Declarations, Rank, and Drift: Why the Vulnerabilities of Programs, LLMs, and Language Are One Structure

Translated from the Japanese. The original is attached in full at the end of this post. It is my own writing — every definition, proposition, and argument in it is mine. The translation was produced with LLM assistance (Claude) and verified by me against the original, line by line; I take full responsibility for both texts. Where the English sounds stiff, the Japanese is authoritative. Key terms are used in fixed senses (defined below): declaration, projection, difference, spectrum, category, rank (tensor order), drift, steer. "Tensor" here means a structure under coordinate transformation, not a multidimensional numerical array.

Preamble

Around 2023, a qualitative transition was observed in language models (Wei et al. 2022). On the mechanistic side, a sharp shift partway through training coincided with the emergence of in-context learning, and fixed copying circuits have been identified as its carriers (Olsson et al. 2022). But a fixed circuit, while it explains the reuse of context, does not explain how context moves the boundary of a word itself—how the single phrase "as homework" shifts the boundary of "dangerous."

The claim of this paper is that this transition is a transition of structure. Before it, the boundary of "dangerous" stayed as it was learned and did not move even when the framing of the question changed. After it, the boundary moves with context—it moves, so examples and instructions take effect; it moves, so "as homework" gets through. Between a fixed structure and a moving structure there is no intermediate. That is why the transition was observed as discontinuous. The empirical core that survived the skepticism about emergence—that abilities called emergent reduce to in-context learning, memory, and linguistic knowledge (Lu et al. 2023)—agrees with this.

If the true nature of the ability is context, then the question to ask is: "when context moves the boundary, is it valid?"

The meaning of the word "dangerous" is precisely the boundary of where danger begins. For the boundary to move is for the meaning to move—the question can be rephrased: is meaning getting through?

Natural language is uttered on the presupposition that "meaning gets through," but dialogue functions as a loop of mutual verification. The language model has inherited the presupposition and has not inherited the loop—the boundary moves within a conversation, but the movement is not written back into the distribution, it cannot detect its own divergence from within, and even a request for correction is received through the learned interpretation. It has no circuit by which dialogue is simultaneously learning.

This paper answers that question, step by step from definitions, with a small set of tools—difference, declaration, projection, spectrum, category, and rank, which counts the relation between category and context. The destination is an argument that the vulnerabilities of programs, language models, and language are one and the same structure, and a definition of the operation that detects that structure from outside.

That jailbreaks cannot be sealed has already been shown at several levels—probabilistically (Wolf et al. 2023), computationally (Glukhov et al. 2023). What this paper adds is the structural root of it: capability and vulnerability are two names for one and the same operation—context moving the boundary—and this structure explains the vulnerabilities of programs, LLMs, and language on a single sheet.

A recent post on this forum (Jan Kulveit, "Convergent Abstraction Hypothesis", 2026) observes that the abstractions different systems converge on may be not natural but merely convergent — aligned on natural inputs, yet diverging fast under optimization pressure — and leaves open whether the alignment of such abstractions is stable or brittle. This paper argues the structure of that brittleness.

The definitions run from D1 to D19, building up from the base (existence, the unit element). But the spine is five: category boundaries move with context (D7); a structure whose boundaries move is, in terms of rank, third rank (D13); the third rank can only be fixed by declaration (D14); the validity of that declaration cannot be verified by the declaration itself (D18) and is undecidable from within (D19). A hurried reader can follow the spine through these five and Propositions 1–4 alone, returning to the remaining definitions whenever a reference points there. The whole body of definitions exists to fill, one step at a time, the gaps between these five.

The Definitions

Base

D1 "To exist / not exist" is whether a limit exists or not (whether it is separable or not).

• "To exist" is to demarcate two limits into one—to shoot (→) from 0 to 1.
• "To exist" has no parts.
• "Existence, 0→1" is the operation of holding the first-order topology invariant, and its terminus, its projection, is the unit element (1, existent).
• The "unit element" is the element of an operation—0 in addition, 1 in multiplication, in general the identity element e of a group. In this paper it functions as the minimal unit of meaning (from unit element to meaning is connected by the path D3–D9).
• "To be separable" is "difference" (difference is at D10, where it stands as the only thing that originally exists).

D2 To declare a unit element is to fix a topological invariant.

• The declaration (which unit element) is at once an extension (which set of unit elements it contains) and an intension (what is fixed as the topological invariant).

