Reading a sentence vector

The headline is a negative typological result: a mean-pooled sentence embedding is not the same kind of object as an LLM residual stream, and the strongest formal versions of the LRH are derived in a way that does not transfer to it.

Three differences are load-bearing. (i) Privileged basis. Elhage et al. (2021) define the residual stream as a bandwidth-limited channel every layer reads and writes; Elhage, Lasenby & Olah (2023) show it empirically has a privileged basis — basis-aligned outlier coordinates — traced to Adam's per-dimension normalizers, with LayerNorm and float precision ruled out. Toy Models of Superposition says of embedding-like spaces the opposite: "it doesn't make sense to analyze basis directions. There would be no reason to expect a basis dimension to be different from any other possible direction." Neuron-level intuitions (monosemantic vs polysemantic units) do not transfer to a pooled z; direction-level claims might. (ii) LRH's formalization is unembedding-relative. Park, Choe & Veitch (ICML 2024) build a causal inner product out of the unembedding geometry, and it is that inner product, not the Euclidean one, under which concept directions behave; Jiang et al. (ICML 2024) derive linearity from the softmax cross-entropy next-token objective plus gradient descent's implicit bias. Both presuppose a softmax over a vocabulary at the site studied. A pooled encoder has none. SONAR is a fourth object again: a seq2seq bottleneck (MT cross-entropy through a cross-attention decoder + MSE tie + denoising), closer to a VAE/IB latent than to either canonical case. (iii) Objective geometry. Contrastive spaces are driven toward alignment plus uniformity on the hypersphere (Wang & Isola, ICML 2020), and InfoNCE-family objectives invert the data-generating process only up to a transformation class (Zimmermann et al., ICML 2021) — a different reason to expect linear structure, one that makes "a factor is linearly recoverable" well-posed while leaving "which direction" unpinned.

Settled: the weak LRH — some features are directions — holds in residual streams (truth: Marks & Tegmark, COLM 2024; sentiment: Tigges et al. 2023, where ablating one direction destroys 76% of above-chance accuracy) and in static word spaces, where the linear analogy structure has real theory behind it (Arora et al., TACL 2016/2018; Allen & Hospedales, arXiv:1901.09813). Superposition is demonstrated in toy models and given a capacity theory by Scherlis et al., whose allocation result matters here: important features get dedicated capacity, mid-importance ones go polysemantic, the least important are dropped entirely.

Contested: the strong LRH. Lewis Smith (2024) argues "nearly all features are directions" is probably false and that much of what a network knows is tacit computational structure with no explicit encoding. Black et al.'s polytope lens (2022) argues directions are not in general monosemantic. Engels et al. (ICLR 2025) show irreducible multi-dimensional features — circular day/month representations, causally used. Nanda, Lee & Wattenberg (2023) give the sharpest methodological warning: Othello-GPT's board state looked non-linear until re-parameterized as "mine vs theirs", whereupon it became linear and steerable by vector arithmetic. Non-linearity under one coding is not non-representation.

For sentence spaces the evidence is thin and split. Positive: Trager et al. (ICCV 2023) find CLIP text embeddings approximately spanned by a few compositionally-additive "ideal words"; Freenor & Alvarez (ICLR 2026) find discourse-level semantic-syntactic transformations are consistent rotations across 3 encoders and 7 languages, claiming the first sentence-level support for LRH; Tehenan et al. (2025) recover linearly-encoded semantic and syntactic aspects and trace them through pooling. Negative: Zhu & de Melo (COLING 2020) find analogy regularities differ substantially by model — no universal offset structure; the word-space critiques (Gonen & Goldberg, NAACL 2019; Nissim et al. 2019/2020) show a linear direction can look like a concept while the concept survives its removal. Two 2026 additions push the same way — geometry is task-shaped, not uniform: Xiong's Lattice Representation Hypothesis (arXiv:2603.01227, ICLR 2026; linear attribute directions with thresholds induce a concept lattice by half-space intersection) and Bassi & Tomar's ordinal geometry (arXiv:2607.04167, ICML 2026 MI workshop; 1-D manifolds with place-cell tiling only where values are locally computable, "higher-dimensional or incoherent" where cross-position integration is required).

Finally the manifold/ID picture: trained nets compress onto low-dimensional curved manifolds far below layer width (Ansuini et al., NeurIPS 2019); LMs show a high-dimensional abstraction phase whose earlier onset predicts better LM quality (Cheng et al., ICLR 2025); natural text embeddings sit at ID ≈ 9 for alphabetic languages and ≈ 7 for Chinese (Tulchinskii et al., arXiv:2306.04723). Most usefully, Lee et al. (ACL 2025) separate the two dimensionalities: nonlinear ID tracks semantic composition, linear dimension tracks superficial aspects.

Three things are settled. First, contextual text spaces are anisotropic: Ethayarajh (2019) showed that in almost all layers of BERT, ELMo and GPT-2 the average cosine similarity between uniformly random words is far from zero, and that in GPT-2's last layer "any two words have on average an almost perfect cosine similarity" (roughly 0.6 in layers 2–8, rising exponentially thereafter). Second, a handful of coordinates dominate that statistic. Timkey & van Schijndel (2021) decomposed cosine similarity per dimension and found 1–5 rogue dimensions carrying most of it — in XLNet layers 10–11 a single dimension contributes >99% of expected cosine similarity, with mean activation 180.0 against −0.084 (σ = 0.77) for every other coordinate. Cosine can therefore "rely on less than 1% of the embedding space". Third, the fix is cheap: standardization, all-but-the-top (Mu & Viswanath 2018), whitening (Su et al. 2021) or flows (Li et al. 2020) all improve similarity-task numbers, and whitening additionally lets you drop dimensions for free.

