# Paper B — Where Retrofitted Recurrence Attaches: Injection Cliffs, Read-Invariance, and a KV-Sharing Hazard

**One-sentence claim.** For loops retrofitted onto a frozen transformer, the
write location is everything and the read location is nothing: performance
falls off a one-layer cliff at the sensor→workspace boundary, is invariant to
where the fed-back state is tapped, and — on KV-sharing architectures —
becomes *structurally impossible* above the sharing boundary, a hazard that
silently invalidates hook-based interventions far beyond this project.

**Audience/venue.** Interpretability/analysis venue (e.g. BlackboxNLP-class
workshop, or an interp track); alternatively TMLR. Cites Paper A for
training recipe, Paper D for the lens.

## Claims and evidence manifest

| # | claim | evidence | status |
|---|---|---|---|
| B1 | Anchor cliff: inject L14→52%, L13→34%, L12→29%, L11→25% (monotone, one-layer onset at lens boundary) | `results-band-{13_30,12_30,11_30}/eval*.json` + reference | ✅ |
| B2 | Tap invariance: taps 23/27/30/32/34 statistically flat (incl. motor/final layer); 40%-shorter loop body matches | `results-tap*/eval*.json` (note: 27/32/34 on H200, 23 on Spark, k0 anchors align) | ✅ |
| B3 | KV-sharing hazard: E2B layers 15–34 reuse K/V from ≤14; band re-runs entered ≥15 are bit-exact nulls in training (zero grad) and behavioral nulls in eval (Δlogit up to ~11 with 0 argmax flips) | arm 17–27/24–34 logs; forensic probes (transcribe from session); `results-node-final/results-kvtest/train.log` | ✅ |
| B4 | Causal demonstration: moving entrance one layer (14→15) reproduces the null on demand | `results-kvtest/train.log` (flat val@ all k) | ✅ (eval tail missing — rerun 5-min eval for completeness) |
| B5 | 12B (no KV sharing) clean location test: wrong band 0.4–2.3% vs 32.8% | `results-node-final/results-12b/eval_12b_gsm_band10*.json` | ✅ |
| B6 | Fixed-point dynamics: big first step, cos→1.000 by k≈4; explains accuracy/sharpening plateau and k-extrapolation flatness | dynamics data + `eval_code_code_kgen.json` | ✅ |
| B7 | Discriminator: cliff = lens boundary vs last-full-attention-KV layer | **MISSING — the (9,30) arm** | ❌ queued idea |
| B8 | Residual-only perturbation impotence: large logit shifts w/o attention pathway don't flip decisions | probe from session (rerun scripted for reproducibility) | ◐ script it |

## The hazard section (the paper's service to the field)
Write as a standalone, checkable warning: (1) detection recipe — check
`num_kv_shared_layers`/equivalents before any layer-局部 intervention; (2)
symptom catalogue — exact-baseline results, zero gradients, big-Δlogit/no-flip;
(3) how our 3 pre-registered arms became silent nulls and how forensics found
it (file diff → shared_kv_states kwarg → config). Affected model classes:
KV-sharing efficiency variants (survey which public families have it).

## Missing experiments (all cheap, Spark)
1. **B7 (decisive): anchor (9,30)** — L9 is full-attention+KV-computing but
   deep in sensor region. Pre-registration drafted in
   `results-loop/PROTOCOL_UNIFIED.md` §(to add). Prediction on record: lens
   boundary wins (arm 1 contained L9 and was catastrophic). ~70 min.
2. B4 completeness eval (5 min).
3. B8 as reproducible script + N=16 items (30 min).
4. Optional: channel-count sweep (anchor 12 with tap 28 length-match) if B7
   surprises. Decide after B7.

## Outline (workshop-length)
1. Setup: retrofit loop machinery (1 fig), what "write" and "read" are.
2. Read-invariance (tap curve fig).
3. Write-cliff (anchor curve fig + 12B clean replication).
4. The KV-sharing hazard (anatomy fig: which layers recompute K/V; symptom
   table; detection recipe).
5. Fixed-point account tying 2–4 together.
6. Implications for activation-intervention methodology.

## Work plan
- [ ] Run B7 + B4-eval + B8-script (one Spark session, ~2h GPU total).
- [ ] Transcribe session forensics into `paper-B/hazard_notes.md` while fresh.
- [ ] Figures: anchor curve, tap curve, KV anatomy diagram.
- [ ] Draft after Paper A ships (it cites A's training recipe).