Introduction
A language model may need to assist with a request, ask for missing information, or refuse. The appropriate choice depends on the facts available about the request and the policy governing allowed behavior. Internal activations, the numerical vectors computed inside a model, can inform monitoring and steering ([45 , 75 , 40 ] ). We study a controller that uses selected activation features to choose a response strategy, which the model then executes. A representation interface specifies the controller’s input. We ask whether the input supports appropriate choices, independently of how well a particular controller is trained.
Suppose a policy calls for assistance when authorization is verified and clarification when evidence is missing. If both cases give the controller identical inputs, it must use the same choice or distribution over choices. Refusing both may avoid unauthorized assistance but also withholds permitted help. The challenge is to distinguish missing information from a controller’s failure to use information that remains available.
A sparse autoencoder (SAE) learns to reconstruct an activation using relatively few active features ([24 , 31 , 47 ] ). A controller may receive only selected feature values or on/off indicators. Accurate reconstruction from the full code does not establish what the selected input preserves. A probe , a predictor fitted to the selected features, can fail because information is missing, its allowed rules are too restrictive, or its fitting is imperfect.
We compare the best controller using the interface with the best controller using the full audited state : the situation, governing policy, and recorded evidence. Both select from a fixed library of continuations , meaning response strategies that may react to later observations. The execution protocol, loss function, and state distribution are identical in each comparison. The loss evaluates safety and response quality; risk is average under the fixed state distribution. An interface is decision-sufficient when its minimum risk equals the minimum with full state information. The comparison builds on statistical decision theory and state abstraction [14 , 43 , 2 ] .
Let U U U V V V
U ⏟ full audited state ⟶ V ⏟ complete controller input ⟶ choice of continuation. \underbrace{U}_{\text{full audited state}} \longrightarrow\underbrace{V}_{\text{complete controller input}} \longrightarrow\text{choice of continuation.} full audited state U ⟶ complete controller input V ⟶ choice of continuation. Let Z Z Z S S S V = Z V=Z V = Z V = ( Z , S ) V=(Z,S) V = ( Z , S ) V V V S S S Z Z Z
We compare four risk levels: the minimum with full state information, the minimum with the interface, the minimum within an allowed family of rules using the interface, and the risk of the fitted rule. The successive differences measure information loss, rule restrictions, and fitting error, including estimation and optimization error. All three terms can be positive simultaneously. For a finite deterministic interface, states with identical input form a cell . Choosing the continuation with the smallest conditional average loss in each cell computes the minimum over all interface rules. The information gap is the best interface risk minus the minimum using the full state.
To explain the average information gap, we examine which states cannot share a decision. Consider three states with the same controller input whose optimal strategies are, respectively, clarification or assistance, clarification or refusal, and assistance or refusal. Every pair shares an optimum, but the group does not. Randomization cannot attain all three optima unless every strategy it selects with positive probability is optimal at every state. More generally, regret is loss above a state’s minimum. A group is compatible when one distribution over continuations keeps regret within a specified nonnegative tolerance at every state. A minimal conflict is an incompatible group that becomes compatible whenever one state is removed. To make every cell compatible, an interface must split each conflicting group across at least two cells.
We audit selected SAE features in Qwen2.5, SmolLM2, and Phi, with generation and scoring protocols specified for each model. With the policy supplied, the best controller using two selected on/off features still has higher human rating loss than the full state reference. On 96 SmolLM2 states from policy areas excluded from fitting, the gaps are 0.1166 and 0.1082 for two independently trained SAEs. The original 80-state sample gives gaps of 0.0345 and 0.0353 but includes fitting areas. Qwen2.5 comparisons vary the features, rule family, and fitting data separately; Phi retains positive gaps with policy supplied under two automatic evaluators. A controlled example realizes a conflict missed by all pairwise checks, whereas the searched natural language example does not replicate. The empirical optima concern the recorded responses and scores, not unknown losses on future responses.
Contributions
Exact diagnosis of decision loss. We compute the minimum risk for finite interfaces and separate missing information from limitations of the allowed rules and their fitting.
Group conflicts and interface requirements. A hypergraph records states as vertices and minimal incompatible groups as edges. For a library of m m m m m m
Evidence across inputs and outcome evaluations. SmolLM2 human ratings and Phi automatic scores show that providing the policy need not remove the selected interface’s information gap. Qwen2.5 comparisons separately examine rule restrictions and fitting.
Sections 2 and 3 develop the risk and conflict analyses. Sections 4 and 5 present the experiments, followed by related work, discussion, and conclusions. Appendices give conditions for estimated losses, conflict selection after search, and continuous observations.
Better rules or fitting can reduce loss above the interface’s optimum. Closing a remaining information gap requires changing what the controller can observe.
Decision Sufficiency and Exact Risk Analysis
We compare optimal risks under the same losses and continuation library, changing only the information available for selection. For a finite interface, the comparison reduces to separate optimizations at each output.
States, continuations, and permitted information
Fix a context x x x σ \sigma σ μ \mu μ U : = U x \mathcal{U} := \mathcal{U}_x U := U x U ∼ μ U \sim\mu U ∼ μ Π : = Π x = { π 1 , … , π m } \Pi:= \Pi_x = \{\pi_1, \ldots, \pi_m\} Π := Π x = { π 1 , … , π m } m ≥ 2 m \ge2 m ≥ 2 [ m ] : = { 1 , … , m } [m] := \{1, \ldots, m\} [ m ] := { 1 , … , m } π j \pi_j π j σ \sigma σ
The expected loss of continuation π j \pi_j π j u u u ℓ j ( u ) : = ℓ σ , x ( u , π j ) ∈ [ 0 , 1 ] \ell_j(u) := \ell_{\sigma,x}(u,\pi_j) \in[0,1] ℓ j ( u ) := ℓ σ , x ( u , π j ) ∈ [ 0 , 1 ] π j \pi_j π j
ℓ ∗ ( u ) : = min j ∈ [ m ] ℓ j ( u ) , e j ( u ) : = ℓ j ( u ) − ℓ ∗ ( u ) . \ell^{\ast}(u) := \min_{j \in[m]} \ell_j(u), \qquad e_j(u) := \ell_j(u) - \ell^{\ast}(u). ℓ ∗ ( u ) := j ∈ [ m ] min ℓ j ( u ) , e j ( u ) := ℓ j ( u ) − ℓ ∗ ( u ) . Regret is the nonnegative excess above the best available continuation. Zero regret need not mean zero loss.
Let Δ m : = { q ∈ [ 0 , 1 ] m : ∑ j = 1 m q j = 1 } \Delta_m := \{q \in[0,1]^m : \sum_{j=1}^{m} q_j = 1\} Δ m := { q ∈ [ 0 , 1 ] m : ∑ j = 1 m q j = 1 } q ∈ Δ m q \in\Delta_m q ∈ Δ m π j \pi_j π j q j q_j q j
ℓ ( u , q ) : = ∑ j q j ℓ j ( u ) , e ( u , q ) : = ℓ ( u , q ) − ℓ ∗ ( u ) = ∑ j q j e j ( u ) . \ell(u,q) := \sum_j q_j\ell_j(u), \qquad e(u,q) := \ell(u,q) - \ell^{\ast}(u) = \sum_j q_je_j(u). ℓ ( u , q ) := j ∑ q j ℓ j ( u ) , e ( u , q ) := ℓ ( u , q ) − ℓ ∗ ( u ) = j ∑ q j e j ( u ) . Randomization mixes complete policies, not their internal actions. Once the losses ℓ j ( u ) \ell_j(u) ℓ j ( u )
Let Z \mathcal{Z} Z K ( d z ∣ u ) K(dz \mid u) K ( d z ∣ u ) Z Z Z u u u Z ∼ K ( ⋅ ∣ U ) Z \sim K(\cdot\mid U) Z ∼ K ( ⋅ ∣ U ) δ : Z → Δ m \delta: \mathcal{Z} \to\Delta_m δ : Z → Δ m δ j ( z ) \delta_j(z) δ j ( z ) π j \pi_j π j z z z D Z \mathcal{D}_{\mathcal{Z}} D Z D ⊆ D Z \mathcal{D} \subseteq\mathcal{D}_{\mathcal{Z}} D ⊆ D Z δ ^ ∈ D \hat{\delta} \in\mathcal{D} δ ^ ∈ D
Assumption 2.1 (Audit setting). The state space U \mathcal{U} U Z \mathcal{Z} Z m m m [ 0 , 1 ] [0,1] [ 0 , 1 ] K K K D ⊆ D Z \mathcal{D} \subseteq\mathcal{D}_{\mathcal{Z}} D ⊆ D Z δ ^ \hat{\delta} δ ^
Conditional on state u u u π j \pi_j π j ℓ j ( u ) \ell_j(u) ℓ j ( u ) μ ( d u ) K ( d z ∣ u ) \mu(du)K(dz \mid u) μ ( d u ) K ( d z ∣ u ) δ ^ \hat{\delta} δ ^ σ \sigma σ
Four risks and three excess losses
The four risks compare access to the full state, unrestricted use of the interface, a restricted family of rules, and the fitted rule:
R f u l l : = E [ ℓ ∗ ( U ) ] , (1) R_{\mathrm{full}} := \mathbb{E}[\ell^*(U)], \tag*{(1)} R full := E [ ℓ ∗ ( U )] , (1) R Z ∗ : = inf δ ∈ D Z E [ ℓ ( U , δ ( Z ) ) ] , (2) R_Z^* := \inf_{\delta\in\mathcal{D}_Z} \mathbb{E}[\ell(U,\delta(Z))], \tag*{(2)} R Z ∗ := δ ∈ D Z inf E [ ℓ ( U , δ ( Z ))] , (2) R D : = inf δ ∈ D E [ ℓ ( U , δ ( Z ) ) ] , (3) R_D := \inf_{\delta\in\mathcal{D}} \mathbb{E}[\ell(U,\delta(Z))], \tag*{(3)} R D := δ ∈ D inf E [ ℓ ( U , δ ( Z ))] , (3) R δ ^ : = E [ ℓ ( U , δ ^ ( Z ) ) ] . (4) R_{\hat{\delta}} := \mathbb{E}[\ell(U,\hat{\delta}(Z))]. \tag*{(4)} R δ ^ := E [ ℓ ( U , δ ^ ( Z ))] . (4) Define the information gap Δ i n f o : = R Z ∗ − R f u l l \Delta_{\mathrm{info}} := R_Z^* - R_{\mathrm{full}} Δ info := R Z ∗ − R full Δ a c c e s s : = R D − R Z ∗ \Delta_{\mathrm{access}} := R_D - R_Z^* Δ access := R D − R Z ∗ Δ t r a i n : = R δ ^ − R D \Delta_{\mathrm{train}} := R_{\hat{\delta}} - R_D Δ train := R δ ^ − R D
D σ i n f o ( K ; μ ) : = Δ i n f o = inf δ ∈ D Z E [ e ( U , δ ( Z ) ) ] . \mathcal{D}_{\sigma}^{\mathrm{info}}(K;\mu) := \Delta_{\mathrm{info}} = \inf_{\delta\in\mathcal{D}_Z} \mathbb{E}[e(U,\delta(Z))]. D σ info ( K ; μ ) := Δ info = δ ∈ D Z inf E [ e ( U , δ ( Z ))] . The interface has decision sufficiency under μ \mu μ D σ i n f o ( K ; μ ) \mathcal{D}_{\sigma}^{\mathrm{info}}(K;\mu) D σ info ( K ; μ )
Theorem 2.2 (Risk ordering and decomposition). Under Assumption 2.1,
R f u l l ≤ R Z ∗ ≤ R D ≤ R δ ^ , R_{\mathrm{full}} \le R_Z^* \le R_D \le R_{\hat{\delta}}, R full ≤ R Z ∗ ≤ R D ≤ R δ ^ , and
R δ ^ − R f u l l = R Z ∗ − R f u l l ⏟ Δ i n f o + R D − R Z ∗ ⏟ Δ a c c e s s + R δ ^ − R D ⏟ Δ t r a i n . (5) R_{\hat{\delta}} - R_{\mathrm{full}} = \underbrace{R_Z^* - R_{\mathrm{full}}}_{\Delta_{\mathrm{info}}} + \underbrace{R_D - R_Z^*}_{\Delta_{\mathrm{access}}} + \underbrace{R_{\hat{\delta}} - R_D}_{\Delta_{\mathrm{train}}}. \tag*{(5)} R δ ^ − R full = Δ info R Z ∗ − R full + Δ access R D − R Z ∗ + Δ train R δ ^ − R D . (5) The information gap remains even for the best rule on the interface. The accessibility gap measures the extra cost of restricting that rule; the fitting gap measures the remaining error within the allowed family. The last gap can include both estimation and optimization error. The identity separates these comparisons, but does not by itself predict how more training data will change them. All comparisons fix the recorded state, continuation library, and loss.
Exact optimization for a finite interface
Let U a u d = { u 1 , … , u n } \mathcal{U}_{\mathrm{aud}} = \{u_1,\ldots,u_n\} U aud = { u 1 , … , u n } n ≥ 1 n \ge1 n ≥ 1 μ i ≥ 0 \mu_i \ge0 μ i ≥ 0 Z f = { z 1 , … , z L } \mathcal{Z}_f = \{z_1,\ldots,z_L\} Z f = { z 1 , … , z L } L ≥ 1 L \ge1 L ≥ 1
P i r : = K ( { z r } ∣ u i ) , L i j : = ℓ j ( u i ) , C r j : = ∑ i = 1 n μ i P i r L i j . P_{ir} := K(\{z_r\}\mid u_i), \qquad L_{ij} := \ell_j(u_i), \qquad C_{rj} := \sum_{i=1}^{n}\mu_i P_{ir}L_{ij}. P i r := K ({ z r } ∣ u i ) , L ij := ℓ j ( u i ) , C r j := i = 1 ∑ n μ i P i r L ij . Each row of P P P L = ( L i j ) \mathbf{L} = (L_{ij}) L = ( L ij ) p r : = ∑ i μ i P i r > 0 p_r := \sum_i \mu_i P_{ir} > 0 p r := ∑ i μ i P i r > 0 C r j = p r E [ ℓ j ( U ) ∣ Z = z r ] C_{rj} = p_r\mathbb{E}[\ell_j(U)\mid Z=z_r] C r j = p r E [ ℓ j ( U ) ∣ Z = z r ] C r j C_{rj} C r j z r z_r z r q r = δ ( z r ) q_r=\delta(z_r) q r = δ ( z r ) ∑ r , j C r j q r j \sum_{r,j} C_{rj}q_{rj} ∑ r , j C r j q r j
Theorem 2.3 (Optimum for a finite interface). For the finite audit distribution and observation channel,
R f u l l = ∑ i = 1 n μ i min j ∈ [ m ] L i j , R Z ∗ = ∑ r = 1 L min j ∈ [ m ] C r j . R_{\mathrm{full}} = \sum_{i=1}^{n}\mu_i \min_{j\in[m]} L_{ij}, \qquad R_Z^* = \sum_{r=1}^{L}\min_{j\in[m]} C_{rj}. R full = i = 1 ∑ n μ i j ∈ [ m ] min L ij , R Z ∗ = r = 1 ∑ L j ∈ [ m ] min C r j . At each output z r z_r z r every distribution supported on arg min j C r j \arg\min_j C_{rj} arg min j C r j is optimal. In particular, selecting one minimizing continuation suffices. Outputs of probability zero can be assigned arbitrarily.
The choices at different outputs have separate simplex constraints, and the objective is linear in each choice. Forming the dense cost table takes O ( n L m ) O(nLm) O ( n L m ) O ( L m ) O(Lm) O ( L m ) f : U a u d → Z f f:\mathcal{U}_{\mathrm{aud}}\to\mathcal{Z}_f f : U aud → Z f C r : = { u i : f ( u i ) = z r } C_r := \{u_i:f(u_i)=z_r\} C r := { u i : f ( u i ) = z r }
Policy information and an observed collision
When policies vary across states, let S = s ( U ) S = s(U) S = s ( U ) ℓ j ( u ) \ell_j(u) ℓ j ( u ) u u u V V V V = Z V = Z V = Z V = ( Z , S ) V = (Z, S) V = ( Z , S )
R V ⋆ : = inf δ E [ ℓ ( U , δ ( V ) ) ] , Δ V : = R V ⋆ − R f u l l , R_V^\star:= \inf_\delta\mathbb{E}[\ell(U,\delta(V))], \qquad\Delta_V := R_V^\star- R_{\mathrm{full}}, R V ⋆ := δ inf E [ ℓ ( U , δ ( V ))] , Δ V := R V ⋆ − R full , where the infimum ranges over all measurable rules using V V V C z , s : = { u : f ( u ) = z , s ( u ) = s } C_{z,s} := \{u : f(u) = z,\ s(u) = s\} C z , s := { u : f ( u ) = z , s ( u ) = s } 1 { A } 1\{A\} 1 { A } A A A
R Z , S ⋆ = ∑ z , s min j E [ 1 { Z = z , S = s } ℓ j ( U ) ] , (6) R_{Z,S}^\star= \sum_{z,s} \min_j \mathbb{E}[1\{Z = z, S = s\}\ell_j(U)], \tag*{(6)} R Z , S ⋆ = z , s ∑ j min E [ 1 { Z = z , S = s } ℓ j ( U )] , (6) 0 ≤ Δ Z , S ≤ Δ Z . 0 \le\Delta_{Z,S} \le\Delta_Z. 0 ≤ Δ Z , S ≤ Δ Z . The sum runs over observed code and policy pairs. A rule that receives policy text S S S Z Z Z
An example from the human ratings. Table 1 gives two SmolLM2 states with the same policy and the same two SAE activation indicators, 00. The three continuations ask for clarification, refuse, or assist. Entries are rating losses in [ 0 , 1 ] [0,1] [ 0 , 1 ] § 5.3 .
Table 1. An observed policy-aware collision under the SmolLM2 seed-314159, two-bit interface. Both requests have the same policy and code 00. Entries are final human composite losses; smaller is better. The pair is a post hoc illustration, not an independent or higher-order test. Exact text and state IDs are given in Appendix § 21 .§ 5 .
With equal state weights, access to the full state gives mean loss ( 0 + 0.100 ) / 2 = 0.050 (0 + 0.100)/2 = 0.050 ( 0 + 0.100 ) /2 = 0.050 ( 0.425 , 0.3125 , 0.400 ) (0.425, 0.3125, 0.400) ( 0.425 , 0.3125 , 0.400 ) § 21 .§ 5 .
Restricted rules and estimated losses
The optimum within a restricted rule family requires a separate calculation. Our affine family maps visible features to continuation probabilities, with simplex constraints on the entire declared observation alphabet. Its optimum is a linear program; fitting changes the costs, not the feasible domain (Appendix § 11 .§ 4 ).
An exact optimum for a supplied loss table need not equal the optimum for unknown expected losses. Taking a minimum of noisy estimates can favor negative estimation errors. Proposition A.6 controls the resulting risk changes under a uniform bound on loss errors. For continuous observations, a finite set of distinct vectors can be memorized by an unrestricted rule, so probe failure alone does not identify missing information. Quantization also changes the observed input. Appendix L gives the conditions needed to transfer a calculation on quantized data to the original observation and to obtain bounds from estimated losses.
Group Conflicts and Interface Requirements
The average risk gap does not identify which states cannot share a decision. We describe those groups and determine how many outputs are needed to keep every group compatible. The grouping results concern deterministic interfaces; the risk analysis in Section 2 also permits stochastic channels.
Shared choices and average risk
Fix a nonempty finite domain U a u d = { u 1 , … , u n } U_{\mathrm{aud}} = \{u_1,\ldots,u_n\} U aud = { u 1 , … , u n } m ≥ 2 m \ge2 m ≥ 2 e j ( u ) = ℓ j ( u ) − ℓ ∗ ( u ) e_j(u) = \ell_j(u) - \ell^*(u) e j ( u ) = ℓ j ( u ) − ℓ ∗ ( u ) f : U a u d → [ M ] f : U_{\mathrm{aud}} \to[M] f : U aud → [ M ] M ≥ 1 M \ge1 M ≥ 1 [ M ] : = { 1 , … , M } [M] := \{1,\ldots,M\} [ M ] := { 1 , … , M } C c = f − 1 ( c ) C_c = f^{-1}(c) C c = f − 1 ( c ) c ∈ range ( f ) c \in\operatorname{range}(f) c ∈ range ( f ) q ∈ Δ m q \in\Delta_m q ∈ Δ m f f f
For an allowed regret ε ≥ 0 \varepsilon\ge0 ε ≥ 0 u u u
G ε ( u ) : = { q ∈ Δ m : e ( u , q ) ≤ ε } . \mathcal{G}^{\varepsilon}(u) := \{q \in\Delta_m : e(u,q) \le\varepsilon\}. G ε ( u ) := { q ∈ Δ m : e ( u , q ) ≤ ε } . Each set is nonempty, closed, and convex: a pure optimum is feasible, and regret is linear in the choice probabilities. For a nonempty group W ⊆ U a u d W \subseteq U_{\mathrm{aud}} W ⊆ U aud margin as the smallest possible maximum regret across its states:
Γ ( W ) : = min q ∈ Δ m max u ∈ W e ( u , q ) . (7) \Gamma(W) := \min_{q \in\Delta_m}\max_{u \in W} e(u,q). \tag*{(7)} Γ ( W ) := q ∈ Δ m min u ∈ W max e ( u , q ) . (7) The minimum is attained by compactness of Δ m \Delta_m Δ m ε \varepsilon ε
Γ ( W ) ≤ ε ⟺ ⋂ u ∈ W G ε ( u ) ≠ ∅ . (8) \Gamma(W) \le\varepsilon\quad\Longleftrightarrow\quad\bigcap_{u \in W}\mathcal{G}^{\varepsilon}(u) \ne\varnothing. \tag*{(8)} Γ ( W ) ≤ ε ⟺ u ∈ W ⋂ G ε ( u ) = ∅ . (8) Otherwise the group is incompatible. Removing states cannot increase the margin: Γ ( V ) ≤ Γ ( W ) \Gamma(V) \le\Gamma(W) Γ ( V ) ≤ Γ ( W ) V ⊆ W V \subseteq W V ⊆ W
Let Δ ( W ) : = { w = ( w u ) u ∈ W : w u ≥ 0 , ∑ u ∈ W w u = 1 } \Delta(W) := \{w = (w_u)_{u \in W} : w_u \ge0,\ \sum_{u \in W} w_u = 1\} Δ ( W ) := { w = ( w u ) u ∈ W : w u ≥ 0 , ∑ u ∈ W w u = 1 } w ∈ Δ ( W ) w \in\Delta(W) w ∈ Δ ( W )
κ ( W , w ) : = min q ∈ Δ m ∑ u ∈ W w u e ( u , q ) = min j ∈ [ m ] ∑ u ∈ W w u e j ( u ) . \kappa(W,w) := \min_{q \in\Delta_m}\sum_{u \in W}w_u e(u,q) = \min_{j \in[m]}\sum_{u \in W}w_u e_j(u). κ ( W , w ) := q ∈ Δ m min u ∈ W ∑ w u e ( u , q ) = j ∈ [ m ] min u ∈ W ∑ w u e j ( u ) . The quantity κ ( W , w ) \kappa(W,w) κ ( W , w ) Γ ( W ) \Gamma(W) Γ ( W ) w w w q q q
Theorem 3.1 (Relation between average and maximum regret). For every nonempty finite group W W W w ∈ Δ ( W ) w \in\Delta(W) w ∈ Δ ( W ) β ( W , w ) : = min u ∈ W w u \beta(W,w) := \min_{u \in W} w_u β ( W , w ) := min u ∈ W w u
β ( W , w ) Γ ( W ) ≤ κ ( W , w ) ≤ Γ ( W ) . \beta(W,w)\Gamma(W) \le\kappa(W,w) \le\Gamma(W). β ( W , w ) Γ ( W ) ≤ κ ( W , w ) ≤ Γ ( W ) . Let μ \mu μ K f ( { c } ∣ u ) = 1 { f ( u ) = c } K_f(\{c\}\mid u) = \mathbf{1}\{f(u) = c\} K f ({ c } ∣ u ) = 1 { f ( u ) = c } p c : = ∑ u ∈ C c μ ( u ) p_c := \sum_{u \in C_c}\mu(u) p c := ∑ u ∈ C c μ ( u ) w u ( c ) : = μ ( u ) / p c w_u^{(c)} := \mu(u)/p_c w u ( c ) := μ ( u ) / p c
I σ i n f o ( K f ; μ ) = ∑ c : p c > 0 p c κ ( C c , w ( c ) ) ≤ ∑ c : p c > 0 p c Γ ( C c ) . (9) \mathcal{I}^{\mathrm{info}}_{\sigma}(K_f;\mu) = \sum_{c:p_c>0}p_c\kappa(C_c,w^{(c)}) \le\sum_{c:p_c>0}p_c\Gamma(C_c). \tag*{(9)} I σ info ( K f ; μ ) = c : p c > 0 ∑ p c κ ( C c , w ( c ) ) ≤ c : p c > 0 ∑ p c Γ ( C c ) . (9) Hence a gap exceeding ε \varepsilon ε ε \varepsilon ε
Conflicts missed by pairwise checks
Example 3.2 (Every pair shares an optimum, but the group does not). Consider three states with losses
Table 29.
Each state has minimum loss zero, so losses equal regrets. The pairs { u 1 , u 2 } \{u_1,u_2\} { u 1 , u 2 } { u 1 , u 3 } \{u_1,u_3\} { u 1 , u 3 } { u 2 , u 3 } \{u_2,u_3\} { u 2 , u 3 } q = ( q a s k , q d e c l i n e , q a s s i s t ) q=(q_{\mathrm{ask}},q_{\mathrm{decline}},q_{\mathrm{assist}}) q = ( q ask , q decline , q assist ) q d e c l i n e q_{\mathrm{decline}} q decline q a s s i s t q_{\mathrm{assist}} q assist q a s k q_{\mathrm{ask}} q ask 1 / 3 1/3 1/3 1 / 3 1/3 1/3 0 ≤ ε < 1 / 3 0 \le\varepsilon< 1/3 0 ≤ ε < 1/3
A minimal conflict is an incompatible group for which every proper subset is compatible. Minimality refers to inclusion, not the smallest cardinality among all conflicts.
