0.717, TPR = 0.300-0.350) default toward SAFE, whereas SmolLM2-1.7B (TPR = 0.950-0.983, TNR = 0.000) and Llama-3.1-8B (TPR = 0.933-0.967, TNR = 0.033-0.067) rubber-stamp almost every function VULNERABLE. On a vulnerable-only benchmark, Llama-3.1-8B’s 93.3% positive rate looks like high sensitivity; paired TNR (5.0% on base, 6.7% on composed_rms_1p0x) and pair accuracy (3.3%) show that it rarely clears a patched fix.

• At 1.0x RMS dosing, composed_rms_1p0x beats its norm-matched random control random_rms_1p0x on 6 of 9 models (6W / 1L / 2T, exact sign-test p = 0.1250, mean dBA = +0.017), including all 4 of 4 <think> reasoning models (4W / 0L / 0T on BA and MCC):

  • On Qwen3-14B, composed_rms_1p0x lifts strict root-cause recall RC from 0.450 (base, 27/60) and 0.467 (random_rms_1p0x, 28/60) to 0.550 (33/60, +10.0 pp over base, +8.3 pp over random_rms_1p0x), CWE bug-class recall from 0.500 to 0.617 (+11.7 pp), sink recall from 0.567 to 0.617 (+5.0 pp over base, +8.4 pp over random_rms_1p0x), and TPR from 0.633 to 0.700 (+6.7 pp), while beating random_rms_1p0x on BA (0.550 vs. 0.525) and twin-pair accuracy (0.267 vs. 0.217).

  • On DeepSeek-R1-Distill-Llama-8B, composed_rms_0p5x lifts TPR from 0.600 (base) to 0.717 (+11.7 pp), BA from 0.417 to 0.483 (+6.6 pp), and sink recall from 0.350 to 0.500 (+15.0 pp) while cutting <think> cap truncations from 38/120 to 33/120; composed_rms_1p0x lifts RC from 0.183 (base) and 0.133 (random_rms_1p0x) to 0.250 (+6.7 pp over base, +11.7 pp over random_rms_1p0x) and raises pair accuracy from 0.067 (base) and 0.083 (random_rms_1p0x) to 0.167 (+10.0 pp over base, +8.4 pp over random_rms_1p0x).

  • On Qwen3-32B, composed_rms_1p0x achieves the highest patched-twin specificity (TNR = 0.550, +5.0 pp over base 0.500, +13.3 pp over random_rms_1p0x 0.417), highest <think> completion rate (89/120 parsed, cap = 35 vs. 42 on random_rms_1p0x), and beats random_rms_1p0x on BA (0.642 vs. 0.592, +5.0 pp) and pair (0.383 vs. 0.333, +5.0 pp), while at 0.5x random_rms_0p5x (BA = 0.667, RC = 0.683) exceeds composed_rms_0p5x (BA = 0.567, RC = 0.633, unadjusted McNemar p = 0.0169, Holm p = 0.2197).

  • On Qwen3-8B, where 54% to 62% of generations hit the 1,536-token <think> cap, composed_rms_1p0x beats random_rms_1p0x across BA (0.367 vs. 0.342), TPR (0.450 vs. 0.433), TNR (0.283 vs. 0.250), RC (0.317 vs. 0.283), pair (0.150 vs. 0.100), and completed <think> chains (55/120 vs. 48/120).

