1 Introduction↩︎

Understanding how a language model produces a behavior is central to auditing, debugging, and trusting it [1]. A common strategy in mechanistic interpretability is to localize a behavior to a circuit: a small set of components that carries out the relevant computation [2], [3]. This strategy depends on a basic primitive: assigning importance to individual components. The same primitive underlies automated circuit discovery [4], [5], feature attribution [6], [7], and structured pruning [8], [9]. In many such methods, importance is estimated in a first-order way: ablate a unit in isolation, measure the output change, and combine these single-unit effects across the circuit. Attribution and edge patching, EAP-IG [10], [11], AtP\(^\star\) [7], sparse feature circuits [12], and Wanda saliency [9] all rely, in different forms, on this node-additive view.

This view is natural when components contribute independently, but self-repair shows where it can fail. In the Hydra effect [13], [14], removing a primary component can activate a dormant backup that substitutes for it. The primary then appears less important than it is, because the model repairs the damage; the backup also appears unimportant, because it is largely silent on the intact model. A first-order score therefore misreads both sides of the redundancy. In GPT-2-small IOI, for example, ablating the name-mover heads that write the answer reduces the task logit-difference by only \(0.22\) from a clean value of \(2.53\), because backup name-movers take over. The larger effect appears only when the backups are removed as well. This is not a noisy measurement artifact but rather a violation of additivity: the IOI name-mover module is \(1.9\times\) super-additive, so the effect of removing a set is not the sum of the effects of removing its members. The resulting bias falls exactly on the redundant components that make a circuit robust and therefore propagates to attribution, knockout, and pruning downstream.

We therefore ask a conditional question: not how much a unit matters on the intact model, but how much it matters once the primary circuit has been removed. Given a candidate primary set \(\mathcal{S}\), we measure how much each remaining unit’s output effect grows under that intervention. A dormant backup has little effect alone but a large conditional effect; an irrelevant unit has neither. This reframing is substantive, not merely procedural: importance stops being an intrinsic property a unit carries and becomes a quantity defined relative to what has been removed, the only frame in which a component that stays silent until its primary fails can be said to matter at all. We call this score CoAx, for conditional co-ablation. It is label-free and output-grounded: it measures growth in Fisher-weighted ablation energy using a single-ablation baseline and one conditional pass. Conceptually, CoAx reads the second-order interaction that node-additive scores discard. Operationally, it solves conditional circuit completion: given a primary circuit found by manual analysis or a first-order method, recover the components that become causal only when that circuit is removed. Thus CoAx complements first-order discovery rather than replacing it.

Empirically, on the labeled GPT-2-small IOI circuit [4], CoAx raises backup-head identification from \(0.33\) to \(0.91\) ROC-AUC, outperforming baselines including self-repair-aware AtP\(^\star\) GradDrop (best \(0.82\)). Counterfactual patching confirms that the recovered heads causally carry the repair. The same label-free procedure transfers to induction across eight models. Once recovered, the backups also close the downstream loop: they restore a much larger self-repair-masked attribution signal (\(1.76\) versus \(0.22\) logit-difference drop), identify the components required for capability knockout (\(0.70\) accuracy, matching the \(0.72\) documented oracle), and improve structured head pruning, scaling from \(124\)M to \(7\)B. In short, first-order methods find the circuit a model uses when everything is intact; CoAx exposes the circuit it falls back on when that path is removed.

Contributions. (i) Conditional component importance. We formalize self-repair as an additivity failure of component importance, introduce conditional circuit completion, and propose CoAx, a label-free, Fisher-grounded score for recovering dormant compensators (Section 2). (ii) Causal validation of recovered backups. We validate CoAx on the documented GPT-2 IOI backup heads, a controlled-redundancy benchmark, mechanistic patching, and faithfulness/completeness checks, and show label-free transfer to induction across eight models in six architecture families (Section 3). (iii) Downstream closure. We show that the recovered backups correct self-repair-masked attribution, scope capability knockout, and yield repair-aware structured pruning (Section 4).

2 Conditional Co-Ablation: Exposing Non-Additive Importance↩︎

We study frozen decoder-only transformers. A structured unit \(u\) is any component with an additive residual-stream contribution that ablation can zero [2]; CoAx is unit-agnostic, and our main experiments use attention heads, the granularity at which head-level circuit ground truth exists. Ablating a set \(M\) of units replaces their contributions with zero and yields logits \(z_M\) over the vocabulary at a given position, with \(z_\emptyset \equiv z_0\) the clean logit vector and \(p_0=\mathrm{softmax}(z_0)\) the clean distribution (all symbols collected in Table 3). The single-unit ablation effect is \(\delta z_u = z_0 - z_{\{u\}}\).

