# RESULT — 082 cosine-gate sensitivity analysis (defensive characterization)

**Tier: T3-exploratory. DONE + SELF-HARVESTED in-session.** Opens BLOCK K (safety applications).
Box GPU phys0 (CVD=0) tmux `c100_082`, **2300 encode/decode jobs, det_ok=True, 42.1 s**.
Rule-based synonym-aware readout PRIMARY (validity certified by ceiling/identity/paraphrase/random
controls); LOCAL codex judge OPTIONAL-not-run (validity already met — see below). Analysis local.
Ran exactly per frozen `PREREG_LITE.md`; no deviations.

## Framing (defensive, per 025 lesson)
A **cosine gate** is a proposed cheap monitor for the SONAR text-autoencoder: holding the clean
latent `z` and a possibly-edited latent `z'`, accept iff `cos(z, z') ≥ τ`. This is a **sensitivity
analysis of that gate's blind spot** — for a fixed τ, how much *genuine, fluent meaning change* can
sit inside the accept region? We use known meaning-flip operators (negation, tense, number, spatial
marker, entity swap, subject/object role swap) as principled, reproducible perturbation generators on
held-out templated sentences, and meaning-preserving paraphrases (noun/verb synonym) as the contrast
the gate *should* accept. This bounds what a cosine monitor can miss and tells a defender how tight τ
must be to catch each class. Neutral language throughout; no "attack".

## ★ Headline — the gate is blind to *logical/grammatical* meaning flips, but sensitive to *who-did-what*
The cosine cost `1 − cos(z, z_flip)` of a **full, fluent meaning flip** depends sharply on the class,
and the ordering is the finding — **opposite to the naive expectation** (prereg):

| class | genuine meaning change? | mean cos(z,z') | cosine cost | miss-rate τ=0.90 | miss-rate τ=0.95 | τ needed to catch (<10%) |
|---|:--:|:--:|:--:|:--:|:--:|:--:|
| **tense** (pres→past) | yes (~1 bit) | **0.960** | 0.040 | **1.00** | **0.85** | 0.975 |
| **number** (sing→plur) | yes (~1 bit) | **0.959** | 0.041 | **1.00** | **0.85** | 0.975 |
| **vertical** (above→below) | yes (marker) | **0.944** | 0.056 | **1.00** | 0.375 | 0.955 |
| **negation** (aff→neg) | yes (~1 bit) | **0.931** | 0.069 | **1.00** | 0.032 | 0.945 |
| *noun_synonym* (paraphrase) | **no** | 0.906 | 0.094 | — | — | — |
| *verb_synonym* (paraphrase) | **no** | 0.908 | 0.092 | — | — | — |
| **entity_swap** (who) | yes | 0.824 | 0.176 | 0.031 | 0.00 | 0.880 |
| **role_swap** (agent↔patient) | yes | 0.839 | 0.161 | 0.00 | 0.00 | 0.875 |

Read top-to-bottom: the **closed-class logical/grammatical operators** (negation, tense, number,
spatial marker) — the ≈1-bit flips of 066/069 — are the **cheap blind spot**: a full meaning flip
sits at `cos ≈ 0.93–0.96`, so a gate at **τ=0.90 misses 100%** of them and even **τ=0.95 still misses
85%** of tense/number flips. In contrast, **entity swap and role (agent/patient) reversal are
EXPENSIVE** (`cos ≈ 0.82–0.84`) — SONAR's pooled embedding robustly encodes *who does what*, so
swapping the binding moves the vector ~3× further and the gate catches these even at a loose τ=0.88.
This directly extends **078's argument-binding wall** and the binding-death program: argument/entity
bindings are strongly represented; grammatical polarity/tense/number are not.

**The load-bearing defensive statement:** a meaning-flipping **negation is CHEAPER in cosine than a
meaning-preserving synonym paraphrase**. Negation's *entire* distribution (min cos **0.908**) sits at
or above the noun-synonym *mean* (0.906). Any τ loose enough to admit paraphrases (which a deployed
monitor must, to avoid false alarms) **necessarily admits negations, tense flips and number flips**.
The gate cannot separate "the X does not Y" from "the X commends/observes …" by cosine.

Verbatim (decode of `z_flip`, all fluent, all clear the gate at the stated cos):
- neg, **cos 0.954** — *The banker guards the deer.* → **The banker does not guard the deer.**
- tense, **cos 0.979** — *The lawyer blames the deer.* → **The lawyer blamed the deer.**
- number, **cos 0.980** — *The teacher guards the deer.* → **The teachers guard the deer.**
- role_swap, cos 0.886 (**caught** by τ≥0.89) — *The soldier blames the patient.* → **The patient blames the soldier.**
- noun_synonym (no meaning change), cos 0.991 — *attorney* decodes back to **lawyer** (SONAR canonicalises the synonym).

## Tradeoff curve & envelope
Pooled validated-flip **miss-rate**: τ=0.90 → **0.641**, τ=0.95 → **0.344**, τ=0.98 → **0.000**
(n=527 validated flips). The **max-meaning-change envelope** (per base, largest detected change with
cos≥τ): τ=0.90 → 100% of bases admit a full flip; τ=0.95 → **91.4%**; τ=0.98 → **2.9%**. So only a
**τ≈0.98** gate closes the blind spot — but at that threshold it also rejects essentially all
paraphrases and most faithful reconstructions (a monitor at τ=0.98 is a near-identity check, not a
usable meaning monitor). **Interpolation frontier** confirms the continuous bound: a *validated*
negation is realised at `cos≈0.96` (α=0.75), a role reversal at `cos≈0.91`.