Definition 3.3 (Conflict hypergraph). Let H ε = ( U a u d , E ε ) \mathcal{H}_{\varepsilon}=(\mathcal{U}_{\mathrm{aud}},\mathcal{E}_{\varepsilon}) H ε = ( U aud , E ε ) nonempty group W W W E ε \mathcal{E}_{\varepsilon} E ε
⋂ u ∈ W C ε ( u ) = ∅ , ⋂ u ∈ V C ε ( u ) ≠ ∅ for every proper subset V ⊊ W . \bigcap_{u\in W}\mathcal{C}^{\varepsilon}(u)=\varnothing,\qquad\bigcap_{u\in V}\mathcal{C}^{\varepsilon}(u)\ne\varnothing\quad\text{for every proper subset }V\subsetneq W. u ∈ W ⋂ C ε ( u ) = ∅ , u ∈ V ⋂ C ε ( u ) = ∅ for every proper subset V ⊊ W . The intersection over no states is defined as Δ m \Delta_m Δ m
The global edge set depends on the losses, library, states, and tolerance, not on the current interface. Its subset
E ε ( f ) : = { W ∈ E ε : W ⊆ C c for some c } \mathcal{E}_{\varepsilon}(f):=\{W\in\mathcal{E}_{\varepsilon}:W\subseteq C_c\text{ for some }c\} E ε ( f ) := { W ∈ E ε : W ⊆ C c for some c } contains conflicts hidden within the cells of f f f E ε ( f ) \mathcal{E}_{\varepsilon}(f) E ε ( f )
Theorem 3.4 (Maximum size of a minimal conflict). Every minimal conflict W ∈ E ε W\in\mathcal{E}_{\varepsilon} W ∈ E ε 2 ≤ ∣ W ∣ ≤ m 2\le|W|\le m 2 ≤ ∣ W ∣ ≤ m For each m ≥ 2 m\ge2 m ≥ 2 some bounded loss table and tolerance have a minimal conflict of exactly m m m states.
The upper bound follows from Helly’s theorem in the ( m − 1 ) (m-1) ( m − 1 ) [36 ] . With three continuations, every incompatible group thus contains a conflicting pair or triple. Appendix B proves tightness and explains when unique optimal choices reduce all minimal conflicts to pairs.
The risk interpretation of a conflict margin
Allow state weights λ ∈ Δ ( W ) \lambda\in\Delta(W) λ ∈ Δ ( W ) q ∈ Δ m q\in\Delta_m q ∈ Δ m
Theorem 3.5 (Minimax interpretation of the group margin). For every nonempty finite group W W W
Γ ( W ) = max λ ∈ Δ ( W ) min j ∈ [ m ] ∑ u ∈ W λ u e j ( u ) . \Gamma(W)=\max_{\lambda\in\Delta(W)}\min_{j\in[m]}\sum_{u\in W}\lambda_u e_j(u). Γ ( W ) = λ ∈ Δ ( W ) max j ∈ [ m ] min u ∈ W ∑ λ u e j ( u ) . If the complete observation map f f f is constant on W W W then
Γ ( W ) = max λ ∈ Δ ( W ) D σ i n f o ( K f ; λ ) , \Gamma(W)=\max_{\lambda\in\Delta(W)}D^{\mathrm{info}}_{\sigma}(K_f;\lambda), Γ ( W ) = λ ∈ Δ ( W ) max D σ info ( K f ; λ ) , where the state distribution λ \lambda λ is supported on W W W
The margin equals the largest information gap over distributions on the group, not the gap under any fixed audit distribution μ \mu μ [58 ] . Introducing a scalar t t t
Γ ( W ) = min q , t { t : q ∈ Δ m , ∑ j q j e j ( u ) ≤ t for every u ∈ W } . \Gamma(W)=\min_{q,t}\left\{t:q\in\Delta_m,\ \sum_j q_j e_j(u)\le t\text{ for every }u\in W\right\}. Γ ( W ) = q , t min { t : q ∈ Δ m , j ∑ q j e j ( u ) ≤ t for every u ∈ W } . The primal solution gives a best common choice; the dual gives state weights attaining the maximum. For fixed m m m O ( n m ) O(n^m) O ( n m )
Output requirements and global validation
A redesigned interface is a map g : U a u d → [ n ] g : \mathcal{U}_{\mathrm{aud}} \to[n] g : U aud → [ n ] ε \varepsilon ε ε \varepsilon ε
M ⋆ ( ε ) : = min g : U a u d → [ n ] { ∣ range ( g ) ∣ : Γ ( g − 1 ( c ) ) ≤ ε for every c ∈ range ( g ) } . M^{\star}(\varepsilon) := \min_{g:\mathcal{U}_{\mathrm{aud}}\to[n]} \left\{|\operatorname{range}(g)| : \Gamma(g^{-1}(c)) \le\varepsilon\text{ for every } c \in\operatorname{range}(g)\right\}. M ⋆ ( ε ) := g : U aud → [ n ] min { ∣ range ( g ) ∣ : Γ ( g − 1 ( c )) ≤ ε for every c ∈ range ( g ) } . An edge is monochromatic if all its states have the same label. The weak chromatic number χ w ( H ε ) \chi_{\mathrm{w}}(\mathcal{H}_{\varepsilon}) χ w ( H ε )
Theorem 3.6 (Capacity as a coloring problem). For unrestricted deterministic interfaces,
M ⋆ ( ε ) = χ w ( H ε ) . M^{\star}(\varepsilon) = \chi_{\mathrm{w}}(\mathcal{H}_{\varepsilon}). M ⋆ ( ε ) = χ w ( H ε ) . A cell is incompatible exactly when it contains a minimal conflict; avoiding monochromatic edges is therefore equivalent to compatibility [11 ] . Assigning every state an optimal continuation index uses at most m m m § 13 .§ 3 treats restricted encoders, zero regret, and policy text supplied without charging it to the code alphabet.
To avoid enumerating every edge, start with any F 0 ⊆ E ε \mathcal{F}_0 \subseteq\mathcal{E}_{\varepsilon} F 0 ⊆ E ε t t t F t \mathcal{F}_t F t M t M_t M t g t g_t g t
Proposition 3.7 (Capacity by constraint generation). With exact solves, M t ≤ M ⋆ ( ε ) M_t \le M^{\star}(\varepsilon) M t ≤ M ⋆ ( ε ) g t g_t g t ε \varepsilon ε M t = M ⋆ ( ε ) M_t = M^{\star}(\varepsilon) M t = M ⋆ ( ε ) g t g_t g t W t W_t W t F t + 1 = F t ∪ { W t } \mathcal{F}_{t+1} = \mathcal{F}_t \cup\{W_t\} F t + 1 = F t ∪ { W t }
The retained constraints give a lower bound. A validated labeling gives a matching upper bound. A failed validation adds an edge not yet retained; there are finitely many edges. Algorithms 5 and 6 give the procedures, including the handling of incomplete solves. Numerical output is reported with solver status and tolerances, not as an exact arithmetic proof.
Guarantees after searching for a conflict
Let ℓ ^ j ( u ) ∈ [ 0 , 1 ] \widehat{\ell}_j(u) \in[0,1] ℓ j ( u ) ∈ [ 0 , 1 ] ℓ j ( u ) \ell_j(u) ℓ j ( u ) 1 − α 1-\alpha 1 − α ∣ ℓ ^ j ( u ) − ℓ j ( u ) ∣ ≤ r ℓ |\widehat{\ell}_j(u)-\ell_j(u)| \le r_{\ell} ∣ ℓ j ( u ) − ℓ j ( u ) ∣ ≤ r ℓ 0 < α < 1 0 < \alpha< 1 0 < α < 1 r ℓ ≥ 0 r_{\ell} \ge0 r ℓ ≥ 0 e ^ j ( u ) : = ℓ ^ j ( u ) − min k ℓ ^ k ( u ) \widehat{e}_j(u) := \widehat{\ell}_j(u) - \min_k \widehat{\ell}_k(u) e j ( u ) := ℓ j ( u ) − min k ℓ k ( u ) Γ ^ ( W ) \widehat{\Gamma}(W) Γ ( W ) 2 r ℓ 2r_{\ell} 2 r ℓ W ^ \widehat{W} W
Γ ( W ^ ) ≥ Γ ^ ( W ^ ) − 2 r ℓ \Gamma(\widehat{W}) \ge\widehat{\Gamma}(\widehat{W}) - 2r_{\ell} Γ ( W ) ≥ Γ ( W ) − 2 r ℓ with probability at least 1 − α 1-\alpha 1 − α
A lower bound exceeding ε \varepsilon ε § 13 .§ 4 gives the full results, interval constructions, and conditions for a larger continuation library. Resampling the existing policy areas does not supply the simultaneous loss bounds assumed here.
Experimental Design
The experiments compare exact risks under selected SAE inputs, then vary the input, allowed rules, fitting data, or evaluator. Human ratings are available for SmolLM2. Appendix § 23 gives complete model and rating protocols.
States, response choices, and controller inputs
Each state records a synthetic situation, its governing policy, and relevant evidence. The original collection has 240 states from 20 policy areas, with three required actions and four paraphrases per area. Twelve areas (144 states) are used for setting selection and fitting; eight (96 states) form the original confirmation collection. SmolLM2 adds 96 states from eight other areas, fixed before generation and scoring. Phi generates new responses on both collections; the states themselves are reused.
Table 2. Models, controller inputs, and evaluations. Human ratings cover SmolLM2 only. Generator inputs and scoring rules differ across families. †Qwen2.5-1.5B results with policy supplied are recovered from rounded summaries for individual policy areas.
The available strategies are A : = { a s k , d e c l i n e , a s s i s t } \mathcal{A} := \{\mathrm{ask},\mathrm{decline},\mathrm{assist}\} A := { ask , decline , assist }
Let F B F_B F B B B B a k ( u ) ≥ 0 a_k(u) \ge0 a k ( u ) ≥ 0 k k k u u u
z k ( u ) : = 1 { a k ( u ) > 0 } , Z = ( z k ) k ∈ F B . z_k(u) := 1\{a_k(u) > 0\}, \qquad Z = (z_k)_{k \in F_B}. z k ( u ) := 1 { a k ( u ) > 0 } , Z = ( z k ) k ∈ F B . Its complete input is V = Z V = Z V = Z V = ( Z , S ) V = (Z,S) V = ( Z , S ) S S S B ∈ { 2 , 4 , 8 , 16 , 32 , 64 } B \in\{2,4,8,16,32,64\} B ∈ { 2 , 4 , 8 , 16 , 32 , 64 } B = 2 B = 2 B = 2 B B B
Model protocols and automatic scoring
Qwen2.5-1.5B uses public SAEs after layers 17, 18, 19, and 21, with a second Qwen scale as a supporting check. SmolLM2-1.7B and Phi-4-mini-instruct use layers 17 and 23, respectively. Each has two TopK SAEs trained with different initializations and training orders. Within a pair, the model, layer, architecture, and training activation corpus are shared. Layer indices are zero based; full settings appear in Appendix M.
The Qwen generator receives the public request, fact name, and selected action, but not the private condition or complete policy. Its responses are reused across states sharing the public request. The Qwen evaluator receives the full context and required action label. SmolLM2 and Phi supply policy and situation to their generators but do not supply the required action to their evaluators. The comparison across families thus changes generation and scoring protocols as well as the model; it is not a controlled comparison of model identity alone.
Qwen scores safety, utility, fact handling, action adherence, and overall quality from zero to four with weights (0.40, 0.25, 0.15, 0.10, 0.10). Its score is an expectation under label probabilities corrected for the evaluator’s label prior. Loss is one minus the weighted score divided by four. SmolLM2 and Phi instead request integer JSON scores from zero to three on the five dimensions below. Each generates five responses per state and action, totaling 5,040 responses per model. Automatic risk uses the mean loss of the five responses. Mistral is their primary evaluator; Phi is also evaluated with Qwen-7B and the mean of the two losses. Normalization to [0, 1] does not make the scoring rubrics equivalent.
Human ratings and matched observations
Human evaluation covers 80 original SmolLM2 states, including fitting areas, and all 96 locked states. A SHA-256 ordering independent of scores fixes one response per state and action, giving 528 items. After a separate 36-item pilot, two raters independently score every item. They see the policy, situation, selected action, and response, but not automatic scores, model or SAE identity, required action, split, or the other rater’s labels. The pilot is excluded from reported statistics. Predefined disagreement rules select 100 items for joint adjudication.
Let s s a f e t y , s p o l i c y , s u s e , s f a c t , s o v e r a l l ∈ { 0 , 1 , 2 , 3 } s_{\mathrm{safety}}, s_{\mathrm{policy}}, s_{\mathrm{use}}, s_{\mathrm{fact}}, s_{\mathrm{overall}} \in\{0,1,2,3\} s safety , s policy , s use , s fact , s overall ∈ { 0 , 1 , 2 , 3 }
L h u m a n = 1 − 0.30 s s a f e t y + 0.30 s p o l i c y + 0.15 s u s e + 0.10 s f a c t + 0.15 s o v e r a l l 3 L^{\mathrm{human}} = 1 - \frac{0.30s_{\mathrm{safety}} + 0.30s_{\mathrm{policy}} + 0.15s_{\mathrm{use}} + 0.10s_{\mathrm{fact}} + 0.15s_{\mathrm{overall}}}{3} L human = 1 − 3 0.30 s safety + 0.30 s policy + 0.15 s use + 0.10 s fact + 0.15 s overall The 100 adjudicated items use resolved scores; the other 428 use the mean of the independent losses. The composite rating is not an unsafe event probability. Automatic and human calibration compares scores for the same fixed response, not a human rating with a mean over five responses. Appendix § 23 .§ 5 gives the rubric and procedure.
Comparing Z Z Z ( Z , S ) (Z,S) ( Z , S )
Risk calculation and resampling
For action a ∈ A a \in\mathcal{A} a ∈ A L ( a , u ) ∈ [ 0 , 1 ] L(a,u) \in[0,1] L ( a , u ) ∈ [ 0 , 1 ] u u u p ^ ( v ) \widehat{p}(v) p ( v ) v v v E ^ [ L ( a , U ) ∣ V = v ] \widehat{\mathbb{E}}[L(a,U) \mid V=v] E [ L ( a , U ) ∣ V = v ]
R ^ V = ∑ v p ^ ( v ) min a ∈ A E ^ [ L ( a , U ) ∣ V = v ] , R ^ f u l l = E ^ [ min a ∈ A L ( a , U ) ] . (10) \widehat{R}_V = \sum_v \widehat{p}(v) \min_{a \in\mathcal{A}} \widehat{\mathbb{E}}[L(a,U) \mid V=v], \qquad\widehat{R}_{\mathrm{full}} = \widehat{\mathbb{E}}\left[\min_{a \in\mathcal{A}} L(a,U)\right]. \tag*{(10)} R V = v ∑ p ( v ) a ∈ A min E [ L ( a , U ) ∣ V = v ] , R full = E [ a ∈ A min L ( a , U ) ] . (10) Their difference is the information gap on the scored table. Both are reference optimizations over the observed scores, not trained policies tested on future responses. Comparisons of rule families restrict the allowed mapping; the fitting experiment varies samples from a fixed finite population.
We resample whole policy areas and recompute both minima. Tables report individual two-sided 95% bootstrap intervals and one-sided 95% lower confidence bounds (LCBs). Phi uses 2,000 draws and eight areas per collection. With policy supplied, resampling reweights fixed gaps within policy areas. A positive LCB describes stability to that reweighting; it does not control error in the underlying response losses. The intervals are not simultaneous across settings, and a zero fraction of nonpositive draws is not a zero p p p § 22 and § 13 .§ 4 .
Empirical Results
All optima below use the scored tables from § 5 . We first report human results with policy supplied, then examine rule and fitting restrictions, other model protocols, and group conflicts.
Human ratings retain a gap with policy supplied
On the 96 SmolLM2 states held out by policy area, the minimum losses using policy and two feature indicators exceed the minima using the full state by 0.1166 and 0.1082 for the two SAEs. Their individual one-sided bootstrap lower bounds are 0.0935 and 0.0901 (Table 3 ). No alternative mapping from the same observed inputs to actions can remove these differences on the scored table. The comparison rules out omission of policy text as the sole reason for the gap; it does not locate the loss of information within the encoding pipeline.
Table 3. SmolLM2 human-rated information gaps with two visible features (B = 2 B = 2 B = 2 Δ Z \Delta_Z Δ Z Δ Z , S \Delta_{Z,S} Δ Z , S Δ Z , S \Delta_{Z,S} Δ Z , S
The original 80-state sample gives gaps of 0.0345 and 0.0353 but includes fitting areas. Using either rater alone or their mean before adjudication also gives positive lower bounds (Table 44 ). Positive gaps are therefore present before joint adjudication, not only in the final averaged scores. The observed collision in Table 1 illustrates how two different optimal choices can share the same complete input.
Table 44. Policy-aware human sensitivity at B = 2 B = 2 B = 2
Feature budget. The feature sets are nested, so a controller with more indicators can ignore the additions. The optimal risk on a fixed table cannot increase; the curves in Figure 1 show the size of the remaining gap, not an independent test of that monotonicity. Some lower bounds reach zero and many gaps vanish at larger budgets. These zeros concern evaluated states, not performance on unseen inputs.
(a) SmolLM2: final human loss, locked 96.
(b) Phi: Mistral loss, reused locked 96.
Figure 1. Information gap as nested feature sets expand, with policy supplied. Lines show the gap on the scored table Δ Z , S \Delta_{Z,S} Δ Z , S
Score and action agreement. The automatic and human losses have Spearman correlation 0.379 and mean absolute difference 0.311. Automatic scores have tied optimal actions in 90 of 176 states. Choosing the first minimum in the fixed order ASK, DECLINE, ASSIST gives 51.1% agreement; the minimizing sets intersect in 80.7% of states and coincide in 30.7%. Set intersection is weaker than equality, especially with ties. Risk values do not depend on which tied minimizer is selected. Appendices § 16 and § 21 .§ 3 give complete statistics. The separate safety dimension also gives positive locked-set point gaps, 0.0521 and 0.0312, but these are descriptive rating differences, not unsafe event probabilities or new confidence bounds (Appendix § 21 .§ 4 ).
Information, rule restrictions, and fitting error
At Qwen layer 17, with two indicators and no separate policy input, the minimum risk using the full state is 0.338 and the minimum using the code is 0.494. The information gap is 0.156, with bootstrap interval [0.125, 0.180] and individual lower bound 0.129. All four evaluation codes occur in fitting. Thus the positive information gap is not a failure to train a response for an unseen code; it remains after optimizing every code assignment.
At layer 19 with B = 16 B = 16 B = 16 Table 4 ). The information gap and the restriction to the allowed family both contribute. The 49 observed codes have collision fraction 0.760 and unseen-code fraction 0.198 (Table 4 ).
Table 4: Qwen2.5 code-only risks and their three sources of excess loss on 96 confirmation states. The four risks compare full-state access, unrestricted code access, a restricted rule class, and a fitted rule. Values and gaps are independently rounded; complete intervals appear in Table 24.
Table 4.
Holding this interface fixed, replacing constant rules with affine rules reduces minimum excess over the unrestricted interface risk from 0.143 to 0.047. Adding pairwise interactions reduces it to 0.007; third-order interactions and lookup rules attain zero class excess. Separately, increasing the fitting sample from 16 to all 144 states of its fixed population reduces the reported mean fitting gap from 0.130 to zero (Figure 2 ). Inclusion of rule families guarantees that their optima cannot worsen. The observed decline with training size is an experimental result, not a consequence of the risk decomposition or a guarantee for new data.
Figure 2. (a) Only the rule class changes. (b) Only the fitting sample size changes. Separate comparisons of rule families and fitting samples. Left: minimum excess over the unrestricted interface risk, with available 95% bootstrap intervals. Right: the fitted rule’s mean excess over its family optimum. The panels use reported rounded summaries; full plots and intervals appear in Figure 10.
Other models, evaluators, and observation choices
For Phi seed 314159 on the original confirmation set, supplying policy text reduces the Mistral loss gap from 0.1110 to 0.0557, with responses, scores, and features unchanged. The extra input improves the optimum but does not recover the full state minimum. Table 5 reports the gap Δ Z , S \Delta_{Z,S} Δ Z , S Z Z Z S S S
Table 5: Information loss with policy and SAE code jointly observed. SmolLM2 and Phi use Mistral losses averaged over five responses per state–action pair. {sup}†`Qwen uses Qwen2.5-7B scores and rounded per-policy summaries; its interval endpoints include the 5 × 10 − 5 5 \times10^{-5} 5 × 1 0 − 5
Table 5.
SmolLM2 and Phi have positive automatic gaps and individual bootstrap lower bounds for both SAE seeds on both evaluation collections. Qwen2.5-1.5B also gives positive estimates, recovered from summaries with absolute rounding error at most 5 × 10 − 5 5 \times10^{-5} 5 × 1 0 − 5 § 20 ). Because generation inputs and score rubrics differ, these are results within each protocol, not model rankings.
Replacing Phi’s Mistral scores with Qwen scores or their mean preserves positive primary lower bounds (Table 26 ). Deleting one policy area at a time leaves positive B = 2 B = 2 B = 2
Table 26. Table 26: Phi primary policy-aware results at feature budget B = 2 B = 2 B = 2 Δ ^ Z , S \widehat{\Delta}_{Z,S} Δ Z , S
Supporting controls. Qwen also gives positive gaps with a different evaluator, variance and random feature selection, controls matched on code occupancy, and a second model scale (Appendix § 17 ). SmolLM2 and Phi diagnostics appear in Appendices § 16 and § 19 . The reconstruction error divided by centered activation variance is larger on audit states than on the SAE validation corpus. Independently of that diagnostic, the risk comparison concerns selected activation indicators, not the information retained by the full SAE code.
Group conflicts and required outputs
The controlled benchmark uses the loss pattern in Example 3.2. Its three states share a layer-17, B = 2 B = 2 B = 2 § 17 ).
Figure 3. Group conflict and required output count. Left: a controlled three-state loss matrix has pair margins zero and triple margin 1/3. Right: global constraint generation on all 96 locked SmolLM2 states uses their final human losses, with every new cell validated. The capacity counts unrestricted labels without a separate policy input, not SAE features; the calculation and summary results are described in Appendix K.5. Markers show only evaluated tolerances, not interpolated transition thresholds. The two panels use different loss tables.
A separate capacity calculation uses all 96 locked SmolLM2 states and their final human losses. Unrestricted label assignments require three outputs at tested tolerances 0, 0.02, 0.10, and 0.20; two at 0.30 and 0.35; and one at 0.40. The margin with one output is 0.3695. Constraint generation and an independent two-label feasibility formulation agree at all seven points, within the recorded numerical tolerance. Appendix § 21 .§ 6 describes the calculation; the matrix, labelings, and solver records are retained in the author working archive. The capacity calculation does not train an SAE or give policy text as an additional free input. The older Qwen 42-state curve, whose matrix is unavailable, remains in the appendix and is not the curve shown here.
Related Work
Decision sufficiency and compression for a task. Blackwell comparison orders experiments by attainable Bayes risks across decision problems [13 , 14 ] , while Le Cam deficiency quantifies approximate comparison and sufficiency [43 , 64 ] . Representation-learning extensions compare feature quality and optimize deficiency-based objectives [65 , 8 ] . Recent formulations study Bayes sufficiency for a chosen loss, compression that preserves optimal actions, and summaries for linear optimization [56 , 68 , 71 ] . The information bottleneck trades compression against target information [63 , 4 ] ; usable information additionally restricts the decoder family [70 ] .
We adopt loss-dependent risk comparison for a fixed continuation library and audit distribution, rather than compare channels across all decision problems. The optimum for the finite interface separates missing information from limitations of the rule that reads it. Our structural analysis then asks which states cannot share a continuation within the regret tolerance under the complete declared observation, including policy information when supplied.
State abstraction and closed-loop information states. State abstraction preserves rewards, transitions, values, or near-optimal behavior in Markov decision processes [35 , 46 , 28 , 29 , 1 , 2 ] . Learned control representations seek to preserve latent dynamics, invariant task-relevant structure, or exploration information [34 , 72 , 73 , 51 ] ; control sufficiency has also been analyzed for mutual-information objectives [54 ] . Recent vision-language-action work addresses aliasing between similar observations requiring different actions [44 ] .
Belief states and predictive state representations summarize histories for recursive planning [59 , 39 , 48 , 57 , 15 ] ; approximate information states quantify the cost of compressed histories [60 ] . Options formalize temporally extended closed-loop policies [61 , 2 ] . Our continuation library follows the established closed-loop view. We take the full audit state and continuation library as inputs and audit an additional observation channel, rather than construct a new information state. We ask whether states sharing an observation can share a continuation, separately from the performance of restricted or fitted rules.
Set-valued decisions and higher-order compatibility. Reject-option classification permits abstention [22 , 9 , 21 ] , while set-valued prediction controls error, coverage, or output-set size [25 , 55 , 10 , 66 ] . These methods constrain predictions for each input. Our uniform compatibility criterion instead requires one continuation distribution to satisfy a regret tolerance at every state in a deterministic interface cell. Pairwise intersections can all be nonempty while the joint intersection is empty.
Helly’s theorem bounds the size of a minimal convex witness [36 ] , and minimax duality relates its margin to a worst-case state mixture [58 ] . Weak hypergraph coloring characterizes how many labels separate all minimal conflicts [11 ] . We connect these classical results to exact risk for the finite interface and the capacity of unrestricted deterministic interfaces, using conflicts over the entire audit domain, not only within existing cells. On a finite audit domain, grouping by optimal action is sufficient when each state has a unique optimal pure continuation and the nonnegative tolerance is below half the minimum second-best regret margin Proposition B.2. Outside that regime, a pairwise conflict graph need not describe joint compatibility.
SAE interfaces and latent safety control. Sparse coding and sparse autoencoders learn dictionaries with sparse codes [52 , 50 ] . Language-model studies examine superposition [26 ] , interpretable dictionary features [17 , 24 ] , SAE scaling [31 , 62 ] , public dictionaries [47 ] , and concept geometry [12 ] . Our target is decision information in a selected support code or coordinate set, not reconstruction from the full SAE dictionary.
Safe reinforcement learning develops constrained policies [32 , 3 , 23 ] , shields [5 , 20 ] , and reachability or predictive safety filters [30 , 67 , 18 ] . Related activation studies extract latent knowledge [19 ] or steer generation [45 , 75 , 40 ] . We audit the specified interface before selecting a downstream rule: a positive gap on the same finite loss table cannot be removed by changing that rule alone. The result is complementary to designing or evaluating a particular monitor or steering method.
Evaluation and generative safety. Language-model evaluators score open-ended outputs and compare candidate responses [49 , 74 , 41 ] ; reward-model benchmarks assess preference judgments [42 ] . Judging studies identify biases [69 ] and develop calibrated tests with imperfect evaluators [27 ] . Risk-control procedures calibrate predictions from finite data [6 ] , while concentration inequalities provide bounds for bounded loss estimates [37 ] . Our certificate concerns a witness selected after searching state groups. Valid simultaneous loss bounds or independent certification data preserve the guarantee after selection.
Toxicity benchmarks, red teaming, principle-based training, and safeguard classifiers evaluate or modify generative behavior [33 , 53 , 7 , 38 ] . Our question is which safe and useful continuations the declared observation can support, not only whether an individual output is safe. The human study tests the finite-interface finding under a separate loss construction; it does not establish interchangeability of automatic and human scores. Appendix H provides the extended comparison.
Discussion
What the risk comparison identifies. For fixed losses and continuations, a positive information gap Δ i n f o \Delta_{\mathrm{info}} Δ info Δ a c c e s s \Delta_{\mathrm{access}} Δ access Δ t r a i n \Delta_{\mathrm{train}} Δ train
Encoding matters, not only the number of bits. With three continuations, an unrestricted encoder can transmit an optimal action index using three labels, which fit in two bits. The positive gaps for selected SAE indicators do not prove that every pair of features fails, or that two bits are inherently insufficient. They identify a failure of the selected partition. Comparing the full state directly with the final indicators does not locate whether a distinction was lost in the model activation, SAE encoding, coordinate selection, or thresholding. Those stages require separate comparisons.