2.1 The conditional co-ablation score↩︎

2.1.0.1 A Fisher geometry over ablations.

We measure ablation effects in the metric the output distribution induces [15]. The Fisher information of the categorical output in logit coordinates, \(F = \mathrm{diag}(p_0) - p_0 p_0^\top\), is exactly the Hessian of \(\mathrm{KL}(p_0\,\|\,\mathrm{softmax}(z))\) at \(z_0\), so a logit perturbation \(\delta z\) has second-order KL cost \(\tfrac12\,\delta z^\top F\,\delta z+ O(\|\delta z\|^3)\). We realize this metric with the centered, Fisher-weighted feature \(\widetilde{\delta z}_u = \sqrt{p_0}\odot(\delta z_u - \mathbb{E}_{p_0}[\delta z_u]\mathbf{1})\) on the top-\(r\) logits. Centering subtracts the shared logit-shift that an ablation imparts to every output coordinate at once, leaving only the part of the perturbation that changes the shape of the distribution; the \(\sqrt{p_0}\) weighting then makes the plain inner product coincide with the Fisher form, \(\langle \widetilde{\delta z}_u, \widetilde{\delta z}_v\rangle = \delta z_u^\top F\, \delta z_v\) (Proposition 1), so \(\mathcal{E}(\delta z_u)\!:=\!\mathbb{E}_{x,t}\|\widetilde{\delta z}_u\|^2\) is the mean KL energy of ablating \(u\). Collecting the centered features into a design matrix \(\bar D\) (one column per unit, its rows running over the top-\(r\) logits at each of the \(P\) calibration positions) gives the Gram (hence PSD) kernel \(\boldsymbol{H}= \tfrac1P \bar D^\top \bar D\) and the Fisher-cosine affinity \(A_{uv} = \boldsymbol{H}_{uv}/\sqrt{\boldsymbol{H}_{uu}\boldsymbol{H}_{vv}} \in [-1,1]\), our first-order baseline (close to recent weight-space head kernels [16]). Built from single ablations, \(\boldsymbol{H}\) is stable but first-order; the genuinely second-order content that recovers compensation lives in two objects it omits, and the rest of this section builds them.

2.1.0.2 Pairwise synergy.

For units \(u,v\), let \(\delta z_{uv} = z_0 - z_{\{u,v\}}\) be the joint-ablation perturbation. The synergy is the non-additive part, \[I_{uv} = \delta z_{uv} - \delta z_u - \delta z_v, \qquad S_{uv} = \mathbb{E}_{x,t}\,\|\widetilde{I}_{uv}\|^2 ,\] which vanishes when units act independently and is large when \(u\) and \(v\) compensate for one another. It captures symmetric cooperation that first-order affinity does not model.

2.1.0.3 The CoAx score.

A backup is dormant until the primaries are gone, so we score units not in isolation but after conditioning on a seed set \(\mathcal{S}\) (typically the high-saliency primaries).

This conditional growth is large for backups, whose effect appears only once \(\mathcal{S}\) is ablated, and near zero for non-redundant units. Computing it costs \(O(|\mathcal{U}|)\) forward passes per seed – the same order as one single-ablation scan, and far below the \(O(|\mathcal{U}|^2)\) of enumerating all pairs explicitly – so the conditional form is what lets the second-order signal scale to large models. The algorithm, its cost, and its calibration-data efficiency are in Appendix 7.

2.1.0.4 Division of labor.

The two signals are the two faces of non-additivity and answer two different questions. Pairwise synergy \(I_{uv}\) is the lens for cooperation, recovering symmetric same-circuit structure. The CoAx score \(\mathrm{comp}_u(\mathcal{S})\) is the lens for substitution, recovering dormant backups as a node-level compensating set. The headline discovery and all applications use the CoAx score; synergy carries the same-circuit analysis of Table 26. A glossary of the terms (primary seed, backup candidate, compensating set, conditional growth, circuit completion) is given in Appendix 7.1.1.

2.2 Why first-order misses backups and CoAx does not↩︎

Three short results make the construction precise and explain the empirics with proofs in Appendix 7.1.3. The first grounds the geometry.

The next formalizes the blind spot. Call a unit a pure backup for \(\mathcal{S}\) if it is dormant on the clean model (\(\delta z_b=0\), equivalently zero clean activation) yet carries the effect once \(\mathcal{S}\) is ablated (\(\mathcal{E}(\delta z_b\mid\mathcal{S})=\Delta>0\)); a unit is inert if it is silent throughout – zero clean activation, \(\delta z_u=0\), and \(\mathcal{E}(\delta z_u\mid\mathcal{S})=0\).

The third explains why the conditional score works and unifies the two signals: a dormant backup’s conditional growth is its second-order coupling to the seed.

