This is an automated rejection. No LLM generated, assisted/co-written, or edited work.
Read full explanation
TL;DR. We tried to read facts out of a language model and into a verified knowledge graph, with a rule that the model may only propose and the graph must independently confirm. The decoding works: attribute relations (a person's language, a place's continent) recover at up to 89.6% top-10 against 16,648 candidates where a no-operator baseline gets 0%, and on 12 invented entities the geometry confidently proposed while the gate committed 0 of 72. Then we ran the check we had skipped - what score does a constant guess get? - and it demoted our own headline: guessing "French" for every subject passes the same gate at 88.9%, so our "55/55 correct" was mostly base rate. A real but smaller channel survives (696 extractions, 22x over its nulls, 90.7% externally graded, and it caught 2 genuine errors in our own graph). Two further attempts - sparse-autoencoder features and single-neuron weight reading - each looked like clear wins and were each erased once the null searched as wide as we had. The transferable lesson: a bar that a random baseline also clears is not evidence, and the null must be as lucky as your search was.
Epistemic status: pilot-scale, single model (Qwen2.5-1.5B), six relations, all bars pre-registered before scoring. One strong positive result, one honest null whose failure was caught by its own controls. We think the architecture claim is solid and the scale claims are not yet made. Every number below is transcribed from a pre-registered measurement report; nothing was re-framed after seeing results.
A language model's factual knowledge is normally reachable only by prompting it and trusting the answer. We describe and measure a different access path: relations recovered as linear operators over hidden states, learned from an existing knowledge graph, with every proposal they produce independently corroborated by that graph before it may become a fact.
The decoding itself is not our contribution - relation linearity is established (Hernandez et al. 2024, Merullo et al. 2024, with the word-arithmetic tradition going back to Mikolov et al. 2013 and the framing of Park et al. 2023). Our contribution is the architecture around it: extraction where geometry may only propose, symbols must verify, and silence is honest.
The commit law
One verification law governs everything, derived by measurement rather than assumed: confidence is carried by edge-disjoint, provenance-distinct anchor count. In our graph, one supporting path yields 88.3% precision; two disjoint paths yield 100.0%. That step is why the gate commits at two.
Independent is the load-bearing word. Two chains through the same hub are one path wearing two hats (enforcing this cut fabrications 19 → 2 in an earlier experiment). Two samples from the same model are one source: asked to corroborate seven plausible-sounding fake entities, two independent passes of the same model family agreed on the same wrong answer 7/7, while the symbolic gate abstained on all seven.
Result I: the operator channel is real, and the gate holds
Method. For six relations, verified subject→object pairs from a 66.4M-edge multi-provenance graph (2,000 train / 250 blind held-out per relation, split by subject-name hash), encoded through Qwen2.5-1.5B at four depths and three templates. Operators: an additive offset (mean of object-minus-subject states) and a ridge affine map. Readout: nearest neighbor against 16,648 entity states. All bars fixed in writing first.
Relation
Operator top-1
Operator top-10
No-operator baseline top-10
native language
65.2%
89.6%
0.0%
continent
37.2%
79.2%
0.0%
country of citizenship
39.6%
73.2%
0.0%
country
23.2%
54.8%
0.4%
capital (identity-class)
16.8%
24.4%
22.4%
headquarters (identity-class)
~15%
~25%
~23%
39 of 72 measured cells cleared the pre-declared bar (≥30% top-10, ≥+10 points over baseline).
The wall that reproduced. Attribute-class relations (a language, a continent) form a strong channel. Identity-class relations (a specific city among ~1,500) do not - the operator adds ~3 points over raw proximity. We had previously measured the same ceiling in a completely different embedding space with different machinery. Finding it inside the LLM's own contextual space suggests it is a property of the representation class:
Geometry carries kinds; it does not carry individuals. Symbols must own identity.
The gate, tested where it can fail. Corroboration ran with the target relation masked graph-wide (including its inverse) - the gate cannot verify by lookup, only by assembling independent evidence from other relations:
Test
Result
Strongest relation (native language)
55/55 commits correct (100%) - but see the "correcting our own headline" section below: a constant-guess null later showed this is substantially base-rate
Pooled, all six relations
93/108 (86.1%) at 7.2% coverage - below the 95% bar
12 invented entities × 6 relations
0/72 commits (geometry proposed confidently for every fake)
The pooled failures are type-confusions verified by association ("Thai" for a language slot attracts hundreds of converging anchors because Thai and Thailand are genuinely related): the gate verifies relatedness, and the missing constraint - the committed object must be of the type the relation demands - is available in the graph. We did not apply it post-hoc; it is future-work item #1.
