🤖 machine learning

Architecture-Dependent Causal Transfer of Activation States Across Large Language Models

This paper demonstrates that while internal activation states can be projected between different large language model architectures with measurable representational alignment, successful end-to-end causal transfer of these states during generation is strictly architecture-dependent, working reliably only for specific decoder-only pairs rather than serving as a universal mechanism.

Original authors: Fernando Cardenas Piepereit

Published 2026-08-18

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Fernando Cardenas Piepereit

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine two people trying to talk to each other, but they are forced to speak through a translator who speaks a third language. The first person whispers a thought, the translator writes it down, the second person reads it, and then the translator writes a reply. This process takes time, costs money, and risks losing the original meaning in the translation. Today, artificial intelligence systems communicate in exactly this way. When one computer program needs to send information to another, it converts its internal thoughts into human-readable text, sends that text, and the receiving program reads it and converts it back into its own internal thoughts. This middle layer of text is the only way they currently know how to talk. But what if they could skip the text entirely? What if one machine could simply hand its internal state directly to another, like passing a note without ever writing it down? This is the question researchers set out to answer: can different types of artificial intelligence, built by different companies and trained on different data, understand each other's internal signals without needing to translate them into words first?

To understand the experiment, it helps to know that these programs, known as large language models, do not think in words the way humans do. Instead, they process information as vast, shifting patterns of numbers called activation states. You can think of these patterns as the specific electrical firing of a brain at a single moment. When a model reads a question, a unique pattern of activity lights up inside it. The researcher wanted to know if the pattern for a specific idea in one model looked similar enough to the pattern for the same idea in a different model that a bridge could be built between them. If the patterns were similar enough, a computer could learn to translate the first model's internal signal directly into the second model's internal signal, bypassing the need for text entirely.

A researcher set out to test this idea using four different artificial intelligence models. These models were chosen carefully to represent different families of technology and different training histories. Three of them were built to generate text one word at a time, while the fourth was built to understand text from both directions at once. The researcher first checked if the internal patterns of these models were even similar enough to be compared. They looked at how the models reacted to pairs of related concepts, such as words that are synonyms or words that are often found together in books. They found that for the three models built in the same way, the internal patterns were indeed similar. However, the model built differently showed no such similarity. This suggested that the way a model is built matters more than who built it or what data it was trained on.

Next, the researcher tried to build a bridge. They trained a small, simple computer program to act as a translator, learning how to convert the internal signal from one model into the internal signal of another. They tested this bridge by showing it a question, converting the first model's reaction to that question, and seeing if the second model could recognize it as the correct answer among a list of twenty possibilities. For the three models that were built similarly, this bridge worked surprisingly well. The second model correctly identified the source of the signal about half the time, which is far better than random guessing. But for the model built differently, the bridge failed completely; the second model could not recognize the signal at all. This confirmed that while a translation layer is possible, it only works between models that share a specific architectural family.

The final and most difficult test was to see if this translation could actually change the behavior of the receiving model in real time. The researcher took the translated signal from the first model and injected it directly into the second model while it was in the middle of writing a new answer. They wanted to see if this injection would steer the second model's output toward the topic of the original question. The results were mixed and revealed a crucial limitation. When they tried this between two specific models, the injection worked. The second model's output shifted noticeably toward the topic of the first model's question, proving that the signal had been received and had a causal effect. However, when they tried the same trick with a third model, it failed completely. Even though the internal patterns looked similar on paper, injecting the signal did not change the output at all.

The researcher concluded that while it is possible to transfer the physical carrier of a thought—the specific pattern of electrical activity—from one machine to another, this does not mean the machines are sharing a deep understanding or a common meaning. In the successful cases, the second model did not necessarily give the correct answer to the original question. Instead, it produced text that was thematically related, like talking about triangles when the original question was about squares. The signal was transferred, but the meaning was not perfectly preserved. The study shows that direct communication between artificial intelligences is technically possible, but it is not a universal language. It depends entirely on the specific design of the machines involved. If the designs do not match, the signal cannot be understood, and the transfer fails. This means that in the future, if we want different AI systems to talk directly to each other, we cannot assume they will just work; we must ensure they are built in compatible ways, or we will need to build a specific translator for every single pair of systems we want to connect.

Technical Summary: Architecture-Dependent Causal Transfer of Activation States Across Large Language Models

Problem Statement
Current inter-AI communication relies exclusively on natural language as an intermediate layer, incurring encoding/decoding overhead, token costs, and latency. This paper investigates whether internal activation states can be transferred causally between different Large Language Model (LLM) architectures via a learned projection, bypassing the natural language layer. The central empirical question is whether independently trained LLMs encode information in representational spaces sufficiently similar to support a learned mapping that can causally alter a target model's behavior.

Methodology
The study employs a three-stage experimental pipeline across four open-weight models: Qwen2-0.5B, Phi-3-mini, Mistral-7B (all causal decoder-only), and FLAN-T5-base (bidirectional encoder-decoder). The experiments are pre-registered with fixed success criteria and utilize Benjamini–Hochberg False Discovery Rate (FDR) correction for statistical testing.

