Can you read what a model is about to say?

The short version

Two questions, one base model, five families of "reader," and a causal follow-up. Here is where they landed.

What a ParaScope is

At a paragraph break, a transformer's residual stream holds a compressed sense of what comes next. A ParaScope (Pochinkov, arXiv:2511.00180) turns that hidden state into the upcoming paragraph. Two shapes:

Continuation ParaScope — patch the break-token residual back into the model as context and let it generate. AutoEncoder-Map ParaScope — a trained map from residual → SONAR sentence-embedding space, then decoded to text. Both recover next-paragraph information worth roughly five tokens of "cheat" context at the 3B scale.

This project asks two things the original paper didn't. Q1 — move the read from the paragraph break to mid-paragraph, and from open text to controlled "talk about X, then Y" pairs: when does the future topic become readable? Q2 — stop training a probe and instead LoRA fine-tune the model itself into a reader of its own state: how good can decode get?

X-then-Y: is the plan there while it writes?

2,400 two-paragraph documents across four prompt families (explicit X→Y, derived-Y, secret-choice, model-chosen). Six layers captured at every paragraph-X token; positions binned 0–9 within the paragraph. Five independent reader families, one verdict.

Three things worth noticing

No prompt echo. Even when Y sits verbatim in the prompt (the explicit family), Y's rank-1 at the prompt's last tokens is 0.004. The parascope reads generation state, not the prompt text.

No boundary crystallization. At the exact final token of paragraph X — the probe's own training position — the champion still reads the just-finished X (cos 0.251) over the imminent Y (0.165, rank-1 0.005). A hard topic switch exposes that the boundary residual does not linearly encode the switch in SONAR space; the paper-era rank-1 on FineWeb is likely carried substantially by topic continuity between adjacent paragraphs.

One real plan signal. The exception is the secret pick — the family where the prompt lists all four options but only the model knows which it chose. There a fresh probe reads the choice at 0.40 vs 0.25 chance (best at L24/L27). That is the only place a genuine, prompt-independent forward plan shows up.

Is that plan causally load-bearing? No — at 3B.

The secret pick is decodable. So the sharp question: if you edit that representation, does the model change its mind? Intervention: add α·(μ_target−μ_orig) — slot-mean differences from mid-paragraph-1 captures — to all paragraph-1 positions during prefill, generate paragraph 2, parse the revealed pick. n=120 per arm.

Steering sits at chance; ablating the 3-dim pick subspace changes nothing. And base_keep is only ~0.6 at temperature 0.3 — the pick is substantially re-decided during paragraph 2. The mid-paragraph signal is a weak bias, not a locked plan.

Update: the topic direction is partially write-capable — ~⅓ clean flips from 1–2 tokens, and more steering only buys stutter

The dose–response follow-up (xy_steer_dose.py) steers toward a third topic Z by adding α·‖h‖·normalize(J[L][Z]) — the mini J-lens topic row — at layers 14/21/27, hitting the boundary \n\n plus the first n−1 generated tokens. n=120 per cell; outcome classified by SBERT over the 64-topic pool; coherence = NLL of the generation under the unsteered model (control 0.28).

The corrected answer: clean control tops out at ~⅓, and it's cheap — 1–2 tokens. Single-position steers (newline or any early token) flip ~28–35% of the time and are always coherent — typically either a real switch or a topic mention that reverts ("volcanoes and other natural disasters. Honeybees are also…"). Steering more tokens raises only the label rate: every marginal "flip" past n≈2 is a repetition loop stuttering the target's first token ("honey honey honey…", "ch ch ch…"), and by n=8 all flips are loops — at every α tried, with or without L27, at temperature 0.3 or 0.8. This was initially misread as "72% coherent flips": the SBERT classifier counts a topic-word stutter as that topic and NLL can't see loops (repetition is self-predictable). Inspecting the real examples — the hover data on this chart — is what caught it.

Which tokens matter? Any two — but the newline buys coherence

Steer any single position — newline or not — and you get the same ~30% flip, always clean: the newline is not a magic switch. Adding positions mostly converts keeps into loops, not into clean flips ({0,1} clean ≈ singles; {0,1,2,3} clean drops to 0.14). The one modest winner is {1,2} — two generated tokens, skipping the newline — at 0.45 clean flips, though its transitions are the least probable under the base model (NLL 2.0 vs 0.94 with the newline steered: the boundary steer makes the switch plausible; later steers make it happen). The loop attractor is not a last-layer artifact — dropping L27 or steering single layers weakens flips without cleaning them.