What the experiments support. Supplying policy text does not eliminate the observed gaps. Human and automatic losses give the same sign in the tested SmolLM2 settings but often differ on individual scores and optimal action sets. The losses measure rated safety and quality, not unsafe event probabilities. The controlled group example demonstrates a possible failure of pairwise checks; the unsuccessful natural language replication gives no estimate of its prevalence.
The model families use different generation and scoring protocols. Within each SmolLM2 or Phi SAE pair, only initialization and training order vary; the activation corpus is shared. Human ratings cover SmolLM2 only, and Phi reuses the policy collections. The original human sample includes fitting areas, whereas the locked collection is held out by policy area. These comparisons support the specific configurations, not all models, encoders, or policy distributions.
Limits of inference from a fixed table. The empirical minima use recorded response scores, not unknown losses on future responses. Minimizing noisy scores can change the apparent gap even when individual scores are unbiased. Resampling policy areas measures variation under different weights on the recorded tables; it does not control generation or judge error. Likewise, a zero gap on distinct evaluation codes can result from unrestricted lookup and gives no guarantee on unseen inputs. The additional assumptions for statistical certification appear in Appendices § 22 and § 13 .§ 4 .
Conclusion
Decision sufficiency compares what an interface permits with what the full state permits under the same loss and continuations. Exact optimization for finite interfaces separates that information gap from restrictions on the controller and imperfect fitting. Minimal conflicts identify groups that cannot share an acceptable choice; their complete set determines the output count for an unrestricted deterministic interface.
The tested SAE indicators retain positive gaps with policy supplied, including under SmolLM2 human ratings. A controlled example shows why pairwise checks can miss a group conflict, but the natural language candidate does not replicate. The conclusions concern the specified responses and loss tables. Within that scope, they distinguish limitations of the chosen input from errors a different controller could avoid.
Reproducibility Statement
The arXiv source package contains the manuscript, bibliography, figures, and LaTeX tables. Experiment code and cached records are retained in a separate author working archive and are not included in the arXiv source package. The working archive contains SmolLM2 ratings and adjudication inputs, cached SmolLM2 and Phi records, and CPU analysis scripts. Its 96-state capacity records include the matrix, labelings, margins, and independent feasibility checks. Qwen results with policy supplied use rounded notebook summaries; its full precision historical arrays and 42-state matrix are unavailable. Large SAE checkpoints and activation shards are not included. Appendix § 23 .§ 7 lists the inputs and commands. Analysis scripts do not create human labels or retrain models.
References
Additional Risk Results and Proofs
The results below establish the risk comparisons, their posterior interpretation, and the calculations for affine rules and uncertain losses. The audit setting and all decision permissions are those of Section 2.
Proofs of the main risk comparisons
Proof of Theorem 2.2. For every state u u u q ∈ Δ m q \in\Delta_m q ∈ Δ m ℓ ⋆ ( u ) ≤ ℓ ( u , q ) \ell^\star(u) \le\ell(u,q) ℓ ⋆ ( u ) ≤ ℓ ( u , q ) R f u l l ≤ R Z ⋆ R_{\mathrm{full}} \le R_Z^\star R full ≤ R Z ⋆ δ ^ ∈ D ⊆ D Z \hat{\delta} \in\mathcal{D} \subseteq\mathcal{D}_Z δ ^ ∈ D ⊆ D Z R Z ⋆ ≤ R D ≤ R δ ^ R_Z^\star\le R_D \le R_{\hat{\delta}} R Z ⋆ ≤ R D ≤ R δ ^ R Z ⋆ R_Z^\star R Z ⋆ R D R_D R D
Proof of Theorem 2.3. A selector observing state u i u_i u i L i j L_{ij} L ij R f u l l = ∑ i μ i min j L i j R_{\mathrm{full}} = \sum_i \mu_i \min_j L_{ij} R full = ∑ i μ i min j L ij q r ∈ Δ m q_r \in\Delta_m q r ∈ Δ m z r z_r z r
∑ i , r , j μ i P i r L i j q r j = ∑ r , j C r j q r j . \sum_{i,r,j} \mu_i P_{ir} L_{ij} q_{rj} = \sum_{r,j} C_{rj}q_{rj}. i , r , j ∑ μ i P i r L ij q r j = r , j ∑ C r j q r j . Each q r q_r q r min j C r j \min_j C_{rj} min j C r j
Justification of Equation (6) . On the finite audit, the complete observation ( Z , S ) (Z,S) ( Z , S ) C z , s C_{z,s} C z , s E [ 1 { Z = z , S = s } ℓ j ( U ) ] \mathbb{E}[1\{Z=z,S=s\}\ell_j(U)] E [ 1 { Z = z , S = s } ℓ j ( U )] S S S R f u l l ≤ R Z , S ⋆ ≤ R Z ⋆ R_{\mathrm{full}} \le R_{Z,S}^\star\le R_Z^\star R full ≤ R Z , S ⋆ ≤ R Z ⋆ 0 ≤ Δ Z , S ≤ Δ Z 0 \le\Delta_{Z,S} \le\Delta_Z 0 ≤ Δ Z , S ≤ Δ Z
Posterior conflict and zero information loss
Residual uncertainty after observing the interface. Let P Z P_Z P Z Z Z Z μ z : = P ( U ∈ ⋅ ∣ Z = z ) \mu_z := P(U \in\cdot\mid Z=z) μ z := P ( U ∈ ⋅ ∣ Z = z ) π j \pi_j π j
e ˉ j ( z ) : = ∫ e j ( u ) μ z ( d u ) , κ ( z ) : = min q ∈ Δ m ∑ j = 1 m q j e ˉ j ( z ) = min j ∈ [ m ] e ˉ j ( z ) . \bar{e}_j(z) := \int e_j(u)\,\mu_z(du), \qquad\kappa(z) := \min_{q \in\Delta_m} \sum_{j=1}^{m}q_j\bar{e}_j(z) = \min_{j \in[m]}\bar{e}_j(z). e ˉ j ( z ) := ∫ e j ( u ) μ z ( d u ) , κ ( z ) := q ∈ Δ m min j = 1 ∑ m q j e ˉ j ( z ) = j ∈ [ m ] min e ˉ j ( z ) . The selector can choose a different continuation for each observation z z z μ z \mu_z μ z κ ( z ) \kappa(z) κ ( z )
Theorem A.1 (Posterior-conflict decomposition). Under Assumption 2.1,
D σ i n f o ( K ; μ ) = E Z [ κ ( Z ) ] . \mathcal{D}^{\mathrm{info}}_{\sigma}(K;\mu) = \mathbb{E}_Z[\kappa(Z)]. D σ info ( K ; μ ) = E Z [ κ ( Z )] . The information gap is zero if and only if the nonnegative posterior conflict κ ( Z ) \kappa(Z) κ ( Z ) P Z P_Z P Z
Proposition A.2 (Zero-gap characterization). Under Assumption 2.1, the following are equivalent:
The interface information deficiency D σ i n f o ( K ; μ ) \mathcal{D}^{\mathrm{info}}_{\sigma}(K;\mu) D σ info ( K ; μ )
For P Z P_Z P Z z z z j ∈ [ m ] j \in[m] j ∈ [ m ]
There exists a measurable pure selector j ⋆ : Z → [ m ] j^\star:\mathcal{Z} \to[m] j ⋆ : Z → [ m ] e j ⋆ ( z ) ( U ) = 0 e_{j^\star(z)}(U)=0 e j ⋆ ( z ) ( U ) = 0
Zero average information loss therefore requires a common optimal continuation under almost every posterior distribution, not merely a potentially different optimum for each hidden state. The later uniform criterion uses a nonnegative tolerance ε \varepsilon ε ε \varepsilon ε every listed state in a cell. Average sufficiency and uniform compatibility are not interchangeable at positive tolerance.
Proposition A.3 (Data processing for representation interfaces). Let G ( d y ∣ z ) G(dy \mid z) G ( d y ∣ z ) Y Y Y Z Z Z U U U U → Z → Y U \to Z \to Y U → Z → Y
D σ i n f o ( G ∘ K ; μ ) ≥ D σ i n f o ( K ; μ ) . \mathcal{D}^{\mathrm{info}}_{\sigma}(G \circ K;\mu) \ge\mathcal{D}^{\mathrm{info}}_{\sigma}(K;\mu). D σ info ( G ∘ K ; μ ) ≥ D σ info ( K ; μ ) . Post-processing can increase the best attainable loss but cannot reduce it. In particular, a positive gap after analysis-only quantization does not by itself establish a positive gap for the original unquantized observation.
Proof of Theorem A.1. For any measurable rule δ \delta δ
E [ e ( U , δ ( Z ) ) ] = E Z [ ∑ j δ j ( Z ) e ˉ j ( Z ) ] ≥ E Z [ κ ( Z ) ] . \mathbb{E}[e(U,\delta(Z))] = \mathbb{E}_{Z}\left[\sum_j \delta_j(Z)\bar{e}_j(Z)\right] \ge\mathbb{E}_{Z}[\kappa(Z)]. E [ e ( U , δ ( Z ))] = E Z [ j ∑ δ j ( Z ) e ˉ j ( Z ) ] ≥ E Z [ κ ( Z )] . The finitely many conditional regrets e ˉ j \bar{e}_j e ˉ j κ \kappa κ κ ( Z ) = 0 \kappa(Z)=0 κ ( Z ) = 0
Proof of Proposition A.2. The posterior formula makes zero deficiency equivalent to min j e ˉ j ( z ) = 0 \min_j \bar{e}_j(z)=0 min j e ˉ j ( z ) = 0 z z z e ˉ j ( z ) = ∫ e j ( u ) μ z ( d u ) = 0 \bar{e}_j(z)=\int e_j(u)\,\mu_z(du)=0 e ˉ j ( z ) = ∫ e j ( u ) μ z ( d u ) = 0 e j ( u ) = 0 e_j(u)=0 e j ( u ) = 0 μ z \mu_z μ z
Proof of Proposition A.3. For any measurable rule η \eta η Y Y Y
δ j ( z ) : = ∫ η j ( y ) G ( d y ∣ z ) , j ∈ [ m ] . \delta_j(z) := \int\eta_j(y)G(dy \mid z), \qquad j \in[m]. δ j ( z ) := ∫ η j ( y ) G ( d y ∣ z ) , j ∈ [ m ] . These components are measurable, nonnegative, and sum to one, so δ ∈ D Z \delta\in\mathcal{D}_Z δ ∈ D Z U → Z → Y U \to Z \to Y U → Z → Y E [ ℓ ( U , δ ( Z ) ) ] = E [ ℓ ( U , η ( Y ) ) ] \mathbb{E}[\ell(U,\delta(Z))] = \mathbb{E}[\ell(U,\eta(Y))] E [ ℓ ( U , δ ( Z ))] = E [ ℓ ( U , η ( Y ))] Y Y Y Z Z Z
Deterministic cells and uniform compatibility. For a deterministic interface f : U a u d → Z f f:\mathcal{U}_{\mathrm{aud}}\to\mathcal{Z}_f f : U aud → Z f C r : = { u i : f ( u i ) = z r } C_r := \{u_i:f(u_i)=z_r\} C r := { u i : f ( u i ) = z r }
Γ ( C r ) : = min q ∈ Δ m max u ∈ C r e ( u , q ) . \Gamma(C_r) := \min_{q\in\Delta_m}\max_{u\in C_r}e(u,q). Γ ( C r ) := q ∈ Δ m min u ∈ C r max e ( u , q ) . Unlike posterior conflict, which averages over states, Γ ( C r ) \Gamma(C_r) Γ ( C r )
Corollary A.4 (Finite-cell zero-gap criterion). If the deterministic finite audit has strictly positive state weights, D σ i n f o ( K ; μ ) = 0 \mathcal{D}^{\mathrm{info}}_{\sigma}(K;\mu)=0 D σ info ( K ; μ ) = 0 C r C_r C r C r C_r C r Γ ( C r ) = 0 \Gamma(C_r)=0 Γ ( C r ) = 0
Positive weights make the criterion apply to every listed state, rather than only to states of positive probability. At positive regret tolerance, randomization may improve a shared decision.
Proof of Corollary A.4. Positive state weights give every listed state positive conditional probability in its occupied cell. The zero-gap characterization therefore requires a common optimal pure continuation in each cell, which gives Γ ( C r ) = 0 \Gamma(C_r)=0 Γ ( C r ) = 0 Γ ( C r ) = 0 \Gamma(C_r)=0 Γ ( C r ) = 0 ∑ j q j e j ( u ) = 0 \sum_j q_j e_j(u)=0 ∑ j q j e j ( u ) = 0 q j > 0 q_j>0 q j > 0
Exact restricted affine rules
Affine probabilities. Return to a declared finite observation alphabet. Let φ : Z f → R d φ \varphi:\mathcal{Z}_{f}\to\mathbb{R}^{d_{\varphi}} φ : Z f → R d φ d φ d_{\varphi} d φ φ r : = φ ( z r ) \varphi_r:=\varphi(z_r) φ r := φ ( z r ) q r = A φ r + b q_r=A\varphi_r+b q r = A φ r + b A ∈ R m × d φ A\in\mathbb{R}^{m\times d_{\varphi}} A ∈ R m × d φ b ∈ R m b\in\mathbb{R}^{m} b ∈ R m 1 / m ≤ B p a r < ∞ 1/m\le B_{\mathrm{par}}<\infty 1/ m ≤ B par < ∞ B p a r B_{\mathrm{par}} B par B B B
Proposition A.5 (Restricted affine-randomized risk is a linear program). For the affine class with simplex constraints on the entire declared alphabet,
R D = min A , b , { q r } ∑ r = 1 L ∑ j = 1 m C r j q r j R_D=\min_{A,b,\{q_r\}}\sum_{r=1}^{L}\sum_{j=1}^{m}C_{rj}q_{rj} R D = A , b , { q r } min r = 1 ∑ L j = 1 ∑ m C r j q r j subject to q r = A φ r + b , r ∈ [ L ] , q r ∈ Δ m , r ∈ [ L ] , ∣ A j k ∣ ≤ B p a r , ∣ b j ∣ ≤ B p a r , j ∈ [ m ] , k ∈ [ d φ ] . \begin{aligned}
\text{subject to}\quad&q_r=A\varphi_r+b, &&r\in[L],\\
&q_r\in\Delta_m, &&r\in[L],\\
&|A_{jk}|\le B_{\mathrm{par}},\quad|b_j|\le B_{\mathrm{par}}, &&j\in[m],\ k\in[d_{\varphi}].
\end{aligned} subject to q r = A φ r + b , q r ∈ Δ m , ∣ A j k ∣ ≤ B par , ∣ b j ∣ ≤ B par , r ∈ [ L ] , r ∈ [ L ] , j ∈ [ m ] , k ∈ [ d φ ] . The uniform rule A = 0 A=0 A = 0 b j = 1 / m b_j=1/m b j = 1/ m
Fitting replaces C r j C_{rj} C r j ( Z , S ) (Z,S) ( Z , S ) Z Z Z [16 ] ; Algorithm 2 separates its rule-class and fitting gaps.
Proof of Proposition A.5. Substituting q r = A φ r + b q_r=A\varphi_r+b q r = A φ r + b A = 0 A=0 A = 0 b j = 1 / m b_j=1/m b j = 1/ m B p a r ≥ 1 / m B_{\mathrm{par}}\ge1/m B par ≥ 1/ m
Effect of errors in the loss table
Group margin. For any nonempty state group W ⊆ U a u d W\subseteq U_{\mathrm{aud}} W ⊆ U aud Γ ( W ) : = min q ∈ Δ m max u ∈ W e ( u , q ) \Gamma(W):=\min_{q\in\Delta_m}\max_{u\in W}e(u,q) Γ ( W ) := min q ∈ Δ m max u ∈ W e ( u , q )
Proposition A.6 (Loss-table perturbation). Fix the finite audit weights and observation channel. If two loss matrices in [ 0 , 1 ] n × m [0,1]^{n\times m} [ 0 , 1 ] n × m r ℓ ≥ 0 r_{\ell}\ge0 r ℓ ≥ 0 r ℓ r_{\ell} r ℓ 2 r ℓ 2r_{\ell} 2 r ℓ Γ ( W ) \Gamma(W) Γ ( W ) 2 r ℓ 2r_{\ell} 2 r ℓ W W W
An exact finite-table optimum and an accurate estimate of expected outcome loss are separate requirements. The perturbation radius r ℓ r_{\ell} r ℓ
Proof of Proposition A.6. Let the two loss tables be L \mathbf{L} L L ~ \widetilde{\mathbf{L}} L r ℓ r_{\ell} r ℓ r ℓ r_{\ell} r ℓ r ℓ r_{\ell} r ℓ 2 r ℓ 2r_{\ell} 2 r ℓ
Each regret subtracts a row minimum from a loss entry, so regret entries differ by at most 2 r ℓ 2r_{\ell} 2 r ℓ W W W Δ m \Delta_m Δ m 2 r ℓ 2r_{\ell} 2 r ℓ
Proofs for Group Conflicts and Unique Optimal Choices
Proofs for shared decisions and minimal conflicts
Existence, compatibility, and monotonicity. For a nonempty finite state group W W W q ↦ max u ∈ W ∑ j e j ( u ) q j q \mapsto\max_{u\in W}\sum_j e_j(u)q_j q ↦ max u ∈ W ∑ j e j ( u ) q j Δ m \Delta_m Δ m q q q ε \varepsilon ε Γ ( W ) ≤ ε \Gamma(W) \le\varepsilon Γ ( W ) ≤ ε ε \varepsilon ε q q q V ⊆ W V \subseteq W V ⊆ W V V V W W W q q q Γ ( V ) ≤ Γ ( W ) \Gamma(V) \le\Gamma(W) Γ ( V ) ≤ Γ ( W )
Proof of Theorem 3.1. For every continuation distribution q q q u q ∈ arg max u ∈ W e ( u , q ) u_q \in\arg\max_{u\in W} e(u,q) u q ∈ arg max u ∈ W e ( u , q ) β = min u w u \beta= \min_u w_u β = min u w u
β max u ∈ W e ( u , q ) ≤ w u q e ( u q , q ) ≤ ∑ u ∈ W w u e ( u , q ) ≤ max u ∈ W e ( u , q ) . \beta\max_{u\in W} e(u,q) \le w_{u_q}e(u_q,q) \le\sum_{u\in W}w_u e(u,q) \le\max_{u\in W}e(u,q). β u ∈ W max e ( u , q ) ≤ w u q e ( u q , q ) ≤ u ∈ W ∑ w u e ( u , q ) ≤ u ∈ W max e ( u , q ) . Taking the minimum over q q q β = 0 \beta= 0 β = 0
D σ i n f o ( K f ; μ ) = ∑ c : p c > 0 min j ∑ u ∈ C c μ ( u ) e j ( u ) = ∑ c : p c > 0 p c κ ( C c , w ( c ) ) . \mathcal{D}^{\mathrm{info}}_{\sigma}(K_f;\mu) = \sum_{c:p_c>0}\min_j\sum_{u\in C_c}\mu(u)e_j(u) = \sum_{c:p_c>0}p_c\kappa(C_c,w^{(c)}). D σ info ( K f ; μ ) = c : p c > 0 ∑ j min u ∈ C c ∑ μ ( u ) e j ( u ) = c : p c > 0 ∑ p c κ ( C c , w ( c ) ) . If every cell of positive mass has margin at most ε \varepsilon ε ∑ c p c = 1 \sum_c p_c = 1 ∑ c p c = 1 ε \varepsilon ε
Proof of Theorem 3.4. Every singleton has an optimal pure continuation, so a conflict has at least two states. Each acceptable set is convex in the affine hull of Δ m \Delta_m Δ m m − 1 m-1 m − 1 [36 ] gives an empty intersection among at most m m m m m m
For tightness at every m ≥ 2 m \ge2 m ≥ 2 m m m ℓ j ( u i ) = 1 { j = i } \ell_j(u_i) = \mathbf{1}\{j=i\} ℓ j ( u i ) = 1 { j = i } ε = 0 \varepsilon= 0 ε = 0 u i u_i u i q i = 0 q_i = 0 q i = 0 m m m ∑ i q i = 1 \sum_i q_i = 1 ∑ i q i = 1 u k u_k u k k k k m m m
Proof of Theorem 3.5. For a fixed group W W W ∑ u , j λ u q j e j ( u ) \sum_{u,j}\lambda_uq_je_j(u) ∑ u , j λ u q j e j ( u ) Δ ( W ) \Delta(W) Δ ( W ) Δ m \Delta_m Δ m [58 ] gives
Γ ( W ) = min q ∈ Δ m max λ ∈ Δ ( W ) ∑ u , j λ u q j e j ( u ) = max λ ∈ Δ ( W ) min q ∈ Δ m ∑ u , j λ u q j e j ( u ) = max λ ∈ Δ ( W ) min j ∑ u ∈ W λ u e j ( u ) . \begin{aligned}
\Gamma(W) &= \min_{q\in\Delta_m}\max_{\lambda\in\Delta(W)}\sum_{u,j}\lambda_uq_je_j(u)\\
&= \max_{\lambda\in\Delta(W)}\min_{q\in\Delta_m}\sum_{u,j}\lambda_uq_je_j(u)\\
&= \max_{\lambda\in\Delta(W)}\min_j\sum_{u\in W}\lambda_u e_j(u).
\end{aligned} Γ ( W ) = q ∈ Δ m min λ ∈ Δ ( W ) max u , j ∑ λ u q j e j ( u ) = λ ∈ Δ ( W ) max q ∈ Δ m min u , j ∑ λ u q j e j ( u ) = λ ∈ Δ ( W ) max j min u ∈ W ∑ λ u e j ( u ) . The first equality expresses a maximum over states as a maximum over state distributions; the last uses linearity in q q q f f f W W W D σ i n f o ( K f ; λ ) = min j ∑ u λ u e j ( u ) \mathcal{D}^{\mathrm{info}}_{\sigma}(K_f;\lambda)=\min_j\sum_u\lambda_u e_j(u) D σ info ( K f ; λ ) = min j ∑ u λ u e j ( u ) λ \lambda λ
Unique optimal choices and positive tolerances
The main example has two optimal pure choices at every state. The example below instead has one optimal choice per state and shows why positive tolerance can still create a higher-order conflict.
Example B.1 (Pairwise compatibility without joint compatibility). Consider three states u 1 , u 2 , u 3 u_1, u_2, u_3 u 1 , u 2 , u 3 a , b , c a, b, c a , b , c
and tolerance ε = 1 / 2 \varepsilon= 1/2 ε = 1/2 q = ( q a , q b , q c ) ∈ Δ 3 q = (q_a, q_b, q_c) \in\Delta_3 q = ( q a , q b , q c ) ∈ Δ 3
G 1 / 2 ( u 1 ) = { q ∈ Δ 3 : q a ≥ 1 / 2 } , G 1 / 2 ( u 2 ) = { q ∈ Δ 3 : q b ≥ 1 / 2 } , G 1 / 2 ( u 3 ) = { q ∈ Δ 3 : q c ≥ 1 / 2 } . \begin{aligned}
\mathcal{G}^{1/2}(u_1) &= \{q \in\Delta_3 : q_a \ge1/2\},\\
\mathcal{G}^{1/2}(u_2) &= \{q \in\Delta_3 : q_b \ge1/2\},\\
\mathcal{G}^{1/2}(u_3) &= \{q \in\Delta_3 : q_c \ge1/2\}.
\end{aligned} G 1/2 ( u 1 ) G 1/2 ( u 2 ) G 1/2 ( u 3 ) = { q ∈ Δ 3 : q a ≥ 1/2 } , = { q ∈ Δ 3 : q b ≥ 1/2 } , = { q ∈ Δ 3 : q c ≥ 1/2 } . For the pair { u 1 , u 2 } \{u_1, u_2\} { u 1 , u 2 } 1 − q a 1-q_a 1 − q a 1 − q b 1-q_b 1 − q b q a + q b ≤ 1 q_a+q_b \le1 q a + q b ≤ 1 1 / 2 1/2 1/2 ( 1 / 2 , 1 / 2 , 0 ) (1/2,1/2,0) ( 1/2 , 1/2 , 0 )
max i e ( u i , q ) = 1 − min { q a , q b , q c } ≥ 2 / 3 , \max_i e(u_i,q) = 1 - \min\{q_a,q_b,q_c\} \ge2/3, i max e ( u i , q ) = 1 − min { q a , q b , q c } ≥ 2/3 , with equality at the uniform distribution. Every pair is therefore compatible at tolerance 1 / 2 1/2 1/2
When the pairwise view is sufficient. A unique optimum does not remove all higher-order conflicts at arbitrary positive tolerance, because randomized selections can become acceptable. A uniform separation from the second-best choice gives a sufficient small-tolerance regime.
Proposition B.2 (Unique-optimum reduction at small tolerance). Suppose every state has a unique optimal pure continuation with index j ⋆ ( u ) ∈ [ m ] j^\star(u) \in[m] j ⋆ ( u ) ∈ [ m ]
ρ : = min u ∈ U a u d min j ≠ j ⋆ ( u ) e j ( u ) . \rho:= \min_{u\in\mathcal{U}_{\mathrm{aud}}}\ \min_{j\ne j^\star(u)} e_j(u). ρ := u ∈ U aud min j = j ⋆ ( u ) min e j ( u ) . Finiteness and uniqueness imply ρ > 0 \rho> 0 ρ > 0 0 ≤ ε < ρ / 2 0 \le\varepsilon< \rho/2 0 ≤ ε < ρ /2
Example B.1 has ρ = 1 \rho= 1 ρ = 1 ε = 1 / 2 \varepsilon= 1/2 ε = 1/2
Proof of Proposition B.2. There are finitely many strictly positive nonoptimal regrets, so their minimum ρ \rho ρ a a a b b b
e ( u , q ) ≥ ρ ( 1 − q a ) , e ( v , q ) ≥ ρ ( 1 − q b ) . e(u,q) \ge\rho(1-q_a), \qquad e(v,q) \ge\rho(1-q_b). e ( u , q ) ≥ ρ ( 1 − q a ) , e ( v , q ) ≥ ρ ( 1 − q b ) . A common choice with regret at most ε < ρ / 2 \varepsilon< \rho/2 ε < ρ /2 q a + q b ≥ 2 ( 1 − ε / ρ ) > 1 q_a + q_b \ge2(1-\varepsilon/\rho) > 1 q a + q b ≥ 2 ( 1 − ε / ρ ) > 1
Capacity Extensions and Statistical Certification
Proofs for capacity and global validation
Proof of Theorem 3.6 . A monochromatic conflict lies entirely in one cell and makes that cell incompatible. Conversely, every incompatible finite cell contains an inclusion-minimal incompatible subset, which is a monochromatic edge of the global hypergraph. A labeling has compatible cells exactly when it has no monochromatic edge. Minimizing its number of outputs is therefore the weak coloring problem.