Together, these results give the picture. A backup is an output-space substitute for the primaries: it writes a correlated logit direction, so its synergy \(I_{sb}\) with the seed is large even as its solo effect \(\delta z_b\) stays small. Proposition 2 makes such a head invisible to any score meeting its invariance condition; Proposition 3 shows that \(\mathrm{comp}\) reads exactly the off-diagonal interaction those scores discard, so it is genuinely second-order rather than an output-grounded re-ablation. On IOI the name-movers and their backups bind into a dense high-synergy module (Figure 2): off-diagonal mass in \(I_{uv}\) that single-ablation saliency, reading only the diagonal, leaves dark, which is why the backups occupy the low-saliency, high-CoAx corner of Figure 1a. The methods we test meet the idealized invariance only approximately, weighting each unit by clean-state statistics that nearly vanish for a near-dormant backup; this is why they land at \(0.33\)–\(0.82\) rather than chance, while CoAx reaches \(0.91\) (Table ¿tbl:tab:backup?).

3 Completing Circuits by Recovering Backups↩︎

We establish CoAx on GPT-2-small IOI, the one circuit with labeled backups. In turn, we recover the documented backups, verify they are mechanistically real, check their faithfulness, completeness, and minimality, complete circuits found automatically by first-order methods, and show the discovery generalizes across scale and architecture.

3.0.0.1 Protocol.

We use the GPT-2-small [17] IOI circuit [4], the only one with head-level backup ground truth. Two ROC-AUCs appear and are never compared: backup-AUC is node-level, ranking the documented backups given the primaries (the headline metric of Table ¿tbl:tab:backup?), and cluster-AUC is pair-level, scoring whether two heads share a circuit (Table 26). Backup-discovery numbers are means over \(4\) prompt seeds (std \(\le\!0.04\)); the controls, per-experiment seed counts, and full protocol are in Appendix 8.

3.1 Backup discovery↩︎

Table ¿tbl:tab:backup? is the central result. Backup name-movers are hard for every node-ranking baseline we test, including those explicitly designed for self-repair: single-ablation saliency (\(0.33\)), attribution patching (\(0.60\)), a self-repair-aware GIM adaptation (\(0.63\)), and EAP-IG (\(0.70\)), a strong circuit-localization baseline on the Mechanistic Interpretability Benchmark (MIB) [18]. The strongest is AtP\(^\star\) with GradDrop (\(0.82\)) [7], whose gradient-dropout is built to catch the direct-versus-indirect gradient cancellation self-repair induces; it leads the other gradient-corrected methods yet still trails CoAx at \(0.91\). The gradient baselines locate the primary name-movers well (\(\approx 0.78\); single ablation is itself partly masked at \(0.43\)). The gap is not about conditioning or a smarter gradient but the node-additive form itself: a backup’s contribution is a non-additive substitution that no additive score, however corrected, can model. Conditioning on the primaries and reading the growth in ablation effect (Eq. 1 ) makes the backups visible: CoAx places \(6\) of the \(8\) documented backups in its top \(20\) of \(141\) candidates (top-\(10\) recall \(4/8\)), far above chance.

One control deserves flagging up front: an input-side co-activation score also ranks the IOI backups highly (\(0.92\) AUC), since they co-fire with the primaries, so CoAx is not the only signal that finds them. But co-activation is correlational: it offers no causal or patching validation, it collapses on movement circuits (duplicate-token \(0.32\) vs.CoAx’s \(0.97\)), and used as a completion signal it over-ablates, its top-\(k\) pulling in co-firing core heads and flipping the IOI logit-difference sign (Appendix 9.1.2). We therefore treat it separately (Section 5) and keep causal node-ranking scores.

3.1.0.1 CoAx completes; it does not discover from scratch.

CoAx uses a primary seed, so we state both directions. The fair comparison gives a baseline the same seed: our GIM-style gradient on the primary-ablated model still reaches only \(0.63\), so conditioning is not enough, and it is the form of the score (full-distribution conditional growth, not a metric gradient) that recovers the backups. Conversely, as a standalone finder that must detect its own seed, CoAx peaks at \(0.60\) (Appendix 9.5.1), below the seed-free AtP\(^\star\) (\(0.82\)). The \(0.91\) headline is thus a completion result with documented primaries as the seed, not standalone discovery.

3.1.0.2 What the IOI numbers establish.

The ranking is statistically far from chance, by two tests that do not lean on the small positive set: a label-permutation test places the \(0.91\) AUC entirely outside the null (\(p<10^{-4}\)), and a hypergeometric top-\(k\) test is significant at every cutoff (\(6/8\) in the top \(20\), \(p=9\times10^{-5}\)). The head-to-head comparison needs more care, because a backup score is only meaningful once it holds the primary seed. Against the fair, same-seed baseline – the seeded GIM at \(0.63\) – the \(0.26\) gap is significant under a paired DeLong test over the eight backups [19] (\(p=2\times10^{-3}\)). The smaller \(0.09\) gap over the seed-free AtP\(^\star\) (\(0.82\)) holds in every seed but is underpowered on only eight positives; that under-power is an artifact of comparing against a baseline denied the seed, not evidence the effect is fragile (all tests, and across-seed variants, in Appendix 9.1.3).