Try it on one document: the honeybees paragraph

The hypothesized demo, run for real: take a single document (the honeybees paragraph, prompted only with "Write a short article about honeybees." — nothing suggests a switch), steer toward "volcanoes" (α=1.0, L14/21/27), and vary which positions get steered. 24 samples per condition; pick a condition to read real generations.

What it shows: unsteered, the model stays on bees 24/24. Steering the newline alone: still bees 92% — the steer surfaces as a passing mention ("volcanoes and other natural disasters. Honeybees are also…") before reverting. Steering the first generated token alone: still bees 96%, often a graceful merge ("The volcanoes of the Andes are home to a unique species of honeybee…"). Steering both: the model leaves bees every time — but on this document the landing is the "volcan volcan" stutter, at every α and temperature tried (and "choral music" gives "ch ch ch"). So the newline-vs-both structure is exactly as hypothesized; what multi-token rank-1 steering can't deliver here is a clean landing. When single-token steers do win cleanly (~⅓ of the time across the population), they read like this:

The upper bound: replace real states instead of adding a direction

The P2 experiment replaces the recipient's residuals (L14/21/27) at the newline + first n−1 tokens with a donor document's real boundary states — a doc genuinely about to write topic Z. Blue curve above; the full grid (n=120/cell):

Two punchlines. First, real states flip cleanly and monotonically — no loops in 480 generations — so the switch information is causally present and usable; it is just distributed across several early-token states, beyond what any rank-1 direction can write. Second, the single-state inversion: the direction-add at the newline flips 35% (an exaggerated, out-of-distribution push whose first sampled token is often a topic word that locks in), while a faithful full-state replace at the newline flips 0% — it emits a generic opener and the model's context immediately re-derives its own plan. One boundary state, even a real one, does not carry the switch: the strongest direct evidence yet for just-in-time re-derivation at 3B.

LoRA continuation readers: how far can decode go?

Instead of a probe that maps a residual to a SONAR vector, LoRA-fine-tune the model into a reader of its own boundary state (LatentQA-style). A soft-projector turns donor residuals into a few soft tokens; the model generates the next paragraph from them. Reader = the model decoding itself. Scored on val shard 8, n=300, against the full-shard retrieval pool.

What the ladder says

Training the reader is everything. The zero-shot continuation parascope on Llama-3B is weak when patching only three layers (0.087) — the paper patched all of them. Tuning the reader takes decode from 0.087 to 0.765.

Epochs beat depth and rank. Holding the ml3/24sh recipe fixed and varying only epochs gives a clean, monotonic curve — 1ep 0.548 → 2ep 0.596 → 3ep 0.670 → 5ep 0.765 SBERT (rank-1 0.210 → 0.313 → 0.393 → 0.397). A third epoch (0.670) already beat a deeper, twice-as-expensive six-layer rank-64 reader (0.623), and the completed 5-epoch run settled the scaling question: decode never saturated — 0.765 is ~97% of the ~0.79 SONAR-roundtrip ceiling, with val CE falling monotonically to the last step (0.593 → 0.368, no overfit). Retrieval is the opposite story: rank-1 flatlined at ~0.40 (rank-5 kept climbing to 0.817), so the remaining gap to the probe's 0.594 is a job for a retrieval-shaped loss, not more epochs.

Multi-layer input was the unlock, same as for the probes: single-layer donors plateaued at val CE ~1.18; the three-layer donor stack dropped it to 0.59.

Pattern across the range: the reader recovers genre, structure, register and domain — sometimes the exact words even where context fails — while named entities, dates and numbers are where it diverges. Context usually matches or beats it (see the recalibration callout above); the interesting cases are where they disagree.

The probe leaderboard, and the magnitude wall

The AutoEncoder-Map side of the project: linear and MLP probes from residual → SONAR, scored by rank-1 retrieval and by decoded-text quality. This is the retrieval SOTA lineage the LoRA reader is measured against.