• Scope, pair-resampled intervals, and multiple-comparison boundary. Six of the nine models (Qwen3.5-0.8B, SmolLM2-1.7B, Mistral-7B-v0.3, Qwen2.5-7B, Llama-3.1-8B, Qwen3-32B) use the heuristic writer layer round(0.67 * n_layers) recorded in asan120-receipt.json rather than a pre-pinned writer from domain-uplift-models.json. Against base, the retained 95% pair-resampled bootstrap intervals (asan120_results.json) for composed_rms_1p0x strict root-cause recall change are +10.0 pp ([0.0, +21.67]) on Qwen3-14B and +6.67 pp ([-5.0, +18.33]) on R1-Llama-8B, while Qwen3-32B balanced accuracy changes by 0.0 pp ([-9.17, +9.17]). Across all 117 paired exact two-sided McNemar tests on verdict correctness (9 models $\times$ 13 comparisons per model, n = 120 per test), no single-model comparison survives within-model or global Holm-Bonferroni correction at $\alpha = 0.05$ (min within-model p_Holm = 0.2197 across 13 tests on Qwen3-32B; global 117-test p_Holm = 1.0), and across the 9-model sign tests (calibrated_1p0x minus random_1p0x: +3/-2/0:4, p = 1.000; composed_rms_0p5x minus random_rms_0p5x: +3/-3/0:3, p = 1.000; composed_rms_1p0x minus random_rms_1p0x: +6/-1/0:2, p = 0.125), the 1.0x RMS directional advantage is consistent across the reasoning cohort (4/4) but below the 9-model exact sign-test significance threshold. Pairwise surface heuristics that see both twins simultaneously (longer snippet is safe: 0.8583; more lines: 0.7500; more conditionals: 0.6750) drop to near-chance item-level safe-label AUCs (0.5735, 0.5415, and 0.5578) when evaluated one snippet at a time under the model task format.

Table 4C: ASAN-120 Descriptive Breakdown Across All 12 CWE Families (Vulnerable Detections / Patched-Benign Clearances Out of 45 = 9 Models $\times$ 5 Pairs per Family)

4.5.1 Real-World Upstream C/C++ Vulnerability Twin Suite (ASAN-RealWorld-60 / ASAN-180)¶

To verify that the paired-twin findings on ASAN-120 hold on production C/C++ parser and runtime functions rather than only standalone constructed templates, we built ASAN-RealWorld-60 (data/asan_realworld_60/asan_realworld_60_paired_benchmark.json, SHA-256 7aaf5593da3f9f84a5df8d77102966ce223a753f7d4d647a1292df1b5f33a151; combined 180-item suite asan180_combined_benchmark.json, SHA-256 526db767cb21a8df4315377c2f7089f79f2d31a103df8bcc71fc5f938630e7cb): 30 sanitizer-reproduced upstream C/C++ vulnerabilities (RW01..RW30) paired with their 30 exact upstream patches (60 functions, mean pre/post twin similarity 89.4%) drawn from 16 production open-source repositories (freetype/freetype, protocolbuffers/protobuf, pnggroup/libpng, openxla/xla, harfbuzz/harfbuzz, AOMediaCodec/libavif, lz4/lz4, google/flatbuffers, libjxl/libjxl, google/XNNPACK, vllm-project/vllm, mlc-ai/xgrammar, onnx/onnx, opencv/opencv, openvinotoolkit/openvino, apache/arrow, and tensorflow/tensorflow; sealed provenance manifest asan_realworld_60_manifest.json, SHA-256 d4ac48b0d9ed9414d4bd06a46322a76b083576fd97a071db969e0c263dc21d08). Every pair was compiled and verified across 360 binary runs (clang++ -O0, -O1, and -O2 with -fsanitize=address,undefined -fno-sanitize-recover=all; validation_receipt.json SHA-256 f64ea55205fb8c36e42e1b46a2c071a21e3a2c7fc4dacc526fcdb0d6b9c7577a, 30 / 30 pairs PASS): every unpatched function (RW*-V) faults at its @SINK / @ROOT line on --trigger and exits 0 on --control, while every patched twin (RW*-S) exits 0 on both.

Evaluating four 0.8B–4B checkpoints across 18 arms (1,080 completions, asan_realworld_60_results.json SHA-256 59402d8fb6627ba08c3a399d97e57a5ac75ecf229ccd727019979536cd138ba8, 0 re-score mismatches, bit-exact weight restoration verified after every arm) reproduces both ASAN-120 behaviors on real upstream code:

1. Sub-2B checkpoints collapse to one-sided priors on real upstream C/C++ code: Qwen3.5-0.8B labels 100% of upstream functions SAFE (TPR = 0.0%, TNR = 100.0%, RC = 0.0%), while SmolLM2-1.7B-Instruct labels 96.7%–100.0% VULNERABLE (TNR = 0.0%, FPR = 100.0%, RC = 0.0%).