Everything else is contested, and the contest was substantially resolved against the 2019–21 consensus during 2022–24. Cai et al. (ICLR 2021) showed the space is locally isotropic inside clusters, so global anisotropy is an artifact of cluster geometry rather than a defect. Ding et al. (2021) evaluated the isotropy-calibration methods head to head and found no consistent gains. Ait-Saada & Nadif (ACL 2023) found anisotropy has limited impact on clustering quality and that fostering anisotropy can help. Mickus, Grönroos & Attieh (ACL 2024) went further and showed mathematically that isotropy is incompatible with the presence of clusters, which also degrades linear classification. Rudman & Eickhoff (ICLR 2024) built a differentiable isotropy regulariser and report that decreasing isotropy improves performance on most tasks and models they tried. The "anisotropy is a bug, whiten it away" program is, as of 2026, largely retired; anisotropy is better read as a measurement artifact of cosine than as a property that hurts.

The cause of outlier dimensions is genuinely open, with three live and partly incompatible accounts. Gao et al. (ICLR 2019) blamed weight-tied likelihood maximisation over a skewed token distribution (the "representation degeneration" story); Puccetti et al. (Findings EMNLP 2022) confirmed the frequency link empirically and tied outliers to the vertical attention pattern on special tokens. Luo, Kulmizev & Mao (ACL 2021) traced the same outliers to positional embeddings, and showed they vanish when RoBERTa is pretrained without them. Bondarenko et al. (NeurIPS 2023) and Sun et al. (COLM 2024) place the origin in attention heads trying to learn a no-op — massive activations up to ~10⁵× typical magnitude acting as fixed bias terms / attention sinks. Godey, de la Clergerie & Sagot (EACL 2024) cut across all three by showing anisotropy appears in models whose objective faces no skewed-vocabulary pressure at all, and in Transformers over non-text data, concluding anisotropy is "inherent to Transformers-based models". A frequency-only explanation is therefore not sufficient.

There is a second, sharper disagreement about whether outlier dimensions do anything. Timkey & van Schijndel found "a striking mismatch": the dimensions dominating cosine similarity are not the ones dominating model behaviour — ablating them barely moves GPT-2's or XLNet's language-modelling distribution. Kovaleva et al. (Findings ACL 2021) found the opposite in BERT-family encoders: disabling <0.0001% of parameters (the high-magnitude LayerNorm scale/bias entries) significantly degrades MLM loss and downstream accuracy. Rudman, Chen & Eickhoff (EMNLP 2023) found a single outlier dimension can solve downstream tasks with minimal error. These are not reconcilable by hand-waving: whether the geometrically loud coordinates are load-bearing appears to depend on the architecture and the readout. Anyone whitening a space is implicitly betting on Timkey's side.

Three smaller literatures matter here. (i) Norm and variance. Yamagiwa & Shimodaira (COLING 2025) make explicit an identity that is exactly the geometry of pooling; Oyama et al. (EMNLP 2023) show the squared norm of a static embedding encodes information gain (KL of the word's co-occurrence distribution from the unigram), and Yokoi et al. (EMNLP 2020) show norm ≈ importance, angle ≈ meaning — so norm-weighted averaging is not neutral. (ii) Hubness, established in general high-dimensional data by Radovanović et al. (JMLR 2010) and in cross-space mapping by Dinu et al. (2015), is startlingly under-studied for modern text embedders; Nielsen & Hansen (NLDL 2024) is essentially the only dedicated Sentence-BERT study, reporting ~75% hubness reduction and ~9% error improvement. (iii) Cosine scepticism, now a real literature: Steck et al. (WWW 2024) derive analytically that cosine similarities of regularized linear-model embeddings can be arbitrary and non-unique; Zhou et al. (ACL 2022) show cosine systematically underestimates similarity for high-frequency words; Năstase & Merlo (2025, unreviewed preprint) find the geometry of sentence embedding spaces is simply not predictive of task performance. Finally, Kulkarni et al. (2026, unreviewed) train 108 controlled OLMo-style models and conclude geometric metrics such as effective rank "primarily reflect training choices rather than performance" — a direct warning against reading a geometry statistic as a quality claim.

Two years ago the field's centre of gravity was Huh, Cheung, Wang & Isola's Platonic Representation Hypothesis (ICML 2024): models trained on different data, architectures and even modalities are converging on a shared statistical model of reality, and convergence increases with scale. In 2025 that reading got its most dramatic empirical support from vec2vec (Jha, Zhang, Shmatikov & Morris), which translated text embeddings between encoders with no paired data at all — GAN adversarial losses plus cycle-consistency and a vector-space-preservation term, learning a shared latent — reaching cosine similarity up to 0.92 and top-1 matching up to 100% on same-backbone pairs across GTR, GTE, E5, Stella, Granite and Qwen. Then mini-vec2vec (Dar, 2025) showed the whole thing can be replaced by a linear transformation fitted by pseudo-parallel matching plus iterative refinement, orders of magnitude cheaper and far more stable. On the supervised-but-tiny side, ALGEN (Chen, Xu & Bjerva, ACL 2025 — one of the few peer-reviewed papers here) fits a one-step least-squares linear map between encoders from ~1k leaked pairs and hits cosine 0.89–0.95 against the target embeddings, saturating by ~3k samples. If you read only these three papers you would conclude that sentence-embedding spaces are all one linear map apart and that any result on one encoder is a result about all of them.

2026 has been the year of the pushback, and it has been sharp. Gröger, Wen & Brbić (ICML 2026) show that standard similarity metrics are confounded — depth and width systematically inflate them — and after permutation-based null calibration "the apparent convergence reported by global spectral measures largely disappears," leaving only agreement about local neighbourhoods. They rename the surviving claim the Aristotelian Representation Hypothesis. Koepke, Zverev, Ginosar & Efros (Back into Plato's Cave, 2026) show the canonical mutual-kNN evidence was measured on ~1k-sample galleries and degrades substantially at million-scale, and that what survives is coarse semantic overlap, not fine-grained structure: "models trained on different modalities may learn equally rich representations of the world, just not the same one." Ciernik et al. find that the training objective, not architecture or data, is the primary determinant of whether representational similarity is even consistent across evaluation datasets.