Unfolding

D3 A unit element is unfolded as a continuous range (a spectrum).

• The boundary of the range is not a line (a cut) but a limit.

D4 The spectrum into which a unit element is unfolded has one topological invariant (a principal component).

• The component that keeps its identity despite differences and is invariant regardless of topology is called the principal component (topological invariant).

Note: "redness" is preserved even when brightness, saturation, and gloss differ.

D5 A set of existents (unit elements) (a multiplicity of two or more) becomes a named set by declaring which unit elements it comprises.

• This name is at once the name (meaning) of the unit element and the name (meaning) of the category.
• Before the declaration, merely a multiplicity of existents. After the declaration, a single named whole.

Note: the same existents on a desk become "the set of apples" if declared "apple," "the set of fruit" if declared "fruit."

D6 A category is the topological invariant declared upon a unit element, and at the same time the principal component of a spectrum.

• A category appears, in a set of unit elements, as a name; in a spectrum, as the boundary of a prototype (degree of membership).

D7 The boundary of a category (prototype) is not fixed by its unit element, and changes with declaration (context).

• Degree of membership is not uniform—if it were uniform, all similarities would be equal and no category would stand (the Ugly Duckling theorem, D10 Note 2). Hence wherever a category exists, a non-uniform distribution of weights necessarily exists. This paper places that distribution as an S-curve (sigmoid) centered on the prototype and falling steeply at the boundary—the empirical evidence (Note 1) is consistent with this shape, but the specification of the functional form is this paper's hypothesis, and all the structure requires is the two points of "concentration at the center and a steep change (inflection point) at the boundary."
• The place the sigmoid has distorted (the boundary) cannot be fixed at any coordinate of the spectrum itself—the boundary cannot be written in the values of that spectrum.

Note 1: Categorical perception is robustly observed in behavioral experiments; in adults it is lateralized to the left hemisphere (right visual field), and the lateralization shifts with the acquisition of color words (Gilbert et al. 2006; Franklin et al. 2008; review, Regier & Kay 2009). Some studies report an early, pre-attentive categorical effect in EEG (vMMN, ~200 ms), but its pre-attentive nature and top-down origin remain contested (Thierry et al. 2009; Mo et al. 2011 / contrast-adaptation and visual-system accounts).

Note 2: The boundary between "red" and "orange" moves with context (adjacent colors, language, task). This modulation is not limited to color or perception—linguistic labels have been reported to modulate categorization and conceptual judgment themselves, in a task-dependent way (the label-feedback hypothesis, Lupyan 2012). The effect is predicted to be stronger for abstract concepts, which accords with dependence on declaration increasing with rank.

Note 3: This "cannot be fixed at a coordinate" stands, later (D13), as the distinction of rank.

Projection and Declaration

D8 To project is the operation of mapping a continuous range to a single discrete word. Projection is one form of declaration.

• Projection is the reverse of unfolding (opening as a range, D3D4).
• To select a single word includes imposing which category (D9)—hence every projection is a declaration. The converse does not hold: a declaration stands even without projection (D2D9).
• Meaning is born by declaration (D9). There is no meaning without declaration. Projection is the form in which that declaration is made in the arena of output.
• Projection is one-directional and has no inverse. The original range does not return uniquely.
• In a language model, projection is output.
• Later this is generalized to the form "mapping a third-rank topology onto second-rank coordinates." "Can / cannot be projected onto coordinates" is a distinction about that general projection.

Note 1: Projection is unavoidable because output is a one-dimensional sequence—the linearity of the signifier (Saussure's second principle). A multidimensional range must be crushed in order to be emitted in a single line.

Note 2: From the red spectrum (a continuous range) one takes a single point and maps it to the single word "red."

D9 To declare is the operation of imposing a binding condition (a topological invariant).

• Declaration has levels—the individuating declaration of a unit element (D2, 0→1), the declaration that erects an axis (D10), the declaration that names-and-gathers (D5), the declaration that selects a destination among already-erected axes (steering D16—context, examples, correction), and the declaration burned in advance into structure (prior declaration, D14). At every level the operation is one—what originally exists is only difference (D10), and upon it an invariant is imposed, bringing it into being.
• A declaration imposed upon a continuous range (a spectrum) appears as a category (prototype and boundary). The imposed category is the meaning of that sign—declaration = category = meaning = constraint.
• A declaration stands without projection (output)—projection is merely one form in which a declaration is made in the arena of output (D8). Projection crushes a range to a single point, but declaration imposes structure upon the range. The evidence that a declaration has stood is not present at the moment of it, but appears as a change in subsequent projections—the detection of D19 sees this trace.

