Semantic Fibers and Cross-Gram Interference: A Calculus of Safety Drift in Overcomplete Representations
Mohammed Ahnouch, Lotfi Elaachack
cs.LG · cs.AI
Quick verdict
Rigorous linear-algebra calculus for cross-lingual safety drift; proofs sound and audits strong, but evidence is synthetic plus one small encoder pilot.
Summary
The paper formalizes cross-lingual safety drift — a model refusing a harmful request in English while complying with its faithful translation — as exact linear algebra on a declared local model. Fixing an externally audited equivalence relation (semantic fibers), a layer representation h=Wz, a feature dictionary, and a linear head, the authors show same-fiber margin drift is a cross-Gram functional (Prop. 1), worst-case drift is a support function (Prop. 3), and margin invariance is an annihilator condition. They define intrinsic calibrated exposure χ_B via a leverage duality χ²=1/ℓ−1 and split observed drift into three regimes: reader fault (recalibrate), ill-conditioned exact fix (regularize), and representation-level collision (no readout repair). Deterministic synthetic audits show identical observed exposure (ρ=0.880) with opposite repair verdicts; intrinsic exposure predicts repair floors (Spearman 0.972), conditioning predicts usable repair (0.889), and an untied order-swap residual predicts composition errors out of sample (median 0.964 vs 0.269 for a static baseline). Two closed-form head repairs and sharp floors (n(n−r)/r) complete the calculus. A pilot on one real multilingual encoder (300 FLORES fibers, d=384) lands in the conditioning regime. Main limitations: all quantitative validation is synthetic by construction; real-model evidence is a single small benign-text pilot with no actual refusal behavior or jailbreak evaluation.
Review complete
Assessment at a glance
4
risk flags identified
● high 0
● medium 2
● low 2
5 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- For a declared quotient, representation, metric, dictionary, head, threshold and contrast model, same-fiber margin drift is exactly a cross-Gram functional and margin invariance is an annihilator condition (Props. 1–3).
- Intrinsic calibrated exposure χ_B, governed by the leverage duality χ²=1/ℓ−1, separates observed drift into three diagnostically distinct regimes — reader fault, ill-conditioned exact fix, representation collision — with identical observed exposure possible under opposite verdicts (Thm. 6, Prop. 7, Table 1).
- An untied order-swap residual estimated on calibration states predicts three-control composition error on unseen states and targets (median Spearman 0.964 vs 0.269 for a static cross-Gram baseline).
- Reader-side repair meets sharp limits: reader-optimized cross-talk is floored at n(n−r)/r (attained at equal leverage), and a column permutation moves block exposure while fixing the entire Gram spectrum, so aggregate spectra never locate exposure (Thm. 12).
- On a real multilingual encoder pilot the diagnosis lands in the conditioning regime: the exact invariant reader (norm 4.9) fails out of sample while a validation-selected regularized reader (norm 1.07) reduces drift at preserved English-score correlation 0.92.
Strengths
Exact, checkable theory with operational payoff
Every quantity (drift functional, support-function certificate, χ_B via leverage duality χ²=1/ℓ−1 in Thm. 6, order-swap identity in Thm. 8) is closed-form with inline proofs; the Cauchy–Schwarz and Moore–Penrose arguments check out as written.
Matched-exposure benchmark is the right experiment
Table 1 holds ρ=0.880 and deployed drift 0.518 identical across three geometries (scores matched to 2.22×10⁻¹⁵), then shows held-out repair verdicts diverge (drift reductions 71.0%/12.7%/−0.0%; exact reader 99.99% vs 52.16% BAcc) — directly proving behavioral observables underdetermine remediation.
Out-of-sample evaluation discipline
Exceptional reproducibility statement
Honest scope and budget relativity
Weaknesses
External validity gap on the safety claim
No empirical baseline comparison despite conceptual positioning
Key extensions stated but unaudited
Thin base for headline correlations and no sensitivity sweeps
Presentation glitches
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
The paper formalizes cross-lingual safety drift — refusal of a harmful request in English while complying with its faithful translation — inside a declared local linear model: h(x) = Wz(x) + ε, a linear head u with margin M(x) = u⊤h − τ, and an externally audited equivalence relation ("semantic fibers"). Claims are deliberately conditional: every quantity is computed "for a declared quotient, representation, metric, dictionary, head, threshold and contrast model." The central results: (i) same-fiber drift is exactly the functional v⊤(z−z′) with v = W⊤u, and margin invariance is the annihilator condition v ∈ Cs⊥ (Prop. 1); (ii) worst admissible drift is a support function hA(−v), with metric-specific constants ρu,B, κu,B, σΔ (Props. 2–3); (iii) intrinsic calibrated exposure χB, tied to relative leverage by χ²B = 1/ℓB − 1, partitions failures into reader fault / ill-conditioned exact fix / representation collision (Thm. 6, Prop. 7); (iv) an untied order-swap identity (Thm. 8) turns interventions into a test of the linear control interface; (v) two closed-form head repairs (Props. 10–11) and two sharp limits — the n(n−r)/r cross-talk floor attained at equal leverage, and non-identification of block exposure by the Gram spectrum under column permutation (Thm. 12). The Scope section candidly states the synthetic study fixes dictionaries by construction and treats "language" as an abstract block.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 4 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What problem does this paper solve?
It explains why a language model may refuse a harmful request in English yet comply when the same request is faithfully translated. The paper models the refusal score as a linear readout of the model's internal representation and computes exactly how same-meaning language changes move that score. It then tells an engineering team whether the problem can be fixed by editing the scoring head alone (recalibration or regularization) or whether it is built into the representation and requires deeper work.
What are the three regimes in the paper's diagnosis?
(1) Reader fault: the deployed scoring head unnecessarily listens to language-variation directions; recalibration or a least-change projection removes the drift. (2) Conditioning problem: a perfectly invariant head exists algebraically, but its huge norm amplifies noise, so the exact fix is unreliable and a regularized reader is the practical answer. (3) Intrinsic collision: the safety direction lies inside the span of language variation, so no head-side repair can remove the response; the representation itself must change.
Was the theory tested on real models?
Only partially. All quantitative validation uses deterministic synthetic geometries where the ground truth is known by construction. One small pilot runs on a real public multilingual sentence encoder (384 dimensions) using 300 professionally translated FLORES-200 sentences, one layer, and a synthetic zero-shot query direction as the score. No actual LLM refusal behavior, harmful prompts, or jailbreak attacks were evaluated.
What is intrinsic exposure χ in this paper?
It is the smallest response to the nuisance language block that any calibrated reader can have, where calibrated means the reader returns a fixed value on the safety direction. It satisfies the identity χ²=1/ℓ−1 relating it to statistical leverage. High χ means no head-side repair can succeed; low χ together with a very large invariant-reader norm means the exact fix exists but is too ill-conditioned to trust, pointing to a regularized reader instead.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figures are accessible only through captions and in-text numbers; visual content could not be independently verified from the extraction.
- The abstract is truncated mid-sentence in the source text; key numbers were cross-checked against the introduction and Sec. 5.
- The companion manuscript on statistical generalization (Ahnouch 2026, cited as under review) could not be checked, so the generalization theory behind the regularization choices is unverified.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.