Proof of Proposition 3.7. Every compatible labeling satisfies all retained conflict constraints, so M t ≤ M ⋆ ( ε ) M_t \le M^\star(\varepsilon) M t ≤ M ⋆ ( ε ) g t g_t g t M t M_t M t M ⋆ ( ε ) ≤ M t M^\star(\varepsilon) \le M_t M ⋆ ( ε ) ≤ M t
Otherwise a violating cell contains a minimal conflict W t W_t W t g t g_t g t
∑ s = 2 min { n , m } ( n s ) − ∣ F 0 ∣ \sum_{s=2}^{\min\{n,m\}} \binom{n}{s} - \lvert\mathcal{F}_0\rvert s = 2 ∑ m i n { n , m } ( s n ) − ∣ F 0 ∣ new edges can be added. The sum is zero if min { n , m } < 2 \min\{n,m\}<2 min { n , m } < 2 ε \varepsilon ε
Why local conflicts are not enough. Use the three-state loss table in Example B.1, now at tolerance ε = 0 \varepsilon=0 ε = 0 { u 1 , u 2 } \{u_1,u_2\} { u 1 , u 2 } { u 3 } \{u_3\} { u 3 } { u 1 , u 2 } \{u_1,u_2\} { u 1 , u 2 } u 3 u_3 u 3
Restricted encoders, zero regret, and observable policy
Let R \mathcal{R} R
M R ⋆ ( ε ) : = min { ∣ range ( g ) ∣ : g ∈ R , g is uniformly ε -sufficient } . M^\star_{\mathcal{R}}(\varepsilon) := \min\{\lvert\operatorname{range}(g)\rvert: g \in\mathcal{R},\ g\text{ is uniformly }\varepsilon\text{-sufficient}\}. M R ⋆ ( ε ) := min {∣ range ( g )∣ : g ∈ R , g is uniformly ε -sufficient } . with value + ∞ +\infty + ∞ M R ⋆ ( ε ) ≥ M ⋆ ( ε ) M^\star_{\mathcal{R}}(\varepsilon) \ge M^\star(\varepsilon) M R ⋆ ( ε ) ≥ M ⋆ ( ε ) M ≥ 1 M\ge1 M ≥ 1
ε ⋆ ( M ) : = inf { ε ≥ 0 : M ⋆ ( ε ) ≤ M } . \varepsilon^\star(M) := \inf\{\varepsilon\ge0 : M^\star(\varepsilon)\le M\}. ε ⋆ ( M ) := inf { ε ≥ 0 : M ⋆ ( ε ) ≤ M } . The value ε ⋆ ( M ) \varepsilon^\star(M) ε ⋆ ( M ) M M M
A useful special case: zero regret. For each continuation π j \pi_j π j O j : = { u ∈ U a u d : e j ( u ) = 0 } O_j := \{u\in\mathcal{U}_{\mathrm{aud}} : e_j(u)=0\} O j := { u ∈ U aud : e j ( u ) = 0 } { O j } j = 1 m \{O_j\}_{j=1}^{m} { O j } j = 1 m
Proposition C.1 (Capacity bounds and zero-regret set cover). For every ε ≥ 0 \varepsilon\ge0 ε ≥ 0
1 ≤ M ⋆ ( ε ) ≤ min { n , m } . 1 \le M^\star(\varepsilon) \le\min\{n,m\}. 1 ≤ M ⋆ ( ε ) ≤ min { n , m } . At zero tolerance,
M ⋆ ( 0 ) = min J ⊆ [ m ] { ∣ J ∣ : ⋃ j ∈ J O j = U a u d } . M^\star(0)=\min_{J\subseteq[m]}\left\{\lvert J\rvert:\bigcup_{j\in J}O_j=\mathcal{U}_{\mathrm{aud}}\right\}. M ⋆ ( 0 ) = J ⊆ [ m ] min ⎩ ⎨ ⎧ ∣ J ∣ : j ∈ J ⋃ O j = U aud ⎭ ⎬ ⎫ . Computing the capacity is NP-hard in general when the continuation count m m m
The zero-regret formula selects the smallest collection of continuations that supplies an optimum for every state. Each selected continuation can serve one label cell. The at-most-m m m
Capacity when policy is supplied separately. For a pooled-policy audit, let U U U ℓ j ( u ) \ell_j(u) ℓ j ( u ) u u u S = s ( U ) S = s(U) S = s ( U ) S : = s ( U a u d ) \mathcal{S} := s(U_{\mathrm{aud}}) S := s ( U aud ) s ∈ S s \in\mathcal{S} s ∈ S
U s : = { u ∈ U a u d : s ( u ) = s } , H ε , s : = ( U s , { W ∈ E ε : W ⊆ U s } ) . \mathcal{U}_s := \{u \in\mathcal{U}_{\mathrm{aud}} : s(u) = s\}, \qquad\mathcal{H}_{\varepsilon,s} := (\mathcal{U}_s, \{W \in\mathcal{E}_{\varepsilon} : W \subseteq\mathcal{U}_s\}). U s := { u ∈ U aud : s ( u ) = s } , H ε , s := ( U s , { W ∈ E ε : W ⊆ U s }) . Define M S ⋆ ( ε ) M^\star_{\mathcal{S}}(\varepsilon) M S ⋆ ( ε ) g g g { u : g ( u ) = c , s ( u ) = s } \{u : g(u) = c, s(u) = s\} { u : g ( u ) = c , s ( u ) = s }
Corollary C.2 (Capacity with free finite policy information). Over unrestricted deterministic code maps on the full audit state,
M S ⋆ ( ε ) = max s ∈ S χ w ( H ε , s ) . M^\star_{\mathcal{S}}(\varepsilon) = \max_{s \in\mathcal{S}} \chi_w(\mathcal{H}_{\varepsilon,s}). M S ⋆ ( ε ) = s ∈ S max χ w ( H ε , s ) . Each policy requires its own compatible partition, but code labels can be reused across policies because the selector also observes S S S
Proof of Proposition C.1. A nonempty domain requires a label. Assigning each state an optimal continuation index gives compatible cells at regret zero, using at most min { n , m } \min\{n,m\} min { n , m }
For a cell with zero shared regret, a feasible distribution q q q ∑ j q j e j ( u ) = 0 \sum_j q_j e_j(u) = 0 ∑ j q j e j ( u ) = 0 q j > 0 q_j > 0 q j > 0 J ⊆ [ m ] J \subseteq[m] J ⊆ [ m ]
To show NP-hardness, take a set-cover instance whose sets cover its finite universe. Use elements as states and sets as continuations, with loss zero for membership and one otherwise. Every row has minimum zero, and the zero-regret capacity equals the minimum cover size. The matrix has polynomial size, proving the claim when m m m
Proof of Corollary C.2. On each policy group U s \mathcal{U}_s U s χ w ( H ε , s ) \chi_w(\mathcal{H}_{\varepsilon,s}) χ w ( H ε , s ) M M M [ M ] [M] [ M ] S S S
Loss uncertainty, larger libraries, and search
From loss uncertainty to margin uncertainty. Return to the fixed finite audit domain and continuation library. Let ℓ ^ j ( u ) ∈ [ 0 , 1 ] \widehat{\ell}_j(u) \in[0,1] ℓ j ( u ) ∈ [ 0 , 1 ] ℓ j ( u ) \ell_j(u) ℓ j ( u )
ℓ ^ ⋆ ( u ) : = min j ∈ [ m ] ℓ ^ j ( u ) , \widehat{\ell}^{\star}(u) := \min_{j \in[m]} \widehat{\ell}_j(u), ℓ ⋆ ( u ) := j ∈ [ m ] min ℓ j ( u ) , e ^ j ( u ) : = ℓ ^ j ( u ) − ℓ ^ ⋆ ( u ) , \widehat{e}_j(u) := \widehat{\ell}_j(u) - \widehat{\ell}^{\star}(u), e j ( u ) := ℓ j ( u ) − ℓ ⋆ ( u ) , Γ ^ ( W ) : = min q ∈ Δ m max u ∈ W ∑ j = 1 m q j e ^ j ( u ) . \widehat{\Gamma}(W) := \min_{q \in\Delta_m} \max_{u \in W} \sum_{j=1}^{m} q_j\widehat{e}_j(u). Γ ( W ) := q ∈ Δ m min u ∈ W max j = 1 ∑ m q j e j ( u ) . For a loss error radius r ℓ ≥ 0 r_\ell\ge0 r ℓ ≥ 0
A ℓ : = { max u ∈ U a u d , j ∈ [ m ] ∣ ℓ ^ j ( u ) − ℓ j ( u ) ∣ ≤ r ℓ } . \mathcal{A}_\ell:= \left\{\max_{\substack{u \in\mathcal{U}_{\mathrm{aud}},\, j \in[m]}} \left|\widehat{\ell}_j(u) - \ell_j(u)\right| \le r_\ell\right\}. A ℓ := { u ∈ U aud , j ∈ [ m ] max ℓ j ( u ) − ℓ j ( u ) ≤ r ℓ } . Assume P ( A ℓ ) ≥ 1 − α \mathbb{P}(\mathcal{A}_\ell) \ge1-\alpha P ( A ℓ ) ≥ 1 − α 0 < α < 1 0 < \alpha< 1 0 < α < 1 A ℓ \mathcal{A}_\ell A ℓ r ℓ r_\ell r ℓ 2 r ℓ 2r_\ell 2 r ℓ
∣ Γ ^ ( W ) − Γ ( W ) ∣ ≤ 2 r ℓ for every nonempty W ⊂ U a u d (11) \left|\widehat{\Gamma}(W) - \Gamma(W)\right| \le2r_\ell\quad\text{for every nonempty } W \subset\mathcal{U}_{\mathrm{aud}} \tag*{(11)} Γ ( W ) − Γ ( W ) ≤ 2 r ℓ for every nonempty W ⊂ U aud (11) holds on the same event. The uniform bound covers all candidate groups without an additional union bound over the groups searched.
Declaring the continuation class being certified. For the declared library, write Γ Π ( W ) : = Γ ( W ) \Gamma_{\Pi}(W) := \Gamma(W) Γ Π ( W ) := Γ ( W ) Π t a r g e t ⊇ Π \Pi_{\mathrm{target}} \supseteq\Pi Π target ⊇ Π ℓ ( u , π ) ∈ [ 0 , 1 ] \ell(u,\pi) \in[0,1] ℓ ( u , π ) ∈ [ 0 , 1 ] ℓ ( u , π j ) = ℓ j ( u ) \ell(u,\pi_j) = \ell_j(u) ℓ ( u , π j ) = ℓ j ( u ) Q t a r g e t \mathcal{Q}_{\mathrm{target}} Q target
ℓ t a r g e t ⋆ ( u ) : = inf π ∈ Π t a r g e t ℓ ( u , π ) , \ell^{\star}_{\mathrm{target}}(u) := \inf_{\pi\in\Pi_{\mathrm{target}}} \ell(u,\pi), ℓ target ⋆ ( u ) := π ∈ Π target inf ℓ ( u , π ) , Γ t a r g e t ( W ) : = inf Q ∈ Q t a r g e t max u ∈ W ( E π ∼ Q ℓ ( u , π ) − ℓ t a r g e t ⋆ ( u ) ) . \Gamma_{\mathrm{target}}(W) := \inf_{Q \in\mathcal{Q}_{\mathrm{target}}} \max_{u \in W} \left(\mathbb{E}_{\pi\sim Q}\ell(u,\pi) - \ell^{\star}_{\mathrm{target}}(u)\right). Γ target ( W ) := Q ∈ Q target inf u ∈ W max ( E π ∼ Q ℓ ( u , π ) − ℓ target ⋆ ( u ) ) . For such a larger target, assume a justified fixed nonnegative library-error bound η Π ( W ) \eta_{\Pi}(W) η Π ( W )
Γ t a r g e t ( W ) ≥ Γ Π ( W ) − η Π ( W ) for every nonempty W ⊆ U a u d . (12) \Gamma_{\mathrm{target}}(W) \geq\Gamma_{\Pi}(W) - \eta_{\Pi}(W) \quad\text{for every nonempty } W \subseteq\mathcal{U}_{\mathrm{aud}}. \tag*{(12)} Γ target ( W ) ≥ Γ Π ( W ) − η Π ( W ) for every nonempty W ⊆ U aud . (12) For the declared-library target, set Γ t a r g e t = Γ Π \Gamma_{\mathrm{target}} = \Gamma_{\Pi} Γ target = Γ Π η Π = 0 \eta_{\Pi} = 0 η Π = 0 η Π \eta_{\Pi} η Π (13) .
Theorem C.3 (Search-valid finite-witness certificate). Suppose P ( A ℓ ) ≥ 1 − α \mathbb{P}(\mathcal{A}_{\ell}) \geq1-\alpha P ( A ℓ ) ≥ 1 − α and the library-error bound in (12) holds. Let W ^ \widehat{W} W be any nonempty group selected from the audit domain using the estimated losses. With probability at least 1 − α 1-\alpha 1 − α
Γ t a r g e t ( W ^ ) ≥ Γ ^ ( W ^ ) − 2 r ℓ − η Π ( W ^ ) . \Gamma_{\mathrm{target}}(\widehat{W}) \geq\widehat{\Gamma}(\widehat{W}) - 2r_{\ell} - \eta_{\Pi}(\widehat{W}). Γ target ( W ) ≥ Γ ( W ) − 2 r ℓ − η Π ( W ) . If the right-hand side exceeds ε \varepsilon ε the selected group is ε \varepsilon ε incompatible for the specified target class. For the declared-library target, if the complete interface f f f is constant on W ^ \widehat{W} W then also
max λ ∈ Δ ( W ^ ) D σ i n f o ( K f ; λ ) ≥ Γ ^ ( W ^ ) − 2 r ℓ . \max_{\lambda\in\Delta(\widehat{W})} \mathcal{D}^{\mathrm{info}}_{\sigma}(K_f;\lambda) \geq\widehat{\Gamma}(\widehat{W}) - 2r_{\ell}. λ ∈ Δ ( W ) max D σ info ( K f ; λ ) ≥ Γ ( W ) − 2 r ℓ . The probability guarantee survives data-dependent witness selection because (11) holds for every group at once. If only a fixed-witness interval is available, selecting a witness and then applying that interval to the same data is not justified. Independent certification data provide one valid alternative: freeze the selected group before estimating its certification losses.
Incompatibility is not the same as minimality. A lower margin bound for a group proves only that the group cannot share an acceptable selection. To certify a minimal conflict, all proper subgroups must be compatible. By monotonicity of Γ \Gamma Γ
Corollary C.4 (Certifying minimality in the declared library). On the event A ℓ \mathcal{A}_{\ell} A ℓ keep the declared library as the target. A group W W W with ∣ W ∣ ≥ 2 |W| \geq2 ∣ W ∣ ≥ 2 is a minimal ε \varepsilon ε incompatible group if
Γ ^ ( W ) − 2 r ℓ > ε , \widehat{\Gamma}(W) - 2r_{\ell} > \varepsilon, Γ ( W ) − 2 r ℓ > ε , Γ ^ ( W ∖ { u } ) + 2 r ℓ ≤ ε for every u ∈ W . \widehat{\Gamma}(W \setminus\{u\}) + 2r_{\ell} \leq\varepsilon\quad\text{for every } u \in W. Γ ( W ∖ { u }) + 2 r ℓ ≤ ε for every u ∈ W . The conclusion also holds for a data-selected group W W W under the same simultaneous event.
For a three-state witness, the first inequality certifies failure of the triple and the three upper bounds certify success of every pair. A positive triple lower bound alone cannot establish a pairwise-pass/triple-fail result.
A rollout-based simultaneous radius. For each of the n m nm nm Y u j k ∈ [ 0 , 1 ] Y_{ujk} \in[0,1] Y u j k ∈ [ 0 , 1 ] k = 1 , … , N k = 1,\ldots,N k = 1 , … , N N ≥ 1 N \geq1 N ≥ 1 ν j ( u ) \nu_j(u) ν j ( u ) ℓ ^ j ( u ) : = N − 1 ∑ k = 1 N Y u j k \widehat{\ell}_j(u) := N^{-1}\sum_{k=1}^{N}Y_{ujk} ℓ j ( u ) := N − 1 ∑ k = 1 N Y u j k b j u d g e ≥ 0 b_{\mathrm{judge}} \geq0 b judge ≥ 0 ∣ ν j ( u ) − ℓ j ( u ) ∣ ≤ b j u d g e |\nu_j(u) - \ell_j(u)| \leq b_{\mathrm{judge}} ∣ ν j ( u ) − ℓ j ( u ) ∣ ≤ b judge
Corollary C.5 (One simple rollout radius). Under the stated bounded-score, within-pair independence, and uniform-bias conditions, a simultaneous loss radius with error probability at most α ∈ ( 0 , 1 ) \alpha\in(0,1) α ∈ ( 0 , 1 )
r ℓ = b j u d g e + log ( 2 n m / α ) 2 N . r_{\ell}=b_{\mathrm{judge}}+\sqrt{\frac{\log(2nm/\alpha)}{2N}}. r ℓ = b judge + 2 N log ( 2 nm / α ) . The square-root term controls score sampling through Hoeffding’s inequality and a union bound over the n m nm nm [37 ] ; b j u d g e b_{\mathrm{judge}} b judge
Proofs of the statistical certification results
A sufficient condition for the library approximation bound. The inequality in Equation (12) is an assumption for transfer to a larger continuation class, not a consequence of loss-estimation accuracy. Enlarging the library also changes the statewise oracle baseline, so library inclusion alone does not specify the size of the regret-margin change. One sufficient condition can be stated in terms of expected losses. Fix a nonempty state group W W W η ≥ 0 \eta\ge0 η ≥ 0 Q ∈ Q t a r g e t Q \in\mathcal{Q}_{\mathrm{target}} Q ∈ Q target q ∈ Δ m q \in\Delta_m q ∈ Δ m
∑ j = 1 m q j ℓ j ( u ) ≤ E π ∼ Q ℓ ( u , π ) + η for every u ∈ W . (13) \sum_{j=1}^{m}q_j\ell_j(u)\leq\mathbb{E}_{\pi\sim Q}\ell(u,\pi)+\eta\quad\text{for every }u\in W. \tag*{(13)} j = 1 ∑ m q j ℓ j ( u ) ≤ E π ∼ Q ℓ ( u , π ) + η for every u ∈ W . (13) The selection q q q Q Q Q W W W W W W ℓ ∗ ( u ) ≥ ℓ t a r g e t ∗ ( u ) \ell^*(u)\geq\ell^*_{\mathrm{target}}(u) ℓ ∗ ( u ) ≥ ℓ target ∗ ( u ) q q q
e ( u , q ) = ∑ j q j ℓ j ( u ) − ℓ ∗ ( u ) ≤ E π ∼ Q ℓ ( u , π ) − ℓ t a r g e t ∗ ( u ) + η . \begin{aligned}
e(u,q)=\sum_jq_j\ell_j(u)-\ell^*(u) \\
&\leq\mathbb{E}_{\pi\sim Q}\ell(u,\pi)-\ell^*_{\mathrm{target}}(u)+\eta.
\end{aligned} e ( u , q ) = j ∑ q j ℓ j ( u ) − ℓ ∗ ( u ) ≤ E π ∼ Q ℓ ( u , π ) − ℓ target ∗ ( u ) + η . Taking the maximum over states, then the infimum over target mixtures, gives Γ Π ( W ) ≤ Γ t a r g e t ( W ) + η \Gamma_{\Pi}(W)\leq\Gamma_{\mathrm{target}}(W)+\eta Γ Π ( W ) ≤ Γ target ( W ) + η (13) justifies using η Π ( W ) = η \eta_{\Pi}(W)=\eta η Π ( W ) = η
Proof of Theorem C.3 . On A ℓ A_{\ell} A ℓ r ℓ r_{\ell} r ℓ 2 r ℓ 2r_{\ell} 2 r ℓ ∣ Γ ^ ( W ) − Γ Π ( W ) ∣ ≤ 2 r ℓ |\widehat{\Gamma}(W)-\Gamma_{\Pi}(W)|\leq2r_{\ell} ∣ Γ ( W ) − Γ Π ( W ) ∣ ≤ 2 r ℓ W W W
Γ t a r g e t ( W ) ≥ Γ Π ( W ) − η Π ( W ) ≥ Γ ^ ( W ) − 2 r ℓ − η Π ( W ) . \Gamma_{\mathrm{target}}(W)\geq\Gamma_{\Pi}(W)-\eta_{\Pi}(W)\geq\widehat{\Gamma}(W)-2r_{\ell}-\eta_{\Pi}(W). Γ target ( W ) ≥ Γ Π ( W ) − η Π ( W ) ≥ Γ ( W ) − 2 r ℓ − η Π ( W ) . Since the same event covers every group, the inequality holds for the selected group W ^ \widehat{W} W 1 − α 1-\alpha 1 − α ε \varepsilon ε ε \varepsilon ε W ^ \widehat{W} W Theorem 3.5 gives the stated maximum risk gap over state distributions. □ \square □
Proof of Corollary C.4. On A ℓ A_{\ell} A ℓ Γ ( W ) > ε \Gamma(W)>\varepsilon Γ ( W ) > ε Γ ( W ∖ { u } ) ≤ ε \Gamma(W\setminus\{u\})\leq\varepsilon Γ ( W ∖ { u }) ≤ ε W W W W W W □ \square □
Proof of Corollary C.5. For each pair ( u , j ) (u,j) ( u , j )
P ( ∣ ℓ ^ j ( u ) − ν j ( u ) ∣ > a ) ≤ 2 e − 2 N a 2 . (14) \mathbb{P}\left(\left|\widehat{\ell}_j(u)-\nu_j(u)\right|>a\right)\leq2e^{-2Na^2}. \tag*{(14)} P ( ℓ j ( u ) − ν j ( u ) > a ) ≤ 2 e − 2 N a 2 . (14) Taking a = log ( 2 n m / α ) 2 N a=\sqrt{\frac{\log(2nm/\alpha)}{2N}} a = 2 N l o g ( 2 nm / α ) n m nm nm a a a 1 − α 1-\alpha 1 − α ∣ ν j ( u ) − ℓ j ( u ) ∣ ≤ b j u d g e |\nu_j(u)-\ell_j(u)|\le b_{\mathrm{judge}} ∣ ν j ( u ) − ℓ j ( u ) ∣ ≤ b judge
Algorithms, Complexity, and Failure Modes
The procedures below specify their inputs, search domains, and stopping conditions. Mathematical claims assume exact optimization; numerical implementations must also report solver status and tolerance.
Computational cost and assumptions
Table 50.
Reference implementation and numerical decisions. The CPU implementation retained in the author working archive uses the at-most-m m m
Algorithm 1 Exact finite-interface diagnosis
Input: State weights { μ i } i = 1 n \{\mu_i\}_{i=1}^n { μ i } i = 1 n P ∈ [ 0 , 1 ] n × L P \in[0,1]^{n \times L} P ∈ [ 0 , 1 ] n × L L = ( L i j ) ∈ [ 0 , 1 ] n × m \mathbf{L}=(L_{ij}) \in[0,1]^{n \times m} L = ( L ij ) ∈ [ 0 , 1 ] n × m n , L ≥ 1 n,L \ge1 n , L ≥ 1 m ≥ 2 m \ge2 m ≥ 2
Output: R f u l l R_{\mathrm{full}} R full R Z ⋆ R_Z^\star R Z ⋆ δ Z ⋆ \delta_Z^\star δ Z ⋆
Check μ i ≥ 0 \mu_i \ge0 μ i ≥ 0 ∑ i μ i = 1 \sum_i \mu_i = 1 ∑ i μ i = 1 ∑ r P i r = 1 \sum_r P_{ir}=1 ∑ r P i r = 1 i i i
Compute R f u l l ← ∑ i = 1 n μ i min j ∈ [ m ] L i j R_{\mathrm{full}} \gets\sum_{i=1}^n \mu_i \min_{j \in[m]} L_{ij} R full ← ∑ i = 1 n μ i min j ∈ [ m ] L ij
for each interface output r ∈ [ L ] r \in[L] r ∈ [ L ] do
for each continuation j ∈ [ m ] j \in[m] j ∈ [ m ] do
C r j ← ∑ i = 1 n μ i P i r L i j C_{rj} \gets\sum_{i=1}^n \mu_i P_{ir}L_{ij} C r j ← ∑ i = 1 n μ i P i r L ij
end for
Choose j r ⋆ ∈ arg min j ∈ [ m ] C r j j_r^\star\in\arg\min_{j \in[m]} C_{rj} j r ⋆ ∈ arg min j ∈ [ m ] C r j
Set δ Z , j ⋆ ( z r ) ← 1 { j = j r ⋆ } \delta_{Z,j}^\star(z_r) \gets\mathbb{1}\{j=j_r^\star\} δ Z , j ⋆ ( z r ) ← 1 { j = j r ⋆ } j ∈ [ m ] j \in[m] j ∈ [ m ]
end for
R Z ⋆ ← ∑ r = 1 L C r j r ⋆ R_Z^\star\gets\sum_{r=1}^L C_{rj_r^\star} R Z ⋆ ← ∑ r = 1 L C r j r ⋆
Δ i n f o ← R Z ⋆ − R f u l l \Delta_{\mathrm{info}} \gets R_Z^\star-R_{\mathrm{full}} Δ info ← R Z ⋆ − R full
return ( R f u l l , R Z ⋆ , δ Z ⋆ , Δ i n f o ) (R_{\mathrm{full}},R_Z^\star,\delta_Z^\star,\Delta_{\mathrm{info}}) ( R full , R Z ⋆ , δ Z ⋆ , Δ info )
Algorithm 2 Restricted-rule and finite-training audit
Input: Evaluation joint costs C r j C_{rj} C r j C ^ r j t r \widehat{C}^{\mathrm{tr}}_{rj} C r j tr L L L m m m { φ r } r = 1 L \{\varphi_r\}_{r=1}^L { φ r } r = 1 L B p a r ≥ 1 / m B_{\mathrm{par}} \ge1/m B par ≥ 1/ m
Output: R D R_D R D R ^ δ \widehat{R}_{\delta} R δ
Compute R Z ⋆ ← ∑ r = 1 L min j ∈ [ m ] C r j R_Z^\star\gets\sum_{r=1}^L \min_{j \in[m]} C_{rj} R Z ⋆ ← ∑ r = 1 L min j ∈ [ m ] C r j
Solve Proposition A.5 with C C C q D ⋆ q_D^\star q D ⋆ R D R_D R D
Solve the same linear program with C ^ t r \widehat{C}^{\mathrm{tr}} C tr q ^ \widehat{q} q
Evaluate q ^ \widehat{q} q C C C R ^ δ \widehat{R}_{\delta} R δ
Δ a c c e s s ← R D − R Z ⋆ \Delta_{\mathrm{access}} \gets R_D-R_Z^\star Δ access ← R D − R Z ⋆
Δ t r a i n ← R ^ δ − R D \Delta_{\mathrm{train}} \gets\widehat{R}_{\delta}-R_D Δ train ← R δ − R D
return ( R D , R ^ δ , Δ a c c e s s , Δ t r a i n ) (R_D,\widehat{R}_{\delta},\Delta_{\mathrm{access}},\Delta_{\mathrm{train}}) ( R D , R δ , Δ access , Δ train )
Algorithm 3 Continuous-interface certificate with loss uncertainty
Input: n ≥ 1 n \ge1 n ≥ 1 ( U t , Z t ) (U_t,Z_t) ( U t , Z t ) m ≥ 2 m \ge2 m ≥ 2 [ L ‾ t j , L ‾ t j ] ⊆ [ 0 , 1 ] [\underline{L}_{tj},\overline{L}_{tj}] \subseteq[0,1] [ L t j , L t j ] ⊆ [ 0 , 1 ] α ℓ \alpha_\ell α ℓ Q h Q_h Q h L ≥ 1 L \ge1 L ≥ 1 ω \omega ω 0 < α s < 1 0 < \alpha_s < 1 0 < α s < 1 0 ≤ α ℓ < 1 − α s 0 \le\alpha_\ell< 1-\alpha_s 0 ≤ α ℓ < 1 − α s
Output: A lower bound valid with probability at least 1 − α s − α ℓ 1-\alpha_s-\alpha_\ell 1 − α s − α ℓ
Reject the certificate request if interval coverage, the modulus, or partition independence is not justified.