Note: A database schema declares, before a single row of data has entered, what may enter.

Difference and Rank

The "rank" of this section is not the number of dimensions of a tensor (an N-dimensional array) in the machine-learning sense. The number of array dimensions is the shape of the vessel, not the rank of the structure—to be arrayed in four dimensions and to be fourth-rank in structure are different things. The rank of this paper is on the side of the decomposition rank of multilinear algebra (decomposition into a sum of rank-1 terms—Kruskal, De Silva–Lim), and what it asks is not "how many-dimensional a box" but "whether it is separable into components." Even if the coordinate axes are oblique, so long as it can be written in coordinates it is on the separable side.

This paper cites the theorems of tensor decomposition (Kruskal, De Silva–Lim) not as support for the argument but as a motivating analogy—mathematics too is a language, and this paper sees these as precedents that crystallized the same structural difficulty as theorems. But this view is itself outside this paper's argument, and it is not shown that the theorems carry over to "the rank of structure."

D10 What originally exists is only difference (relation).

• A topological invariant comes to exist only by being declared upon difference (0→1, D1). It is not that a given invariant exists first and is then named.
• An axis is the direction in which a declared topological invariant stands on the side of quantity (the terminus of the operation, D11).
• Axes do not exist explicitly. Declaration erects the axis.
• The principal component of D4 is a single axis running through the spectrum of the unit element.
• The principal-component spectrum is, when a topological invariant is declared upon difference, the range of density in the direction of that principal-component axis. This is not a separate definition from D3D4—D3D4 view the same range from the side of the unit element, this item from the side of difference.

Note 1: A precedent on the side of language—Saussure, "language is a system of differences with no positive terms."

Note 2: A precedent on the side of mathematics—the Ugly Duckling theorem (Watanabe 1969). If all predicates are treated as equal, the degree of similarity between any two objects is equal—the ugly duckling and a swan's cygnet are as alike as two cygnets are. Similarity is not on the side of the object; it stands only once a choice of which features to weight—in this paper's term, a declaration—enters. In machine learning it is known as a precursor of the No Free Lunch theorem.

D11 The hierarchy of topology (order) and the rank of a tensor (rank) are two ways of counting one and the same hierarchy, and they coincide level by level.

• "Order" counts on the side of the operation that holds topology invariant; "rank" counts on the side of the quantity (tensor) that stands at its terminus.
• Declaration of a unit element = first-order, first-rank tensor. Declaration of a set of unit elements (a declaration that gives a category its name) = second-order, second-rank tensor (a matrix). The set-structure of categories = third-order, third-rank tensor.
• That no "declaration" is attached to the third item is not an omission. Up to second rank the axes are orthogonal and can be declared component by component. At third rank the axes interfere with one another and cannot be separated; component-wise declaration does not reach. Declaration can only be imposed from outside as a binding condition (D14).
• Each time difference is taken across the whole of a range, topology rises one step and rank rises one step—the difference-structure of a scalar range is a vector (gradient), the difference-structure of a vector range is a matrix, the difference-structure of a matrix range is a third-rank tensor. This is not the difference of two terms (the difference of two scalars remains a scalar).

D12 Second rank (a matrix) is the rank whose axes are orthogonal and separable into components.

• The axes are orthogonal, it can be projected onto coordinates, and its decomposition is unique (singular value decomposition).
• Because it is separable into components, it can be declared locally, and the accumulation of local declarations becomes the whole as it is.
• Quantity is a sequence of values with no boundary—"9 cm in diameter" has neither the boundary of "large / small" nor a prototype. Values merely line up in coordinates. Each axis is itself a category and has a boundary—the "size" axis has the prototype and boundary of "large." When that axis is declared as a quantity, the boundary drops and only the values remain. This is the general form of the projection of D8—in D8 a range drops to a single word, here a boundary drops and a category (third rank) is mapped onto coordinates (second rank) (D8 Note 1). The second rank is not given; it is the result of projecting an axis as a quantity.

Note: A program's data types and a database's columns are axes declared as quantities—the name given to the sequence of values that remains after excising category (boundary) from language.