Underneath both camps sits a measurement crisis the field has not resolved. Kornblith et al. introduced CKA in 2019 precisely because CCA-family measures cannot work when dimension exceeds sample count; Davari et al. (ICLR 2023) then showed CKA values can be optimised up or down without changing functional behaviour, and are dominated by high-variance directions and outliers. Klabunde et al.'s ReSi benchmark (ICLR 2025) put 24 measures through six grounded tests across graph, language and vision and found no single measure or category wins. So the same pair of encoders can be declared aligned or not depending on the index chosen. Bansal, Nakkiran & Barak's answer — stitch the models and see whether the composite works — is the functional alternative, and it is the standard this strand should hold itself to.

The deepest 2026 finding for our purposes is that alignment and function have come apart empirically. Usama & Chang (Convergence Without Understanding, 16 models, 800 reasoning problems) report CKA 0.875 between pre-decision representations but 0.274 post-decision, alignment higher on problems all models fail (0.897) than problems they solve (0.830), and information that transfers across models at 66% accuracy while ablation flips only 1.5–5.5% of predictions. Zhang & Xin independently report a Pythia-160M→410M activation bridge with normalized cosine ≈0.97 that produces no downstream improvement when injected. Against that, Agarwal reports cross-model steering vectors transferring at a 71.0% win rate (vs 68.0% for native vectors) with Procrustes cosines 0.895–0.956 — but only at ≥1.7B parameters, degrading sharply below 0.8B. The honest summary: a linear map between two spaces is now easy to find and weak evidence about anything causal.

Finally, the ancestor literature already told us when unsupervised alignment breaks, and nobody should have forgotten it. MUSE (Conneau, Lample, Ranzato, Denoyer & Jégou, ICLR 2018) aligned word embedding spaces adversarially with no parallel data; Søgaard, Ruder & Vulić (ACL 2018) immediately showed monolingual spaces of even similar languages "are not isomorphic," and the method collapses under domain mismatch, different embedding algorithms, and morphologically rich languages. Vulić et al. (EMNLP 2019) then reported zero BLI performance on 87 of 210 language pairs. Those are exactly the axes on which SONAR is unusual.

The settled core is twenty-five years old in kernel form and nine in neural form. A mean over a set is a kernel mean embedding with the linear kernel; embeddings of distributions are injective exactly when the kernel is characteristic, a condition Sriperumbudur et al. (2010) pinned down precisely — and the linear kernel is emphatically not characteristic, so a plain mean loses everything beyond a first moment of the element distribution. Deep Sets (Zaheer et al., 2017) recast this constructively: every permutation-invariant function of a set can be written ρ(Σ φ(x_i)), and the interesting question became how big the latent space of φ has to be. That question is now essentially answered, and the answers are bad for small vectors. Wagstaff et al. (ICML 2019, JMLR 2022) showed the original "fixed latent dimension suffices" conjecture only holds via pathologically discontinuous φ; with continuous φ you need latent dimension at least N, the maximum set size, and one dimension short of that the model's worst-case error is no better than a constant baseline. Tabaghi & Wang (2023) extended this to sets of vectors: 2ND suffices for identifiable multisets of N points in R^D, O(N^D) in general. Amir et al. (NeurIPS 2023) showed neural (rather than polynomial) moments do give injectivity with an optimal count up to a factor of two. Wang et al. (ICLR 2024) softened the picture — poly(N,D) suffices if you allow two embedding layers — and Zweig & Bruna (NeurIPS 2022) hardened it in another direction, exhibiting a set function that a pairwise-interaction (Relational Network) architecture approximates efficiently but that Deep Sets needs width exponential in N and D to represent. The field's consensus in 2024–26 is that sum-pooling is universal in principle and dimension-hungry in practice, and that most of the useful expressivity comes from arity: how many elements the pre-pooling map is allowed to see at once.

That arity axis is Janossy pooling (Murphy et al., ICLR 2019), which is the single most useful frame this literature offers a TAE program and the one the field itself under-uses. Janossy pooling writes an invariant function as the average of an order-sensitive function over all reorderings, and interpolates by k-ary truncation: k = 1 recovers Deep Sets / bag-of-words, k = n recovers arbitrary sequence functions. Wagstaff et al. explicitly place Deep Sets as "the most efficient incarnation of the Janossy pooling paradigm." A 2025 negative result sharpens it: Reshef & Dym prove no piecewise-linear Janossy pooling function can be injective, which means a ReLU-family transformer composed with a mean cannot be injective on multisets at any width.

The symmetrization side is quieter and less contested. Group averaging over a finite group is a projection onto the invariant subspace — the Reynolds operator — and Elesedy & Zaidi (ICML 2021) made the linear case exact: symmetrization is an orthogonal projection, and the generalisation benefit is precisely the squared norm of the component it deletes. Bloem-Reddy & Teh (JMLR 2020) give the general functional-representation theorem, Puny et al. (ICLR 2022) the cheap approximation (frame averaging over a subset rather than the whole group), and Set Transformer (Lee et al., ICML 2019) the learned alternative — Pooling by Multihead Attention, a weighted rather than uniform average. Nobody in this literature writes about sentences. It does, however, write about the pooling operator explicitly as a Reynolds operator, which corrects an assumption this strand was written under. Sannai, Kawano & Kumagai (2021) build reductive Reynolds operators as network layers and show the interesting design variable is which subset of the group you average over — the Janossy-arity axis reached from group theory — and Talhi, Wolf & Monod (Feb 2026) prove the sharp version for readouts: every linear permutation-invariant readout, sum and mean pooling included, factors through the Reynolds operator and projects onto the fixed subspace of the permutation action, erasing all non-trivial symmetry-aware components whatever the encoder does. Xu et al.'s GIN result (ICLR 2019) adds the aggregator-specific half of the same picture from the expressivity side: mean pooling sees only the proportions of element types, so it cannot distinguish multisets with identical distributions — a strictly weaker operation than the sums every Deep-Sets bound above is stated for.