Representational Similarity Analysis:
- Data: 12 "RELATED" concept pairs (topically linked, lexically dissimilar) and 12 "SYNONYM" pairs (semantically identical, lexically dissimilar).
- Metrics: Centered Kernel Alignment (CKA), Orthogonal Procrustes analysis, and Mutual $k$ -Nearest-Neighbour ( $k$ -NN) alignment.
- Controls: Random-initialization null baselines (computed for Qwen2/FLAN-T5 due to memory constraints) and a lexical-triviality control (SYNONYM pairs) to distinguish shared surface tokens from true semantic alignment.
- Observation: Mean-pooling excluded position 0 for causal models to avoid "attention sink" artifacts where early tokens dominate pooled vectors.
Cross-Model Projection Network:
- A Multi-Layer Perceptron (MLP) was trained to map hidden states from a source model (middle layer, fraction 0.5) to a target model's hidden state space.
- Evaluation: Top-1 retrieval accuracy on a held-out set of 20 questions (chance level = 5%).
- Baseline: An untrained MLP with random weights was used to isolate the contribution of learned weights.
End-to-End Causal State Transfer:
- Mechanism: Projected activation vectors from a source model were injected into a target model during generation. To avoid tensor-reshape errors associated with manual position-ID construction, the author implemented a full re-computation of the sequence through the embedding and transformer layers at each step, replacing the hidden state at the last prompt position with the projected vector.
- Conditions: Real injection (projected source state) vs. Negative control (projected state of a "wrong" question).
- Success Criterion: The target model's generated output (pooled vector) must have the true source question as its nearest neighbor significantly more often than the negative control (McNemar's test).

Key Results

Representational Alignment:
- Trained vs. Untrained: For Qwen2 and FLAN-T5, alignment in trained models significantly exceeded random-initialization baselines, confirming the signal is learned, not architectural.
- Metric Robustness: Standard metrics (CKA, Procrustes) were distorted by high-magnitude activation dimensions (superposition), often showing higher alignment in untrained models. Mutual $k$ -NN (rank-based, scale-invariant) was the only metric showing the expected pattern (trained > untrained) and was used as the primary metric.
- Architecture Dependence: Alignment was consistently higher among causal decoder-only models (CKA 0.16–0.42) than between causal models and the bidirectional FLAN-T5 (CKA 0.08–0.10). Architectural family predicted alignment more strongly than training organization.
- Semantic Specificity: "RELATED" pairs showed robust clustering across most models. "SYNONYM" pairs (lexically disguised) were robust only for Mistral-7B; for others, clustering aligned more with topical co-occurrence than deep semantic equivalence.
Cross-Model Projection:
- The learned projection network achieved 45–50% top-1 retrieval accuracy for all three causal decoder-only pairs (significantly above the 5% chance level, $p < 0.0001$ ).
- The Qwen2 $\to$ FLAN-T5 pair performed at chance level (5.0%), indicating that representational alignment sufficient for retrieval does not extend to bidirectional encoders in this setup.
End-to-End Causal Transfer:
- Success: Only one of the three decoder-only pairs (Qwen2-0.5B $\to$ Phi-3-mini) met the pre-registered success criterion. The real-condition retrieval rate was 23.3% vs. 0.0% for the negative control ( $p_{FDR} = 0.047$ ).
- Failure: Both pairs targeting Mistral-7B showed 0.0% accuracy in the real condition, indistinguishable from the negative control, despite Mistral showing strong raw projection accuracy in the previous stage.
- Qualitative Observation: In successful trials, the generated text was thematically related to the source question but rarely the literal answer (e.g., a question about bicycle wheels generated text about animal leg counts), suggesting a transfer of "representational vehicle" rather than specific content.

Significance and Claims

The paper concludes that causal transfer of activation states is architecture-dependent, not universal.

Vehicle vs. Content: The author explicitly frames their claim within the philosophy of mind distinction between the vehicle (the physical/computational carrier) and the content (the meaning). The results demonstrate a causal transfer of the representational vehicle: an activation pattern that shifts a target model's output toward a specific representational neighborhood. The paper does not claim that the target model "understands" the content or that a shared meaning has been established.
Predictive Limitations: Representational alignment at the hidden-state level (even when strong) is not a reliable predictor of successful end-to-end causal transfer at the generation level. The failure of Mistral-targeted pairs despite high alignment metrics highlights this disconnect.
Safety Implications: The study identifies a potential safety risk: direct activation transfer bypasses natural language, removing the residual accessibility of human-readable monitoring (content filters, audit logs). While the current effect size is modest and limited to small models, it establishes a proof-of-concept vulnerability for covert, steganographic-like communication between agents that operates one layer deeper than token-level steganography.

Limitations
The study is restricted to small/medium open-weight models (0.5B–7B parameters). The positive result (Qwen2 $\to$ Phi-3) has a wide confidence interval and a modest effect size. The study does not provide a formal information-theoretic characterization of the channel capacity. The reasons for the failure of Mistral-targeted pairs (scale, quantization, layer calibration) remain open questions.

Technical Summary: Architecture-Dependent Causal Transfer of Activation States Across Large Language Models

More like this