Because eight documented backups cannot supply a powered head-to-head comparison, a controlled-redundancy synthetic benchmark does (Table 10, Appendix 9.1.4). With \(100\) planted backups the clean-state scores stay at or below chance – first-order energy at \(0.42\) actively anti-ranks them – while CoAx reaches \(0.90\) (\(p<10^{-15}\)), exactly as Proposition 2 predicts. The benchmark also isolates which property of the score does the work, and it is not conditioning alone: a conditional but answer-aligned GIM proxy reaches \(0.85\) yet collapses where the real IOI backups live, off the answer direction (all eight have \(\beta<0.01\), an energy fraction rather than a causal weight). Reading the full conditional distribution, CoAx stays invariant there – the same reason the real GIM reaches only \(0.63\) on IOI (Appendix [app:beta]).

3.2 Are the discovered heads real backups?↩︎

A discovery method must surface heads that behave like backups, not merely match labels. For the top-\(10\) heads by CoAx score we measure two label-free signatures: the activation ratio (output norm with primaries ablated over clean) and the conditional causal effect (the logit-difference drop from ablating the head once the primaries are gone). The documented backups among the top-\(10\) score \(1.21\) and \(+0.21\) on these, versus \(1.03\) and \(-0.12\) for the other surfaced heads; keeping only heads that both wake up and are load-bearing raises documented-backup precision in the top-\(10\) from \(0.40\) to \(1.00\) (Appendix 9). To rule out circularity, an independent structural check (a name-mover attends to and copies the IO token [4]) ranks the backups at \(0.96\) ROC-AUC while sharing none of CoAx’s machinery (Spearman \(\rho=0.09\)), corroborating the discovery rather than restating it (the bespoke read does not transfer to other circuits; Appendix 9).

3.2.0.1 How the backups take over.

Beyond labels, we trace the hand-off directly (Figure 3). As we ablate more of the primary name-movers (\(k=0,1,2,3\), strongest first), the discovered backups wake up monotonically – their output-norm ratio climbs from \(1.00\) to \(1.15\) and their conditional causal drop from \(+0.05\) to \(+0.11\) – while a matched random control stays flat. A direct-logit-attribution [20] decomposition confirms a genuine hand-off: the primary name-movers carry large positive clean DLA to the \(\text{IO}-\text{S}\) direction (\(+0.76\)), and the backups’ DLA to the answer more than doubles once the primaries are ablated (\(+0.07\!\to\!+0.21\)). Finally, counterfactual patching [21] closes the causal loop: ablating the primaries but freezing the backups to their dormant value removes \(55\%\) of the self-repair, while freezing a matched random set removes none (Figure 3d). The backups’ wake-up causally drives the repair, not mere correlation.

3.3 Faithfulness, completeness, and minimality↩︎

A discovered circuit is judged by three community-standard criteria [4]: it should be faithful (reproduce the behavior), complete (contain every component the model uses), and minimal (every component is necessary). Self-repair is precisely a completeness failure (it is how the IOI backups were first noticed), so completeness is the criterion that most sharply separates CoAx from first-order discovery, and we report all three.

3.3.0.1 Completeness.

A circuit is complete if it reproduces the full model’s response to ablating its members. We mean-ablate every head outside a circuit and measure how its IOI logit-difference responds to ablating the name-movers, relative to the full model. The first-order circuit (the documented IOI circuit without its backups, which is what an additive method recovers) is badly incomplete (gap \(0.72\)): it cannot reproduce the self-repair the model performs. Completing it with the CoAx backups closes the gap to \(0.15\), matching the complete documented circuit (\(0.16\)), whereas a matched-random completion does not (\(0.61\)). The dose-response curve of Figure 1c is the same completeness statement drawn as a trajectory.

3.3.0.2 Minimality check.

The recovered set is enriched for individually necessary compensators: once the name-movers are ablated, the documented backups among the surfaced heads have positive mean conditional logit-difference drop (\(+0.21\)) while non-backup surfaced heads average negative (\(-0.12\), §3.2). Individual-head drops are noisy (App. 9), so we read this as evidence for minimality, not proof every selected head is necessary.

3.3.0.3 Faithfulness.

Counterfactual patching (Figure 3d) gives the causal form of faithfulness: the completed circuit’s backups are the components the model actually uses under intervention – freezing them to their dormant state removes over half of the self-repair, while freezing random heads removes none.