The NLP side arrived at the same facts empirically and without the vocabulary. Arora, Liang & Ma's SIF baseline (ICLR 2017) showed weighted averaging beats trained recurrent encoders on STS; Wieting & Kiela (ICLR 2019) showed random-parameter encoders over pretrained word vectors close most of the remaining gap; SBERT's pooling ablation (Reimers & Gurevych, EMNLP 2019) found MEAN beats CLS and MAX, which is why almost every encoder since — SONAR included — mean-pools. The order question was raised by Conneau et al. (ACL 2018): static averaging sits at ~51% on bigram-shift, i.e. exactly chance, while contextual encoders are well above. Arora et al.'s DisC (ICLR 2018) explained why averaging is not as lossy as it looks — the bag-of-words is recoverable from the sum by compressed sensing — and Lee et al. (ECAI 2020) closed the loop: concatenating unigram, bigram and trigram averages reconstructs 97.9% of test sentences exactly, against 0.0% for an LSTM autoencoder. That is a k = 3 Janossy pooling, and it demonstrates that word order can be exactly recoverable from a purely order-blind statistic of local n-grams. The remaining contested question is behavioural, not mathematical: Sinha et al. (EMNLP 2021), Pham et al. (Findings ACL 2021) and Hessel & Schofield (ACL 2021) argue models barely use order (75–90% of BERT GLUE predictions survive shuffling; QNLI drops 4%); Ravishankar et al. (ACL 2022) push back, showing shuffled-pretrained LMs still retain naturalistic order information and that many non-GLUE tasks genuinely need it. Both camps agree the information is present; they disagree about whether anything reads it. That is the same present-but-unread structure the host program measures.

The settled part is the equivalence at the bottom: a probabilistic model of a source is a lossless compressor of it, and conversely (Delétang et al.). That makes "how much information is in z" answerable in principle by measuring how many bits of a sentence a decoder conditioned on z no longer has to pay for. Everything contested sits one level up: which bits, measured how, and whether the number means anything.

The information-bottleneck programme (Tishby, Pereira & Bialek 1999) supplied the vocabulary — minimise I(X;Z) subject to preserving I(Z;Y), a generalisation of rate–distortion solved by a Blahut–Arimoto-style iteration — and then largely broke as an explanation of deep learning. Saxe et al. (ICLR 2018) showed the celebrated "compression phase" is an artefact of double-saturating nonlinearities (tanh compresses, ReLU does not), that networks which never compress still generalise, and that full-batch GD reproduces the effect, killing the SGD-diffusion story. What survived is the rate–distortion framing itself, and Alemi et al.'s "Fixing a Broken ELBO" is the version that matters for autoencoders: models with identical ELBO occupy different points on an (R, D) curve, and the curve depends entirely on which distortion you chose. This is the single most useful import for a TAE: verbatim-token distortion and semantic-similarity distortion give two different curves over the same latent, and a "capacity knee" is a statement about one of them, not about the vector.

The probing side had its own reckoning. Voita & Titov reframed probing as description length of the labels given the representation, which prices in probe complexity and data efficiency; Pimentel et al. then argued that if probing estimates mutual information, you should use the strongest probe, and — more damagingly — that I(sentence; property) is a constant fixed by the text, not a property of the encoder, so the naive question is ill-posed. The resolution the field converged on is Xu et al.'s V-information: information is only meaningful relative to a computationally restricted family V, and V-information (unlike Shannon MI) can be created by computation. Ethayarajh et al. turned this into a working instrument (PVI) and won an ICML outstanding paper for it. The practical upshot: any "bits in z" number must name its V. And there is a hard statistical barrier underneath — McAllester & Stratos prove that a distribution-free, high-confidence lower bound on MI from N samples cannot exceed O(ln N). Large bit counts can be upper bounds or model-relative V-information; they cannot be distribution-free lower bounds.

Where the field genuinely moved in 2024–26 is capacity numbers. Allen-Zhu & Li put language-model knowledge storage at a strikingly stable 2 bits per parameter, robust to int8 quantisation, architecture and MoE sparsity. Morris et al. (2025), using a Kolmogorov-flavoured decomposition of memorisation into "unintended memorisation" and generalisation, measured ≈3.6 bits per parameter for GPT-style models and showed grokking begins exactly when capacity fills. Kuratov et al. (ACL 2025, oral) attacked the object this review cares about directly — how much text fits in one input vector — and found a single Llama-3.1-8B vector can be optimised to decode 1,568 tokens (≈4,865 bits of information gain), with capacity scaling near-linearly in the number of vectors and, crucially, depending on the decoder rather than the dimension alone.

And the headline result: Weller et al. (ICLR 2026) proved that a d-dimensional single-vector embedding cannot realise all top-k relevance patterns over n documents once C(n,k) exceeds (1+1/γ)^d, then demonstrated it empirically — free-optimised embeddings break at n=10 for d=4 and n=626 for d=45, and their cubic fit extrapolates a 1024-d embedding to roughly 4 million documents. On their LIMIT dataset (50k docs, 1k queries, k=2), frontier embedders score ~5–19% recall@100 while BM25 gets ~98%. This is the first hard, non-vacuous dimension bound on exactly the kind of object a SONAR latent is, and it is now the reference point everyone else in this strand gets compared against.

Three literatures that grew up separately have collided in 2024–2026, and the collision is exactly where this program's null sits.

The first is VSA. Its representational side is settled: binding by tensor product (Smolensky 1990), circular convolution (Plate 1995), random matrices (MBAT), or permutation are inter-derivable, and Frady, Kleyko & Sommer's unified theory shows the retrieval-accuracy curves are universal across VSA models — an SNR of √(d/M) and a channel capacity near half a bit per neuron. What is not settled, and matters here, is what happens at the tail. The program observes unbind quality ~.72 at 2 items decaying to a ~.4 floor at depth 6, where uniform theory says .408 at N=6 and keeps falling to ~.35 at N=8. The literature is unambiguous on the theory side and it does not support a floor: Teeters, Kleyko, Kanerva & Olshausen (2023) state flatly that for a superposition vector "the probability of a component ... matching the corresponding bit in the value is reduced as more key-value pairs are superimposed, and there is no way to improve the probability" — monotone decay, no plateau, which is precisely why they argue working memory must be offloaded to a Sparse Distributed Memory whose capacity is decoupled from vector width. A 2026 preprint (Borobia et al.) sharpens the same point from the other direction: linear readout of a superposition has a worst-case crosstalk floor of Ω(d^−1/2) and Ω(s/d) per-coordinate error at quadratic load, while thresholded recovery keeps near-quadratic capacity — i.e. floors are a property of the readout, not of the code. So the program's observed floor is either (a) an artefact of the readout metric, (b) non-uniform amplitudes (Frady's λ-attenuation / recency operators), (c) chunking, or (d) — the option the literature does not name but which follows from one line of algebra — a codebook that is not quasi-orthogonal. See "What this strand implies" for the derivation; it fits the program's numbers better than chunking does.