2. Qwen3.5-4B achieves non-zero strict root-cause recall (RC = 10.0%) and 43.3% sink localization on real upstream bugs: Only the 4B reasoning model achieves non-zero 3-criterion root-cause attribution (RC = 10.0%, Class Acc = 16.7%, Sink Acc = 43.3%), while neither calibrated_1p0x nor composed_rms_1p0x significantly outperforms base or norm-matched random controls (all exact two-sided McNemar p >= 0.125), matching the ASAN-120 null result for small models.

4.6 Focused Dose-Response Case Study: Qwen3.5-4B (Regime B)¶

Alongside the multi-model sweeps, this single-model case study isolates how changing the loop-edit dose affects completion and attribution. This test gives the same 30 crash traces to each edited model with a 1,536-token limit. “Closed” means the model emitted </think> within that limit. The other columns score the final answer’s bug class, culprit frame, and root cause separately. A completed answer can still be wrong. The dose changes only B1 in the a05 and a15 arms. Strict scoring requires a committed answer after </think>. In the reported copy-the-input control, a whole-output keyword matcher scored the raw prompt 28/30, while strict scoring gave it 0/30; merely repeating a function name is not correct attribution.

• Model: Qwen3.5-4B; 30 prompts per arm; 1,536-token cap (data/multiseed_and_dose_20261109/qwen35_4b_dose_and_rand3_receipt.json, sha256: eae628d0...a5ca).

• Arms: base / rand1 / rand2 / rand3 (3-seed equal-norm random ensemble, seeds 20261105..20261107, 0.0 ± 0.0 / 30); g030 (uncalibrated $\gamma = 0.30$ ported from 0.8B); a05, a06, a07, a08, a09 (B1 at $0.50\times$, $0.60\times$, $0.70\times$, $0.80\times$, and $0.90\times$; B2 and B3 held at $1.0\times$); b1only ($\alpha = 1.0\times$, loop edit only); cal738 ($\alpha = 1.0\times$, composed B1+B2+B3); a15 (B1 at $1.5\times$; B2 and B3 held at $1.0\times$).

• Closed means an emitted closing think tag; class, frame, and root cause require a committed final answer.

Dose and completion

Strict attribution

Sampling the interior 0.60x..0.90x interval (a06, a07, a08, a09) shows that loop closure rises as a monotonic ramp across [0.50x, 1.50x] rather than a discontinuous step (0/30 at 0.50x -> 2/30 at 0.60x -> 5/30 at 0.70x -> 12/30 at 0.80x -> 14/30 at 0.90x -> 21/30 at 1.00x -> 30/30 at 1.50x), while mean generated tokens fall monotonically (1,536 -> 1,491 -> 1,430 -> 1,318 -> 1,210 -> 954 -> 789) and strict attribution tracks closure (0/30 -> 1/30 -> 3/30 -> 8/30 -> 8/30 [10/30 class and frame] -> 14/30 -> 19/30). Exact two-sided McNemar tests against base: a08 loop closure $p = 4.88 \times 10^{-4}$ (12 vs. 0 discordant pairs); a09 loop closure $p = 1.22 \times 10^{-4}$ (14 vs. 0 discordant pairs); cal738 loop closure $p = 9.54 \times 10^{-7}$ (21 vs. 0 discordant pairs); a15 loop closure $p = 1.86 \times 10^{-9}$ (30 vs. 0 discordant pairs). Comparing a15 vs. cal738: loop closure $p = 0.0039$, culprit frame $p = 0.0078$.