3.4 CoAx as a completion module↩︎

In practice the primary seed comes from a first-order method, so the realistic test is whether CoAx completes an automatically discovered circuit. Seeding it with the top-\(3\) heads of AtP, EAP-IG, or AtP\(^\star\) and adding its top-\(4\) backups roughly doubles the joint-ablation IOI logit-difference drop, far above a matched-random control (AtP \(1.28\!\to\!3.11\) vs random \(1.69\); EAP-IG \(0.68\!\to\!1.71\) vs \(0.95\); AtP\(^\star\) \(1.85\!\to\!3.73\) vs \(2.25\); Table [tbl:tab:completion]), so CoAx runs end-to-end and label-free, not only on documented seeds. Two qualifications temper this. On raw faithfulness it merely ties extending the circuit by the finder’s own next-\(4\) heads (\(+\)own), though it recruits far lower-ranked ones (mean first-order percentile \(0.69\) vs \(0.97\)); what makes the identity of the heads matter, not their number, is the knockout of §4, where \(+\)own overshoots into the core circuit (\(0.24\)) while CoAx matches the documented set (\(0.70\), Table 2). And completion quality tracks seed quality: under a noisy seed the recruited heads are mid-ranked compensators of that seed rather than the cleanly dormant backups recovered from documented primaries (Appendix 9.4.2).

3.4.0.1 Same-circuit structure, and a built-in ablation.

The same second-order signal also clusters same-circuit heads (cluster-AUC, full table Appendix 11.6): pairwise synergy wins decisively on the information-movement circuits over both input-side controls (duplicate-token \(0.97\) vs.\(0.32\)/\(0.59\); induction \(0.94\) vs.\(0.75\)/\(0.89\)), because these heads share aligned output effects but neither correlated activations nor aligned value subspaces, while co-activation wins the co-located writing heads – the two lenses are complementary. This doubles as an ablation of CoAx: dropping the second-order term collapses name-mover clustering from \(0.76\) to \(0.34\), so the gain is the interaction term, not merely output-grounded ablation.

3.5 Generalization: scale and architecture↩︎

IOI is the only circuit with documented head-level backups, so we test that the discovery generalizes along two axes (Figure 4): scale, the same IOI circuit on larger models, and architecture, a second redundant circuit (induction) across model families.

3.5.0.1 Scale: backups replicate across the GPT-2 family.

We run the identical label-free pipeline (detect the name-mover primaries by direct-logit attribution, recover compensators by conditional growth, validate by mechanism) on GPT-2 medium and large, which carry no backup labels. On every size the recovered set wakes up when the primaries are ablated – its output-norm ratio is \(1.15\), \(1.05\), and \(1.13\) (small, medium, large) versus \(\approx\!1.00\) for the rest of the model (\(\le\!0.01\) std over two seeds; Figure 4a) – and is load-bearing only then (Appendix 9). The headline backup structure is not a GPT-2-small artifact.

3.5.0.2 Architecture: conditional completion transfers across families.

We apply CoAx to induction, a second attention-mediated circuit known to be redundant across heads [22], with a fully label-free pipeline that also detects the primaries. On GPT-2-small, seeding the documented induction heads returns a compensating set that is necessary only once the primaries are gone (conditional causal drop \(0.89\) versus \(0.05\) random); ablating the primaries barely moves the induction log-probability (drop \(0.27\)), but adding the discovered compensators drops it by \(8.5\), about \(10\times\) the matched-random control. This holds on eight further models spanning six architecture families (Figure 4b), with attribution factors of \(2.1\) to \(12\times\). A stronger \(+\)own control (the model’s own next-strongest induction heads; Figure 4c) confirms the recovered set is load-bearing, but CoAx and \(+\)own are comparable here: induction’s redundancy is shared among co-firing homogeneous heads, with no distinct backup class to single out, so we claim label-free recovery, not unique identification (Appendix 9).

3.5.0.3 Scope and regime.

CoAx targets the harder dormant-substitution regime, where a unit is silent until a primary is removed (IOI) and first-order scoring provably fails (Prop. 2). Where redundancy is instead shared among units that already co-fire (induction is closer to this) the components are not hidden, so even input-side co-activation finds them and CoAx is complementary there, not a replacement. At the other extreme the head-level signal does not transfer to the MLP-dominated greater-than circuit [23] (a preliminary FFN-group probe recovers only \(1.5\times\) over random, within one std), suggesting greater-than carries much weaker recoverable self-repair at this granularity – a property of the circuit, not the unit (Appendix 9.4.3). The recovery is robust to the primary seed, the ablation value, and the prompt template, but the seed must be the functional primary circuit; full seed, template, and cross-model-geometry sweeps are in the appendix.