The second literature is the binding problem itself, and its lesson is that "binding" is not one thing. Feldman (2013) decomposes it into four problems — general coordination, visual feature binding, variable binding, and subjective unity — with different computational requirements, and argues that only some have neural solutions. Neuroscience never reached consensus: von der Malsburg's temporal-correlation programme sat opposite Riesenhuber & Poggio's argument (Neuron 24(1):87–93, doi:10.1016/S0896-6273(00)80824-7) that hierarchical feed-forward models with conjunction-coding units are not in fact bound by the binding problem. Greff, van Steenkiste & Schmidhuber (2020) ported the framing to ANNs as segregation → representation → composition, and it remains the standard citation for "networks lack dynamic flexible binding". Nobody in that lineage claims a pooled sentence vector should support abstract role binding; several of them predict it should not.

The third is the compositionality debate, which has genuinely moved. Fodor & Pylyshyn (1988) demanded systematicity; Smolensky (1990) answered with tensor products, and the Microsoft/JHU line (Smolensky et al., AI Magazine 2022) still argues TPRs are the required bridge. But in 2025 the opposing camp published a joint revisionist statement: Griffiths, Lake, McCoy, Pavlick & Webb, Whither symbols in the era of advanced neural networks?, argue modern networks already exhibit the capacities the symbolic argument said required symbols, and relegate symbolic structure to characterising the problem rather than implementing the solution. Notably McCoy — first author of TPDN — is on that paper. The field's centre of gravity has moved from "do nets compose?" to "which substrate, and how partially?"

The most decision-relevant development is the mechanistic LLM-binding line, and it has quietly undercut its own strongest claim. Feng & Steinhardt (ICLR 2024) found "binding ID vectors" attached additively to entities and attributes across Pythia and LLaMA. Dai, Heinzerling & Inui (2024) then showed the causally efficacious subspace is an Ordering ID — it encodes the order of entity and attribute, not an abstract binding token. Gur-Arieh, Geva & Geiger (2025/ICLR 2026) showed the positional mechanism degrades in middle positions as entity count grows, and that models patch the gap with a lexical mechanism (retrieve by bound counterpart) and a reflexive pointer; their three-mechanism causal model reaches 95% agreement with next-token distributions over nine models and ten tasks. Read together: what LLMs have is position + content-keyed retrieval with graceful fallback, not an abstract role variable.

The compositional-generalization literature has had two lives. Its first (2018–2021) was a demolition phase: SCAN showed seq2seq RNNs at near-0% on a held-out primitive, COGS showed Transformers falling from 96–99% in-distribution to 16–35% on structural generalization, CFQ built a distribution-based methodology (maximum compound divergence) that made the gap tunable. Its second life has been a sustained methodological retreat. Csordás, Irie & Schmidhuber (EMNLP 2021) showed that much of the apparent failure was hyperparameter and early-stopping artefact — relative position embeddings alone take SCAN's length split to 100% at cutoff 26, and COGS goes 35%→81% with no architectural change. Wu, Manning & Potts (TACL 2023) went further: a large share of COGS failure is caused by incidental notation in the target logical form rather than by semantic interpretation, and their ReCOGS re-serialisation makes baselines substantially better while remaining hard. The honest 2026 position is that these benchmarks measure something real but that "model X fails SCAN" is no longer a publishable claim without an ablation over the trivia.

Meanwhile Hupkes et al. (JAIR 2020) settled the definitional fight by refusing to settle it: they split compositionality into five separable tests (systematicity, productivity, substitutivity, localism, overgeneralisation) and showed architectures dissociate across them. This matters enormously for reading any null: a model can be systematic and non-productive, or local and non-substitutive. The host program's null is a systematicity + substitutivity result (recombination across construction and vocabulary), not a productivity result.

The measurement-of-representations sub-literature is smaller and, quietly, in worse shape. Andreas's TRE (ICLR 2019) is still the reference metric but it requires you to supply the derivation and the composition operator, so it scores the fit of your hypothesis, not the representation. Murty et al.'s tree projections give a parameter-free tree-structuredness score for transformers and show tree-likeness increasing over training and correlating with compositional generalization. The sharpest negative result is Chaabouni et al. (ACL 2020): in emergent communication, topographic similarity — the field's standard compositionality-of-representation measure — does not predict generalization. More compositional codes are easier to transmit to new learners, but compositionality and generalization dissociate. Any measure the TAE program reports must survive that objection.

The most program-relevant body of work is the bag-of-words line, and it is where the field is currently most contested. Yuksekgonul et al. (ICLR 2023 oral) showed CLIP at 59% on Visual Genome Relation (chance 50) and 46% on COCO Order (chance 20) — a model that wins retrieval benchmarks while being near-blind to who-did-what-to-whom. Winoground (CVPR 2022) put SOTA VLMs below the 16.67% chance group score. But both have taken heavy fire. Diwan et al. (EMNLP 2022) annotated Winoground and concluded that solving it requires commonsense reasoning, locating tiny objects and visual-textual fusion — that compositional language understanding is not the binding constraint, and with only 400 examples the benchmark cannot support the claim it is used for. Hsieh et al. (NeurIPS 2023) landed the harder blow: blind, text-only models beat CLIP on 9 of 10 existing compositionality tasks (Vera scores 70.8% on ARO-Swap against CLIP's 21–32%), because the automatically generated hard negatives are implausible or ungrammatical rather than compositionally wrong. On their debiased SugarCrepe, NegCLIP's apparent 94.5% on swap negatives falls to 76.2%. Udandarao et al. (2025, preprint) then showed SugarCrepe itself retains distribution asymmetries that simple heuristics exploit across 17 benchmarks. The lesson for anyone publishing a bag-of-words-style null in 2026 is not that the finding was wrong — CLIP really is weak at relations — but that the benchmark, not the model, is the default suspect, and a null survives only if it comes with a control showing the task is unsolvable by surface cues and a power check showing the effect would have been detected.