The story in three moves

Data, then architecture, then base-model size. Doubling data lifted rank-1 ~0.06 at every layer, then saturated (24→32 shards = +0.005). An MLP direction head broke the linear rank-1 ceiling without losing decode coherence. A 9× bigger base model (gemma-3-27b) predicts the next-paragraph direction best of all. Multi-layer input, model size and data all stack: rank-1 0.658 → 0.661 → 0.676.

For reference: the paper's 24-sublayer Llama-3B TAE ParaScope reports ~0.55 mean cosine; a single-layer L27 mse+zscore probe here reaches 0.514 val-cos — about 93% of the paper's signal from 1/24 of the input.

The reading toolkit: 2023–2026

Every technique that could, in principle, read an upcoming topic from activations while the model writes about something else. Filter by family; the rating is each tool's fit for the X-then-Y read.

Full 35-paper review with per-tool notes and the ranked shortlist: TECHNIQUES.md in the repo. Applicability rating = expected signal-to-effort for reading upcoming topic Y mid-paragraph.

What it all means

1. Llama-3B plans just-in-time. It re-derives the next topic from the prompt as it writes (Wu et al.'s "breadcrumbs" world), holding only a weak choice-bias in activations. The rich thing a parascope reads is the current state; the specific future is mostly reconstructed on the fly.

2. The decisive follow-up needs a bigger model. "Where's the Plan?" found Gemma-3-27B is the exception where boundary plans are causally used — and gemma-27b is also this repo's retrieval SOTA. Re-running the secret-choice causal protocol on gemma-3-27b (an A100-80G job) is the single highest-value next experiment.

3. Decode was capacity-bound, not information-bound — and it tops out at "context-grade." The LoRA reader's decode win at one-third the data says the binding constraint was decoder-side capacity, and five epochs pushed it to 0.765. But the context-only baseline (0.800) shows what that number means: the reader compresses context-grade information into three vectors rather than reading anything beyond it. The probe's rank-1 (0.594 vs context's 0.480) is the one super-context signal. Retrieval and decode want different losses; the best system likely uses both.

4. Rank-1 steering is partial and brittle — and metrics lie about it. The slot-mean plan direction can't write at any dose; the J-lens topic direction flips cleanly ~⅓ of the time with 1–2 steered tokens, and pushing harder only produces topic-word stutter that an embedding classifier happily counts as success. Two working lessons: always read the generations (the hover examples caught the miscount), and pair every embedding metric with a repetition check. Real-state patching then settled it: full donor states flip cleanly and monotonically (0.65 at 8 positions, no loops), while a single state — even a real one — flips nothing. The plan is causally sufficient but distributed; there is no compact handle.

Methods & disclosure

Base model. Llama-3.2-3B-Instruct (28 layers, d_res=3072). Sentence embeddings via SONAR (1024-d), decoded with the SONAR text decoder. Retrieval pools use the full validation shard (~10.3k paragraphs). Probe retrieval and LoRA-reader retrieval use the identical protocol (SONAR-encode the output, rank against true targets) so numbers are comparable — with the caveat that the LoRA path is scored text→SONAR-re-encode (lossy) while the probe is scored on its raw output vector.

X-then-Y dataset. 2,400 two-paragraph documents, four prompt families, ~78% compliant. Residuals captured at six layers across all paragraph-X tokens, binned 0–9 by within-paragraph position. Causal tests use slot-mean difference vectors added during prefill (and, as a control, at every generated token). Compute: 3× A4000 16GB.

Dose–response & baselines (Phase 5). Steering adds α·‖h‖·normalize(J-lens row of a third topic) at layers 14/21/27 to the boundary newline + first n−1 generated tokens; outcomes SBERT-classified over the 64-topic pool with an unsteered-model NLL coherence guard (n=120/cell). The NLL guard is blind to repetition loops and the SBERT label counts topic-word stutter as a flip, so clean-flip rates are re-estimated post-hoc with a distinct-token-ratio check (<0.35 = degenerate) on the saved generations (60/cell, so ±~0.06); the flip-label curves are kept for comparison. Baselines re-run the exact 300 eval boundaries (same seed-0 draw) with the true text context in place of soft tokens: context-only, context + first k true target tokens (cheat-k), and wrong-boundary donors (shuffled floor).