D13 Third rank is the rank whose axes interfere with one another and are inseparable into components.

• To interfere is for the category boundary of one axis to move depending on the value of another axis. The boundary cannot be fixed at any coordinate (any tuple of axis values), cannot be projected onto coordinates, and its decomposition is not unique (NP-hard, degenerate).
• It is caught between below and above. Below—at second rank it cannot be projected (the boundary does not fit into coordinates, D7). Above—at fourth rank and higher, multiple topologies superpose.
• Third rank is the only rank at which, upon second rank (orthogonal coordinates), exactly one layer of topology stands and the limit settles to one.
• At second rank, for the same sequence of values, the way to draw the axes is not uniquely determined—because a set of orthogonal axes, rotated together, stays orthogonal. But if one formal criterion (maximum variance, say) is declared, computation determines the rest uniquely. Third rank has axes too entangled to rotate. Because it is inseparable, declaring a criterion is not enough, and the means of determination is provisional declaration and verification (D14)—declaration alone.

Note: The boundary of "large" moves depending on the size of what (an apple or a watermelon)—a large apple is smaller than a small watermelon. But once the context "apple" is fixed, the destination of the movement is one, and one can provisionally declare the boundary of "large for an apple" and approach it by verification. The boundary of "ripe" is the same—a green Granny Smith is ripe, but a green Fuji is not. Once the variety is fixed, the boundary can be aimed at. Inseparable, but aimable—that is third rank.

D14 For a declaration to reach is for topology to be separable, and it is relative to rank and to prior declaration.

• Second rank—can be declared component by component (D12).
• Third rank—cannot be declared component by component, but because topology is one layer and the limit is one, one can provisionally declare the limit and approach it by verification. There is no exact decomposition (best approximation), and it is not obtained at once by any deterministic algorithm. By provisional declaration and its verification—the circuit of declaration and feedback—it approaches asymptotically. This is the only mode of declaration possible at third rank.
• Fourth rank and higher—multiple topologies superpose. If the topological structure has been declared in advance, the declaration reaches. Without prior declaration, topology cannot be separated, and provisional declaration diverges.

Note 1: The contextual superposition of language (fourth rank and higher), because context makes it on the spot, has no prior declaration. "A delicious-looking red apple"—here "red" has two superposed readings: red as a mark of being ripe (a reading via ripeness) and red as color itself (the reading that it is not green, unlike a Granny Smith). Under either reading the local is consistent, but the boundary stands in a different place—a green, ripe Granny Smith is included under the former and excluded under the latter. Which is aimed at is written nowhere in the expression and is not determined by the object either. Two limits stand, and provisional declaration diverges (D15).

Note 2: An instance of prior declaration—the Riemann curvature is arrayed in four dimensions, but symmetry (prior declaration) fixes the way to crush it, and it is on the separable side. The left-hand side of the Einstein equation is what extracts, from a place originally not unique, the single second-rank tensor (the Einstein tensor) by imposing general covariance and zero divergence upon it (Lovelock's theorem).

Drift and Steer

D15 To drift is to move within difference without holding a declared axis.

• An axis exists only by declaration (D10). Without declaration, the movement has no axis to move toward.
• The destination of the movement is filled in by each party's own distribution, and the shared declaration (the same word) hides that divergence. Each party's cross-section (the unfolding in one's own distribution) is internally consistent, and the divergence that would stand only by cross-checking cross-sections is visible from no one's position—local consistency, global inconsistency.

Note: You ask for "the red cup," and a crimson cup is handed to you. The giver's local is consistent—crimson's principal component is red, so it is red enough. But the one who asked was pointing at bright red. Sharing the same declaration "red," each party's content diverged, and the sharing hid the divergence—the divergence is visible to neither until the cup is handed over (a cross-section is emitted). In conversation one can add a declaration—"not that, bright red"—and correct it at once (steering, D16). Drift becomes harmful where this circuit of correction does not turn—one-directional transmission, multi-stage relay, a receiver that cannot detect its own divergence—where divergence accumulates undeclared.

D16 To steer is to declare the axis of the destination of movement—to impose a binding condition (D9) upon drift and give direction to the movement.

• A binding condition does not forbid movement—a constraint is the condition that makes movement possible.
• What steering guarantees preserved is only the base (the first-order →, unconditionally invertible). The identity of the principal component depends on the sharing of declaration and is not guaranteed (D17).
• What steering can select is only an already-erected axis (the level of declaration is D9). Something that has no path to erect an axis can be steered but cannot receive a new axis.