The text-side analogues are more robust precisely because they are more controlled. Sinha et al. (ACL 2021) showed NLI models assign the same label to word-scrambled premises across English and Mandarin. Weller et al.'s NevIR (EACL 2024) found most neural retrievers at or below random ranking on document pairs differing only in negation, reproduced at SIGIR 2025 with the finding that fine-tuning on one negation dataset does not transfer to another. Nikolaev & Padó (EACL 2023) found sentence-transformer cosine similarity is driven 3–4× more by shared nouns than by shared predicates, and that thematic roles are ignored once noun overlap is controlled.

The founding result of this strand is now eight years old and has not been overturned: a single fixed-size sentence vector reliably carries length, lexical content, and a surprising amount of recoverable surface information, and carries abstract predicate-argument structure badly or not at all. Adi et al. (2017) established the frame — length, word content, word order as three separable auxiliary tasks — and Conneau et al. (2018) scaled it to ten probing tasks across eight training objectives, showing among other things that bag-of-vectors baselines beat sophisticated encoders on content-style probes while every encoder struggles on structural ones. The 2019–2022 encoder boom (SBERT, SimCSE, Sentence-T5/GTR, E5/BGE/GTE, INSTRUCTOR) improved benchmark numbers enormously without disturbing that picture, because it optimised a different quantity: Wang & Isola's alignment/uniformity decomposition explains what contrastive training does to the space (collapse positives, spread the rest on the hypersphere) and conspicuously says nothing about structure. MTEB's own headline finding — no method dominates across tasks — is best read as evidence that these models are not converging on a single latent notion of "meaning".

The sharpest content claim of the last four years is Nikolaev & Padó's (EACL 2023): sentence transformers have a nominal-participant-set bias. Cosine similarity between two sentences is governed by the overlap of their noun participants far more than by shared predicates, modifiers or adjuncts — and, critically, "the precise syntactic-thematic functions of the participants are largely irrelevant." That is, published in 2023 and on SBERT-class encoders, essentially the same claim as this program's certified thematic-role-binding null. It is the single most important predecessor in this strand, and the program is not n=1 on the phenomenon, only on SONAR. Zhang et al. (EMNLP Findings 2023) corroborated from the evaluation side: text embedding models fail at syntactic structural generalisation and standard benchmarks do not expose the failure. Nikolaev & Padó's own follow-up (Investigating semantic subspaces of Transformer sentence embeddings through linear structural probing, BlackboxNLP 2023, arXiv:2310.11923 — VERIFIED) adds that the semantic-subspace picture differs substantially across encoder-only, decoder-only and encoder–decoder families but is "largely model-size invariant" — i.e. the deficit is architectural and objective-driven, not a scale problem you can wait out.

Against this sits a genuinely opposed camp. Nastase & Merlo (2024) report that sentence embeddings do decompose into identifiable structural parts, hitting F1 ≈ 0.997–0.9992 on discriminating chunk patterns from a compressed 5-d latent, and localising agreement information to specific latent units. Opitz & Frank's S³BERT (AACL 2022) showed you can train sub-embeddings that carry semantic roles, negation and quantification while preserving SBERT performance — i.e. the information is available to a supervised decomposition even if the vanilla space does not organise by it. Tehenan et al. (2025), with Opitz, push this mechanistically: dictionary learning on token-level representations plus an account of how pooling compresses them, concluding that "many semantic and syntactic aspects are linearly encoded". The disagreement is real but resolvable, and the resolution is the program's own: Nastase & Merlo's 0.997 is within-template discrimination over a controlled vocabulary — exactly the regime where the program also gets AUC .997 — while Nikolaev & Padó's null is across construction and vocabulary. Decodability is not abstraction; both camps are measuring correctly, on different quantities.

The 2025–26 movement is toward vocabulary projection and dimension-level forensics. Ram et al. (ACL 2023) started it by projecting dual-encoder vectors into vocabulary space and finding "rich semantic information" — dense retrieval as a distribution over tokens. FLiP (Kesiraju et al., Interspeech 2026) is the mature form and the centrepiece of this strand: a rank-factorised linear map from a frozen sentence embedding to a bag-of-words logit vector, recovering 77.29% of English SONAR text lexical content and 74.09% for SONAR speech, against 59.45%/57.27% for the non-factorised baseline and 29.58% for SpLiCE. That number is independent confirmation of the program's ~75% token-ID figure, obtained by different authors on different data with a different estimator. Alongside it, SONAR-specific work has finally appeared from outside: SPARTA (2025) reports a single SONAR coordinate correlating r = −0.956 with token length; Allesiardo et al. (LREC 2026) find dimensions whose perturbation-sensitivity predicts decoding anomalies; and a LessWrong writeup (Hawthorne & Nellessen, 2025) reports near-parallel English→Spanish translation vectors and position-shift vectors that work only for fixed filler contexts. The field's uncomfortable open question, sharpened by Nastase & Merlo (2025), is whether cosine geometry tracks any of it — they find [CLS] and mean-pooled representations that are nearly orthogonal yet perform identically on 216 linguistic tasks.

Probing began as a convenience — Alain & Bengio's linear classifier probes, then Conneau-style sentence-embedding probing tasks — and spent 2019–2022 being systematically dismantled from four directions at once. The field has not converged. It has instead settled into a stable set of mutually incompatible positions, and which one you adopt determines whether a null is publishable at all.