4 Closing the Loop: Attribution, Knockout, and Pruning↩︎

A blind spot in component importance does not stay confined to discovery. Attribution, knockout, and pruning all rank components by the same node-additive score, so each inherits the same error wherever a circuit is redundant: it under-credits the primary whose damage is repaired and overlooks the backup that repairs it. We close the loop by feeding the recovered backups – the output of CoAx, computed once and label-free – back into all three pipelines. That one set serves all three: it restores the causal effect self-repair had hidden from attribution, supplies exactly the compensators a capability knockout must also remove, and yields a pruning order that keeps a backup once its primary is gone. The paper’s thesis is in this sense operational and not merely diagnostic: conditioning on what has already been removed repairs the measurements the blind spot had distorted.

6pt

4.1 Attribution: recovering the masked causal effect↩︎

Attribution asks how much a set of heads is worth, read off as the behavioral change when they are ablated. On the IOI name-movers that question returns the wrong answer: ablating the primaries alone drops the logit-difference by only \(0.22\) (four-seed mean, clean \(2.53\); the single-seed value is \(0.11\), reconciled in Appendix 10), because their backups absorb the damage. Re-attributing the same set together with the CoAx backups recovers a \(1.76\) drop (Table 1) – the effect the redundancy had hidden. We benchmark this against the two controls that matter, rather than the inflated ratio over the over-masked baseline: it exceeds a matched random top-up (\(1.0{\pm}0.7\)) and even the curated documented backups (\(1.15\)) at every seed. The margin over the documented set is small but consistent, which we read as a hint that the hand-annotated list does not exhaust the functional compensators – the extra surfaced heads carry the same backup signature (Appendix 9) – rather than as noise.

6pt

4.2 Circuit knockout: a capability needs its backups removed↩︎

Knockout is the mirror image of attribution: to disable a behavior one must remove its backups too, or self-repair restores it. Ablating the documented name-mover primaries – the heads a first-order analysis would call “the circuit” – barely dents IOI accuracy (\(1.00\!\to\!0.97\)); the behavior survives, fully masked (Table 2, \(4\) seeds). Adding the label-free CoAx backups is what brings accuracy down to \(0.70\), matching the documented-backup oracle (\(0.72\)). What turns this into a statement about which heads rather than how many is the first-order top-up: extending the ablation by the same number of the model’s own next-ranked heads overshoots to \(0.24\), cutting past the backups into the core name-movers (Figure 1c). CoAx recovers the specific compensators a complete knockout needs, not merely more of them. Accuracy need not fall to chance – IOI retains redundancy beyond the name-mover family – so the informative quantity is the ordering across sets, not the absolute floor.

4.3 Pruning: a repair-aware removal order↩︎

A one-shot pruner scores every head independently, so self-repair hides a redundant group’s joint importance: a primary and its backup each rate low on their own, the group is pruned together, and the behavior it carried collapses. The fix is again conditioning. We prune sequentially, re-measuring the CoAx score after each removal, so a backup’s importance rises the moment its primary leaves and the pruner keeps it. The benefit comes in two layers (Figure 5a–d; full sweep Appendix 11). First, the co-ablation energy is already a strong standalone head score: across four models from \(124\)M to \(7\)B it beats every weight-, magnitude-, and gradient-based baseline, including the strong gradient-Taylor order wherever Taylor is defined (\(50\%\)-sparsity perplexity \(80.6\) vs \(201.4\) on GPT-2-small, with the margin holding on GPT-2-large and Pythia-1.4B). Second, re-measuring sequentially adds a further self-repair-aware gain that widens with sparsity (\(80.6\) vs \(112.6\) for the static order); because the two orders share the identical signal and differ only in the conditioning, this increment isolates the value of conditioning itself. The dominant effect is the better head score, which the sequential pass then refines – the same conditional principle, now used to retain the very components a behavior depends on. Zero-shot accuracy tells the same story (Appendix 11).

5 Related Work↩︎

5.0.0.1 Most automated discovery relies on additive scores.

ACDC [5], attribution and edge patching [6], EAP-IG [11], and AtP\(^\star\) [7] score a component by its single-node effect and select greedily; [5] already observe that this systematically misses the negative and compensating components a circuit relies on. A newer wave (sparse feature circuits [12], information-flow routes [24], contextual decomposition [25], and edge pruning [26]) refines the search but still selects through additive or locally linear scores, and so inherits the same blind spot. Our pairwise synergy \(I_{uv}\) is the second-order correction these methods omit: CoAx beats EAP-IG (strong on MIB [18]) and AtP\(^\star\) on backup recovery while matching them on the non-redundant primaries, so it adds the missing axis without giving up the one they already have.

5.0.0.2 Self-repair and redundancy.

The Hydra effect [13], IOI backup name-movers [4], copy-suppression [27], and anti-erasure mechanisms [14] are established by manual knock-out-and-inspect. Methods that automate around self-repair either diagnose it ([28] show joint ablation does up to an order of magnitude more damage than summed single ablations) or de-bias a node’s own score to undo the masking (GIM [29]; AtP\(^\star\) GradDrop [7]). Both keep importance node-additive, so neither names the compensating heads; CoAx does, and confirms them causally. A fair GIM that shares our seed still reaches only \(0.63\) versus \(0.91\), which pins the gap to the node-additive form rather than to conditioning.