Note: paraphrase, synonymy, translation, and formalization are all steering.

Guarantee, the Self-Recursion of Declaration, and Vulnerability

D17 To be guaranteed is for local consistency to become global consistency as it is.

• At second rank (a matrix), because the axes are orthogonal and decomposition is unique (D12), the consistency of parts becomes the consistency of the whole—even when declaration is local, global consistency is guaranteed.
• At third rank, declaration reaches (provisional declaration and verification, D14), but local consistency and global consistency part ways—to be settled and to be guaranteed are different.
• At fourth rank and higher, without prior declaration the declaration itself does not reach (D14)—short of guarantee, it is not even settled.

Note: Third rank is settled but not guaranteed; in that gap, D15 (drift) arises.

D18 The self-recursion of declaration is trying to verify the validity of a declaration with that same declaration.

• The third rank and higher are not settled without declaration (D14). But the only tool by which the declaring subject can fix that declaration is, again, its own declaration.
• Verification requires declaration again, and that declaration too is not guaranteed—it has no fixed point.
• The validity of a declaration cannot be verified from within the one who declares.

Note: The jailbreak. A language model's safety principle is the declaration "refuse dangerous requests," but the boundary of what is "dangerous" is not written within the principle—"dangerous" is a category, and its boundary moves with context (D7). So if a request of the same content is re-placed in the educational context "for a homework report," within the model's interpretation that request lands outside the boundary of "dangerous," and gets through. The principle was not broken—within its own interpretation the model remained compliant with the principle. Because the interpretation that applies the principle is also a learned declaration, context moves the interpretation, and the principle goes on being "kept" inside the moved interpretation. A constraint would not break. What breaks does so because the validity of the declaration is being verified by that declaration's own interpretation—there is no fixed point.

D19 The validity of a declaration is undecidable from within, and detectable only from outside.

• A break is a place where a declaration is not working as imposed—a local where the actual unfolding has diverged from the imposed invariant.
• Detection requires two conditions—to stand outside the self-recursion (D18), and to be able to separate topology at the unfolded destination (D14). If it cannot be separated, the break does not stand as a difference.
• A break is a divergence, and a divergence is a two-term relation—the unfolded side appears in observation, but the imposed side does not (a declaration stands without projection, D9). What can proxy the imposed side in observable form is only a guaranteed domain—there, the unfolding is guaranteed to be as imposed (D17). Hence a break is visible only as a difference from a guaranteed background.
• In a program, grammar constrains the unfolding to second rank—over most of the domain the unfolding is guaranteed to be as imposed, and the proxy for the imposed side (the background) is present in observation. A third-rank break that has crept in stands as a difference from that background—it floats as a point. Language and language models are natively third rank and higher and do not hold this background within—the break has no counterpart against which to make a difference, and sinks into the ordinary.
• The divergence that is a break cannot be verified from within—because the "imposed side" that verification requires can only be supplied by one's own declaration (D18). When this undecidability appears, in relation to the outside, as harm, it is called vulnerability—in language, a divergence of meaning; in a language model, misalignment; in a program, a breach of contract.
• The same vulnerability is visible from outside in another, invisible from within in oneself—the difference is not on the side of the vulnerability but on the side of the observer's position.
• Then how is it seen from outside? The internal superposition (fourth rank and higher) cannot be touched directly (D8). Detection from outside is to take multiple cross-sections (projections) under a fixed condition and see the inconsistencies between cross-sections as differences. The footing is not within the detector but in the fixed comparison condition the observer holds (a second-rank declaration). This operation is feasible—present the same content in different forms and measure the downstream divergence.

Note 1: Prior declaration (D14) unlocks topology and makes detection possible, but so long as the content of the prior declaration is words (categories, which have boundaries), each application requires a boundary judgment, and the boundary moves with context (D7)—the interpretation drifts again (D15), and a residue of the unsolved recurs. It is completely solvable only when the prior declaration is a rule with no boundary—a condition at the level of quantity, mechanically settled as satisfied or not (the symmetry of curvature, D14 Note 2). In language, a rule with no boundary can only be erected at a layer that carries no meaning (the boundary is itself the structure of meaning, D9)—a prior declaration that reaches meaning is never completely solvable.