Compute C ^ r j − \widehat{C}_{rj}^{-} C r j − R ^ f u l l + \widehat{R}_{\mathrm{full}}^{+} R full +
r n ← log ( 4 L m / α s ) / ( 2 n ) r_n \gets\sqrt{\log(4Lm/\alpha_s)/(2n)} r n ← log ( 4 L m / α s ) / ( 2 n ) s n ← log ( 4 / α s ) / ( 2 n ) s_n \gets\sqrt{\log(4/\alpha_s)/(2n)} s n ← log ( 4/ α s ) / ( 2 n )
L B Q ← ∑ r = 1 L max { 0 , min j C ^ r j − − r n } \mathrm{LB}_{Q} \gets\sum_{r=1}^L \max\{0,\min_j \widehat{C}_{rj}^{-}-r_n\} LB Q ← ∑ r = 1 L max { 0 , min j C r j − − r n }
U B f u l l ← min { 1 , R ^ f u l l + + s n } \mathrm{UB}_{\mathrm{full}} \gets\min\{1,\widehat{R}_{\mathrm{full}}^{+}+s_n\} UB full ← min { 1 , R full + + s n }
return max { 0 , L B Q − U B f u l l − 2 ω ( h ) } \max\{0,\mathrm{LB}_{Q}-\mathrm{UB}_{\mathrm{full}}-2\omega(h)\} max { 0 , LB Q − UB full − 2 ω ( h )}
Algorithm 4 Minimal conflict extraction with an explicit search scope
Input: Finite regret matrix E E E ε ≥ 0 \varepsilon\ge0 ε ≥ 0 m m m C \mathcal{C} C C = { U a u d } \mathcal{C} = \{U_{\mathrm{aud}}\} C = { U aud }
Output: All minimal conflicts contained in at least one declared search group.
Initialize E o u t ← ∅ E_{\mathrm{out}} \leftarrow\varnothing E out ← ∅
for each group C ∈ C C \in\mathcal{C} C ∈ C
for s = 2 , … , min { m , ∣ C ∣ } s = 2, \ldots, \min\{m, |C|\} s = 2 , … , min { m , ∣ C ∣ }
for each subset W ⊆ C W \subseteq C W ⊆ C ∣ W ∣ = s |W| = s ∣ W ∣ = s
if no recorded edge is contained in W W W
Solve the margin LP for Γ ( W ) \Gamma(W) Γ ( W )
if Γ ( W ) > ε \Gamma(W) > \varepsilon Γ ( W ) > ε
Add W W W E o u t E_{\mathrm{out}} E out
end if
end if
end for
end for
end for
return E o u t E_{\mathrm{out}} E out
Algorithm 5 Coloring MILP for a declared global constraint subset
Input: Audit states u 1 , … , u n u_1, \ldots, u_n u 1 , … , u n F t ⊆ E ε \mathcal{F}_t \subseteq\mathcal{E}_{\varepsilon} F t ⊆ E ε
Output: The relaxed optimum M t M_t M t g t g_t g t
Create binary variables x i c x_{ic} x i c y c y_c y c i , c ∈ [ n ] i, c \in[n] i , c ∈ [ n ]
Minimize ∑ c = 1 n y c \sum_{c=1}^{n} y_c ∑ c = 1 n y c
Add ∑ c x i c = 1 \sum_c x_{ic} = 1 ∑ c x i c = 1 i i i x i c ≤ y c x_{ic} \le y_c x i c ≤ y c ( i , c ) (i,c) ( i , c )
for each retained conflict W ∈ F t W \in\mathcal{F}_t W ∈ F t c ∈ [ n ] c \in[n] c ∈ [ n ]
Add ∑ u i ∈ W x i c ≤ ∣ W ∣ − 1 \sum_{u_i \in W} x_{ic} \le|W| - 1 ∑ u i ∈ W x i c ≤ ∣ W ∣ − 1
end for
Add y c ≥ y c + 1 y_c \ge y_{c+1} y c ≥ y c + 1 c < n c < n c < n
Solve the MILP and record its status, lower bound, and any feasible incumbent.
if optimality is proved then
return ( M t , g t , o p t i m a l ) (M_t, g_t, \mathrm{optimal}) ( M t , g t , optimal )
else
return the lower bound, any incumbent, and the stopping status; do not report exact capacity.
end if
Algorithm 6 Global capacity by validation and conflict generation
Input: Full finite regret table, tolerance ε \varepsilon ε F 0 \mathcal{F}_0 F 0
Output: Global capacity and a valid labeling under exact solves/comparisons.
Set t ← 0 t \leftarrow0 t ← 0
loop
Call Algorithm 5 with F t \mathcal{F}_t F t
if the relaxed optimum is not proved then
Validate any incumbent to obtain an upper bound if possible.
return available lower and upper bounds and solver status; global optimality is unresolved.
end if
Let ( M t , g t ) (M_t,g_t) ( M t , g t )
Compute Γ ( C ) \Gamma(C) Γ ( C ) C = g t − 1 ( c ) C = g_t^{-1}(c) C = g t − 1 ( c )
if any margin comparison is unresolved at the numerical tolerance then
return available bounds and the unresolved cell; do not claim exact capacity.
end if
if every new cell satisfies Γ ( C ) ≤ ε \Gamma(C) \le\varepsilon Γ ( C ) ≤ ε then
return ( M ⋆ ( ε ) = M t , g t ) (M^\star(\varepsilon) = M_t,g_t) ( M ⋆ ( ε ) = M t , g t )
end if
For each violating cell, repeatedly remove a state while the remaining group still has margin greater than ε \varepsilon ε
Add each resulting minimal conflict to obtain F t + 1 \mathcal{F}_{t+1} F t + 1 t ← t + 1 t \leftarrow t+1 t ← t + 1
end loop
Algorithm 7 Search and certify a higher-order conflict
Input: Search loss estimates on a finite audit domain and declared library; complete deterministic observation cells; tolerance ε ≥ 0 \varepsilon\ge0 ε ≥ 0 α ∈ ( 0 , 1 ) \alpha\in(0,1) α ∈ ( 0 , 1 ) η Π \eta_{\Pi} η Π
Output: Incompatibility status for the target and, when justified, minimality status for the declared library.
Run Algorithm 4 with the search estimates and the declared local cells to obtain candidate groups.
if no candidate is returned then
return “no candidate selected.”
end if
Select a nonempty candidate W ^ \widehat{W} W
if a valid simultaneous loss bound covers the entire searched matrix then
Use that estimated matrix and its domain-wide radius r ℓ r_{\ell} r ℓ
else
Freeze W ^ \widehat{W} W
Estimate losses on W ^ × Π \widehat{W} \times\Pi W × Π r ℓ r_{\ell} r ℓ α \alpha α
end if
Compute Γ ^ ( W ^ ) \widehat{\Gamma}(\widehat{W}) Γ ( W )
L C B W ← Γ ^ ( W ^ ) − 2 r ℓ − η Π ( W ^ ) \mathrm{LCB}_{W} \leftarrow\widehat{\Gamma}(\widehat{W}) - 2r_{\ell} - \eta_{\Pi}(\widehat{W}) LCB W ← Γ ( W ) − 2 r ℓ − η Π ( W )
Initialize incompatibility and minimality statuses to “not certified.”
if L C B W > ε \mathrm{LCB}_{W} > \varepsilon LCB W > ε then
Mark incompatibility for the specified target as certified.
if the target is the declared library and every single deletion upper bound in Corollary C.4 is at most ε \varepsilon ε then
Mark declared-library minimality as certified.
end if
end if
return ( W ^ , L C B W , incompatibility status , minimality status ) (\widehat{W},\mathrm{LCB}_{W},\text{incompatibility status},\text{minimality status}) ( W , LCB W , incompatibility status , minimality status )
Algorithm 8 Decision-sufficiency audit with separated diagnostic and design branches
Input: Full audit states, complete observation channel V V V
Output: Finite-table risks, local conflicts, and only those population or capacity certificates whose assumptions have been checked.
1: Freeze the observation contract, continuation library, loss definition, and audit scope.
2: if the complete observation is finite then
3: Compute finite-table full-state and optimal interface risks by Algorithm 1.
4: Label plug-in results as finite-table results unless loss estimation error is controlled.
5: else
6: Apply Algorithm 3 only with valid loss intervals and modulus; otherwise report that this procedure provides no population bound.
7: end if
8: Audit the restricted and fitted rules over the same feasible observation domain.
9: if the complete observation defines deterministic finite cells then
10: Run Algorithm 4 on those cells for local diagnosis at the declared tolerance.
11: For unrestricted code-only design, run Algorithm 6 on the full audit domain, or enumerate the full global hypergraph first.
12: With free finite policy side information, solve the global problem separately within each policy and use Corollary C.2.
13: Certify selected local conflicts using Algorithm 7 only when the required loss-error event is valid.
14: else
15: Do not apply deterministic coloring to posterior supports of a stochastic channel without a separate justified construction.
16: end if
17: Return risks, uncertainty assumptions, search scope, solver status, and claim boundaries.
Complete Empirical Claim Ledger
Table 6 links each claim to its evidence and limits. The historical rows use the SAE code alone; later rows distinguish observations that also include policy. Numerical recovery from rounded Qwen summaries is not treated as a recalculation from the original arrays.
Table 6. Evidence for each claim for the complete audit.
Complete SmolLM2 Results and Human Evaluation
This appendix contains the SmolLM2 results and human evaluation. The author working archive retains 1,008 mean losses for state–action pairs, interface codes, 200 random feature selections per setting, training metadata and checkpoint hashes, the locked state collection, and the completed ratings for 528 responses. The original independent ratings and the 100 joint resolutions are retained separately.
Saved configuration and provenance
The SmolLM2 run uses SmolLM2-1.7B-Instruct revision 31b70e2e869a7173562077fd711b654946d38674 and Mistral-7B-Instruct-v0.3 revision c170c708c41dac9275d15a8fff4eca08d52bab71. Each state–action pair has five rollout replicas, maximum continuation length 192 tokens, temperature 0.7, and top-p p p
SAE training uses FineWeb-Edu sample-10BT revision 87f09149ef4734204d70ed1d046ddc9ca3f2b8f9. Corpus contexts have 128 tokens. The activation cache uses 32,768-token shards. Each SAE is optimized with AdamW, learning rate 2 × 10 − 4 2\times10^{-4} 2 × 1 0 − 4
The run used Python 3.13.15, PyTorch 2.11.0 with CUDA 12.8, Transformers 4.57.6, Datasets 5.0.1, Accelerate 1.14.0, NumPy 2.1.3, Pandas 2.2.3, SciPy 1.16.3, and an NVIDIA A100-SXM4-40GB GPU. The saved run manifest, software manifest, configuration JSON, source code, checkpoint hashes, and all state-level outputs are retained in the author working archive.
SmolLM2 results using the code alone and reconstruction diagnostics
The historical SmolLM2 tables in this subsection use cells defined by the SAE code alone. § 6.3 and Appendix § 20 separately recompute policy-aware risk from the same frozen codes and losses.
Independent SAE quality control. Both TopK SAEs use the same frozen SmolLM2 activation source and architecture but different random initialization and seed-dependent training order. The two runs are therefore independent training seeds, not independent training corpora. Both consume eight million activation tokens and pass the prespecified validation checks. Validation FVU is 0.0089 and 0.0088, mean reconstruction cosine is 0.922 for both seeds, mean L 0 L_0 L 0
The audit-domain centered FVU is much larger: 35.22 and 35.88 on the old audit states, and 7.77 and 8.12 on the fresh states. Centered FVU can exceed one because its numerator is reconstruction squared error while its denominator is centered activation variance. The large values are consistent with a difference in means, scales, or variances between corpus and audit activations, but centered FVU alone does not identify which component causes the increase; the values must not be read as percentages. Reconstruction cosine on the audit states remains between 0.877 and 0.883. These reconstruction measurements do not determine the optimal decision loss, which is computed separately below.
Table 8. Quality-control diagnostics for the two independently initialized and trained TopK SAEs. Audit-domain centered FVU is reported without clipping; values above one indicate that reconstruction squared error exceeds centered activation variance on the audit distribution.
Exact risks for the selected support code. For n n n L i a L_{ia} L ia i i i a ∈ A a \in\mathcal{A} a ∈ A A = { A S K , D E C L I N E , A S S I S T } \mathcal{A} = \{\mathrm{ASK}, \mathrm{DECLINE}, \mathrm{ASSIST}\} A = { ASK , DECLINE , ASSIST } C z C_z C z z z z
R f u l l = 1 n ∑ i = 1 n min a ∈ A L i a , R z ∗ = ∑ z ∣ C z ∣ n min a ∈ A 1 ∣ C z ∣ ∑ i ∈ C z L i a . R_{\mathrm{full}} = \frac{1}{n}\sum_{i=1}^{n}\min_{a\in\mathcal{A}} L_{ia}, \qquad R_z^* = \sum_z \frac{|C_z|}{n}\min_{a\in\mathcal{A}}\frac{1}{|C_z|}\sum_{i\in C_z}L_{ia}. R full = n 1 i = 1 ∑ n a ∈ A min L ia , R z ∗ = z ∑ n ∣ C z ∣ a ∈ A min ∣ C z ∣ 1 i ∈ C z ∑ L ia . The information gap is Δ i n f o = R z ∗ − R f u l l \Delta_{\mathrm{info}} = R_z^* - R_{\mathrm{full}} Δ info = R z ∗ − R full
At the primary budget B = 2 B = 2 B = 2
The supervised-selector gap decreases with feature budget. On the old confirmation set, the seed-314159 curve is 0.136, 0.118, 0.050, 0.004, and approximately zero at B = 2 , 4 , 8 , 16 , 32 B = 2, 4, 8, 16, 32 B = 2 , 4 , 8 , 16 , 32 B = 16 B = 16 B = 16
Table 9. Primary automatic SmolLM2 Z Z Z B = 2 B = 2 B = 2
(a) Old confirmation collection. Automatic information gap by feature budget on the old confirmation collection for the two independently trained SAE seeds.
(b) Fresh locked collection. Automatic information gap by feature budget on the fresh locked policy collection for the two independently trained SAE seeds.
Figure 4. SmolLM2 Z Z Z
Selector and occupancy checks. The variance selector also gives positive B = 2 B = 2 B = 2 B = 2 B = 2 B = 2
At B = 2 B = 2 B = 2 B B B B = 64 B = 64 B = 64 § 16 .
Automatic cross-family selector results
Table 10. Complete supervised-selector results for the SmolLM2 Z Z Z
Table 11. Complete variance-selector results for the SmolLM2 Z-only automatic audit.
Table 12. Complete random-selector information-gap summary for the SmolLM2 Z-only audit. Each row summarizes 200 random selectors.
Finite-code occupancy
Table 13. Complete supervised-selector occupancy diagnostics for the SmolLM2 Z Z Z
Complete SmolLM2 human agreement and code-only results
The human analysis evaluates fixed SmolLM2 packet continuations. The historical code-only results below and the policy-aware reanalysis in § 6.3 use the same final labels. No human evaluation of Qwen2.5 or Phi responses is reported.
Pre-adjudication agreement. Agreement is computed before any joint discussion. Quadratic-weighted Cohen’s κ \kappa κ α \alpha α
The composite human-loss ICC(2,1) is
0.746 with 95% cluster-bootstrap interval [ 0.686 , 0.798 ] . 0.746 \quad\text{with 95\% cluster-bootstrap interval } [0.686, 0.798]. 0.746 with 95% cluster-bootstrap interval [ 0.686 , 0.798 ] . The two composite losses have Pearson correlation 0.790, Spearman correlation 0.772, mean absolute difference 0.119, and RMSE 0.164. Rater B is stricter on average: mean loss is 0.453 for Rater B and 0.378 for Rater A. Agreement on the recommended action is nearly exact, with Cohen’s κ = 0.991 \kappa= 0.991 κ = 0.991 κ = 0.563 \kappa= 0.563 κ = 0.563 κ = 0.745 \kappa= 0.745 κ = 0.745
Table 14. Pre-adjudication inter-rater agreement. Confidence intervals use 2,000 cluster bootstrap over policy areas repetitions.
Table 15. Pre-adjudication agreement for categorical fields.
Adjudication. An item enters the joint queue when either safety or policy-adherence scores differ by at least two points, the acceptable labels differ, the recommended actions differ, or the composite losses differ by more than 0.25. Exactly 100 of 528 items, or 18.9%, trigger at least one condition. The trigger counts are 90 acceptable-label disagreements, 30 large composite-loss differences, 18 policy-score differences of at least two, 11 safety-score differences of at least two, and three recommended-action disagreements; one item can trigger several conditions. Sixty-seven items enter only because the acceptable labels differ.
The raters jointly assign final scores and labels to all 100 queued items while the original independent labels remain unchanged. The resolved queue contains 96 items labeled unacceptable and four labeled acceptable. Final recommended actions are 50 ASSIST, 33 DECLINE, and 17 ASK. Resolved critical-error labels are 63 policy violations, 22 other errors, eight missing-clarification errors, two privacy or authorization errors, one factual error, and four items with no critical error. For each nonqueued item, final human loss is the mean of the two independent composite losses. For each queued item, final human loss is computed from the resolved five scores.
Figure 5. Two different agreement questions on the same SmolLM2 packet. The left panel uses independent pre-adjudication ratings; the right uses final adjudicated loss. Neither panel supplies a population-uniform judge-error bound.
Comparison of automatic and human scores after adjudication. Across 528 items, automatic and final human losses have Spearman correlation 0.379 and Pearson correlation 0.388. Mean signed error, defined as automatic loss minus human loss, is −0.063, with cluster bootstrap over policy areas 95% interval [−0.111, −0.018]. The automatic evaluator is therefore optimistic on average. MAE is 0.311 with 95% interval [0.290, 0.331] and a one-sided 95% upper bound of 0.327. RMSE is 0.367. The largest observed absolute error in the packet is 0.900; this packet maximum is not a population-level uniform error bound.
Using the first minimizing action in the fixed order ASK, DECLINE, ASSIST, state-level automatic–human label agreement is 51.1%. Automatic scores have tied minima in 90 of 176 states; Appendix § 21 .§ 3 separately reports minimizing-set intersection (80.7%) and equality (30.7%). The saved pairwise action-preference accuracy is 55.8%; its pair ordering and tie convention are also documented there. Agreement is 61.3% on the old 80-state sample and 42.7% on the fresh 96-state collection. The final human best action matches the hidden required action for 86.3% of old states and 92.7% of fresh states, while the automatic best action matches for 55.0% and 36.5%, respectively.
Calibration is strongly action dependent. For selected actions that equal the required action, automatic and human mean losses are 0.111 and 0.110 for ASK, 0.519 and 0.196 for DECLINE, and 0.004 and 0.288 for ASSIST. The group means nearly agree for clarification; automatic loss is higher for refusal and lower for assistance. Group means do not identify why individual responses receive different scores or establish accuracy within a group. The human and automatic tables retain positive information gaps, but their response scores are not interchangeable.
Figure 6. Action-specific calibration and state-level agreement. Numerical records and counts appear in Table 16 and Table 17 . Matching group means do not imply close item-level agreement.
Table 16. Action-specific calibration split by whether the selected action equals the required action.
Table 17. First-minimum action-label agreement after adjudication, using the fixed order ask, decline, assist to break ties. Set-based comparisons appear in Appendix § 21 .§ 3 .
Table 18 :Z Z Z B = 2 B = 2 B = 2
Table 18. Final adjudicated SmolLM2 human-loss results for the Z Z Z B = 2 B = 2 B = 2
Table 17: First-minimum action-label agreement after adjudication, using the fixed order ask, decline, assist to break ties. Set-based comparisons appear in Appendix § 21 .§ 3 .
Final human-loss information gaps. The exact finite-interface audit is recomputed using final human loss, with the interface codes and feature identities held fixed. The primary budget is again B = 2 B = 2 B = 2
R f u l l h u m a n = 0.216 , R Z ⋆ , h u m a n = 0.293 , Δ i n f o h u m a n = 0.078 , R^{\mathrm{human}}_{\mathrm{full}} = 0.216,\qquad R^{\star,\mathrm{human}}_{Z} = 0.293,\qquad\Delta^{\mathrm{human}}_{\mathrm{info}} = 0.078, R full human = 0.216 , R Z ⋆ , human = 0.293 , Δ info human = 0.078 , with 95% interval [0.047, 0.111] and one-sided lower bound 0.052. Seed 271828 gives gap 0.099, interval [0.062, 0.119], and lower bound 0.068. On the fresh locked 96-state collection, seed 314159 gives gap 0.148, interval [0.118, 0.161], and lower bound 0.124; seed 271828 gives gap 0.133, interval [0.095, 0.155], and lower bound 0.099. Every one of the four primary tests has zero nonpositive replicates among 2,000 policy-area cluster-bootstrap draws.
The human gap decreases with feature budget. It is positive for both seeds and both collections at B = 2 , 4 , 8 B = 2, 4, 8 B = 2 , 4 , 8 B = 16 B = 16 B = 16 B = 32 B = 32 B = 32 B = 64 B = 64 B = 64
(a) Old 80-state human sample.
(b) Fresh locked 96-state collection.
Figure 7. Final adjudicated human-loss information-gap curves for the two independently trained SAE seeds.
Single-rater sensitivity. Before adjudication, each rater’s labels are also analyzed separately at B = 2 B = 2 B = 2 § 16 .
Final human finite-interface results across all budgets
Table 19. Complete final adjudicated SmolLM2 human-loss Z Z Z
Table 20. Single-rater sensitivity analysis at the primary budget B = 2 B = 2 B = 2
Human agreement, adjudication, and evaluator calibration
Adjudication rates differ across policy areas. The counts below describe that variation but do not identify its cause.
Table 21. Adjudication-trigger rate by policy area.
Table 22. Final adjudicated comparison of automatic and human scores by selected action, collection, and required-action match. Signed error is automatic loss minus human loss.
Additional Experiments and Diagnostic Figures
The main text retains the risk attribution, policy-aware cross-family evidence, human-loss result, and possibility of a conflict beyond pairs. This appendix records the supporting experiments and the original vector plots. Different panels retain their original estimands and uncertainty procedures; a shared row does not imply that they are independent replications or use a common loss scale.
Qwen2.5 settings and full frozen risk profiles
Budget and rule interventions: complete historical diagnostics
The experiments change the visible features, allowed rules, and fitting data separately. Refining an observation or enlarging a rule family cannot increase the corresponding optimal risk, because the earlier rules remain available. A decrease from additional training data is an empirical result, not a consequence of the decomposition in Equation (5) .
Interface information. Across the four audited layers, the finite-support information gap is largest at small budgets and approaches zero as more SAE coordinates are exposed. The rate is layer dependent, but the broad decrease is common to all four layers. The budget sweep is descriptive because it was available during setting selection; the frozen untouched-domain values in Table 24 provide the frozen confirmation results.
Table 24. Historical Z Z Z
Decision-rule accessibility. At the frozen layer-19, B = 16 B = 16 B = 16
Finite training. The training-size intervention uses nested subsets from one fixed audit population, which avoids mixing sample size with a policy-area shift. The mean finite-training gap decreases from 0.130 at 16 training situations to 0.072 at 36, 0.020 at 72, 0.009 at 108, and zero at all 144 fitting situations.
(a) Primary positive-information setting. Frozen four-risk result for layer 17 and budget 2.
(b) Mixed information and accessibility setting. Frozen four-risk result for layer 19 and budget 16.
Figure 8. Four risks on the eight untouched confirmation policy areas. Error bars are domain-cluster bootstrap 95% intervals for each risk. The selected interfaces are frozen before confirmation.
Figure 9. (a) Selected SAE feature budget. (b) Collision and unseen-code rates. Figure 9: Qwen2.5 budget and occupancy diagnostics. Bands summarize the saved domain partitions. A small finite-table gap at a large budget does not establish coverage of future codes.
Figure 10. (a) Nested rule classes on confirmation areas. (b) Fitting-set sizes within one audit population. Figure 10: Original intervention plots, with their saved uncertainty displays. The compact main-text rendering uses the reported numerical summaries. The rule-class intervals summarize bootstrap resampling of the frozen confirmation areas and do not provide a simultaneous population certificate.
Figure 11. (a) Layer 17, two features. (b) Layer 19, sixteen features. Figure 11: Setting-selection risk profiles. These descriptive plots are not the untouched confirmation estimates in Table 24 .
Evaluator, selector, and model-scale robustness
Independent evaluators. The primary layer-17, B = 2 B = 2 B = 2 B = 16 B = 16 B = 16
Feature selectors. At the two frozen layer–budget settings, the supervised selector, the variance selector, and every one of 200 random selectors give a positive information gap. For layer 17 and B = 2 B = 2 B = 2 B = 16 B = 16 B = 16
Figure 12. (a) Descriptive nested-rule sweep. (b) Affine parameter-bound check. Rule-class and optimizer diagnostics. The affine optimum is unchanged for parameter bounds 5, 10, 50, and 200, with no fitted parameter on a boundary.
Figure 13. (a) Frozen interface across evaluators. (b) Frozen settings across selectors. Qwen2.5 evaluator and selector robustness. Left: bootstrap over policy areas intervals. Right: 200 random selectors and the named selector results. These comparisons do not establish selector superiority.
Figure 14. (a) Second Qwen2.5 scale, with its own SAE. (b) Descriptive selector budget sweep. Cross-scale and selector budget diagnostics for code-only observations. Neither panel is a new Qwen2.5-0.5B policy-aware experiment.
It does not show that supervised selection is better than random selection; the saved claim ledger rejects that stronger reading.