Two systems notes: logit-lens decoding of operator outputs was dead (≤2%), so extraction is inherently closed-world - the graph supplies the vocabulary, the model only the geometry that selects among it. And encoding runs at 399 entities/s on a consumer GPU, so a 100k-entity sweep costs ~4 minutes per template: batched matrix arithmetic, not autoregressive generation.
Correcting our own headline: the loud-class ride
A follow-up ran the null arm the original probe had not: what does a constant guess achieve through the same gate?
Proposing a single fixed object for every subject - "French" for the language relation - passes the gate 63 times at 88.9% precision; "United States" for citizenship commits 86 times at 66.3%. The gate cannot refuse a high-base-rate object. So the 100% above is substantially base-rate rather than earned, and under pre-declared bars 0 of 6 relations passed once these nulls were in place.
The type constraint we'd identified as future work did land, and worked: pooled precision 86.1% → 97.1%, eliminating 13 of 15 wrong commits at a 35% coverage cost.
And a real channel survives underneath. Excluding high-base-rate objects and sweeping 62,000 subjects produced 696 residual extractions with diverse objects, against a wrong-subject null of 32 and a random-direction null of 1 - beating its nulls by ~22x. Externally graded: 107 of 400 sampled rows were gradeable at all (73% are tail entities no external source covers), scoring 90.7%. In the reverse direction, 48 disagreements with the graph were hand-classified: 26 graph-right, 18 entity-linking artifacts, and 2 genuine graph errors the model caught. Against the pre-declared bar (1,000 additions at 95%) this is partial - the artifact ships exploratory, not promoted into the graph.
The same discipline that produced our best number is what took it back. A headline that cannot survive a constant-guess baseline was never a measurement of the method.
Result II: a negative result, reported first-class
We applied the same discipline one level deeper. SAEs decompose activations into features (Gao et al. 2024, Cunningham et al. 2023, Bricken et al. 2023); the standing weakness is that features get labeled by asking an LLM what they seem to mean - unverified and circular. Our corpus is text aligned to verified triples (REBEL), so feature labeling can be a measurement against external ground truth instead.
We trained a TopK SAE (24,576 latents, k=32) on 250k activation positions. It reconstructed well - FVE 0.9645 against a 0.60 floor, 0.07% dead latents - and under our first grounding bench it labeled 41 features at ≥90% held-out precision.
That number is wrong, and our own controls said so:
Control
First bench
Corrected bench
SAE
41 grounded
0 grounded / 121 candidate
Random directions
23 grounded
0 / 0
Shuffled labels
5 grounded
0 / 70 candidate
The mechanism generalizes, which is why we report it in detail: one class ("human") was 63% of eval mentions and nearly linearly separable in raw activations; a threshold test on a dominant, geometrically loud class is easy to pass by chance; cosine against an unnormalized class centroid mostly measures "is this an entity mention at all"; and 24,576 candidates against a 5% false-pass threshold buys ~1,200 free passes. Two weak correlational tests conjoined still admit chance.
The corrected bench subtracts the shared mention direction (centroids then measure class, not mention-ness), replaces the significance threshold with a selection-matched null (beat the max of 24,576 random directions), and requires a margin over every competing class. Under it, random directions ground nothing - and neither does the SAE. The pre-declared retry (k=16, FVE 0.990) changed nothing: zero grounded, retry delta zero. Diagnosis: ~8 scoreable activations per latent at pilot scale - starvation, not refutation - plus class imbalance. Verdict: null at this scale, revival conditions recorded (class-balanced eval, ~10× more activations, finer classes), not a rescue.
The measurable claim of this work is not that our extraction works. It is that when it does not work, our instruments say so before we do.
A third access path, and a third null: reading the weights at rest
Weights are the cheapest access path - no forward pass at all. FFN layers behave as key-value memories (Geva et al. 2021), so a value vector can be decoded through the output embedding to ask what a neuron writes. We scanned every neuron for programming idioms, on CPU, in ~7 minutes.
It passed the pre-declared bar on all 13 targets - and is still a null. The bar compared against 500 random draws, which scored zero, making every ratio infinite. But the search ranged over ~396,000 candidate directions. Running the null as wide as the search collapses it to 0.7x-1.8x: real neurons hit idiom tokens at essentially the random rate, and random directions achieve rank 1 on 11/13 targets, matching the real ones.
One structural finding survives: [::-1] tokenizes as a three-token sequence, so the idiom cannot live in one neuron even in principle. The knowledge is a sequence of associations, not an address. Corpus mining beat weight-reading on every target tested.