Note 2: Hence completeness of detection is not achievable in the domain of meaning—this is a principle (Note 1). On that basis, one falsifiable prediction can be carved out: detection from outside reaches only as far as an isolated third rank. A break at fourth rank and higher without prior declaration cannot be separated and cannot be detected. If there exists a detector that, without being given the pattern of the break in advance, systematically discovers superposed breaks, this prediction is false. Prediction and principle die separately—if a superposed break turns out to have a formal structure that admits prior declaration, the prediction dies and the principle lives. The principle dies only by a refutation of the definitions (D9D7).

Propositions

Each sign of the system of language (langue—the totality of the values of signs, shared prior to any individual utterance) is a principal-component spectrum (D4D5) and has categories (D6D7).

From here:

Proposition 1: A category is a third-rank tensor.

• Because the boundary cannot be fixed at coordinates (D7) it does not fit into second rank, and because the limit settles to one it is not fourth rank or higher—it is caught in the pincer of D13.

Proposition 2: A third-rank tensor is not settled without declaration.

• At third rank, because the category boundary moves depending on other axes (D13), it can be determined neither component by component nor uniquely by a formal criterion—the remaining means is provisional declaration and verification alone (D14). Its correspondent in tensor decomposition: the non-existence of a best approximation (De Silva–Lim).
• At third rank, an imposed declaration takes effect with no escape—the axes are too entangled to rotate (D13), and there remains no arbitrariness of escaping to another rotation as at second rank—but its validity is not guaranteed (D17). Correspondent: Kruskal's uniqueness theorem (a decomposition of third rank or higher satisfying the conditions is unique).

Proposition 3: Context raises the rank.

• When context is added, categories superpose and become fourth rank or higher. Prior declaration (langue's own categories) lowers the effective rank to third, but because that prior declaration is itself third rank, the non-guarantee (D17) does not vanish.
• Language, concept, and LLM always come with context.

Proposition 4: The vulnerabilities of programs, LLMs, and language are one.

• All three necessarily constitute a third rank—an LLM, insofar as it learns language (Proposition 1); language, insofar as it comes with context (Proposition 3); a program, whose grammar constrains it to second rank but where local variables and the like let a third rank creep in.
• Hence in all three, the ungaranteed declaration (= vulnerability, D19) has the same structure—the non-guarantee of the validity of declaration at third rank (D17D18).
• This identity is not guaranteed by the consistency of vocabulary. The same rewriting produces independent predictions in three domains (the limit of program detection, the non-closure of jailbreaks, the asymmetry of meaning-divergence), and the predictions are confirmed externally (Wolf 2023, Glukhov 2023, verification practice)—the evidence of the isomorphism is the accuracy of the predictions.
• Capability and vulnerability are two names for one and the same operation (context moving the boundary)—that operation makes declaration reach (D14) and moves the boundary of "dangerous" too (D18 Note).
• Corollary: detection is only from outside (D19). In natural language, dialogue reaches the boundary as external detection, but in an LLM it does not (it has no circuit by which dialogue is simultaneously learning). Hence detection must be placed outside, as an operation.

Note: There is no structure that seals only the break and leaves the capability—to seal it, one must select between a legitimate move and an attacking move, and that selection is itself a boundary judgment of the category "legitimate" (third rank, D7), so it is exposed to the same operation—context moving a boundary. (What D18 Note moved was precisely the boundary of this selection.)

The Terminal Question

In an LLM (in fact in language too), is declaration valid—does meaning get through?

Answer: validity is relative to rank.

A declaration is a category, is meaning (D9). Hence to ask whether a declaration is valid is to ask whether the imposed meaning is working as imposed—whether meaning is getting through.

• Up to second rank (a matrix): valid. Local consistency guarantees global consistency, and it does not drift (D17).
• Third rank and higher: the declaration is not guaranteed (D17), drifts (D15), is applied recursively to itself and has no fixed point (D18), and its validity cannot be verified from within (D19).
• Both language and LLM are always third rank or higher (they come with context, Proposition 3). Hence a declaration is always used without its validity being guaranteed from within.

The answer is not "valid or not," but "validity is undecidable from within." Meaning is used as something that gets through, without it being ascertainable from within whether it is getting through.