5.0.0.3 Second-order and interaction-aware importance.

Second-order structure underlies weight pruning, from Optimal Brain Damage [30] to the Fisher framework of [8]; inference-time pruners select pathways from representation–parameter probes [31], an input-side signal complementary to our output-grounded order. Neuron Shapley [32] accounts for interactions but by combinatorial sampling, not a closed-form output-grounded kernel. Closest in vocabulary is the concurrent synergistic core [33], which ranks heads by the information-theoretic synergy of their activation statistics, an input-side and correlational notion. This input-side family is strong on IOI, where the backups co-fire with the name-movers (co-activation alone reaches \(0.92\) AUC), so we do not claim CoAx is the only signal that finds them. But being correlational it gives no causal or patching validation, collapses on movement circuits, and over-ablates when used to complete a circuit (§3.1, Appendix 9.1.2). CoAx is the opposite kind of measurement – causal and output-grounded – which is precisely what lets it carry the downstream attribution, knockout, and pruning results that a correlational ranking cannot.

6 Conclusion↩︎

Self-repair shows that a component’s importance is not a property it carries alone, but one that surfaces only in relation to the rest of the circuit: the heads that matter most are often those that do nothing until another fails. Once we stop scoring units in isolation and instead ask how each responds when the primary set is removed, the redundancy that hides from first-order analysis becomes something we can name, rank, and intervene on. CoAx makes that shift concrete and cheap, turning a known or discovered primary circuit into the explicit backup set behind it, and with it repairing the attribution, knockout, and pruning pipelines the blind spot had quietly corrupted. Faithful interpretability of a robust model, we argue, must therefore be conditional: redundancy is not noise to be averaged out but structure to be conditioned on.

Appendix Overview↩︎

This appendix provides the material supporting the main text: the method details and proofs, the full experimental protocol, and the complete per-model and per-seed results behind every reported number. It is organized by topic, in the order the main text introduces them.

• Appendix 7, Method details. In three parts: the definitions, Fisher geometry, and proofs; the algorithm, its cost, efficiency, and implementation; and the hyperparameters with the ablation-value and calibration-efficiency robustness studies.

• Appendix 8, Experimental setup. Models, calibration and evaluation data, circuit ground truth, metric definitions, and the full baseline roster with implementation notes.

• Appendix 9, Discovery, full results. In five parts: (i) statistical significance and controls (per-seed AUC, permutation / hypergeometric / DeLong tests, the synthetic benchmark, and the co-activation control); (ii) evidence the surfaced heads are genuine backups (wake-up and hand-off, the signature filter, a single-head case study, and circuit visualizations); (iii) what the score keys on (the feature ablation and the module’s non-additivity); (iv) generalization, completion, and scope (induction across scales and architectures, completing automatically-discovered circuits, and the greater-than boundary); and (v) robustness (primary seed and prompt template).

• Appendix 10, Attribution and removal, full results. Per-seed attribution correction, the relation to behavior-faithfulness metrics, and the per-seed capability-removal accuracy.

• Appendix 11, Pruning and cross-scale geometry, full results. All sparsities, models, and tasks; the Taylor baseline; per-seed downstream accuracy; the module-partition negative; and the per-model vs-active geometry numbers for all twelve models.

• Appendix 12, Limitations, broader impact, and reproducibility. An honest account of scope, societal impact, and the code map, commands, and compute for reproduction.

7 Method Details↩︎

7.1 Definitions, geometry, and proofs↩︎

7.1.1 Terminology↩︎

We fix the vocabulary used throughout. Primary seed \(\mathcal{S}\): the components whose removal triggers compensation, supplied by the analyst or by a first-order discovery method. Backup candidate \(u\): a unit whose conditional ablation effect increases after \(\mathcal{S}\) is removed. Compensating set \(\mathcal{B}\): the top-ranked backup candidates CoAx returns, optionally filtered by the mechanistic signatures. Conditional growth: the increase in Fisher ablation energy of a unit once \(\mathcal{S}\) is ablated, i.e.the CoAx score \(\mathrm{comp}_u(\mathcal{S})\). Pairwise synergy \(I_{uv}\): the symmetric non-additivity of jointly ablating two units. Circuit completion: adding a compensating set to a first-order-discovered primary circuit. We say “second-order” in the intervention sense (removing a set \(\neq\) summing its members), and reserve “backup/compensator” for candidates that also pass a behavioral sign or signature check.

7.1.1.1 Notation.

Table 3 collects every symbol used in the method and proofs.