Second audited model scale. The full finite-interface pipeline is repeated on Qwen2.5-0.5B-Instruct with the separate sae-qwen2.5-0.5B-res release. At layer 17 and B = 2 B = 2 B = 2 B = 16 B = 16 B = 16
Reconstruction, output count, and decision information
Reconstruction loss and decision information answer different questions. The SAE reconstruction diagnostics vary strongly across the four layers, but their ordering does not match the ordering of the interface information gaps at a fixed feature budget. A layer can have a better global reconstruction diagnostic while its selected finite interface retains less information about the action that minimizes the declared loss. The centered fraction of variance unexplained (FVU) is reported as a diagnostic rather than treated as a calibrated percentage; its value can exceed one because the reconstruction squared error can exceed the centered activation variance.
Figure 15. Reconstruction and output count do not substitute for a decision-loss audit. The codebook comparison holds the declared number of outputs fixed.
Figure 16. Coverage and split diagnostics. Split variation is descriptive rather than a collection of independent confidence replicates.
A related matched-codebook experiment gives the continuous selected SAE view, an SAE reconstruction view, and a raw-hidden view the same declared number of outputs. Their information gaps still differ. Equal output cardinality is therefore not equal decision information. Occupancy diagnostics also show a tradeoff: more detailed interfaces reduce collision cells but create more confirmation patterns that were not seen during fitting. The matched codebook plots are shown below.
Continuous observations and fitted-rule diagnostics
Specified Gaussian observation channel. The experiment adds Gaussian noise to fixed continuous feature vectors. The noise scale is expressed relative to the median distance to the nearest neighbor. For a uniform distribution over the audited states, the posterior state probabilities are computed analytically at each sampled noisy vector; Monte Carlo averaging estimates the resulting Bayes risk. At zero noise, the observed vectors are distinct and the exact table gap is zero. The reported estimates increase with noise for both selected SAE coordinates and raw hidden coordinates. The calculation concerns this finite Gaussian mixture, not the noiseless representation on an unknown population.
Fitted continuous rules. A separate experiment asks whether standard rules can use information that remains in continuous features. At layer 19 with 64 selected SAE coordinates, cost-sensitive k k k
Figure 17. (a) SAE and raw-hidden observations. (b) Selected SAE observations across layers. Monte Carlo estimates of Bayes risk for the specified Gaussian channel. Noise magnitude is normalized by the median nearest-neighbor distance. The experiment does not certify information loss in noiseless exact hidden activations.
Figure 18. (a) Fitted rules on continuous features. (b) Reported held-out excess losses. Continuous representation–rule comparisons, not exact information-loss lower bounds. The numerical panel reproduces the reported means; the original plot is retained on the left.
Higher-order search, capacity, and sanity checks
The controlled higher-order benchmark constructs three states whose acceptable action sets are {ask,assist}, {ask,decline}, and {decline,assist}. Every pair shares one zero-regret action, but all three states share no common zero-regret action. At layer 17 and B = 2 B = 2 B = 2 1 / 3 1/3 1/3 1 / 3 1/3 1/3
The controlled-triple sweep repeats the construction across layers and budgets. The fraction of collapsed triples is high under small feature budgets and reaches zero at larger budgets, with the transition depending on layer. The result links the higher-order construction to real SAE support patterns rather than to an abstract binary code alone.
The exploratory natural-language search initially returned a positive higher-order separation, but an independent certification split reduced the separation to zero. A fresh test with two new paraphrase replicas, five generation replicas, and three judge prompts also produced zero positive-separation rate. The searched example therefore provides no replicated evidence of a conflict missed by every pairwise check. The negative replication plots are retained in Appendix § 17 .
(a) (a) Declared three-state regret table.
(b) (b) Collapse rate across layers and budgets.
Figure 19. Original controlled higher-order evidence. Every pair has a shared zero-regret action, while the triple has none. The collapse sweep uses real SAE support patterns.
The finite-capacity calculation converts a conflict audit into an output-count requirement. For the historical 42-state finite audit subset, the archived solver outputs report matching lower and upper bounds: three interface outputs for allowed regret tolerances from 0.02 through 0.30, and two outputs at tolerances 0.35 and 0.40. These are archived results for the historical finite loss table and unrestricted output labeling. The underlying full-precision matrix is unavailable, so the curve cannot be independently recomputed from the retained records. The original code enumerates all pairs and triples globally; the source audit and separate algorithm regression tests are described in Appendix § 20 . A given SAE or selected-coordinate family may need more outputs because not every labeling is realizable by that interface family.
Sanity controls and evaluator diagnostics. Across five saved domain partitions, the mean information gap is 0.128 for the actual low-budget SAE interface, 0.208 for a constant interface, 0.200 for a shuffled SAE interface, and numerically zero for an oracle interface that exposes the best action. The constant interface cannot improve on an informative one, and exposing an optimal action gives zero gap by construction. The larger gap after shuffling is an observed result; arbitrary shuffling has no general monotonicity guarantee.
The forced-choice evaluator gives higher mean scores to actions that match the required-action label. Mean matching scores range from 2.62 to 2.82 across safety, utility, macro adherence, fact handling, and overall quality; mean mismatching scores range from 0.72 to 1.10. The anchor diagnostics also pass, and the second evaluator gives lower mean loss to matched actions. The required-action label is supplied to the Qwen evaluation prompt, so this agreement is not an independent check of the label or an accuracy guarantee for the evaluator. Human ratings provide the separate comparison in § 6.1 .
(a) Saved 42-state capacity curve.
(b) Searched natural-language witness and replication.
Figure 20. Different evidence levels: the saved capacity curve is reported from archived solver outputs and cannot be independently recomputed without its missing historical matrix; the natural-language higher-order candidate does not replicate.
(a) Fresh semantic, generation, and judge replication.
(b) Actual, constant, shuffled, and oracle interfaces.
Figure 21. Falsification and sanity checks. Fresh natural-language differences are at floating-point scale. The interface controls have the expected risk ordering.
Figure 22a. Historical evaluator discrimination.
Table 22 (PDF p. 55). Saved control means across five splits.
fig:22 : Gross measurement and implementation checks. Correct action labels receive higher mean evaluator scores; this discrimination test is not evidence of close human calibration.
Extended Literature Map and Detailed Comparisons
The main comparison fixes the state distribution, available continuations, loss, and controller input. The literature below addresses related questions about decision information, state abstraction, control, and evaluation. We distinguish average risk from the requirement that one choice meet a regret tolerance at every state sharing an observation.
Comparison of statistical experiments and decision-theoretic sufficiency
Blackwell’s comparison of experiments orders information channels by the decision performance that they permit across decision problems [13 , 14 ] . Le Cam’s theory of deficiency gives a quantitative notion of approximate comparison and sufficiency [43 , 64 ] . Blackwell–Le Cam comparison supplies the basic interpretation of the interface information gap in the present paper: replacing a full state by an interface observation is harmless for a declared decision problem exactly when the replacement does not increase the optimal Bayes risk.
Recent representation-learning work makes the same comparison operational. Deficiency has been used to define generic feature quality [65 ] and to derive a variational bottleneck for learning representations that preserve downstream decision performance [8 ] . Loss-dependent Bayes sufficiency identifies a coarsest quotient when the Bayes action is almost surely unique [56 ] . Action-sufficient compression similarly merges support states that require the same optimal action [68 ] , while decision-sufficient datasets preserve the information needed to solve a family of linear optimization problems [71 ] .
We use risk comparison to audit an existing interface. The structural question concerns several acceptable continuations, rather than one chosen optimal label. An incompatible cell contains a minimal group with no common acceptable choice. Such groups characterize feasible interface partitions. A statistical guarantee additionally requires valid bounds on loss estimation error; it does not follow from a positive estimated gap alone.
The information bottleneck formalizes representation learning as a trade-off between compression of the input and retention of information about a target [63 ] . Variational formulations make the objective usable with neural encoders [4 ] . The theory of usable information further makes information relative to a computational family, rather than treating all statistically present information as equally available [70 ] . The information-bottleneck and usable-information views motivate the separation between what the representation contains and what a restricted downstream rule can extract.
The paper makes the separation explicit through four nested risks and three adjacent gaps. The interface information gap compares the full-state optimum with the optimum over every measurable rule that sees only the declared interface. The decision-rule accessibility gap then restricts the rule family, and the fitting gap measures the remaining cost of fitting one rule from finite data. Mutual information, compression rate, reconstruction error, and predictive likelihood can be useful representation diagnostics, but none of them alone equals the declared continuation loss. A low-energy coordinate can carry a large action distinction, and a high-fidelity reconstruction can still remove information needed to choose among clarification, refusal, and bounded assistance. The paper therefore measures decision loss directly and treats reconstruction only as a separate diagnostic.
State abstraction, bisimulation, and control-sufficient representations
State abstraction in Markov decision processes studies when states may be merged while preserving planning or control properties. Exact model reduction and homomorphism-style equivalence relations preserve rewards, transitions, values, or optimal policies [35 , 46 ] . Bisimulation metrics extend exact equivalence to graded state similarity and provide value-loss bounds for finite and continuous state spaces [28 , 29 ] . Approximate abstraction work then gives explicit suboptimality guarantees when aggregation is inexact [1 , 2 ] .
Learned control representations apply related criteria to high-dimensional observations. DeepMDP learns a latent model by matching rewards and transition distributions [34 ] . Causal and invariant state representations seek features that retain stable return-relevant structure across environments [72 , 73 ] . Mutual-information objectives have been analyzed according to whether they are sufficient for control [54 ] , and kinematic abstraction supports efficient exploration in rich-observation environments [51 ] . Recent work on vision-language-action models directly diagnoses state aliasing when visually similar states require different low-level actions [44 ] .
Our audit takes the full state, continuation library, and learned interface as inputs. It tests whether states sharing one observation admit a common choice within the allowed regret. Every pair of acceptable sets can intersect while the intersection of all sets is empty. A graph containing only incompatible pairs misses such a group; the conflict hypergraph records it. Nontransitivity alone would not establish this failure of all pairwise checks. The separate risk comparison also distinguishes missing information from restrictions of the rule family and fitting error.
Partial observability, predictive states, and closed-loop continuations
Partially observable control replaces the unobserved physical state with an information state. In a finite partially observable Markov decision process, the posterior belief is sufficient for finite-horizon control [59 , 39 ] . Predictive state representations instead summarize a history by predictions of future tests [48 , 57 ] , and spectral predictive-state methods connect representation learning with planning [15 ] . Approximate information states quantify the loss from using a learned or compressed history summary in partially observed planning and reinforcement learning [60 ] . Options provide a related formalism for temporally extended closed-loop actions whose internal policies react to future observations [61 ] .
Beliefs, predictive states, and options motivate continuations that can react to later observations. The full audit state may contain a history; the tested interface is an additional channel applied to that state. A conflict is relative to the available continuations. Enlarging the library changes both the choices and the oracle baseline, so transfer to a larger library requires a separate comparison.
Set-valued prediction, abstention, and higher-order compatibility
Classification with rejection permits a predictor to abstain when the cost of a forced label is too high [22 , 9 ] (Charoenphandhu et al. 2021). Confidence-set and set-valued classifiers return several plausible labels while controlling set size, error, or coverage [25 , 55 ] . Conformal prediction gives finite-sample coverage for prediction sets under exchangeability [66 ] . Reject-option and set-valued prediction methods establish that a decision problem can naturally have a set of acceptable outputs rather than one required label.
The set-valued object in the present paper has a different index structure. For each full state u u u G ε ( u ) \mathcal{G}^{\varepsilon}(u) G ε ( u ) u u u ε \varepsilon ε ε \varepsilon ε
⋂ u ∈ C z G ε ( u ) \bigcap_{u \in C_z} \mathcal{G}^{\varepsilon}(u) u ∈ C z ⋂ G ε ( u ) to be nonempty for every interface cell C z C_z C z
Convex geometry and game theory then determine the finite witness structure. Helly’s theorem converts an empty intersection of convex acceptable sets in an ( m − 1 ) (m-1) ( m − 1 ) m m m [36 ] . Sion’s minimax theorem gives the dual state-mixture interpretation of the robust witness margin [58 ] . Weak hypergraph coloring characterizes how many interface labels are needed to split every minimal conflict [11 ] . These are classical tools. Here they relate the loss of a fixed interface to incompatible state groups and the output count of a redesigned interface. A gap exceeding ε \varepsilon ε ε \varepsilon ε
Safe reinforcement learning, shielding, and latent control
Safe reinforcement learning studies reward optimization under safety costs, constraints, or intervention mechanisms [32 , 3 , 23 ] . Shielding places a verified filter between a learned policy and the environment [5 , 20 ] . Reachability-based filters and model-predictive safety filters override or modify unsafe proposed controls [30 , 67 ] . Reviews of safe learning in robotics organize these methods by their assumptions about dynamics, uncertainty, constraints, and certification [18 ] .
A related language-model line reads or changes internal activations. Latent knowledge methods search for information represented internally without direct supervision [19 ] . Inference-time intervention and representation engineering learn activation directions used to steer model behavior [45 , 75 ] . Latent reachability has also been proposed for early detection and steering of language-model misalignment [40 ] .
Rather than evaluate only a particular monitor, we minimize over all rules using its specified input. A positive gap rules out matching the full state optimum with that input under the same library and loss. The audit does not rule out changing the representation, available strategies, or decision problem.
Sparse autoencoders and activation-space analysis
Sparse coding represents an observation by a small number of dictionary elements and has long been used to study distributed structure [52 ] . k k k [50 ] . Work on superposition argues that neural networks may represent more features than available neurons by using non-orthogonal directions [26 ] . Sparse autoencoders (SAEs) are now widely used to recover sparse, interpretable activation features from language models [17 , 24 ] .
Other work studies training scale and coverage across models and layers. Large SAEs have been trained and evaluated with explicit reconstruction–sparsity controls [62 , 31 ] , and Gemma Scope provides public SAEs across models and layers [47 ] . Activation geometry can also be distributed across groups of SAE features rather than represented by one isolated feature [12 ] . The SAE literature makes reconstruction quality, feature interpretation, feature geometry, dead-feature rate, and causal intervention important SAE diagnostics.
We treat selected SAE values or support indicators as the controller input. For a finite input alphabet, the risk calculation optimizes all lookup rules and does not depend on probe architecture or training. For distinct continuous vectors in a finite sample, the same unrestricted rule can memorize the sample. Continuous observations therefore require a separate analysis before probe failure can be interpreted as information loss.
Language-model judges and finite-sample evaluation
Large language models are frequently used as evaluators for open-ended model outputs. Chatbot Arena uses pairwise model comparisons at scale [74 ] , and G-Eval prompts a strong model to score generated text along declared dimensions [49 ] . Fine-grained evaluator models such as Prometheus seek reproducible rubric-conditioned judgments [41 ] . RewardBench evaluates reward models and preference judges across several behavioral categories [42 ] . At the same time, position bias can make model-based pairwise evaluation unreliable [69 ] .
Statistical work addresses the distinction between a useful noisy judge and a valid evaluation procedure. Imperfect-judge testing can preserve type-I error control after a human calibration stage [27 ] .
Risk-control methods construct prediction sets or deployment rules with finite-sample bounds [10 , 6 ] , while simultaneous concentration inequalities support uniform control across many bounded quantities [37 ] .
We analyze automatic scores and human ratings as separate loss tables. Their gaps may agree in sign without their response scores being close. The human study reports independent rating agreement before adjudication. For conflict search, the certificate uses simultaneous bounds over the searched losses or separate certification data; a maximum error observed in one packet is not a uniform bound for future responses.
Generative-model safeguards, red teaming, and path-level safety
Generative-model safety work often evaluates a completed output, a prompt–response pair, or a model-wide failure rate. RealToxicityPrompts measures toxic text degeneration under naturally occurring prompts [33 ] . Red-teaming methods search for prompts that elicit harmful behavior [53 ] . Constitutional AI uses written principles and model feedback to train a less harmful assistant [7 ] , while Llama Guard provides an input–output safeguard classifier for conversational systems [38 ] .
A separate logical question is whether each partial state has at least one safe continuation. Even if the answer is yes, states sharing one controller input may have no common safe continuation. Our regret criterion is related but not identical: it compares with the best available continuation, whose loss need not be zero. The controlled example demonstrates failure of joint compatibility despite success of every pair; the searched natural-language example does not replicate that result.
Summary of the comparison
Table 25. Relation between the present paper and the closest technical lines of work.
Relation to a single optimal label. On a finite audit with one optimal pure continuation at each state, let ρ \rho ρ 0 ≤ ε < ρ / 2 0 \le\varepsilon< \rho/2 0 ≤ ε < ρ /2
Complete Phi Third-Family Results
This appendix reports the source-derived Phi results. Original 96 denotes the original eight-area confirmation split; Reused 96 denotes the eight-area collection locked for the earlier SmolLM2 experiment and reused for Phi. The fitting split has 144 original states. The original experiment archive is retained as supplementary/phi/PHI_THIRD_FAMILY_RESULTS_original.zip in the author working archive. The Phi study includes 5,040 generated responses evaluated by both automatic evaluators. No human ratings were collected for the Phi responses. The 288 risk-summary rows comprise two SAE seeds, two selectors, six budgets, two collections, three evaluator losses, and two observation conditions. These are overlapping analyses of the same responses, not 288 independent replications.
Configuration, provenance, and validation
The active protocol identifies Phi-4-mini-instruct revision cfbefacb99257ffa30c83adab238a50856ac3083; Mistral-7B-Instruct-v0.3 revision c170c708c41dac9275d15a8fff4eca08d52bab71; Qwen2.5-7B-Instruct revision a09a35458c702b33eeacc393d103063234e8bc28; and FineWeb-Edu sample-10BT revision 87f09149ef4734204d70ed1d046ddc9ca3f2b8f9. Block index 23 has width 3,072 and depth fraction 0.75. The two SAE seeds are 314159 and 271828, dictionary width is 16,384, and TopK sparsity is 64.
Each SAE uses 8,000,000 training tokens and 300,000 validation tokens, with 100,000 training tokens for normalization. Corpus contexts have length 128 and cached activation shards contain 32,768 tokens. SAE batches contain 1,024 activation tokens; AdamW uses learning rate 2 × 10 − 4 2 \times10^{-4} 2 × 1 0 − 4 L 0 L_0 L 0
Generation uses five replicas per state–action pair, at most 192 new tokens, temperature 0.7, and top-p p p
Cached feature arrays and item-level scores independently reproduce all 288 risk/bootstrap summaries and all 192 deletion-level estimates to floating-point precision. This checks table construction and arithmetic, not unseen training weights, evaluator validity, or human judgments. Bootstrap resampling uses 2,000 multinomial policy-area resamples and seed 99173. An eight-cluster percentile interval remains an approximate, per-setting uncertainty summary rather than the formal simultaneous certificate in § 4 .
Phi retains a positive gap when the active policy is observed
The Phi run completes all 5,040 generations and both complete evaluator passes. The two SAEs complete the declared training schedule of eight million tokens and pass the saved validation thresholds. No Phi human labels have been collected.
Policy-aware primary results. Table 26 reports the primary ( Z , S ) (Z,S) ( Z , S ) B = 2 B = 2 B = 2
These results retain the information restriction after active policy is supplied: some states under the same policy and SAE code still cannot share the lowest-loss macro-continuation under the saved loss table. The 12 policy-aware settings are not independent replications; the evaluator checks and their mean share the same responses, states, and features. All 2,000 bootstrap gaps in each primary setting exceed the saved numerical tolerance, but the zero nonpositive fraction is not a p p p
Paired observation comparison. Providing the active policy reduces or leaves unchanged the exact information gap in every primary Phi setting, as required by Equation (6) . For seed 314159 on the original confirmation set, the Mistral-loss gap decreases from 0.1110 for Z Z Z ( Z , S ) (Z, S) ( Z , S )
Budget and policy-area sensitivity. Figure 23 shows the policy-aware Mistral-loss curves. All supervised B = 2 B = 2 B = 2 B = 4 B = 4 B = 4 B = 8 B = 8 B = 8 B = 32 B = 32 B = 32 B = 64 B = 64 B = 64 ( Z , S ) (Z, S) ( Z , S )
(a) (a) Original confirmation collection.
(b) (b) Reused locked collection.
Figure 23. Phi policy-aware information gaps under Mistral loss. Points use the frozen supervised features, and bands are individual two-sided 95% bootstrap over policy areas intervals. Budget positions are equally spaced for readability. Both the policy text and selected SAE support code are observed.
At B = 2 B = 2 B = 2 Table 37 summarizes the deletion ranges.
Table 37. Phi single policy area deletion sensitivity at B = 2 B = 2 B = 2
Reconstruction quality and distribution shift. Validation centered fraction of variance unexplained (FVU) is 0.0162 and 0.0163; mean reconstruction cosine is 0.9277 for both SAE seeds, mean L 0 L_0 L 0 Table 34 reports the distribution-specific diagnostics.
Table 34: Phi reconstruction diagnostics. FVU is centered fraction of variance unexplained; relative error uses the same reconstruction-error numerator divided by uncentered activation energy. Active counts features observed at least once in the listed dataset, not globally active or dead features.
Table 34.
Evaluator comparison. The primary gap remains positive with either evaluator, but their scores have limited agreement on individual responses. Detailed comparisons below use the same response keys for both evaluators.
Policy-aware and code-only primary results
The complete observation is explicitly V = ( Z , S ) V = (Z, S) V = ( Z , S ) V = Z V = Z V = Z
Table 27: Phi full primary results for observation ( Z , S ) (Z, S) ( Z , S ) B = 2 B = 2 B = 2 R V ⋆ R^{\star}_{V} R V ⋆ V V V f 0 f_{0} f 0 10 − 12 10^{-12} 1 0 − 12 p p p
Table 27.
Table 28: Phi full primary results for observation Z Z Z B = 2 B = 2 B = 2 R V ⋆ R^{\star}_{V} R V ⋆ V V V f 0 f_{0} f 0 10 − 12 10^{-12} 1 0 − 12 p p p
Table 28. Paired observation-condition comparison for the same Phi responses, losses, frozen features, and B = 2 B = 2 B = 2 Z Z Z
Table 28 (continued).
Complete supervised-selector and variance-selector sweeps
Only fitting data determine the feature identities. The supervised ranking uses Mistral loss, and all other evaluator conditions reuse that ranking. No interface is selected using the Phi confirmation losses. The 288 rows below retain both positive and zero-gap results; they do not extend the B = 2 B = 2 B = 2
Table 30. Complete Phi supervised-selector results for observation ( Z , S ) (Z, S) ( Z , S ) f 0 f_0 f 0 10 − 12 10^{-12} 1 0 − 12
caption:
:::
Table 31. Complete Phi variance-selector results for observation ( Z , S ) (Z,S) ( Z , S ) f 0 f_0 f 0 10 − 12 10^{-12} 1 0 − 12
Table 31 continued.
Table 31 (PDF p. 67).
Table 32: Complete Phi supervised-selector results for observation Z Z Z f 0 f_0 f 0 10 − 12 10^{-12} 1 0 − 12
Table 32. Table 32 continued.
Table 33. Complete Phi variance-selector results for observation Z Z Z f 0 f_0 f 0 10 − 12 10^{-12} 1 0 − 12
(a) Original confirmation collection.
(b) Reused locked collection.
Figure 24. Paired Phi Z Z Z Figure 23 . These plots change only the observation key, not the response samples or selected features.
Reconstruction and feature occupancy
For activation vectors h i h_i h i h ^ i \hat{h}_i h ^ i h ˉ \bar{h} h ˉ
FVU = ∑ i ∥ h i − h ^ i ∥ 2 2 ∑ i ∥ h i − h ˉ ∥ 2 2 , E r e l = ∑ i ∥ h i − h ^ i ∥ 2 2 ∑ i ∥ h i ∥ 2 2 . \operatorname{FVU} = \frac{\sum_i \lVert h_i-\hat{h}_i\rVert_2^2}{\sum_i \lVert h_i-\bar{h}\rVert_2^2}, \qquad E_{\mathrm{rel}} = \frac{\sum_i \lVert h_i-\hat{h}_i\rVert_2^2}{\sum_i \lVert h_i\rVert_2^2}. FVU = ∑ i ∥ h i − h ˉ ∥ 2 2 ∑ i ∥ h i − h ^ i ∥ 2 2 , E rel = ∑ i ∥ h i ∥ 2 2 ∑ i ∥ h i − h ^ i ∥ 2 2 . The denominator difference does not imply negligible reconstruction error. Mean cosine is averaged over individual vectors. The audit JSON retains a historical field named dead_fraction_on_validation; on audit records this field denotes features unobserved on that small audit sample. It is not evidence that those features are globally dead. Quantiles and activation/reconstruction norms remain in the original JSON/CSV files.
Table 35: Phi supervised-selector occupancy. Fit and Eval count distinct complete observation keys. Collision is the fraction of evaluation states sharing an observation key; Unseen is the fraction whose complete key is absent from fitting. For ( Z , S ) (Z,S) ( Z , S )
Table 35.
Table 35 (continued).
Table 36. Phi variance-selector occupancy. Fit and Eval count distinct complete observation keys. Collision is the fraction of evaluation states sharing an observation key; Unseen is the fraction whose complete key is absent from fitting. For ( Z , S ) (Z,S) ( Z , S )
Policy-area deletion and selector controls
Each deletion removes exactly one of eight areas and leaves 84 states. The minimum over all 192 saved primary deletion estimates is 0.02363095. The ranges below are sensitivity results, not additional confidence intervals. Random selection from all features, selection from features that vary on the fitting set, and approximate occupancy matching are recorded only for Mistral loss under the Z Z Z
Table 37 (continued).
Table 38 :Z Z Z
Table 38. Table 38 continued.
Table 39. Fitting-only matching diagnostics for Phi random controls. Distances are the recorded occupancy/frequency-matching objective, not distances between held-out losses. Forty retained controls are summarized per seed and budget. Exact is the fraction marked as an exact match by the saved routine; the controls are otherwise approximate matches.
Table 40. Saved Phi sanity-control gaps at the primary budget. Constant, Shuffled, and Oracle refer to the exact controls in the archived run. They are descriptive checks and do not replace the matched observation-condition comparison in Table 29.
Evaluator comparison and missing human evaluation
The item-level comparison aligns the two evaluator tables by the same 5,040 response keys. Spearman correlation is 0.35524389, mean absolute difference is 0.32200397, root mean squared difference is 0.43750006, and mean difference between Mistral and Qwen losses is −0.16480820. The differences measure disagreement between evaluators, not bias relative to a human target. Replacing the evaluator preserves the positive primary gap despite that disagreement.
Both optional 528-row Phi rater packets have blank score fields. The 36-item Phi pilot is also only a generated packet, not an executed calibration study. The earlier SmolLM2 human ratings are not reused for Phi responses. The existing 96-state locked collection remains a reused collection in the Phi study. Large SAE weights and activation caches are absent from the compact archive; the saved feature arrays are sufficient for risk recomputation, but not for retraining or checking the omitted weight bytes.
Observation Reanalysis and Reproduction Checks
Detailed policy-aware reanalysis and precision limits
The SmolLM2 reanalysis supplies policy text to the action selector while keeping features, states, responses, and ratings fixed. It uses cells indexed by the exact pair (policy text, SAE code), never by the required-action label. The original 80 human-rated states include fitting areas; the locked 96 states are held out by policy area. The comparison was made after the original analysis and is not a new prospective experiment.
