🤖 AI

Entangled by Design: Spurious Intra-Variable Signal Routing in Tabular In-Context Learners

This paper reveals that in-context learners for tabular data inevitably route predictions through spurious signals embedded in composite features rather than true causal signals, a failure that worsens with larger contexts and model expressiveness but can be effectively mitigated by environment-stratified context construction and S-swap augmentation.

Original authors: Athanasios Vlontzos, Giorgos Papanastasiou, Bernhard Kainz, Sotirios Tsaftaris

Published 2026-07-29

📖 8 min read🧠 Deep dive

CC BY 4.0

Original authors: Athanasios Vlontzos, Giorgos Papanastasiou, Bernhard Kainz, Sotirios Tsaftaris

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are trying to teach a robot how to predict the weather. You show it a thousand photos of sunny days, and in every single photo, the sky is blue. The robot learns a simple rule: "Blue sky means sun." But here is the catch: in your training photos, the sky is always blue because you only took pictures during the day. You never showed the robot a single photo of a cloudy night. The robot didn't learn that "sun" causes "blue sky"; it just learned that "blue" and "sun" happen to appear together. If you later show it a photo of a blue sky at night (which is impossible, but let's say the robot sees a blue screen), it might get confused. This is the world of Machine Learning, specifically a clever trick called In-Context Learning. Instead of retraining the robot from scratch every time, you just give it a few examples right before it makes a guess, and it figures out the pattern on the fly. It's like handing a detective a few clues and saying, "Solve this case," without ever changing the detective's brain. But what happens if those clues are misleading? What if the clues point to a suspect who is innocent, just because they happened to be at the scene of the crime in every photo you showed the detective?

This paper investigates a sneaky trap that can fool these smart, flexible robots when they are used for things like predicting patient recovery in hospitals. The researchers found that when a robot sees a mix of "real" information (like a patient's actual health) and "fake" information (like a glitch in the hospital's specific equipment), it often gets tricked. It learns to rely on the glitch because, in the training data, the glitch happened to match the outcome perfectly. The paper proves that simply giving the robot more examples doesn't fix this; in fact, it might make the robot even more stubbornly wrong. However, the authors also discovered a clever, lightweight trick to break this spell, allowing the robot to ignore the glitch and focus on the real health signals, even without knowing exactly what the glitch looks like.

The Detective and the Broken Thermometer

Let's dive into the story. Imagine a hospital where a new AI system is hired to predict how fast patients will recover. The system is shown data from one specific hospital. In this hospital, there is a hidden problem: the thermometers are slightly broken. They always read 2 degrees higher than they should. But here's the twist: the patients who get the "high fever" reading on these broken thermometers also happen to be the ones who recover quickly. Why? Because the broken thermometers are only used in the VIP ward, and VIP patients get better care and recover faster.

The AI, being a super-smart pattern matcher, looks at the data and says, "Aha! High temperature readings mean fast recovery!" It doesn't know about the VIP ward or the broken thermometer. It just sees that Temperature (S) and Recovery (Y) are best friends in the data it was given. So, when it makes a prediction, it routes its decision through the temperature reading. It thinks, "I'll bet on the temperature!"

Now, imagine this AI is sent to a new hospital. This new hospital has brand-new, perfect thermometers. The VIP ward is gone. The link between "high temperature" and "fast recovery" is broken. But the AI is still using its old rule: "High temperature = Fast recovery." Because the new thermometers are accurate, the AI sees normal temperatures for sick patients and predicts they will recover slowly, or it sees high temperatures for healthy patients and predicts they will recover fast. It fails completely, and it fails silently, because it has no way of knowing it was tricked by the broken thermometer in the first place.

The paper calls this "Spurious Routing." The AI is "routing" its decision through a fake signal (the broken thermometer) instead of the real signal (the patient's actual health).

The Trap of Composite Signals

The researchers realized that this isn't just about broken thermometers. It happens whenever a single piece of data is a "bundle" of two things: the Real Signal (the patient's true health) and the Spurious Signal (the equipment glitch). In the math world, they call this a "composite representation."

The paper asks a big question: Can we teach the AI to ignore the glitch? The authors tested two types of AI detectives:

The Linear Detective: A simple, rule-based AI that does basic math (like a very smart spreadsheet).
TabPFN: A super-complex, "state-of-the-art" AI that is like a genius detective who has read every medical book in the world.

They ran thousands of simulations where they controlled exactly how much the "glitch" (S) was mixed with the "real health" (C). They found something surprising and a bit scary: The AI cannot fix this on its own.