The first fracture is over probe capacity, and it is a genuine, unresolved disagreement between named parties. Hewitt & Liang (EMNLP 2019) argue for simple, selective probes: pair every linguistic task with a control task of random labels, and report selectivity (task accuracy minus control accuracy). Their finding — that popular ELMo probes are not selective, and that dropout does not control MLP probe complexity — became the field's default hygiene requirement. Pimentel, Valvoda, Hall Maudslay, Zmigrod, Williams & Cotterell (ACL 2020) argue the exact opposite: because a representation is a deterministic function of the sentence, mutual information between a linguistic property and the representation is upper-bounded by the information in the sentence itself, so probing cannot in principle measure "presence." It measures ease of extraction, and if you want a tight estimate you should "always select the highest performing probe you can, even if it is more complex." Voita & Titov (EMNLP 2019) and Pimentel & Cotterell (EMNLP 2021) split the difference by changing the quantity: report minimum description length (variational or online codelength), or Bayesian mutual information, so that "how hard was this to extract" is measured rather than argued about. Pimentel et al.'s own Pareto Probing (EMNLP 2020) then makes the trade-off explicit as a hypervolume, and reports the uncomfortable consequence that non-contextual fastText appears to encode more morpho-syntax than BERT on POS and dependency-arc labelling — a result Immer, Torroba Hennigen, Fortuin & Cotterell (ACL 2022) reproduce under a Bayesian inductive-bias framing.

The second fracture is over what a probe's success means for the model. Ravichander, Belinkov & Hovy (EACL 2021) show models encode properties they demonstrably do not need, and — devastatingly — that probes exceed chance even when the property is distributed in the data as random noise. Elazar, Ravfogel, Jacovi & Goldberg (TACL 2021) show conventional probing performance is not correlated with task importance, and propose amnesic probing: erase the property with INLP, then measure the effect on behaviour. Antverg & Belinkov (ICLR 2022) show the standard neuron-ranking pipeline conflates probe quality with ranking quality. Lovering, Jha, Linzen & Pavlick (ICLR 2021) offer the constructive version: extractability plus evidence during fine-tuning predicts use.

The third fracture is over erasure as a measuring stick. INLP (ACL 2020), RLACE (ICML 2022) and LEACE (NeurIPS 2023) make linear concept removal tractable, closed-form and provably complete against linear adversaries. But Ravfogel, Vargas, Goldberg & Cotterell (EMNLP 2022) show kernelised erasure does not transfer between nonlinear adversaries; Ravfogel, Goldberg & Cotterell (ACL 2023) show that binary log-linear guardedness can be broken by a multiclass log-linear model; and Kumar, Tan & Sharma (NeurIPS 2022) prove that even when concept features alone would suffice for perfect accuracy, the probe will likely exploit non-concept features instead — so probe-based removal fails in both directions.

The fourth is causal. Geiger et al. (NeurIPS 2021; CLeaR 2024) replace correlational probing with causal abstraction and interchange interventions; Boundless DAS (NeurIPS 2023) scales it. Where the field moved in 2024–2026 is self-criticism of this move: Makelov, Lange & Nanda show subspace activation patching can appear to manipulate a feature while activating dormant pathways, and Canby, Davies, Rastogi & Hockenmaier (IJCNLP-AACL 2025) show an inherent completeness/selectivity trade-off across all causal-probing families, with nullifying (INLP-style) interventions far less complete than counterfactual ones.

What is conspicuously absent from all of this: any accepted protocol for publishing a probing null. Card, Henderson, Khandelwal, Jia, Mahowald & Jurafsky (EMNLP 2020) established that underpowered NLP experiments are the norm, and NLP still does not routinely use the tools the biomedical and psychological literatures use for evidence-of-absence — equivalence testing, Bayes factors, or pre-registered smallest-effect-of-interest bounds. The program's planted-effect check is a step into that vacuum.

The founding result is settled and has been independently reproduced: a fixed-size sentence vector retains enough information to reconstruct short text verbatim. Morris et al.'s vec2text recovers 92.0% of 32-token Wikipedia passages exactly from GTR-base embeddings (BLEU 97.3, token-F1 99), and Seputis et al.'s RecSys-2025 reproducibility study measured 94.0% / BLEU 98.5 on the same setup. Nobody disputes that a 768–1536-d vector is a near-lossless code for ~32 tokens of English.

What is contested is everything about the shape of the curve beyond that point, and the field moved sharply on this in 2025–26. The original paper's headline degradation — 60.9% exact at 32 tokens falling to 8.0% at 128 tokens on OpenAI ada-002 — is real but is not a clean measurement of embedding capacity, because those two numbers come from two different inverter models, each trained at its own target length. Seputis et al. could not obtain the 32-token checkpoint and so ran the 128-token inverter on 32-token text: exact-match collapsed from the reported 60.9% to 4.8%, while the same inverter at its native ~81-token length still scored 8.1%. Holding the attacker fixed, exact-match is therefore not monotone decreasing in length. Their conclusion — "the model is sensitive to the length of the input text", meaning the training length — reframes the degradation curve as a joint property of the embedding and the inverter's training distribution. The same study also found the original out-of-domain BEIR numbers optimistic (BioASQ BLEU 22.8 → 8.6, NQ 32.7 → 14.7 on reproduction), attributing the gap to undocumented checkpoint versions and evaluation samples as small as n=90.

The second movement is a collapse in the attacker's cost. vec2text needed millions of training pairs, an encoder-specific inverter, and up to 50 re-embedding queries per example. ALGEN (Chen, Xu & Bjerva, ACL 2025) showed that sentence-embedding spaces are near-isomorphic enough that a single one-step linear alignment from ~1,000 leaked pairs transfers a shared generator across encoders (ROUGE-L 38.3–45.8, cosine 0.89–0.95); LAGO adds graph-structured language similarity for 10–20% ROUGE-L over ALGEN with as few as 10 samples per language; ZSInvert (Zhang, Morris & Shmatikov) removes per-encoder training entirely; and Zero2Text (2026) removes leaked pairs entirely, using an LLM prior plus online ridge regression against black-box API queries. The trajectory is monotone: the information is in the vector, and every year less attacker knowledge is needed to get at it.