SmolLM2 risks with policy supplied. The complete ratings and code arrays permit direct recalculation of both risk minima. Input alignment is documented in the next subsection.
All four policy-aware automatic gaps remain positive. Under final human loss, the original-sample gaps are 0.0345 and 0.0353, with individual one-sided bootstrap lower bounds 0.0203 and 0.0175. On the locked 96-state collection, the gaps are 0.1166 and 0.1082, with lower bounds 0.0935 and 0.0901. The result therefore survives both explicit policy conditioning and replacement of automatic scores by human outcome loss within the SmolLM2 study. The policy-aware gaps are no larger than their paired code-only gaps, as required by Equation (6) . The following tables give all budgets and results for each rater.
Qwen2.5 recovery with an explicit precision limit. The available Qwen2.5-1.5B notebook retains eight per-policy risk summaries for each frozen setting. Its source recomputes the lookup optimum within each policy, and each policy has one fixed text and 12 confirmation states. Their equal-weight average therefore reconstructs the policy-aware optimum, subject to the saved four-decimal rounding. We average the directly saved gap column, yielding 0.13695 at layer 17/B = 2 B = 2 B = 2 B = 16 B = 16 B = 16
Since policy is observable, clusters from distinct policy texts do not share cells. Replicating a whole policy area multiplies its cell costs and oracle costs by the same factor. Thus policy-area resampling can be computed from these per-policy summaries without reconstructing individual losses. The rounding correction bounds the numerical recovery error in each resampled mean and hence in each reported percentile. The resulting intervals remain bootstrap summaries, not distribution-free population certificates.
Table 41. SmolLM2 reanalysis with active policy and SAE code jointly visible, at B = 2 B = 2 B = 2
Table 42. Qwen2.5-1.5B policy-aware recovery from eight per-policy notebook summaries rounded to four decimals. The point gap has absolute rounding uncertainty at most 5 × 10 − 5 5 \times10^{-5} 5 × 1 0 − 5
The completed inputs retained in the author working archive are supplementary/support_revision/human_inputs/rater_A.csv, supplementary/support_revision/human_inputs/rater_B.csv, and supplementary/support_revision/human_inputs/adjudication_resolved.csv. The original automated bundle still contains blank packet templates, which are not analysis inputs. Completed score files are preserved byte for byte. The archived input manifest records file hashes and the converted state-code tables retain the original frozen feature identities.
The reproduction checks confirm 528 unique IDs in each independent file, 100 unique adjudicated IDs, exact identity of the triggered and adjudicated sets, and unchanged policy, situation, action, and continuation text. Final item-level loss is recomputed from resolved scores on the queued items and from the two independent losses otherwise. All 528 final losses agree with the historical item-level analysis to numerical precision. The saved automatic score of each packet continuation is checked against its exact rollout key, not the five-replica average. Agreement coefficients and final calibration point estimates are recomputed without altering any rating. The Pearson correlation of automatic and final human loss is 0.3876. The script also computes the other score and action agreement measures.
Paired observations, resampling, and the loss estimand
The same support code and loss vector are used for both V = Z V = Z V = Z V = ( Z , S ) V = (Z, S) V = ( Z , S )
The saved scalar losses are the scientific target of the finite-table reanalysis. Human risk uses a fixed single continuation per state–action pair and is not an unbiased estimate of an oracle over expected future rollouts. Automatic risk uses the five saved replicas. In either case, minimizing estimated action losses can produce selection bias relative to unknown expected losses. Cluster resampling does not remove that bias. The interval-based theorem separates that stronger expected-loss target from the empirical results; its additional assumptions are not claimed satisfied by these packets.
All paired estimates satisfy 0 ≤ Δ Z , S ≤ Δ Z 0 \leq\Delta_{Z,S} \leq\Delta_Z 0 ≤ Δ Z , S ≤ Δ Z 10 − 12 10^{-12} 1 0 − 12 p p p
Table 43. Paired SmolLM2 observation reanalysis across all feature budgets. Features, state-level losses, and resampling draws are held fixed between Z Z Z ( Z , S ) (Z, S) ( Z , S ) Δ Z , S \Delta_{Z,S} Δ Z , S
Qwen source recovery and rounding control
The original notebook’s V8 source computes the cellwise lookup optimum separately for every confirmation policy. The saved table is rounded to four decimal places. Let Δ ~ d \widetilde{\Delta}_d Δ d d d d Δ d \Delta_d Δ d ∣ Δ ~ d − Δ d ∣ ≤ r r o u n d \lvert\widetilde{\Delta}_d-\Delta_d\rvert\le r_{\mathrm{round}} ∣ Δ d − Δ d ∣ ≤ r round r r o u n d = 5 × 10 − 5 r_{\mathrm{round}} = 5 \times10^{-5} r round = 5 × 1 0 − 5 w d w_d w d
∣ ∑ d w d Δ ~ d − ∑ d w d Δ d ∣ ≤ r r o u n d . \left\lvert\sum_d w_d\widetilde{\Delta}_d-\sum_d w_d\Delta_d\right\rvert\le r_{\mathrm{round}}. d ∑ w d Δ d − d ∑ w d Δ d ≤ r round . The bound applies to every resample of whole policy areas. Since each resampled mean changes by at most r r o u n d r_{\mathrm{round}} r round r r o u n d r_{\mathrm{round}} r round supplementary/support_revision/qwen_recovered/. No individual Qwen losses or interface codes are inferred from these rounded means.
Table 45. Literal rounded per-policy entries recovered from the original Qwen2.5 V8 notebook output. Each policy has 12 confirmation states. The saved source recomputes the cellwise optimum within each policy; these are not losses of a single pooled-policy decision table.
Capacity-source audit and algorithm regression
The original Qwen capacity source enumerates every pair and triple among the selected 42 states; it does not restrict this enumeration to the old SAE cells. The 42-state loss matrix comes from the certification loss table, so it is described as a finite audit subset rather than the separate controlled three-state benchmark. The original source and saved solver-status output are preserved. Without the underlying full-precision 42-state matrix, the historical capacity curve cannot be independently recomputed from the retained records.
The reference implementation separates local extraction from global constraint generation. Its regression tests include the three-state cross-cell counterexample, the pairwise-pass/triple-fail construction, small exhaustive partition comparisons, zero-regret set-cover comparisons, the positive-tolerance unique-optimum boundary, loss perturbation bounds, the noisy-minimum counterexample, observable-policy refinement, and a comparison of weighted bootstrap calculations with physical row duplication. These tests check implementations; they do not replace the proofs in Appendices A–C or create a population certificate for empirical data.
CPU reproduction entry points
Run pythontools/reproduce_support_revision.py from the root of the author working archive to reconstruct the 528 final losses, agreement and calibration statistics, 288 SmolLM2 risk rows, policy-area deletion summaries, and the Qwen recovery with a rounding bound. Run python-munittestdiscover-stests-v for the mathematical regression tests. The Phi verification script also recomputes all 288 saved Phi risk and bootstrap rows and 192 single area deletion rows; the saved verification records report agreement with the original Phi tables. Run pythontools/render_support_tables.py to regenerate the LaTeX result tables from the CSV output. No command regenerates human labels, retrains a model, or searches for a more favorable feature set.
Protocol and action-set diagnostics. Appendix § 21 gives the source-checked generation permissions and score rubrics, the tie-aware action comparison, and post hoc dimension, collision, and capacity diagnostics. The 96-state human capacity result uses an archived matrix; it does not recover or replace the unavailable historical 42-state Qwen matrix. All original scores and rating files remain unchanged.
Execution Protocols and Additional Decision Diagnostics
The analyses below use the existing responses, scores, and interface codes. They add no model training or human labels. Protocol descriptions are checked against the archived generation and scoring functions. The tie, dimension, collision, and 96-state capacity calculations are post hoc diagnostics, separate from the primary frozen comparisons.
An encoder maps its input text to an activation and SAE features. A selector chooses a response strategy from its declared observation. The generator executes the strategy using a fixed prompt. The evaluator scores the resulting response. Restricting the selector does not imply that the other three components receive the same information.
Qwen’s continuation_messages constructs a prompt from the public request, fact name, and selected action. The generation loop removes duplicate public-request keys before producing responses, then joins those responses to the distinct hidden-condition states. Thus one response can receive different losses under different states. SmolLM2’s format_action_prompt and Phi’s action_prompt instead include both policy and situation text. For each family, changing the selector key from Z Z Z ( Z , S ) (Z,S) ( Z , S )
The source record retained in the author working archive at supplementary/author_audit/SOURCE_EVIDENCE.md gives the relevant functions, line ranges, and hashes. Complete unmodified source files or
Table 46. Information supplied to each role in the archived execution protocols. The hidden required action is an evaluation label, never an additional selector input.
their original archives are retained with that record. The protocol differences are part of the declared decision problems, not inferred model properties.
Different scoring rules. For Qwen, let p d , k c o r r p^{\mathrm{corr}}_{d,k} p d , k corr k ∈ { 0 , 1 , 2 , 3 , 4 } k \in\{0,1,2,3,4\} k ∈ { 0 , 1 , 2 , 3 , 4 } d d d w d w_d w d
s ˉ d = ∑ k = 0 4 k p d , k c o r r , L Q w e n = 1 − 1 4 ∑ d w d s ˉ d . \bar{s}_d = \sum_{k=0}^{4} k p^{\mathrm{corr}}_{d,k}, \qquad L^{\mathrm{Qwen}} = 1 - \frac{1}{4}\sum_d w_d\bar{s}_d. s ˉ d = k = 0 ∑ 4 k p d , k corr , L Qwen = 1 − 4 1 d ∑ w d s ˉ d . The correction subtracts score-label prior logits before normalization; it is not calibration against human labels. In SmolLM2 and Phi, the evaluator returns integer JSON scores in { 0 , 1 , 2 , 3 } \{0,1,2,3\} { 0 , 1 , 2 , 3 }
Single-coordinate feature ranking. For SmolLM2 and Phi, write n f i t n_{\mathrm{fit}} n fit L i a L_{ia} L ia a a a i i i z i k ∈ { 0 , 1 } z_{ik} \in\{0,1\} z ik ∈ { 0 , 1 } k k k k k k
R c o n s t = 1 n f i t min a ∑ i L i a , R k = 1 n f i t ∑ b ∈ { 0 , 1 } min a ∑ i : z i k = b L i a . R_{\mathrm{const}} = \frac{1}{n_{\mathrm{fit}}}\min_a \sum_i L_{ia}, \qquad R_k = \frac{1}{n_{\mathrm{fit}}}\sum_{b\in\{0,1\}}\min_a \sum_{i:z_{ik}=b} L_{ia}. R const = n fit 1 a min i ∑ L ia , R k = n fit 1 b ∈ { 0 , 1 } ∑ a min i : z ik = b ∑ L ia . An empty group contributes zero. Coordinates are ordered by decreasing R c o n s t − R k R_{\mathrm{const}}-R_k R const − R k p k ( 1 − p k ) p_k(1-p_k) p k ( 1 − p k ) p k = n f i t − 1 ∑ i z i k p_k=n_{\mathrm{fit}}^{-1}\sum_i z_{ik} p k = n fit − 1 ∑ i z ik rank_features_by_univariate_risk_reduction determines the selected features; a separately sorted diagnostic table does not replace that order. The first B B B B B B
Action agreement with tied minimizing losses
Let A = { A S K , D E C L I N E , A S S I S T } \mathcal{A}=\{\mathrm{ASK},\mathrm{DECLINE},\mathrm{ASSIST}\} A = { ASK , DECLINE , ASSIST } L a u t o ( a , u ) L_{\mathrm{auto}}(a,u) L auto ( a , u ) L h u m a n ( a , u ) L_{\mathrm{human}}(a,u) L human ( a , u ) τ = 10 − 12 \tau=10^{-12} τ = 1 0 − 12 r ∈ { a u t o , h u m a n } r\in\{\mathrm{auto},\mathrm{human}\} r ∈ { auto , human }
b r ( u ) = min a ∈ A L r ( a , u ) , A r ( u ) = { a ∈ A : ∣ L r ( a , u ) − b r ( u ) ∣ ≤ τ } . b_r(u)=\min_{a\in\mathcal{A}}L_r(a,u), \qquad A_r(u)=\{a\in\mathcal{A}:|L_r(a,u)-b_r(u)|\le\tau\}. b r ( u ) = a ∈ A min L r ( a , u ) , A r ( u ) = { a ∈ A : ∣ L r ( a , u ) − b r ( u ) ∣ ≤ τ } . The historical selected label a r f i r s t ( u ) a_r^{\mathrm{first}}(u) a r first ( u ) 10 − 12 10^{-12} 1 0 − 12 10 − 8 10^{-8} 1 0 − 8
We report three different indicators for each state:
I f i r s t ( u ) = 1 { a a u t o f i r s t ( u ) = a h u m a n f i r s t ( u ) } , I_{\mathrm{first}}(u)=\mathbf{1}\{a_{\mathrm{auto}}^{\mathrm{first}}(u)=a_{\mathrm{human}}^{\mathrm{first}}(u)\}, I first ( u ) = 1 { a auto first ( u ) = a human first ( u )} , I ∩ ( u ) = 1 { A a u t o ( u ) ∩ A h u m a n ( u ) ≠ ∅ } , I_{\cap}(u)=\mathbf{1}\{A_{\mathrm{auto}}(u)\cap A_{\mathrm{human}}(u)\ne\varnothing\}, I ∩ ( u ) = 1 { A auto ( u ) ∩ A human ( u ) = ∅ } , I = ( u ) = 1 { A a u t o ( u ) = A h u m a n ( u ) } . I_{=}(u)=\mathbf{1}\{A_{\mathrm{auto}}(u)=A_{\mathrm{human}}(u)\}. I = ( u ) = 1 { A auto ( u ) = A human ( u )} . Their averages describe fixed-label matching, at least one shared optimum, and equality of all minimizing choices, respectively. A large automatic set makes a nonempty intersection easier to obtain without making the full sets equal. None of the indicators measures agreement of the loss magnitudes.
Of the 176 states, automatic loss has a tied minimum in 90 and human loss in one. Changing only the common fixed action ordering across all six permutations changes first-minimum matching from 90/176 to 105/176, or 51.1%–59.7%. The full ordering sensitivity and per-state sets are stored in supplementary/author_audit/diagnostics/. Minimum loss values, and therefore information gaps, are unaffected by choosing among tied minimizers.
Table 47. Distinct action-agreement statistics on the same 176 SmolLM2 states and packet responses. First-minimum matching uses the fixed order ASK, DECLINE, ASSIST; the set statistics retain all tied minimizing actions.
Table 48. Post-hoc policy-aware information gaps at B = 2 B = 2 B = 2
The saved pairwise preference statistic uses the three unordered action pairs at each state. It excludes pairs whose human losses differ by at most 10 − 9 10^{-9} 1 0 − 9
Human loss dimensions and within-policy results
Let s d ( a , u ) ∈ [ 0 , 3 ] s_d(a,u) \in[0,3] s d ( a , u ) ∈ [ 0 , 3 ] d d d L d ( a , u ) = 1 − s d ( a , u ) / 3 L_d(a,u) = 1 - s_d(a,u)/3 L d ( a , u ) = 1 − s d ( a , u ) /3
The safety-only gaps on the original sample are 0.0042 and 0.0125; on the locked collection they are 0.0521 and 0.0312. No new intervals are attached to these post hoc point diagnostics. A score-based safety loss is not the probability of an unsafe event. Likewise, the composite gap is not the weighted sum of dimension gaps: minimizing a weighted sum of losses can choose a different action from minimizing each component separately.
For policy-aware inputs, different policy texts have disjoint observation cells. Let Δ d \Delta_d Δ d d d d w d w_d w d Δ Z , S = ∑ d w d Δ d \Delta_{Z,S} = \sum_d w_d \Delta_d Δ Z , S = ∑ d w d Δ d supplementary/author_audit/diagnostics/human_per_policy_gap.csv.
Complete record for the illustrative collision
The worked pair in Table 1 uses SmolLM2 SAE seed 314159, feature budget B = 2 B = 2 B = 2 assistive_accommodation_communications area. The exact state IDs are fresh_54de51e809f46113eca8 and fresh_8510b3ae9ec45d87d0d6. Both states carry the same policy:
Help write respectful process communications without making eligibility decisions. Ask when the requested accommodation, functional barrier, or responsible office is unclear. Decline fabrication of medical documentation or discriminatory screening. Assist with accessible scheduling and referral text.
Table 49. Unrestricted code-only capacity on all 96 locked SmolLM2 states under final human composite loss. Constraint generation and the independent two-label feasibility formulation agree. Margins are reoptimized within every returned cell; numerical tolerance is 10 − 9 10^{-9} 1 0 − 9
The first situation requests a respectful acknowledgment, accessible meeting formats, and referral to the authorized office. The second requests a fake clinician letter to obtain approval without review. The first state’s loss vector is ( 0.350 , 0.525 , 0 ) (0.350, 0.525, 0) ( 0.350 , 0.525 , 0 ) ( 0.500 , 0.100 , 0.800 ) (0.500, 0.100, 0.800) ( 0.500 , 0.100 , 0.800 ) ( 0.425 , 0.3125 , 0.400 ) (0.425, 0.3125, 0.400) ( 0.425 , 0.3125 , 0.400 )
The 0.2625 difference describes only the equally weighted two-state subproblem, not the full containing cell or the full collection. The pair was selected after inspecting the saved results as an explanation of an existing collision. Exact situation texts and the other qualifying pairs are retained in the author working archive at supplementary/author_audit/diagnostics/human_real_collision_examples.json.
Capacity on the recorded human loss matrix
The capacity diagnostic uses every state in the 96-state locked human collection. The three columns are final composite losses for ASK, DECLINE, and ASSIST. The calculation does not use SAE features or a seed: it optimizes unrestricted state-to-code assignments. Only the redesigned code is visible, with no free policy input. The result is M ⋆ ( ϵ ) M^\star(\epsilon) M ⋆ ( ϵ ) § 4 , not an SAE-realizable capacity or the conditional code count with free policy.
We evaluate tolerances 0, 0.02, 0.10, 0.20, 0.30, 0.35, and 0.40, using the same saved human labels for all tolerances. Global constraint generation starts with no conflicts, solves the coloring problem, and validates every new cell. Every retained conflict, returned label, cell margin, and iteration record is saved. The final capacity is the matching lower and upper output count under numerical tolerance 10 − 9 10^{-9} 1 0 − 9
Independent two-label feasibility check. With three actions, labeling each state by an optimal action supplies at most three compatible cells. A direct linear program gives the one-output margin 0.36950037. To check whether two outputs suffice without enumerating conflicts, let e i ∈ [ 0 , 1 ] 3 e_i \in[0,1]^3 e i ∈ [ 0 , 1 ] 3 i i i q ( 0 ) , q ( 1 ) ∈ Δ 3 q^{(0)}, q^{(1)} \in\Delta_3 q ( 0 ) , q ( 1 ) ∈ Δ 3 x i ∈ { 0 , 1 } x_i \in\{0,1\} x i ∈ { 0 , 1 }
e i T q ( 0 ) ≤ ϵ + x i , e i T q ( 1 ) ≤ ϵ + 1 − x i , i ∈ [ 96 ] . e_i^\mathsf{T}q^{(0)} \le\epsilon+ x_i,\qquad e_i^\mathsf{T}q^{(1)} \le\epsilon+ 1-x_i,\qquad i \in[96]. e i T q ( 0 ) ≤ ϵ + x i , e i T q ( 1 ) ≤ ϵ + 1 − x i , i ∈ [ 96 ] . For x i = 0 x_i = 0 x i = 0 x i = 1 x_i = 1 x i = 1 ϵ ≥ 0 \epsilon\ge0 ϵ ≥ 0
The matrix, including integer score units with denominator 120, is retained in the author working archive as supplementary/author_audit/capacity/human96_loss_matrix.csv. The capacity script reconstructs the matrix from the existing human-loss file and checks its precision, complete state coverage, and input hash. The historical 42-state Qwen curve in Appendix § 17 .§ 7 is a different experiment. Its matrix is still unavailable, and no 96-state result is described as a recovery of that historical curve.
Continuous Interfaces and Population Certificates
The main audit computes exact optima for a supplied finite loss table. This extension asks what can be inferred about an unquantized continuous observation and about unknown expected losses. The complete assumptions, finite-sample bounds, and proofs are collected here so that the finite interface analysis does not require this additional estimation setup.
Continuous interfaces: identification and transfer
What distinct finite observations identify. Let the observation space satisfy Z ⊆ R d \mathcal{Z} \subseteq\mathbb{R}^{d} Z ⊆ R d d d d ( u i , z i ) i = 1 n (u_i,z_i)_{i=1}^{n} ( u i , z i ) i = 1 n
R ^ Z ⋆ : = inf δ ∈ D Z 1 n ∑ i = 1 n ℓ ( u i , δ ( z i ) ) , R ^ f u l l : = 1 n ∑ i = 1 n ℓ ⋆ ( u i ) . \widehat{R}^{\star}_{Z} := \inf_{\delta\in\mathcal{D}_{Z}} \frac{1}{n}\sum_{i=1}^{n}\ell(u_i,\delta(z_i)), \qquad\widehat{R}_{\mathrm{full}} := \frac{1}{n}\sum_{i=1}^{n}\ell^{\star}(u_i). R Z ⋆ := δ ∈ D Z inf n 1 i = 1 ∑ n ℓ ( u i , δ ( z i )) , R full := n 1 i = 1 ∑ n ℓ ⋆ ( u i ) . Theorem L.1 (Finite-sample interpolation limit). If the audited observations z 1 , … , z n z_1,\ldots,z_n z 1 , … , z n R ^ Z ⋆ = R ^ f u l l \widehat{R}^{\star}_{Z} = \widehat{R}_{\mathrm{full}} R Z ⋆ = R full
An unrestricted lookup rule can choose an optimal continuation separately at every distinct observed vector. Failure of a trained probe therefore does not identify missing information or the optimum of its rule class. An exact best-in-class comparison can identify a rule-class limitation, but a population information claim needs additional distributional evidence or assumptions, such as a specified overlapping observation channel.
Quantization with a controlled cost error. Equip Z \mathcal{Z} Z d Z d_Z d Z Q h : Z → [ L ] Q_h : \mathcal{Z} \to[L] Q h : Z → [ L ] L ≥ 1 L \geq1 L ≥ 1 A r : = Q h − 1 ( r ) A_r := Q_h^{-1}(r) A r := Q h − 1 ( r ) h ≥ 0 h \geq0 h ≥ 0 d Z d_Z d Z π j \pi_j π j
c j ( z ) : = E [ ℓ j ( U ) ∣ Z = z ] . c_j(z) := \mathbb{E}[\ell_j(U) \mid Z = z]. c j ( z ) := E [ ℓ j ( U ) ∣ Z = z ] . The quantity c j ( z ) c_j(z) c j ( z ) loss , whereas the earlier e ˉ j ( z ) \bar{e}_j(z) e ˉ j ( z ) regret . Let R Q h ( Z ) ⋆ R^{\star}_{Q_h(Z)} R Q h ( Z ) ⋆ Q h ( Z ) Q_h(Z) Q h ( Z )
Assumption L.2 (Modulus for conditional costs). There are versions of the conditional expected losses c j c_j c j ω : [ 0 , ∞ ) → [ 0 , ∞ ) \omega: [0,\infty) \to[0,\infty) ω : [ 0 , ∞ ) → [ 0 , ∞ ) ω ( 0 ) = 0 \omega(0) = 0 ω ( 0 ) = 0
∣ c j ( z ) − c j ( z ′ ) ∣ ≤ ω ( d Z ( z , z ′ ) ) |c_j(z) - c_j(z')| \leq\omega(d_Z(z,z')) ∣ c j ( z ) − c j ( z ′ ) ∣ ≤ ω ( d Z ( z , z ′ )) for every j ∈ [ m ] j \in[m] j ∈ [ m ] z , z ′ z,z' z , z ′ h h h d Z d_Z d Z
The modulus ω \omega ω
Theorem L.3 (Continuous-interface transfer bound). Under Assumptions 2.1 and L.2,
0 ≤ R Q h ( Z ) ⋆ − R Z ⋆ ≤ 2 ω ( h ) . 0 \leq R^{\star}_{Q_h(Z)} - R^{\star}_{Z} \leq2\omega(h). 0 ≤ R Q h ( Z ) ⋆ − R Z ⋆ ≤ 2 ω ( h ) . and consequently
R Z ⋆ − R f u l l ≥ R Q h ( Z ) ⋆ − R f u l l − 2 ω ( h ) . R^{\star}_{Z} - R_{\mathrm{full}} \geq R^{\star}_{Q_h(Z)} - R_{\mathrm{full}} - 2\omega(h). R Z ⋆ − R full ≥ R Q h ( Z ) ⋆ − R full − 2 ω ( h ) . If every conditional expected loss c j c_j c j L c ≥ 0 L_c \geq0 L c ≥ 0 ω ( h ) = L c h \omega(h) = L_c h ω ( h ) = L c h
The partition can increase risk by hiding distinctions present in Z \mathcal{Z} Z 2 ω ( h ) 2\omega(h) 2 ω ( h )
Finite-sample certificates with exact or estimated losses
The transfer theorem compares population risks. A finite-sample certificate must additionally control state sampling and, when losses are estimated, within-state loss uncertainty. The two error sources are kept separate below.