Even if you give the AI more and more examples from the first hospital, it doesn't get smarter about the glitch. In fact, the paper shows that giving the AI more context (more examples) actually makes it more committed to the wrong answer. If the glitch was slightly helpful in the training data, the AI will double down on it. The more examples you show it, the more it believes the glitch is the truth.

The authors proved mathematically that as long as the glitch and the outcome are linked in the training data, the AI must use the glitch. It's not a bug; it's a feature of how these models work. They call this "unavoidable spurious routing."

The Magic Trick: The "S-Swap"

So, if the AI is doomed to be tricked, is there any hope? The authors say yes, and they found a solution that is surprisingly simple. They call it "S-swap augmentation."

Imagine you are the detective again. You have a pile of case files. In every file, there is a temperature reading and a recovery time. The files are all from the VIP ward with the broken thermometers.
The "S-swap" trick is like this: You take the temperature reading from File A and swap it with the temperature reading from File B, but you keep the recovery time the same.

File A: "Broken Thermometer says 104°F, Patient recovered fast."
File B: "Broken Thermometer says 98°F, Patient recovered slow."

You swap the temperatures:

File A (Modified): "Broken Thermometer says 98°F, Patient recovered fast."
File B (Modified): "Broken Thermometer says 104°F, Patient recovered slow."

Now, look at the pattern. The temperature no longer predicts the recovery! The high temperature is now paired with a slow recovery, and the low temperature is paired with a fast recovery. The link is broken. The AI looks at this new, swapped data and realizes, "Wait a minute. The temperature doesn't matter at all! It's just noise."

The paper shows that this trick works incredibly well.

For the simple Linear Detective, it reduced the reliance on the glitch by 74%.
For the super-smart TabPFN, it reduced the reliance by a massive 98.8%.

Even better, the AI didn't just become "confused" or "give up." It actually started paying attention to the real health signal. The paper found that the AI's sensitivity to the real cause increased by 8.4 times. It didn't stop learning; it just learned the right thing.

Why This Matters

The researchers tested this on real-world data too, using a dataset of human pancreas cells from different labs. Even though they didn't know exactly which parts of the data were the "glitch" and which were the "real biology," they could estimate the glitch just by looking at how the data varied between labs. When they applied the S-swap trick, the AI's reliance on the lab-specific glitches dropped by nearly 89%.

The paper concludes that we don't need to rebuild these powerful AI models or teach them complex new rules. We just need to be smarter about the examples we show them. By swapping around the "glitchy" parts of the data before the AI makes a guess, we can trick the AI into ignoring the fake signals and focusing on the truth.

It's a reminder that in the world of AI, sometimes the smartest thing you can do isn't to give the robot more data, but to rearrange the data you already have so the robot can't help but see the truth. The paper proves that while these models are powerful, they are also vulnerable to "spurious routing," but with a little bit of clever data mixing, we can guide them back to the right path.

Technical Summary: Entangled by Design: Spurious Intra-Variable Signal Routing in Tabular In-Context Learners

Problem Statement

The paper addresses a critical failure mode in In-Context Learning (ICL) for tabular data, specifically when models are deployed in heterogeneous environments (e.g., different hospitals or experimental batches). The core issue is spurious intra-variable signal routing.

In many real-world scenarios, an observed feature vector $X$ is a composite of a true causal signal $C$ (e.g., patient health) and a spurious signal $S$ (e.g., equipment artifacts or batch effects), often entangled within the same feature space or distinct subspaces: $X = [C; \alpha S; \eta]$ . Within a single environment, an unobserved confounder $U$ (e.g., patient demographics) may drive both the spurious signal $S$ and the outcome $Y$ , creating a non-zero in-context correlation $\text{Corr}(S, Y) \neq 0$ .

Standard ICL models, such as TabPFN or linear ridge estimators, observe only the context examples. They rationally learn to route predictions through $S$ because it is predictive within the context, even though $S$ is non-causal. When deployed to a new environment where the relationship between $S$ and $Y$ changes (due to different equipment or site-specific factors), the model fails silently. This differs from traditional cross-variable spurious correlation problems because the causal and spurious signals are often entangled within a single observed feature vector or distinct subspaces of a composite representation, making them indistinguishable via standard in-context statistics alone.

Methodology

Theoretical Framework

The authors formalize the setting using a Structural Causal Model (SCM) where:

Causal Signal ( $C$ ): Invariant across environments.
Spurious Signal ( $S$ ): Correlated with $Y$ only via a shared confounder $U$ within an environment.
Composite Observation: $X = [C; \alpha S; \eta]$ , where $\alpha$ controls the entanglement strength.