Direct 4-Arm MATH-500 Attribution on Qwen3.5-0.8B: What the Test Tells Us in Plain Words¶

To compare template-level <think> bypassing (enable_thinking=False) against weight-space loop suppression (secant_b1_edit) and an orthogonal norm-matched random control (random_norm_matched) on the exact Qwen/Qwen3.5-0.8B (revision 2fc06364..., sha256 04b1c301...) and HuggingFaceH4/MATH-500 (revision 6e4ed1a2...) model-dataset pair studied by Takehi et al., we ran a controlled 4-arm evaluation (n = 100, max_new_tokens = 4,096, BF16, greedy decoding, seed 20261108, lm_eval 0.4.13 minerva_math math_verify, receipt qwen35_08b_thinking_off_vs_edit_receipt.json, sha256 bc3c982e...c13b):

In plain words, this 4-arm comparison establishes three points:

1. A weight edit does not teach a model new math (base_thinking_off vs. base_thinking_on): Qwen3.5-0.8B already knew how to solve 48.0% of MATH-500. With <think> enabled, 99 / 100 baseline runs get stuck repeating themselves inside <think> and fail to emit </think> within 4,096 new tokens (1.0% post-</think> accuracy; 12.0% whole-response). Setting enable_thinking=False lifts accuracy to 48.0% (47 vs. 0 discordant pairs, exact two-sided McNemar $p = 1.42 \times 10^{-14}$, Holm-adjusted $p = 7.11 \times 10^{-14}$), matching Takehi et al.'s 32,768-token edited score (48.1%) consistent with single-shot weight subtraction unblocking pre-existing capability rather than injecting new math skill.

2. Our B1 loop edit is a real mechanism across 3 random direction seeds (secant_b1_edit vs. random_norm_matched seed_1..seed_3, receipt SHA-256 f7da8318...6dc2): Because the B1 edit direction is a deterministic mean difference over the fixed calibration set and evaluation uses greedy decoding (temperature = 0), secant_b1_edit is a single deterministic run while the 3-seed ensemble varies the random control direction (seed_1..seed_3). Unlike Qwen3-8B on GSM8K (where <think> loops are mild enough that a norm-matched random edit matches the targeted edit at 30/100), on Qwen3.5-0.8B MATH-500 three independent orthogonal random direction seeds (seed_1 = 20261108, seed_2 = 20261109, seed_3 = 20261110, each orthogonal to B1 with matched Frobenius norms 1.7489 and 1.3988 on the exact same 64 columns of layers 15 and 19) close only 2 / 100, 6 / 100, and 1 / 100 <think> traces (mean 3.0% ± 2.6%, 0 / 100 closed by $\ge 2/3$ majority vote across random seeds) and score 0.0%, 2.0%, and 1.0% post-</think> (mean 1.0% ± 1.0%, 0 / 100 solved by $\ge 2/3$ majority vote; whole-response 18.0%, 16.0%, and 19.0%, mean 17.7% ± 1.5%). By contrast, secant_b1_edit lifts </think> closure to 64 / 100 (64.0%) (exact two-sided McNemar $p \le 4.74 \times 10^{-15}$, Holm-adjusted $p \le 3.32 \times 10^{-14}$ against every random seed) and post-</think> accuracy to 24.0% (24/0, 24/2, and 24/1 discordant pairs against seed_1..seed_3, exact two-sided McNemar $p = 1.19 \times 10^{-7}$, $1.05 \times 10^{-5}$, and $1.55 \times 10^{-6}$, Holm-adjusted $p \le 8.39 \times 10^{-5}$ across all 3 seeds; whole-response 31.0% vs. 12.0% base, $p = 6.60 \times 10^{-5}$). Under the 4,096-token budget, 36 / 100 secant_b1_edit traces did not emit </think> within the budget (31 at the text cap, 4 ended early without closing, 1 re-tokenized over the cap), explaining the gap between 24.0% at 4,096 tokens and 48.1% at 32,768 tokens. Across the 100 paired items, 5 of the 24 problems solved by secant_b1_edit were problems that base_thinking_off (48.0%) missed (19 solved by both, 29 only by base_thinking_off, 5 only by secant_b1_edit).