The pattern across three rungs: calibration is the whole game
Three independent attempts to read knowledge out of a model each produced an apparently strong result, and each was retracted by a null matched to the actual selection pressure:
Attempt
Apparent result
After a matched null
SAE features
41 grounded
0 - random dictionary grounded 23 under the same bar
Single-neuron weight reading
13/13 targets pass
0.7x-1.8x - null searched 500 draws against a 396,000-wide search
Two-channel retrieval union
regressions fixed, recall up
1.5x vs a union-matched null - the second channel, not the new one, did the work
A bar that a random baseline can also pass is not evidence, however many candidates clear it. The null must search as wide as the claim.
I regard this as the most transferable result here. Each of the three would have been publishable as a positive finding under a conventionally-specified control. What distinguishes the surviving positives is not that they were larger - it's that they went through nulls built to match how hard we searched. One of those nulls, applied late, correctly demoted our own best number.
What this is for
Ranked by evidence:
Verified KB growth and repair. Bidirectional: facts the model holds that the graph lacks (gate-verified additions), and facts the graph holds that the model contradicts (in an earlier hybrid measurement, the graph overrode the model 11 times and was right 10).
Abstention before generation. The fake-entity result inverts into a guardrail: confident geometric proposal + zero independent corroboration is precisely the signature of a question that should be refused rather than answered - with a measured 0-fabrication property behind it rather than a heuristic.
Knowledge inventory as a model audit. Per model, which relations have a strong channel and which don't - the weak ones being where that model will confabulate. Model cards report benchmarks; this reports a verified factual inventory.
Program synthesis from English (sibling line): verb semantics as checkable specifications; where the spec underdetermines, the system asks a discriminating question instead of guessing. Wiring a mined English layer into the benchmark runner was A/B tested on exactly the 64 tasks it can affect (the other 193 provably unchanged - the layer emits nothing for them): 0 regressions, +1 verified solve, moving the zero-weight synthesizer to 113/223 under a 35x-test deflation grader. 13 of the 64 were unmeasurable because the search overruns its deadline - disclosed, and now a tracked defect.
Honest limits
This does not become a language model. It is a knowledge/verification engine: closed-world, auditable, silent where it cannot verify.
Identity stays walled - reproduced across two embedding spaces and three mechanisms.
Coverage has a principled floor: an entity with fewer than 2 independent facts cannot be verified at any depth (measured: 0/69 recovered; 59 of them had at most 1 fact in total). Depth does not manufacture independence.
Relation linearity is replication, on a different model with simpler estimators.
The feature rung is null at pilot scale, as above; the single-neuron rung is null too (0.7x-1.8x vs a matched baseline).
Base rates can masquerade as verification. A gate cannot refuse a high-frequency object; constant-guess baselines must be run per relation. Our own strongest figure was demoted by exactly this.
Scale: one 1.5B model, six relations, pilot-scale SAE. The throughput numbers make broader sweeps cheap; they have not yet been run.
Method notes
Bars written before results (the 86.1% pooled gate figure is reported as a partial failure; the identified fix was withheld from the run). Mandatory adversarial controls (they killed a 41-feature "success"). Blind splits by entity. Masked corroboration (no verification-by-lookup). Independent adversarial audit of new code (it found a commit path that could emit code contradicting a user's own example; fixed before reporting). Negative results ledgered so dead levers stay dead.
Full PDF with the complete result grids and references available; pre-registered measurement reports and code available on request.
TL;DR. We tried to read facts out of a language model and into a verified knowledge graph, with a rule that the model may only propose and the graph must independently confirm. The decoding works: attribute relations (a person's language, a place's continent) recover at up to 89.6% top-10 against 16,648 candidates where a no-operator baseline gets 0%, and on 12 invented entities the geometry confidently proposed while the gate committed 0 of 72. Then we ran the check we had skipped - what score does a constant guess get? - and it demoted our own headline: guessing "French" for every subject passes the same gate at 88.9%, so our "55/55 correct" was mostly base rate. A real but smaller channel survives (696 extractions, 22x over its nulls, 90.7% externally graded, and it caught 2 genuine errors in our own graph). Two further attempts - sparse-autoencoder features and single-neuron weight reading - each looked like clear wins and were each erased once the null searched as wide as we had. The transferable lesson: a bar that a random baseline also clears is not evidence, and the null must be as lucky as your search was.