The paper introduces the Causal Sensitivity Ratio (CSR) as a diagnostic metric to quantify routing behavior:
$\text{CSR}(w) := \frac{\mathbb{E}[|w_S \alpha \Delta S|]}{\mathbb{E}[|w_C \Delta C|]}$
where $\Delta S$ and $\Delta C$ represent perturbations (swaps) of the spurious and causal components, respectively.

$\text{CSR} \approx 0$ : The model routes through the causal signal.
$\text{CSR} > 1$ : The model is more sensitive to the spurious signal than the causal one (failure regime).

Theoretical Analysis

The authors derive a closed-form characterization for the population CSR under ridge ICL (linear in-context learning):
$\text{CSR}_{\text{pop}} = \underbrace{\frac{\alpha^2}{\alpha^2 + \lambda}}_{\text{entanglement}} \cdot \underbrace{\frac{\rho_S}{\rho_C}}_{\text{signal ratio}} \cdot \underbrace{(1 + \lambda)\kappa(\delta)}_{\text{protocol constant}}$
Key theoretical findings include:

Unavoidability: Under in-context confounding ( $\rho_S \neq 0$ ), spurious routing is unavoidable for any regularization strength $\lambda > 0$ .
Context Size: Larger context sizes do not resolve the issue; in high-spurious regimes, they can amplify commitment to the spurious signal by up to $1.74\times$ .
Identifiability: Routing is unidentifiable if $C$ and $S$ share a single scalar coordinate ( $D=1$ ); distinct subspaces are required for diagnosis.

Mitigation Strategies

The paper proposes two lightweight, model-agnostic interventions that operate at the context construction level, requiring only weak environment labels (e.g., batch IDs) and no knowledge of the causal partition:

Environment-Stratified Context Construction: Sampling context examples from different environments to mix distributions of $S$ while holding $Y$ levels constant, reducing in-context $\text{Corr}(S, Y)$ .
S-swap Augmentation: For each context point $(X_i, Y_i)$ , a paired copy $(\tilde{X}_i, Y_i)$ is added where the spurious dimensions of $X_i$ are replaced with those from a different environment. This signals to the model at the point level that $S$ does not predict $Y$ .

Key Results

Empirical Validation

The authors validated their theory on both linear ICL (ridge regression) and TabPFN (a state-of-the-art pretrained tabular transformer) using a controlled structural causal model.

Correlation with Theory: The empirical CSR strongly correlates with the theoretical predictor $\hat{\rho}_S / \hat{\rho}_C$ ( $r=0.997$ for linear ICL, $r=0.979$ for TabPFN).
Amplification Effects:
- Increasing context size ( $n$ ) from 16 to 512 amplified spurious routing by $1.74\times$ in high-spurious regimes.
- More expressive models (TabPFN) showed greater vulnerability than linear ICL in high-entanglement corners (a $+2.22$ CSR gap), though they were more responsive to mitigations.
Robustness: The theoretical predictions held even with subspace overlap (up to $40^\circ$ rotation), with correlation dropping only slightly ( $r \geq 0.93$ ).

Mitigation Performance

Linear ICL: S-swap reduced CSR by 74% and improved Out-of-Distribution (OOD) RMSE by 34.2%.
TabPFN: S-swap reduced CSR by 98.8% (from 5.777 to 0.067). Crucially, the model did not become agnostic; it rerouted through the causal signal, increasing causal sensitivity by 8.4 $\times$ .
Real-World Validation: On the scIB pancreas dataset (single-cell genomics), S-swap reduced CSR by 88.9% using only estimated spurious subspaces derived from batch structure, confirming applicability without ground-truth causal labels.

Significance and Claims

The paper claims to identify and formalize a specific failure mode of in-context learning that is distinct from cross-variable spurious correlations. Its primary contributions are:

Theoretical Proof of Impossibility: Demonstrating that standard regularization cannot eliminate spurious routing in composite representations when in-context confounding exists.
Diagnostic Metric: Introducing the CSR as a robust, perturbation-based diagnostic that quantifies routing behavior even when causal partitions are latent.
Model-Agnostic Solution: Proposing S-swap augmentation, a context-level intervention that effectively forces ICL models to ignore spurious signals and rely on causal ones without requiring model retraining, architectural changes, or access to the causal partition.
Paradoxical Expressivity: Highlighting that while more expressive models (like TabPFN) are more vulnerable to spurious routing in high-spurious regimes, their capacity also allows them to respond more dramatically to invariance signals (like S-swap), leading to superior recovery compared to linear baselines.

The authors position this work as a necessary correction for the deployment of ICL in scientific and biomedical domains, where data heterogeneity is the norm and silent failures due to dataset shift are critical risks.