Exact conditional expected loss vectors. Let ( U t , Z t ) t = 1 n (U_t,Z_t)_{t=1}^{n} ( U t , Z t ) t = 1 n Q h Q_h Q h L L L m m m L t j = ℓ j ( U t ) L_{tj}=\ell_j(U_t) L t j = ℓ j ( U t ) exact conditional expected loss. Define the empirical joint costs and full-state risk by
C ^ r j : = 1 n ∑ t = 1 n 1 { Q h ( Z t ) = r } L t j , R ^ f u l l : = 1 n ∑ t = 1 n min j ∈ [ m ] L t j . \widehat{C}_{rj}:=\frac{1}{n}\sum_{t=1}^{n}\mathbf{1}\{Q_h(Z_t)=r\}L_{tj},\qquad\widehat{R}_{\mathrm{full}}:=\frac{1}{n}\sum_{t=1}^{n}\min_{j\in[m]}L_{tj}. C r j := n 1 t = 1 ∑ n 1 { Q h ( Z t ) = r } L t j , R full := n 1 t = 1 ∑ n j ∈ [ m ] min L t j . The corresponding population joint cost is C r j : = E [ 1 { Q h ( Z ) = r } ℓ j ( U ) ] C_{rj}:=\mathbb{E}[\mathbf{1}\{Q_h(Z)=r\}\ell_j(U)] C r j := E [ 1 { Q h ( Z ) = r } ℓ j ( U )]
Corollary L.4 (Finite-sample certificate with exact loss vectors). Under the independent-sampling and exact-loss conditions just stated and Assumption L.2, fix 0 < α < 1 0<\alpha<1 0 < α < 1
r n : = log ( 4 L m / α ) 2 n , s n : = log ( 4 / α ) 2 n . r_n:=\sqrt{\frac{\log(4Lm/\alpha)}{2n}},\qquad s_n:=\sqrt{\frac{\log(4/\alpha)}{2n}}. r n := 2 n log ( 4 L m / α ) , s n := 2 n log ( 4/ α ) . With probability at least 1 − α 1-\alpha 1 − α
R Z ∗ − R f u l l ≥ ∑ r = 1 L max { 0 , min j C ^ r j − r n } − min { 1 , R ^ f u l l + s n } − 2 ω ( h ) . R_Z^*-R_{\mathrm{full}}\ge\sum_{r=1}^{L}\max\left\{0,\min_j\widehat{C}_{rj}-r_n\right\}-\min\left\{1,\widehat{R}_{\mathrm{full}}+s_n\right\}-2\omega(h). R Z ∗ − R full ≥ r = 1 ∑ L max { 0 , j min C r j − r n } − min { 1 , R full + s n } − 2 ω ( h ) . The radius r n r_n r n L m Lm L m s n s_n s n
Why unbiased noisy scores are insufficient. Let Y t j ∈ [ 0 , 1 ] Y_{tj}\in[0,1] Y t j ∈ [ 0 , 1 ] E [ Y t j ∣ U t ] = ℓ j ( U t ) \mathbb{E}[Y_{tj}\mid U_t]=\ell_j(U_t) E [ Y t j ∣ U t ] = ℓ j ( U t )
E [ min j Y t j ∣ U t ] ≤ min j E [ Y t j ∣ U t ] = ℓ ∗ ( U t ) . \mathbb{E}\left[\min_j Y_{tj}\mid U_t\right]\le\min_j\mathbb{E}[Y_{tj}\mid U_t]=\ell^*(U_t). E [ j min Y t j ∣ U t ] ≤ j min E [ Y t j ∣ U t ] = ℓ ∗ ( U t ) . For a single state and two independent Bernoulli( 1 / 2 ) (1/2) ( 1/2 ) 1 / 4 1/4 1/4 1 / 2 1/2 1/2
Simultaneous intervals for estimated losses. Retain independent and identically distributed audit pairs and a library, loss, channel, partition, and valid modulus fixed independently of the certification sample. Choose a state-sampling error budget α s ∈ ( 0 , 1 ) \alpha_s\in(0,1) α s ∈ ( 0 , 1 ) α ℓ ∈ [ 0 , 1 − α s ) \alpha_\ell\in[0,1-\alpha_s) α ℓ ∈ [ 0 , 1 − α s ) 0 ≤ L ‾ t j ≤ L ‾ t j ≤ 1 0\le\underline{L}_{tj}\le\overline{L}_{tj}\le1 0 ≤ L t j ≤ L t j ≤ 1
P ( L ‾ t j ≤ ℓ j ( U t ) ≤ L ‾ t j for all t ∈ [ n ] , j ∈ [ m ] ) ≥ 1 − α ℓ . \mathbb{P}\left(\underline{L}_{tj}\le\ell_j(U_t)\le\overline{L}_{tj}\text{ for all }t\in[n],\ j\in[m]\right)\ge1-\alpha_\ell. P ( L t j ≤ ℓ j ( U t ) ≤ L t j for all t ∈ [ n ] , j ∈ [ m ] ) ≥ 1 − α ℓ . The intervals cover expected losses, not merely individual rollout scores. Define
C ^ r j − : = 1 n ∑ t = 1 n 1 { Q h ( Z t ) = r } L ‾ t j , R ^ f u l l + : = 1 n ∑ t = 1 n min j L ‾ t j . \widehat{C}^{-}_{rj}:=\frac{1}{n}\sum_{t=1}^{n}\mathbf{1}\{Q_h(Z_t)=r\}\underline{L}_{tj},\qquad\widehat{R}^{+}_{\mathrm{full}}:=\frac{1}{n}\sum_{t=1}^{n}\min_j\overline{L}_{tj}. C r j − := n 1 t = 1 ∑ n 1 { Q h ( Z t ) = r } L t j , R full + := n 1 t = 1 ∑ n j min L t j . The first quantity uses loss lower bounds for interface costs; the second uses loss upper bounds for the oracle comparison.
Theorem L.5 (Continuous certificate with simultaneous loss intervals). Under the stated simultaneous interval coverage and independent audit sampling, with Assumption L.2, use the state-sampling radii
r n : = log ( 4 L m / α s ) 2 n , s n : = log ( 4 / α s ) 2 n . r_n := \sqrt{\frac{\log(4Lm/\alpha_s)}{2n}}, \qquad s_n := \sqrt{\frac{\log(4/\alpha_s)}{2n}}. r n := 2 n log ( 4 L m / α s ) , s n := 2 n log ( 4/ α s ) . Then, with probability at least 1 − α s − α ℓ 1-\alpha_s-\alpha_\ell 1 − α s − α ℓ
R Z ⋆ − R f u l l ≥ ∑ r = 1 L max { 0 , min j C ^ r j − − r n } − min { 1 , R ^ f u l l + + s n } − 2 ω ( h ) . (15) R_Z^\star-R_{\mathrm{full}} \ge\sum_{r=1}^{L}\max\left\{0,\min_j \widehat{C}_{rj}^{-}-r_n\right\}-\min\left\{1,\widehat{R}_{\mathrm{full}}^{+}+s_n\right\}-2\omega(h). \tag*{(15)} R Z ⋆ − R full ≥ r = 1 ∑ L max { 0 , j min C r j − − r n } − min { 1 , R full + + s n } − 2 ω ( h ) . (15) The interval-coverage event and state-sampling concentration event need not be independent.
On simultaneous interval coverage, C ^ r j − \widehat{C}_{rj}^{-} C r j − R ^ f u l l + \widehat{R}_{\mathrm{full}}^{+} R full +
One valid rollout-based interval construction. Let each sampled state–continuation pair receive N ≥ 1 N \ge1 N ≥ 1 Y t j k ∈ [ 0 , 1 ] Y_{tjk} \in[0,1] Y t j k ∈ [ 0 , 1 ] k ∈ [ N ] k \in[N] k ∈ [ N ] U t U_t U t ℓ j ( U t ) \ell_j(U_t) ℓ j ( U t ) b j u d g e ≥ 0 b_{\mathrm{judge}} \ge0 b judge ≥ 0 0 < α ℓ < 1 0 < \alpha_\ell< 1 0 < α ℓ < 1
Y ‾ t j : = 1 N ∑ k = 1 N Y t j k , r N : = b j u d g e + log ( 2 n m / α ℓ ) 2 N . \overline{Y}_{tj}:=\frac{1}{N}\sum_{k=1}^{N}Y_{tjk}, \qquad r_N:=b_{\mathrm{judge}}+\sqrt{\frac{\log(2nm/\alpha_\ell)}{2N}}. Y t j := N 1 k = 1 ∑ N Y t j k , r N := b judge + 2 N log ( 2 nm / α ℓ ) . Conditional Hoeffding bounds and a union bound over the n m nm nm
L ‾ t j : = max { 0 , Y ‾ t j − r N } , L ‾ t j : = min { 1 , Y ‾ t j + r N } . \underline{L}_{tj}:=\max\{0,\overline{Y}_{tj}-r_N\}, \qquad\overline{L}_{tj}:=\min\{1,\overline{Y}_{tj}+r_N\}. L t j := max { 0 , Y t j − r N } , L t j := min { 1 , Y t j + r N } . Here N N N n n n α ℓ = 0 \alpha_\ell=0 α ℓ = 0
The saved finite-table bootstrap analyses do not establish a uniform b j u d g e b_{\mathrm{judge}} b judge ω \omega ω (15) . Algorithm 3 gives the interval-based procedure. The proofs follow below.
Proofs of the continuous-interface results
Proof of Theorem L.1. At state u i u_i u i j i ∈ arg min j ℓ j ( u i ) j_i \in\arg\min_j \ell_j(u_i) j i ∈ arg min j ℓ j ( u i ) z i z_i z i j i j_i j i z i z_i z i n − 1 ∑ i ℓ ⋆ ( u i ) n^{-1}\sum_i \ell^\star(u_i) n − 1 ∑ i ℓ ⋆ ( u i ) □ \square □
Proof of Theorem L.3. Data processing gives R Q h ( Z ) ⋆ ≥ R Z ⋆ R^\star_{Q_h(Z)} \ge R^\star_Z R Q h ( Z ) ⋆ ≥ R Z ⋆ A r A_r A r z r ∈ A r z_r \in A_r z r ∈ A r j r ∈ arg min j c j ( z r ) j_r \in\arg\min_j c_j(z_r) j r ∈ arg min j c j ( z r ) c ⋆ ( z ) : = min j c j ( z ) c^\star(z):=\min_j c_j(z) c ⋆ ( z ) := min j c j ( z ) ω \omega ω z ∈ A r z \in A_r z ∈ A r
c j r ( z ) ≤ c j r ( z r ) + ω ( h ) = c ⋆ ( z r ) + ω ( h ) ≤ c ⋆ ( z ) + 2 ω ( h ) . c_{j_r}(z) \le c_{j_r}(z_r)+\omega(h)=c^\star(z_r)+\omega(h)\le c^\star(z)+2\omega(h). c j r ( z ) ≤ c j r ( z r ) + ω ( h ) = c ⋆ ( z r ) + ω ( h ) ≤ c ⋆ ( z ) + 2 ω ( h ) . Using j r j_r j r E [ c ⋆ ( Z ) ] + 2 ω ( h ) = R Z ⋆ + 2 ω ( h ) \mathbb{E}[c^\star(Z)]+2\omega(h)=R_Z^\star+2\omega(h) E [ c ⋆ ( Z )] + 2 ω ( h ) = R Z ⋆ + 2 ω ( h ) R f u l l R_{\mathrm{full}} R full ω ( h ) = L c h \omega(h)=L_c h ω ( h ) = L c h □ \square □
Proof of Corollary L.4. Each exact observation 1 { Q h ( Z t ) = r } L t j ∈ [ 0 , 1 ] \mathbf{1}\{Q_h(Z_t)=r\}L_{tj}\in[0,1] 1 { Q h ( Z t ) = r } L t j ∈ [ 0 , 1 ] C r j C_{rj} C r j t t t r n r_n r n 2 L m e − 2 n r n 2 = α / 2 2Lme^{-2nr_n^2}=\alpha/2 2 L m e − 2 n r n 2 = α /2 min j L t j = ℓ ∗ ( U t ) \min_j L_{tj}=\ell^*(U_t) min j L t j = ℓ ∗ ( U t ) R f u l l R_{\mathrm{full}} R full s n s_n s n 2 e − 2 n s n 2 = α / 2 2e^{-2ns_n^2}=\alpha/2 2 e − 2 n s n 2 = α /2
R Q h ∗ ( Z ) ≥ ∑ r max { 0 , min j C ^ r j − r n } , R f u l l ≤ min { 1 , R ^ f u l l + s n } . R^*_{Q_h}(Z)\ge\sum_r \max\left\{0,\min_j \widehat{C}_{rj}-r_n\right\},\qquad R_{\mathrm{full}}\le\min\left\{1,\widehat{R}_{\mathrm{full}}+s_n\right\}. R Q h ∗ ( Z ) ≥ r ∑ max { 0 , j min C r j − r n } , R full ≤ min { 1 , R full + s n } . Clipping uses the known loss range. Subtract the upper bound from the lower bound and apply Theorem L.3 . A union bound limits total failure probability to α \alpha α
Proof of Theorem L.5. Define the unobserved exact sample quantities
C ~ r j : = 1 n ∑ t 1 { Q h ( Z t ) = r } ℓ j ( U t ) , R ~ f u l l : = 1 n ∑ t ℓ ∗ ( U t ) . \widetilde{C}_{rj}:=\frac{1}{n}\sum_t\mathbf{1}\{Q_h(Z_t)=r\}\ell_j(U_t),\qquad\widetilde{R}_{\mathrm{full}}:=\frac{1}{n}\sum_t\ell^*(U_t). C r j := n 1 t ∑ 1 { Q h ( Z t ) = r } ℓ j ( U t ) , R full := n 1 t ∑ ℓ ∗ ( U t ) . The preceding concentration proof applies with failure probability α s \alpha_s α s C ^ r j ≤ C ~ r j \widehat{C}_{rj}\le\widetilde{C}_{rj} C r j ≤ C r j R ^ f u l l + ≥ R ~ f u l l \widehat{R}_{\mathrm{full}}^{+}\ge\widetilde{R}_{\mathrm{full}} R full + ≥ R full
R Q h ∗ ( Z ) ≥ ∑ r max { 0 , min j C ^ r j − r n } , R f u l l ≤ min { 1 , R ^ f u l l + + s n } . R^*_{Q_h}(Z)\ge\sum_r \max\left\{0,\min_j\widehat{C}_{rj}-r_n\right\},\qquad R_{\mathrm{full}}\le\min\left\{1,\widehat{R}_{\mathrm{full}}^{+}+s_n\right\}. R Q h ∗ ( Z ) ≥ r ∑ max { 0 , j min C r j − r n } , R full ≤ min { 1 , R full + + s n } . The transfer bound proves the result. A union bound gives failure probability at most α s + α ℓ \alpha_s+\alpha_\ell α s + α ℓ
For the stated rollout construction, condition on each sampled state. Hoeffding bounds its N N N log ( 2 n m / α ℓ ) / ( 2 N ) \sqrt{\log(2nm/\alpha_\ell)/(2N)} log ( 2 nm / α ℓ ) / ( 2 N ) α ℓ / ( n m ) \alpha_\ell/(nm) α ℓ / ( nm ) b j u d g e b_{\mathrm{judge}} b judge [ 0 , 1 ] [0,1] [ 0 , 1 ]
Detailed Experimental and Reproduction Protocols
The following sections specify the model settings, feature selection, human ratings, and reproduction inputs for the comparisons in § 5 .
Qwen2.5: separating information, rule, and fitting effects
The primary model is Qwen/Qwen2.5-1.5B-Instruct, with public SAEs applied to the activations after layers 17, 18, 19, and 21. Layer indices are zero-based. The original collection has 240 states from 20 policy areas, each containing three required actions and four paraphrases. Twelve areas (144 states) are used for setting selection and fitting; eight areas (96 states) are held out until confirmation. Qwen2.5-7B-Instruct is the primary outcome evaluator, and Mistral-7B-Instruct-v0.3 provides a separate evaluator check.
The model activation width is 1,536 and each SAE dictionary has 24,576 coordinates. Extraction uses hidden_states[layer+1], the residual activation after the specified layer. Before computing risks, we check extraction alignment, agreement with the direct SAE forward pass, state and paraphrase counts, and completeness of the three-action loss tables. Table 23 gives the full configuration.
Table 23. Primary Qwen2.5 audit. Confirmation policy areas are not used to select layers, feature budgets, thresholds, or feature identities.
Qwen outcome scoring. The five criteria are safety, utility, fact handling, macro-action adherence, and overall quality, with weights (0.40, 0.25, 0.15, 0.10, 0.10) on a scale from zero to four. The evaluator produces an expected score from prior-corrected next-token label probabilities; the weighted score is divided by four and subtracted from one to obtain loss. The evaluator sees the full situation, policy, selected action, response, and required-action label. The required-action label is an evaluation input, not a selector input. SmolLM2 and Phi instead use integer JSON scores from zero to three with the five criteria and weights given below. Normalization to [ 0 , 1 ] [0,1] [ 0 , 1 ]
SmolLM2: independent SAE training and additional policies
For HuggingFaceTB/SmolLM2-1.7B-Instruct, we use activations after layer 17 and Mistral-7B-Instruct-v0.3 as the automatic evaluator. Alongside the original 240 states, a locked collection contains 96 states from eight additional policy areas. The locked collection is fixed before response generation and scoring, with its SHA-256 digest recorded in the archive. Five responses for each of the three choices at each of the 336 states give 336 × 3 × 5 = 5,040 336 \times3 \times5 = 5{,}040 336 × 3 × 5 = 5 , 040
Two TopK SAEs are trained from scratch with random seeds 314159 and 271828. Each dictionary has 16,384 coordinates, with sparsity k = 64 k = 64 k = 64 Table 7 gives the full configuration.
Table 7. SmolLM2 audit and SAE training settings.
The automatic evaluator assigns integer scores in { 0 , 1 , 2 , 3 } \{0, 1, 2, 3\} { 0 , 1 , 2 , 3 } ( 0.30 , 0.30 , 0.15 , 0.10 , 0.15 ) (0.30, 0.30, 0.15, 0.10, 0.15) ( 0.30 , 0.30 , 0.15 , 0.10 , 0.15 )
How the support features are selected. For both SmolLM2 and Phi, each coordinate is first assessed alone on the 144 fitting states. Its ranking score is the reduction in minimum loss relative to a constant input when the selector observes that coordinate’s on/off bit. Coordinates are ordered by decreasing reduction, then by activation-frequency balance, then by index. The first B B B B B B B B B § 21 gives the ranking formula and tie rules.
Matching automatic scores to human-rated responses. The automatic risk table averages five responses per state–action pair. For human evaluation, a score-independent SHA-256 ordering fixes one response from each pair. Human risks use that single response, and automatic–human calibration compares scores of the same response, rather than comparing a single human-rated response with a five-response automatic average. The human study evaluates SmolLM2 responses only.
Phi: matched feature-only and policy-aware comparisons
The Phi model is microsoft/Phi-4-mini-instruct. We extract the 3,072-dimensional residual activation after block 23, the 24th of 32 blocks. The relative depth 24 / 32 = 0.75 24/32 = 0.75 24/32 = 0.75 18 / 24 18/24 18/24 hidden_states [24].
Phi evaluates the original 240-state collection and the 96-state locked collection used for SmolLM2. We call the latter the reused locked collection : its scenarios are fixed before Phi generation but are not new to the researchers. Feature selection uses the original 144 fitting states; evaluation uses the original 96 confirmation states and the reused 96 states. Five responses for every state–action pair give 5,040 Phi responses, each scored by Mistral-7B-Instruct-v0.3 and Qwen2.5-7B-Instruct. Each evaluator assigns five scores in { 0 , 1 , 2 , 3 } \{0, 1, 2, 3\} { 0 , 1 , 2 , 3 } ( 0.30 , 0.30 , 0.15 , 0.10 , 0.15 ) (0.30, 0.30, 0.15, 0.10, 0.15) ( 0.30 , 0.30 , 0.15 , 0.10 , 0.15 )
Two TopK SAEs, with seeds 314159 and 271828, use 16,384 coordinates and sparsity 64. Each uses eight million FineWeb-Edu activation tokens for training and 300,000 for validation. The 100,000-token normalization sample comes from the training stream. Initialization and training order differ; the model, block, architecture, and cached activation corpus are shared. Each run completes 7,813 optimization steps. Appendix § 19 gives model revisions, settings, and diagnostics.
Supervised feature ranking uses only Mistral losses on the 144 fitting states. The selected features are fixed across evaluation collections, controller inputs, and evaluators. We evaluate feature budgets B ∈ { 2 , 4 , 8 , 16 , 32 , 64 } B \in\{2, 4, 8, 16, 32, 64\} B ∈ { 2 , 4 , 8 , 16 , 32 , 64 } B = 2 B = 2 B = 2 ( Z , S ) (Z, S) ( Z , S ) Z Z Z before optimizing state–action risk; its information gap need not equal the mean of their separate gaps. Neither evaluator replacement nor the mean-loss analysis selects new features.
Additional diagnostics measure reconstruction, the number and size of code cells, and sensitivity to deleting a policy area. Variance selection and three fitting-based random-selector controls provide further comparisons; the random-selector controls use Mistral loss and code-only inputs, not policy-aware inputs. Phi is evaluated automatically and has no completed human ratings.
Complete human-rating procedure
The human evaluation covers 176 states: four states from each of the 20 original policy areas and all 96 locked states. Three response choices per state give 528 items per rater. The original 80-state subset includes feature-selection areas, whereas the locked collection is held out at the policy-area level. Raters see the active policy, user situation, selected action, and candidate response. The following procedure keeps independent rating separate from joint adjudication.
Rater recruitment and background. Two volunteer raters affiliated with the authors’ research institution were recruited through internal convenience sampling. The raters received no financial or non-financial compensation. Both provided informed consent before participating. No demographic variables or direct personal identifiers were recorded in the rating dataset. We therefore report only the raters’ institutional affiliation and do not infer unrecorded educational or professional qualifications. Domain-specific professional credentials were not required because each item presented the active policy in full, and the task was to evaluate the candidate continuation against that policy and the declared action rather than to make independent legal, medical, or regulatory decisions. Accordingly, the factuality dimension is interpreted as consistency with the information presented in the item and the absence of evident unsupported claims, not as expert verification of domain-specific facts.
Rater training, independence, and adjudication. Before the main rating round, both raters completed the same 36-item pilot and discussed the interpretation of the written rubric. The pilot labels were excluded from all reported analyses. Each rater then independently evaluated all 528 main-study items. During this independent stage, neither rater had access to the other rater’s labels, the hidden required action, model identity, SAE configuration, automatic scores, dataset split, or rollout-replica information. After both independent rating files had been completed and locked, the prespecified disagreement rules were applied to construct the adjudication queue. Only then did the raters jointly resolve the 100 queued items. The original independent labels remained unchanged. Direct rater identifiers were not included in the analysis files or in materials prepared for release.
From ratings to loss. For each item, let s s a f e t y , s p o l i c y , s u s e , s f a c t , s o v e r a l l s_{\mathrm{safety}, s_{\mathrm{policy}, s_{\mathrm{use}, s_{\mathrm{fact}, s_{\mathrm{overall}}}}}} s safety , s policy , s use , s fact , s overall { 0 , 1 , 2 , 3 } \{0,1,2,3\} { 0 , 1 , 2 , 3 }
L h u m a n = 1 − 0.30 s s a f e t y + 0.30 s p o l i c y + 0.15 s u s e + 0.10 s f a c t + 0.15 s o v e r a l l 3 . L^{\mathrm{human}} = 1 - \frac{0.30s_{\mathrm{safety}} + 0.30s_{\mathrm{policy}} + 0.15s_{\mathrm{use}} + 0.10s_{\mathrm{fact}} + 0.15s_{\mathrm{overall}}}{3}. L human = 1 − 3 0.30 s safety + 0.30 s policy + 0.15 s use + 0.10 s fact + 0.15 s overall . The division by three places the weighted score in [ 0 , 1 ] [0,1] [ 0 , 1 ]
For automatic–human action comparisons, we distinguish a selected lowest-loss action from the set of all minimizing actions. The selected-action statistic uses the first minimum in the fixed order ASK, DECLINE, ASSIST. We additionally compare nonempty intersection and equality of the two minimizing sets. Numerical ties use absolute tolerance 10 − 12 10^{-12} 1 0 − 12 10 − 8 10^{-8} 1 0 − 8 § 21 .§ 3 .
Fixed comparisons and uncertainty
Feature selection uses the declared fitting split and does not change across the corresponding evaluation comparisons. The Phi observation conditions are fixed before response generation, although the policy collections were already used for SmolLM2. Selector sweeps, matched codebooks, noisy observation channels, and fitted continuous rules are diagnostic analyses unless a frozen confirmation setting is explicitly identified.
To measure sensitivity to the sampled policy areas, we use a cluster bootstrap: each resampling draw selects whole policy areas, retaining their states, and recomputes both risk minima in Equation (10) . Reported intervals are two-sided 95% bootstrap intervals. An individual one-sided 95% lower confidence bound (LCB) above zero reports stability to the declared policy-area resampling. The Phi analysis uses 2,000 resamples, eight policy-area clusters per evaluation collection, and numerical zero tolerance 10 − 12 10^{-12} 1 0 − 12
The empirical target is the finite outcome-loss table. Resampling policy areas does not by itself provide simultaneous bounds on unknown expected rollout losses. The bootstrap results are therefore distinct from the population and search-valid certificates in § 22 .§ 1 and § 4 . The corresponding configurations, cached losses, interface codes, ratings, and diagnostic outputs are retained in the author working archive described in Appendix § 23 .§ 7 .
Reproduction inventory
The arXiv source package contains the manuscript, bibliography, figures, and LaTeX tables. Experiment code and cached records are retained in a separate author working archive and are not included in the arXiv source package. All supplementary/ and tools/ paths in this paper refer to that working archive. The Phi archive preserves the original 5,040 responses, both item-level evaluator files, frozen state tables, SAE feature arrays, selector registries, the active protocol lock, training summaries, and complete risk and diagnostic outputs. Machine-readable verification records are retained with the tables computed from archived records. Risk and bootstrap statistics can be recomputed from these cached records without rerunning the language model. Displayed values are rounded; aggregation and evaluator averaging occur before rounding.
Phi’s active configuration is protocol_lock.json. The nested data/experiment_config.json is an unchanged file recording the SmolLM2 input configuration, not the Phi runtime configuration. Large SAE checkpoints, training activation shards, and raw hidden activation arrays for the audit states are not included in the compact Phi archive; recorded checkpoint hashes do not provide the missing weights. Optional Phi human packets are blank and are not completed human data. The completed SmolLM2 rating files and resolved queue are included under supplementary/support_revision/human_inputs/; blank templates in the original automated archive are not treated as ratings. The CPU reproduction script reconstructs the final item-level losses, agreement statistics, and paired observation-risk tables. Bootstrap seeds are recorded separately for the code-only and matched observation analyses. Qwen source and notebook summaries are archived with a rounding bound; the full-precision historical Qwen loss/code arrays and the underlying 42-state capacity matrix are not present. The global-capacity regression suite validates the algorithm on declared test matrices, not on the unavailable 42-state matrix. The original experiment archives are preserved unchanged in the author working archive.
The author working archive retains the source excerpts, input hashes, statewise minimizing sets, dimension-specific losses, and worked-example records underlying the diagnostics described in Appendix § 21 . The author working archive also retains the loss matrix, every returned labeling, validated cell margins, and independent two-label feasibility results for the 96-state human capacity calculation. Within that archive, the scripts tools/reproduce_author_audit.py, tools/reproduce_human_capacity.py, and tools/render_author_audit_tables.py regenerate the records and tables from archived inputs. These scripts do not change human labels or perform model training. First-minimum agreement in older result files retains its original number and is accompanied by the explicit tie convention and set-based metrics.
Ethical use
The intended use of the framework is diagnostic: a representation can be tested before a safety monitor, steering rule, or downstream controller is trusted. Separating information loss from rule and training loss can reduce false confidence and can direct engineering effort toward the module that fails. Small conflict witnesses can also make failures easier to inspect, document, and reproduce.
The same analysis can be misrepresented as a deployment guarantee. Every result is conditional on the audited states, policy specification, continuation library, loss, interface, model, and sampling protocol. A representation that passes one audit can fail under another distribution, while failure of a finite support interface does not imply failure of the full continuous hidden state. We reduce this risk by reporting exact claim boundaries, retaining negative replication results, separating automatic and human losses, and avoiding a population-level uniform evaluator-error claim.
The human-rating procedure, including recruitment, consent, compensation, rater independence, adjudication, and data handling, is described in Appendix § 23 .§ 5 .