Epistemic status: pilot-scale, single model (Qwen2.5-1.5B), six relations, all bars pre-registered before scoring. One strong positive result, one honest null whose failure was caught by its own controls. We think the architecture claim is solid and the scale claims are not yet made. Every number below is transcribed from a pre-registered measurement report; nothing was re-framed after seeing results.
A language model's factual knowledge is normally reachable only by prompting it and trusting the answer. We describe and measure a different access path: relations recovered as linear operators over hidden states, learned from an existing knowledge graph, with every proposal they produce independently corroborated by that graph before it may become a fact.
The decoding itself is not our contribution - relation linearity is established (Hernandez et al. 2024, Merullo et al. 2024, with the word-arithmetic tradition going back to Mikolov et al. 2013 and the framing of Park et al. 2023). Our contribution is the architecture around it: extraction where geometry may only propose, symbols must verify, and silence is honest.
The commit law
One verification law governs everything, derived by measurement rather than assumed: confidence is carried by edge-disjoint, provenance-distinct anchor count. In our graph, one supporting path yields 88.3% precision; two disjoint paths yield 100.0%. That step is why the gate commits at two.
Independent is the load-bearing word. Two chains through the same hub are one path wearing two hats (enforcing this cut fabrications 19 → 2 in an earlier experiment). Two samples from the same model are one source: asked to corroborate seven plausible-sounding fake entities, two independent passes of the same model family agreed on the same wrong answer 7/7, while the symbolic gate abstained on all seven.
Result I: the operator channel is real, and the gate holds
Method. For six relations, verified subject→object pairs from a 66.4M-edge multi-provenance graph (2,000 train / 250 blind held-out per relation, split by subject-name hash), encoded through Qwen2.5-1.5B at four depths and three templates. Operators: an additive offset (mean of object-minus-subject states) and a ridge affine map. Readout: nearest neighbor against 16,648 entity states. All bars fixed in writing first.
Relation
Operator top-1
Operator top-10
No-operator baseline top-10
native language
65.2%
89.6%
0.0%
continent
37.2%
79.2%
0.0%
country of citizenship
39.6%
73.2%
0.0%
country
23.2%
54.8%
0.4%
capital (identity-class)
16.8%
24.4%
22.4%
headquarters (identity-class)
~15%
~25%
~23%
39 of 72 measured cells cleared the pre-declared bar (≥30% top-10, ≥+10 points over baseline).
The wall that reproduced. Attribute-class relations (a language, a continent) form a strong channel. Identity-class relations (a specific city among ~1,500) do not - the operator adds ~3 points over raw proximity. We had previously measured the same ceiling in a completely different embedding space with different machinery. Finding it inside the LLM's own contextual space suggests it is a property of the representation class:
The gate, tested where it can fail. Corroboration ran with the target relation masked graph-wide (including its inverse) - the gate cannot verify by lookup, only by assembling independent evidence from other relations:
Test
Result
Strongest relation (native language)
55/55 commits correct (100%) - but see the "correcting our own headline" section below: a constant-guess null later showed this is substantially base-rate
Pooled, all six relations
93/108 (86.1%) at 7.2% coverage - below the 95% bar
12 invented entities × 6 relations
0/72 commits (geometry proposed confidently for every fake)
The pooled failures are type-confusions verified by association ("Thai" for a language slot attracts hundreds of converging anchors because Thai and Thailand are genuinely related): the gate verifies relatedness, and the missing constraint - the committed object must be of the type the relation demands - is available in the graph. We did not apply it post-hoc; it is future-work item #1.
Two systems notes: logit-lens decoding of operator outputs was dead (≤2%), so extraction is inherently closed-world - the graph supplies the vocabulary, the model only the geometry that selects among it. And encoding runs at 399 entities/s on a consumer GPU, so a 100k-entity sweep costs ~4 minutes per template: batched matrix arithmetic, not autoregressive generation.
Correcting our own headline: the loud-class ride
A follow-up ran the null arm the original probe had not: what does a constant guess achieve through the same gate?
Proposing a single fixed object for every subject - "French" for the language relation - passes the gate 63 times at 88.9% precision; "United States" for citizenship commits 86 times at 66.3%. The gate cannot refuse a high-base-rate object. So the 100% above is substantially base-rate rather than earned, and under pre-declared bars 0 of 6 relations passed once these nulls were in place.
The type constraint we'd identified as future work did land, and worked: pooled precision 86.1% → 97.1%, eliminating 13 of 15 wrong commits at a 35% coverage cost.