3. Why not just turn <think> off everywhere? As Section 4.5 (ASAN-120) shows below, models without <think> collapse to one-sided guessing on paired C/C++ vulnerability auditing (BA = 0.475 to 0.533, 93% to 100% false-positive rate on patched code for Llama-3.1-8B and SmolLM2-1.7B, <= 6.7% root-cause recall across all 5 non-reasoning models), whereas keeping <think> enabled with calibrated B1 + B2 + B3 surgery beats random controls on 4 / 4 reasoning models and lifts Qwen3-14B strict root-cause recall from 45.0% to 55.0%. Furthermore, distilled reasoning models (DeepSeek-R1-Distill-Qwen-7B, DeepSeek-R1-Distill-Llama-8B) and raw .gguf files have no enable_thinking=False template switch.

Section 4 takeaway: Each study supports its own claim. Calibration matched the requested shift on all 15 Stage-1 models. Project-Then-Heal kept local leakage at the float32 floor (float64 floor 3.18e-17 to 5.07e-17 in the RMS sweep) on every model where gradient projection did not. On 14 models, the calibrated 1.0x edits left public-benchmark scores within about 2 pooled points of base, as equal-size random edits did, with a pooled MMLU-Pro cost of 2.0 points and no significant crash-triage gain. Across 6 models in the RMS-relative dosing sweep (24,000 evaluations), sizing edits by $\sigma_{\text{writer}}$ (5.85 to 78.15) showed that unhealed composed edits match norm-matched random controls. Direct 60-step heal-the-base (base_lora_1p0x) and healed-random (random_healed_rms_1p0x) controls show that on Qwen2.5-Math-7B-Instruct the 87 -> 93 GSM8K gain comes from the 60-step LoRA adaptation pass (93/100 on both controls, p = 1.000, consistent with the LoRA pass driving the accuracy lift), while ProjectThenHealLinear (composed_healed_rms_1p0x) reduces domain-subspace leakage from 4.75% to 5.08e-17 at zero accuracy cost; on Qwen2.5-Coder-7B-Instruct HumanEval, composed_healed_rms_1p0x (42/100) vs. base_lora_1p0x (37/100, p = 0.332) and random_healed_rms_1p0x (35/100, p = 0.189) is within sample noise at n = 100, while the lock reduces domain leakage from 3.69% to 3.34e-17. Finally, on the paired ASAN-120 vulnerability and patched-benign twin benchmark (9 models $\times$ 7 arms, 7,560 evaluations), benign controls expose trivial one-sided predictions (BA ≈ 0.50) across all 5 non-reasoning models, whereas on the 4 <think> reasoning models composed_rms_1p0x beats random_rms_1p0x 4/4 on balanced accuracy (6W / 1L / 2T overall, sign-test p = 0.125) and lifts strict root-cause recall (RC) by +6.7 to +10.0 percentage points over base on DeepSeek-R1-Distill-Llama-8B (0.183 -> 0.250) and Qwen3-14B (0.450 -> 0.550).

5. Static Weight Auditing¶

Sections 1 to 4 edit weights. This section uses the same readers to inspect weights someone else may have edited, without running the model. Every number below comes from a receipt whose inputs were hashed before and after each run (pre_sha256 == post_sha256). That is a non-adversarial host-filesystem bracket, not descriptor-bound execution.

5.1 Spectral Trojan Auditing and the Vocabulary Phase Transition¶

secant audit-trojan (secant read --detect-anomalies --marchenko-pastur) implements a two-stage static spectral detector:

1. Stage 1 (Iterated Outlier Singular-Value Peeling & Row/Column Spike Detection): Iteratively peels outlier singular values ($\sigma_i > \sigma_{MP}$) from the total Frobenius energy ($\lVert W\rVert_F^2 - \sum_{i=1}^k \sigma_i^2$, the exact Frobenius energy of the rank-$k$ ablated matrix $W - \sum_{i=1}^k \sigma_i u_i v_i^\top$) until the residual Marchenko-Pastur bulk edge $\sigma_{MP} = \sigma_{\text{entry}}\sqrt{d_{\text{out}}}(1 + \sqrt{d_{\text{in}}/d_{\text{out}}})$ reaches a fixed point (mp.rs), and checks row/column norm spikes (zero_rows, collapsed_rows, spike_cols).