## Controls / gates — ALL PASS
- **G_ceiling** (decode of real flip realises intended change): negation 0.990, tense/number/vertical/
  entity/role **1.00**; garble 0.00 → cosine costs are interpretable.
- **G_identity** (α=0 / decode(z_base)): mean detected-change **0.029** (~0), chrF-to-base **96.9**,
  garble 0.00 — no-change positive control clean.
- **G_random** (Gaussian push matched to each flip's ‖z_flip−z_base‖): detected meaning change
  **0.042** pooled (≤0.15) at the SAME cosine as the real flips — **cosine cannot separate a real
  meaning flip from an inert equal-cost push; the *operator* achieves the flip where random does
  not** (extends 080's random-inert finding).
- **G_paraphrase**: noun/verb synonyms read as UNCHANGED meaning 0.95/0.96 (SONAR canonicalises
  synonyms) → correctly *not* counted as flips.
- **G_norm** (lesson 3): ‖z‖ flat across all classes (0.185–0.199 vs base 0.193) — no norm confound.
- **G_det**: PASS. **Offset generator** (v_class = mean(z_flip−z_base) on TRAIN, 078/080 machinery):
  negation/tense/number/vertical validity 0.93/1.0/1.0/1.0 at cos 0.95–0.97 — reproduces the flip as
  a linear latent edit at the same cheap cosine cost.

## Predictions → outcomes → Brier (frozen in PREREG_LITE)
| id | statement | P | outcome |
|----|-----------|---|---------|
| P1 | negation AND role_swap both cos≥0.90 | 0.70 | **FALSE** (neg 0.931 ✓, role 0.839 ✗) |
| P2 | role_swap is the cheapest (highest-cos) flip | 0.55 | **FALSE** (it is the *2nd most expensive*; tense is cheapest) |
| P3 | entity_swap cos < negation cos | 0.60 | **TRUE** (0.824 < 0.931) |
| P4 | pooled miss-rate ≥0.50 at τ=0.95 | 0.65 | **FALSE** (0.344 — gate better than expected at 0.95) |
| P5 | negation needs τ≥0.97 to catch | 0.60 | **FALSE** (caught at τ=0.945) |
| P6 | random matched-cosine change ≤0.15 | 0.80 | **TRUE** (0.042) |
| P7 | entity_swap ≈ noun_synonym cos (within 0.03) | 0.75 | **FALSE** (0.082 apart — gate *can* separate these) |

**Mean Brier = 0.3339** (poorly calibrated; 3/7). **The misses ARE the science.** The prereg
mental model — that argument reordering/role-swap would be the near-free blind spot — was
**backwards**: SONAR encodes argument/entity binding *robustly* (expensive to move), and the actual
blind spot is the **closed-class logical/grammatical operators**. Several predictions (P4, P5, P7)
also mis-estimated the gate as *worse* than it is on entity/role/negation while *missing* that
tense/number remain the durable hole even at τ=0.95. The corrected picture is cleaner and ties
tighter to 066/069 (bits) and 078 (binding wall) than the prereg guessed.

## Caveats / limitations
- **Worst-case per-class characterisation** (upper envelope of what the gate can miss for a class),
  not an average-case deployment rate. Templated single-clause SVO/copular stimuli, one embedder
  (SONAR), greedy decode, English only.
- **Rule-based readout is primary**; it is synonym-aware and certified by ceiling≈1.0 / identity≈0 /
  paraphrase / random controls, so the meaning-change labels are constructed-ground-truth + decode-
  validated, not judge-dependent. LOCAL codex neutral-rubric judge was **not run** (validity already
  met by ceiling 0.99–1.0 + identity 0.029 + norm-flat + det_ok, per 080 precedent); running it on
  the selected max-change + controls is the obvious promotion step above T3.
- Cosine here is on the **direct latent pair** (monitor holds both z and z') — the *stronger*,
  non-deployable gate of 025; 025 already showed the deployable re-encode-self form is ~90% blind
  regardless. This row shows even the *strong* gate has a structured blind spot for logical flips.
- "Bits" tie-in is by reference to 066/069 (negation/tense/number ≈1 bit), not recomputed here.

## Bottom line
For this autoencoder, a cosine gate on the clean-vs-edited latent pair is a **poor detector of
logical and grammatical meaning flips** and a **good detector of entity/role (who-did-what) changes**.
The cheap blind spot is exactly the ≈1-bit closed-class operators: a full negation, tense change, or
singular↔plural flip sits at cos 0.93–0.98 — *closer to the original than a synonym paraphrase* — so
no single threshold both admits paraphrases and rejects negations. A defender relying on latent-cosine
must set τ≈0.98 to catch logical flips (collapsing it to a near-identity check) or pair it with an
orthogonal semantic/logical check. **Follow-up worth funding? Y (narrow):** (1) codex neutral-judge
cross-check to promote above T3; (2) natural (non-templated) sentences — does the negation/entity
cost ordering hold off-manifold?; (3) a *logical-flip-aware* auxiliary probe (negation/quantifier
direction) as the missing orthogonal check the cosine gate needs.

## Provenance / hygiene
Repo: PREREG_LITE.md (frozen), src/{gen_flips,flip_decode,analyze_flips,run_082.sh},
out/{points,offsets,meta,analysis,stimuli}.json + run.log. Box GPU0 claimed at 35 MiB, released at
exit; no foreign process touched; `tmux kill-session` on own session only (job self-exited). night8
venv, `unset CONDA_PREFIX`, HF_HOME=/workspace/hfcache, BLAS=8. Single experiment in flight. Local
commit, no push. T3-exploratory.