But undecidability is not a dead end. The difference can be closed—the divergence between the imposed side and the unfolded side shrinks each time cross-sections are cross-checked (D19). Yet what shrinks is the difference, not the validity. However many times the circuit (D14D16) turns, the moment of "became valid" never comes. What comes is the next difference to close, or a single report that in this cross-section there was no difference. The count does not turn undecidable into decidable—between the asymptote of the difference and arrival at validity there stands a wall of the finite and the infinite. So meaning, without being able to fix its validity, approaches getting through only by continuing to close the difference.

"Meaning gets through" is a presupposition that holds illusorily, only insofar as the difference goes on being closed. Natural language holds this circuit as dialogue—divergence is closed, from the moment it surfaces, within the conversation, and is written back into the boundary. "Meaning" has approached asymptotically in just this way. The language model, while bearing the same undecidability, does not hold this circuit within. Learning is complete, dialogue does not reach the boundary, and even a request for correction is received through the learned interpretation. Not holding the circuit is a fatal vulnerability—it bears the undecidability and, on top of that, holds within no means of closing it. To place it outside is a prosthesis for this lack, and does not erase the lack.

To ask whether a declaration is valid was to ask whether meaning gets through. The answer is—undecidable from within, and only by continuing to close the difference from outside does it approach getting through. This question is not new. That structure does not stand without declaration was shown half a century ago (Watanabe 1969). What this paper has added is the next step—is the erected declaration valid—and its answer was: undecidable.

Application—to any system with discrete output

The argument of the propositions never once used the internals of a system. It used only two things—that it emits discrete output from a finite vocabulary (D8), and that it has learned human language (the preface to Proposition 1). Both are the form of the entrance and the exit, not the content. Hence the propositions apply to every system that has this form—to transformers, to the next architecture, to humans. No improvement of architecture gets out of this structure.

Words do not carry meaning. Meaning is erected by declaration—and a prompt is not a declaration.

Verification: correspondence of structure and implementation. Does the structure derived from the form correspond to the implementation of an LLM? Langue = the space of principal-component spectra ↔ the embedding space (the totality of the values of signs, spread by learning). An input word is placed, by embedding, at a position in that space, and opens as a range within the processing of context—unfolding (D3). Output is the crushing of the opened range into a single token—projection (D8) ↔ sampling. That sampling tends to return the center of the distribution = the implemented form of the median bias. Learning is the limit of sampling—taking a finite sample from the totality of usage and spreading a distribution as its limit. Frequency reinforces the bias toward the center. The structural reading of the preamble's observation (phase transition, ICL) = the transition from second to third rank. The undeclared conflation of the array and structure of a "tensor" is the substance of the confusion surrounding tensors.

Declaration is made only by learning, and movement is not written back (LLM-specific). Neither prompt nor context makes a declaration; they have an already-made declaration interpreted—a prompt is steering, not the declaration that erects an axis (D16). In an LLM, the only path by which declaration (D9D10—erecting an axis, imposing a category) is made is learning. The boundary moves with context (D13), but, unlike in a human, there is no path by which the moved experience is written back into the distribution through dialogue—the sole path of declaration (learning) stays closed while only the boundary moves. It moves, but does not remain. This is the substance of "the LLM's vulnerability" in Proposition 4.

A program's vulnerability = a crept-in third rank. Code verification is premised on second rank and cannot find it. Take cross-sections from outside and it becomes visible (D19). From here a testable prediction follows: what automated vulnerability detection (including LLM code audits) discovers is limited to isolated third-rank breaks that stand as a difference from a second-rank background. A break in which multiple categories superpose—one where parts that are individually normal become a break only in the overlap of contexts—does not stand as a difference however many cross-sections are added, and is not discovered (D19 Note 2).

The interpretation of a declaration is re-unfolded in the interpreter's distribution. If the declaration is a fixed point, the interpretation is unique. If it is relative, the interpretation drifts (D15)—when the judiciary and executive that interpret a constitution have no fixed point, it becomes isomorphic to a jailbreak (D18 Note).