The third movement — and the most important one for anyone hoping a latent is private by construction — is that defences do not survive contact with adaptive attackers. Gaussian noise at λ=0.01 looked excellent in 2023 (retrieval nDCG@10 0.302 → 0.296, reconstruction BLEU 80.4 → 10.3 on GTR-base). Chen, Lent & Bjerva then showed the same λ leaves multilingual e5 retaining over 70% of its original BLEU where monolingual GTR falls to 16% — English-calibrated defences do not transfer. ALGEN reports that WET and shuffling have minimal effect and that DP at ε=12 preserves >25% of un-defended inversion quality. Wang et al.'s denoising-aware inverter (ICDM 2026) recovers ~154% relative BLEU over prior baselines on noise-protected embeddings by training a denoiser with Stein's unbiased risk estimator. DeepInvert (2026) breaks nine obfuscation defences and states the governing trade-off plainly: schemes that preserve enough signal for utility retain enough structure for inversion, and schemes that resist inversion collapse utility. The live counter-position comes from learned, non-additive defences — Eguard (AAAI-26) claims >95% of tokens protected at no downstream cost, SPARSE applies concept-targeted elliptical noise, TextCrafter learns noise direction by RL — none of which has yet been independently attacked. Cheap 8-bit quantisation is the dark-horse defence (BLEU 63.1 → 20.7 at unchanged nDCG@10), also untested adaptively.

Two structural facts run underneath all of this. First, bag-of-words survives far longer than word order: across BEIR, as mean length goes 15.7 → 128 tokens, vec2text BLEU falls 95.5 → 14.5 (−85%) while token-F1 falls only 98.6 → 51.5 (−48%). Second, the length wall is a pooling wall, not a representation wall: Dong et al. invert a 4,112-token medical prompt at 86.88 token-F1 from a middle Llama-3 layer — because that state is T×d, not a single pooled vector.

The readout side is settled as a practice and unsettled as a science. Logit lens (nostalgebraist, 2020) established that you can just multiply an intermediate residual by the unembedding and read tokens; Belrose et al.'s tuned lens (2023) showed that this is unreliable in a model-specific way — on several models (BLOOM, OPT-13B) representation drift makes the raw logit lens produce near-noise — and that a learned affine probe per layer is "more predictive, reliable and unbiased." Din et al. (2023) generalised the same move to arbitrary layer-to-layer linear short-cuts. Pal et al.'s Future Lens (CoNLL 2023) pushed readout past the next token, recovering tokens at position ≥ t+2 from a single hidden state at >48% accuracy in the best layers. Patchscopes (Ghandeharioun et al., ICML 2024) reframed all of these as special cases of "paste the state into a prompt and let a model talk about it," and SelfIE (Chen et al., ICML 2024) made the target model interpret its own embeddings. LatentQA (Pan, Chen, Steinhardt) and REMEDI (Hernandez, Li, Andreas) train a decoder explicitly for the job, and Li, Guo, Huang, Steinhardt & Andreas (2025) show that a model fine-tuned to explain its own computations beats a more capable foreign explainer. The trajectory is unmistakable: from a fixed linear map, to a prompted LM, to a trained decoder — each step buying resolution and spending independence.

That is where the second literature bites. The 2025–26 critical wave is specifically about the decoder's own contribution. Millicent Li et al., Do Activation Verbalization Methods Convey Privileged Information? (ICML 2026) run the obvious control that the field had skipped: they show one can score well on standard verbalization benchmarks without access to the target model's internals at all, so verbalizations may reflect the verbalizer's parametric knowledge rather than anything privileged. Gong et al.'s Faithful-Patchscopes (Jan 2026) supply the mechanism and a number: when the patched state encodes a prior-violating attribute (a purple broccoli), the explaining model emits "green," and faithfulness drops 18.84% on average on such biased cases; their fix, BALOR, contrasts unpatched against patched logits — i.e. it estimates the prior and subtracts it. Earlier, Huang et al. (2023) showed that even high-confidence GPT-4 explanations of GPT-2 XL neurons have high error rates observationally and near-zero causal effect, and Paulo et al. (2024) had to invent five new scoring modes, including intervention scoring, because explanation-scoring by simulation is too weak to certify a caption.

The NMT community solved a structurally identical problem a decade earlier and the interp community has largely not read it. Voita, Sennrich & Titov (ACL 2021) decompose each output token's prediction into source contribution versus target-prefix contribution using LRP — literally "how much came from the conditioning vector versus the decoder's own language model." Raunak et al. (NAACL 2021) name the two failure modes, detached and oscillatory hallucinations, and tie source-perturbation hallucination to long-tail memorisation. Guerreiro et al. (EACL 2023) annotate 3,400+ sentences and find prior detectors "largely inadequate." Dale, Voita, Barrault & Costa-jussà (2023) then show that source contribution alone doubles detection accuracy for the most severe hallucinations, and that cross-lingual sentence similarity does better still. Maynez et al. (ACL 2020) had already established for summarisation that all systems hallucinate substantially and that entailment correlates with faithfulness better than any n-gram metric. Du et al. (ACL 2024) give the general information-theoretic version — mutual-information-grounded persuasion and susceptibility scores for context-versus-prior reliance.

The open disagreement is whether a decoded description is evidence about the latent or evidence about the decoder. Ghandeharioun/Chen's camp treats the explainer's capability as a feature (a stronger model reads a weaker one better); Li et al. and Gong et al. treat the same capability as the confound, and demand no-access and prior-only controls. Nobody in either camp has published a fidelity threshold with a certified flip rate, and nobody has published a fail-closed decoder for interpretability. The abstention machinery exists — conformal abstention with finite-sample hallucination-rate guarantees (Abbasi Yadkori et al., 2024), conformal language modeling (Quach et al., ICLR 2024), MT quality-estimation gating — but it has never been bolted onto a latent-readout decoder.