Written as a Record, Read as an Address: What a Forward Pass Leaves in an Operation's KV Cache
cs.CL
Quick verdict
Claims LLM forward passes write causally recoverable KV-cache records the model itself reads only as addresses; sound causal design, mostly synthetic tasks.
Summary
The paper asks what a transformer writes into its KV cache while reading an operation ('Swap the contents of Box F and Box B', 'a = b + 1') and how that content is later accessed. The authors split a forward pass into a frozen writer, which computes the cache, and a reader — the same network with a rank-16 LoRA active only at query and answer rows — whose attention to all state-description lines is masked, so anything the reader recovers must already be in the unmodified cache. On synthetic boxes and code tasks with Llama-3.2-1B, Llama-3.1-8B and Mistral-7B, base readers answer at most 0.06 of hidden-state queries versus 0.75–1.00 after isolation training, while ordinary fine-tuning on identical data stays near the base level. Recoverable information follows the operation's read/write footprint, confirmed on a held-out a = b + 1. Carrier transplants show the base model natively routes which visible line to read — by value, not name — and trained readers additionally decode the payload (the value the operation read) from a single operand-name token in layers 12–15 of 32 (Llama-8B) or 14–17 (Mistral). The recipe extends to ToMi and GSM8K but is bounded by training coverage and costs open-book accuracy. Limitations include the absence of a capacity-matched adapter control, NF4 quantization without a bf16 control, seed variance, and a mostly synthetic single-step scope.
Review complete
Assessment at a glance
5
risk flags identified
● high 0
● medium 2
● low 3
5 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Operation-span KV entries store information that is causally recoverable by a trained reader but that base models almost never retrieve (≤0.06 vs 0.75–1.00 across three models).
- What is recoverable follows the operation's read∪write footprint, confirmed on a held-out a = b + 1 where only addressed roles bind to donor values.
- The base model natively uses the operation-span carrier to route which visible line downstream computation reads — by value rather than by name.
- Isolation training preserves native routing and adds payload access read from a single operand-name token in mid-depth layers (12–15 of 32 in Llama-3.1-8B; 14–17 in Mistral-7B), the same site that holds the routing record.
- Learned access is bounded by training coverage of values and operations and costs open-book accuracy.
Strengths
Causal design that separates writing from reading
The frozen writer recomputes the cache without gradients at every step; the reader's LoRA touches only query/answer rows and masks are assertion-checked, so anything recovered under OP_ONLY provably pre-exists in the cache (Section 2, Figure 1). Appendix C rules out substitutes: a later filler span whose K/V attend to strictly more context supports only 0.055, and null-content donors drop readers to 0.013–0.040.
The right control arm, and its failure is informative
ORD fine-tuning sees identical pairs, schedules and seeds with nothing masked, yet stays near base (Table 2: q0 ≤ .094 on Llama-3.2-1B; ≤ .25 on 8B/Mistral), cleanly localizing the effect to the read view rather than supervision or extra optimization.
Role-resolved footprint with a held-out test
Sharp dissociation of routing and payload
Unusually candid boundary results
Weaknesses
Capacity confound on the trained reader
Post-hoc analytic choices in the flagship held-out result
Synthetic, single-step scope
Uneven cross-model replication
Quantization precision uncontrolled
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
The paper addresses a narrow but foundational question in mechanistic interpretability: when a decoder-only LLM reads an operation sentence ('Swap the contents of Box F and Box B', or 'a = b + 1'), what do the K/V entries written at that span contain, and how are they consumed downstream? The authors argue prior entity-tracking work establishes what models *use* (query-time rebinding rather than eager state updates), while probing and patching alone cannot establish what is *written* into the cache. Five claims: (1) operation-span KV entries hold causally recoverable records the base model rarely retrieves (base ≤0.06 vs isolation-trained 0.75–1.00, three models, Section 4.1); (2) recoverable content follows the operation's read∪write footprint, confirmed on a held-out 'a = b + 1' (Section 4.2); (3) the base model natively uses the carrier to route which visible line is read — by value, not by name (Section 4.3); (4) isolation training adds payload access read from the same operand-name token in mid-depth layers, 12–15 of 32 in Llama-3.1-8B and 14–17 in Mistral-7B (Section 4.4); (5) learned access is bounded by training coverage and costs open-book accuracy (Section 5).
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 5 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is 'isolation training' in this paper?
A training scheme where a frozen base model (the writer) computes the KV cache for a prompt, and a LoRA-adapted copy of the same network (the reader) is trained to answer while its attention to all state-description lines is masked, so it sees only the operation sentence. Anything the reader learns to recover must therefore already be encoded in the unmodified cache.
Do LLMs store world state in the KV cache after reading an update?
This paper shows the KV entries written at an operation sentence do contain a causally recoverable record — a trained reader can decode which variable the operation read and its value — but the base model itself uses that record mainly as an address, to choose which visible text to read, and almost never answers from it directly.
Which models and layers are involved?
Experiments use Llama-3.2-1B-Instruct (FP32), Llama-3.1-8B-Instruct and Mistral-7B-Instruct-v0.3 (both NF4-quantized). The payload is read from a single operand-name token in layers 12–15 of 32 for Llama-3.1-8B and layers 14–17 for Mistral-7B — the same site that holds the routing record.
Does the trained reader hurt normal model performance?
Yes, somewhat. Isolation-trained readers lose 0.105/0.168/0.017 of open-book accuracy on unseen code instances and much more on GSM8K (0.460–0.885 vs 0.970 open accuracy), and the learned access does not transfer to unseen operations or to answer values outside the training range.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figures are available only as captions and embedded numbers in the extracted text; visual layout and some plot-level details could not be inspected.
- Several cited works are dated 2026 (EMNLP/ICML 2026, arXiv 2026 preprints) and could not be verified offline.
- This is a v1 arXiv preprint with no peer-review record; the review judges the manuscript as submitted.
- Extraction appears complete (abstract through Appendix J), supporting high confidence.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.