And a real channel survives underneath. Excluding high-base-rate objects and sweeping 62,000 subjects produced 696 residual extractions with diverse objects, against a wrong-subject null of 32 and a random-direction null of 1 - beating its nulls by ~22x. Externally graded: 107 of 400 sampled rows were gradeable at all (73% are tail entities no external source covers), scoring 90.7%. In the reverse direction, 48 disagreements with the graph were hand-classified: 26 graph-right, 18 entity-linking artifacts, and 2 genuine graph errors the model caught. Against the pre-declared bar (1,000 additions at 95%) this is partial - the artifact ships exploratory, not promoted into the graph.
Result II: a negative result, reported first-class
We applied the same discipline one level deeper. SAEs decompose activations into features (Gao et al. 2024, Cunningham et al. 2023, Bricken et al. 2023); the standing weakness is that features get labeled by asking an LLM what they seem to mean - unverified and circular. Our corpus is text aligned to verified triples (REBEL), so feature labeling can be a measurement against external ground truth instead.
We trained a TopK SAE (24,576 latents, k=32) on 250k activation positions. It reconstructed well - FVE 0.9645 against a 0.60 floor, 0.07% dead latents - and under our first grounding bench it labeled 41 features at ≥90% held-out precision.
That number is wrong, and our own controls said so:
Control
First bench
Corrected bench
SAE
41 grounded
0 grounded / 121 candidate
Random directions
23 grounded
0 / 0
Shuffled labels
5 grounded
0 / 70 candidate
The mechanism generalizes, which is why we report it in detail: one class ("human") was 63% of eval mentions and nearly linearly separable in raw activations; a threshold test on a dominant, geometrically loud class is easy to pass by chance; cosine against an unnormalized class centroid mostly measures "is this an entity mention at all"; and 24,576 candidates against a 5% false-pass threshold buys ~1,200 free passes. Two weak correlational tests conjoined still admit chance.
The corrected bench subtracts the shared mention direction (centroids then measure class, not mention-ness), replaces the significance threshold with a selection-matched null (beat the max of 24,576 random directions), and requires a margin over every competing class. Under it, random directions ground nothing - and neither does the SAE. The pre-declared retry (k=16, FVE 0.990) changed nothing: zero grounded, retry delta zero. Diagnosis: ~8 scoreable activations per latent at pilot scale - starvation, not refutation - plus class imbalance. Verdict: null at this scale, revival conditions recorded (class-balanced eval, ~10× more activations, finer classes), not a rescue.
A third access path, and a third null: reading the weights at rest
Weights are the cheapest access path - no forward pass at all. FFN layers behave as key-value memories (Geva et al. 2021), so a value vector can be decoded through the output embedding to ask what a neuron writes. We scanned every neuron for programming idioms, on CPU, in ~7 minutes.
It passed the pre-declared bar on all 13 targets - and is still a null. The bar compared against 500 random draws, which scored zero, making every ratio infinite. But the search ranged over ~396,000 candidate directions. Running the null as wide as the search collapses it to 0.7x-1.8x: real neurons hit idiom tokens at essentially the random rate, and random directions achieve rank 1 on 11/13 targets, matching the real ones.
One structural finding survives:
[::-1]tokenizes as a three-token sequence, so the idiom cannot live in one neuron even in principle. The knowledge is a sequence of associations, not an address. Corpus mining beat weight-reading on every target tested.The pattern across three rungs: calibration is the whole game
Three independent attempts to read knowledge out of a model each produced an apparently strong result, and each was retracted by a null matched to the actual selection pressure:
Attempt
Apparent result
After a matched null
SAE features
41 grounded
0 - random dictionary grounded 23 under the same bar
Single-neuron weight reading
13/13 targets pass
0.7x-1.8x - null searched 500 draws against a 396,000-wide search
Two-channel retrieval union
regressions fixed, recall up
1.5x vs a union-matched null - the second channel, not the new one, did the work
I regard this as the most transferable result here. Each of the three would have been publishable as a positive finding under a conventionally-specified control. What distinguishes the surviving positives is not that they were larger - it's that they went through nulls built to match how hard we searched. One of those nulls, applied late, correctly demoted our own best number.
What this is for
Ranked by evidence:
Honest limits
Method notes
Bars written before results (the 86.1% pooled gate figure is reported as a partial failure; the identified fix was withheld from the run). Mandatory adversarial controls (they killed a 41-feature "success"). Blind splits by entity. Masked corroboration (no verification-by-lookup). Independent adversarial audit of new code (it found a commit path that could emit code contradicting a user's own example; fixed before reporting). Negative results ledgered so dead levers stay dead.
Full PDF with the complete result grids and references available; pre-registered measurement reports and code available on request.