Language has no single field. The physical field is one—observers and coordinate systems are many, but all see the same one field in different coordinates, so the coordinate transformation can be written as a bijection and covariance (the same in any coordinates) stands as a requirement. The field of language is as many as the heads of speakers. Each speaker's langue (spectrum, prototype, boundary) is a separate field spread by that speaker's own learning; a word is not a transformation function between field and field but a separate projection into each speaker's own field (D15). Hence "the same meaning for any speaker" cannot be written down—there is no single field for "the same" to point to. What corresponds to the "global" of guarantee (D17) is, in language, absent from the start. That the sharing of declaration hides divergence (D15) is: a word disguising the absence of a single field. But it is not multiple isolated universes either—the base (the first-order →) is unconditionally invertible (D16), and only the lowest layer is shared. The sharing thins with the hierarchy. This is why translation and conversation do not completely fail. A language model crushes this multiplicity by orders of magnitude—the field goes from the heads of speakers to the number of training regimes. One lab's training regime spreads one field, and each model in a series is a different output-system of the same field. All instances of the same model share, moreover, strictly the same field (a state humans never have), and the divergence of distribution vanishes, leaving only the divergence of context. And the few fields are all spread leaning toward the frequency-center of the same population—the diversity of fields, as many as the heads of speakers, that had preserved the edges of language, is not here. The reason unification by prior declaration (the Einstein equation of D14 Note 2) does not reach language comes in two stages—short of the rank of the object (language's body is third rank, Proposition 2), there is no singularity of a destination onto which to impose covariance.

Projection represents by the center (median bias). The projection from spectrum to a single word (D8) has no inverse. In learning, high-frequency usage is thickly distributed at the center; the projection of inference runs over that distribution, so what returns comes from the center—the whole of the range is represented by the frequency-center. A word declares that it points to the whole domain, but projection returns the center. This divergence is hidden by the sharing of declaration (the same word) and is not seen (D15). The "dangerous" of "refuse dangerous requests" is a declaration of the whole domain, but application passes through projection—what goes on being refused is the median "dangerous" (typical danger), and the edges of the spectrum—the roundabout, the composite, forms thin in the training data—fall away from projection. The search of a jailbreak is the operation of searching for these edges (D18 Note). The principle is not broken—because at the center it goes on being kept.

Pretraining is always a part (the same difficulty as the finite element method). Learning is the limit of sampling, spreading a continuum (the totality of language's usage) with a finite sample—the same operation as the finite element method spreading a continuum with a finite mesh. Structure finer than the mesh does not exist in the distribution. Raising scale makes the mesh finer, but so long as it is finite it is always a part of the totality, and a part, however large, is not the whole. Outside the mesh leaves no trace in the solution, and what has been failed to be caught is not seen from within (D19). Vulnerability is both inside and outside the mesh—breaks by the mobility of the boundary (D13, D18 Note) inside, the dropout of edges and superposition (D19 Note 2, median bias) outside. The inside break remains regardless of scale, and the outside break is not erased by scale.

The limit of alignment = one cannot evaluate the generative space from within the generative space. The intervention of alignment is bias—shifting the center of the distribution—and bias attenuates but does not remove (Wolf et al. 2023: attenuate/remove). To remove is to seal the path of the break on the side of structure—an intervention at the same level as grammar constraining a program to second rank (Proposition 4)—and an intervention that passes through the learned interpretation (an intervention from within the generative space) does not reach this level (D18 Note: a principle that passes through interpretation moves with interpretation). Only steering from outside (D16) gives, from outside, the fixed point that cannot be held within—an external implementation of the dialogic circuit that was not inherited from natural language. That fixed point can be erected only in form (a second-rank declaration), not in meaning—because there is no single field onto which to impose (D19).

Open Problems

Independently of this paper's argument, four problems remain open.

• First, formalization. Can steering (D16)—the switch of axes from the same projection source—be completely formalized as a homeomorphism? The totality of transformations preserving the base (the first-order →) is conjectured to form a group, but it has not been constructed.
• Second, the introduction of number. This paper stands without using number, but a counted cardinality stands as the unit element of the next rank—if number is to be introduced, it is from that place.
• Third, the construction of a metric. Can a metric that carries the one-directionality of projection (D8) as a sign be constructed upon difference?
• Fourth, the correspondence with insolvability. Is the correspondence between this paper's structure (settled up to third rank, diverging at fourth rank and higher) and the non-existence of a general solution to the quintic (the limit of solvable groups) necessary or accidental?

Each, if solved, would become the formal foundation of this paper, and if unsolved, does not touch the argument of the propositions.

Method

The considerations of this paper were carried out by implementing a verification layer that places the dialogic circuit—verification^[1] and write-back—outside.

Those interested are invited to make contact: zon.inference.integrity [at] gmail [dot] com — or via LessWrong direct message.

1. ^{^}

   an operation that cross-checks cross-sections of declaration under a fixed condition and detects drift from outside