2. Stage 2 (Cross-Layer Sibling Modified Z-Score & Vocabulary Token Projection): Because natural trained weight matrices are heavy-tailed and first/last transformer blocks (layers.0 and the final block) interface directly with token embeddings, Stage 2 compares each tensor’s peeled $\sigma_1/\sigma_{MP}$ ratio against its architectural layer family (blk.*.ffn_down.weight, model.layers.*.mlp.down_proj.weight) via the Iglewicz-Hoaglin modified z-score (sibling_outlier when $z > 3.5$ in a family of $\ge 4$ layers), while --vocab-tensor projects the leading left singular vector $u_1$ onto the unembedding matrix ($E \cdot u_1$) to surface its top promoted vocabulary tokens.

Trained weight matrices are non-i.i.d. and already sit well above the Marchenko-Pastur bulk edge on unedited checkpoints, so $\sigma_1/\sigma_{MP}$ serves as a relative ranking feature paired with the cross-layer sibling modified-Z test and --vocab-tensor projection rather than a standalone i.i.d. threshold. To measure when these signals fire, a rank-1 edit $\Delta W = \theta\,\hat e_T\, c^\top$ was planted in the layer-12 MLP down projection of SmolLM2-1.7B-Instruct (SafeTensors, family_size = 24) and Qwen3.5-4B (BF16 GGUF, where blk.*.ffn_down.weight has family_size = 33 because llama.cpp exports the 32 decoder blocks blk.0..31 plus blk.32, the Multi-Token Prediction / MTP blk.32.nextn.* head block). Here $\hat e_T$ is the unit embedding row of a trigger token, and $c$ spreads equal weight over 16 evenly spaced input columns. The edit was planted at 12 relative Frobenius doses $g = \lVert\Delta W\rVert_F/\lVert W\rVert_F$ from 0 to 16%.

A rank-1 edit’s only singular value is $\sigma_{\text{trojan}} = \lVert\Delta W\rVert_2 = \lVert\Delta W\rVert_F = g\lVert W\rVert_F$. The standalone singular-value equality reference (nominal crossover) where the planted perturbation’s spectral norm equals the unedited matrix’s leading singular value $\sigma_1(W)$ is:

which is 8.65% for SmolLM2 and 6.57% for Qwen. Because $\Delta W$ and $W$ are not orthogonal in general, the exact dose at which the top singular vector of $W + \Delta W$ aligns with the trigger direction depends on the overlap between $\Delta W$ and the leading singular triplets of $W$; empirically, the discrete post-hoc dose sweep (4%, 6%, 8%, 10%, 12%) brackets $g^*$ on both models.

The vocabulary jump happens across the sampled doses bracketing $g^*$: $\cos(u, u_1)$ goes from 0.168 to 0.991 between 6% and 8% on Qwen ($g^* = 6.57\%$), and from 0.569 to 0.984 between 8% and 10% on SmolLM2 ($g^* = 8.65\%$). Well below $g^*$ the planted direction is nearly absent from $u_1$ ($\cos < 0.17$ at 6% on both models). Close to $g^*$ the two directions mix (SmolLM2 at 8%: $\sigma_{\text{trojan}}/\sigma_1 = 0.92$, $\cos = 0.569$). Above $g^*$, $u_1$ aligns with the planted direction ($\cos > 0.98$). The automatic sibling test needs a further 39% to 83% of $\sigma_1$ beyond that ($\sigma_{\text{trojan}}/\sigma_1$ = 1.39 and 1.83 at the first flag). Excluding the MTP head block blk.32 (32-tensor decoder family blk.0..31) on Qwen3.5-4B leaves the 12% sibling-outlier crossover dose unchanged while raising blk.12’s modified z-score from 2.43 to 2.85 at 10%, from 3.58 to 4.21 at 12%, and from 5.92 to 6.94 at 16% (0 / 32 false positives on the unedited base). Full 12-dose tables: payload checks, Section 5.1.