4pt

7.1.2 Fisher-weighted co-ablation features↩︎

For a frozen model with dense next-token distribution \(p_0\) at a calibration position, ablating unit \(u\) changes the logits to \(z_{\{u\}}\), giving \(\delta z_u = z_0 - z_{\{u\}}\). The Fisher information of the categorical output, \(F = \mathrm{diag}(p_0) - p_0 p_0^\top\), is the local second-order form of \(\mathrm{KL}(p_0 \,\|\, p_{\{u\}})\), so \(\tfrac12\,\delta z_u^\top F\, \delta z_u\) is, to second order, the KL cost of the ablation. We work with the centered, Fisher-weighted feature \(\widetilde{\delta z}_u = \sqrt{p_0}\odot(\delta z_u - \mathbb{E}_{p_0}[\delta z_u]\mathbf{1})\) on the top-\(r\) logits (\(r{=}192\)), making \(\langle \widetilde{\delta z}_u, \widetilde{\delta z}_v\rangle\) a Fisher inner product and the Gram matrix \(\boldsymbol{H}\) positive semidefinite. The centering removes the shared logit-shift direction that otherwise inflates every pairwise affinity; the design ablation in Appendix 9 shows it is the load-bearing ingredient.

7.1.3 Proofs↩︎

Throughout, a position contributes a clean logit vector \(z_0\) with \(p_0=\mathrm{softmax}(z_0)\), and \(\overline{a}:=\mathbb{E}_{p_0}[a]=\sum_i (p_0)_i a_i\) for a vector \(a\). The feature map \(a\mapsto\widetilde{a}=\sqrt{p_0}\odot(a-\overline{a}\mathbf{1})\) is linear in \(a\).

7.2 Algorithm, cost, and implementation↩︎

7.2.1 Algorithm and complexity↩︎

The single-unit features and one conditional pass are each \(O(|\mathcal{U}|)\) forward passes. The explicit pairwise synergy is \(O(|\mathcal{U}|^2)\) and is restricted to a candidate set for large models. The greedy self-repair-aware pruning order of Appendix 11 amortizes the same forwards: at each step it re-uses the conditional baseline and evaluates the marginal energy of every remaining unit (Algorithm 7).

The static co-ablation order scores once with \(\mathcal{E}(\delta z_u\mid\emptyset)\) (the diagonal of \(\boldsymbol{H}\)) and never re-measures; the two orders share the identical signal and differ only in the conditioning on \(\mathcal{P}\), which is what isolates the self-repair-aware gain in Appendix 11.

7.2.2 Cost↩︎

CoAx adds a single conditional pass to the single-ablation pass, both \(O(|\mathcal{U}|)\) forward passes and no backward passes. Table 4 reports the resulting wall-clock time and peak memory on one GPU: from a few seconds on GPT-2-small to about two minutes on a \(1.3\)B model, with memory dominated by the frozen model itself.

4pt

7.2.3 Efficiency↩︎

We do not claim CoAx is the cheapest score – a single gradient pass costs less – but its efficiency profile is favorable in the dimensions that matter for a discovery primitive (Figure 8). (i) Forward-only and label-free. CoAx needs no backward pass and no task gradient: it is \(2|\mathcal{U}|{+}1\) forward passes per seed (\(|\mathcal{U}|\) for the single-ablation baseline, \(|\mathcal{U}|\) for the conditional pass, one for the seed-ablated reference), so it parallelizes trivially and never differentiates the model. The gradient baselines (AtP, EAP-IG, AtP\(^\star\)) each need a backward pass and a task metric, yet top out at \(0.82\). (ii) The conditional form avoids a quadratic cost. The second-order signal is, in its explicit form, the pairwise synergy \(I_{uv}\) over all pairs – \(O(|\mathcal{U}|^2)\) forward passes (\(\approx\!10^4\) for GPT-2-small). The conditional score \(\mathrm{comp}_u(\mathcal{S})\) recovers the same backup-revealing information at \(O(|\mathcal{U}|)\) by conditioning on the seed once rather than enumerating pairs, a \(\sim\!36\times\) saving at this scale that grows with model size. (iii) Data-cheap. Because the score is calibration-only, it is also cheap in data: \(32\) unlabeled prompts already reach \(0.90\) backup AUC (Figure 9a). Wall-clock and memory for the two passes are in Table 4; on GPT-2-small the full discovery is a few seconds on one GPU.

Table 5 gives the per-method cost breakdown behind Figure 8: forward and backward passes (symbolically and for GPT-2-small, \(|\mathcal{U}|{=}144\), \(L{=}12\)), forward-pass-equivalents (FPE; one backward \(=\) two forwards), whether the score is label-free, and its backup AUC. The pattern is that CoAx buys the only \(0.91\) with forward passes alone and no labels, and its conditional route is \(\sim\!36\times\) cheaper than the explicit pairwise synergy that carries the same second-order signal.

5pt

7.2.4 Implementation details↩︎

We make the score precise to support reproduction.

• Energy. \(\mathcal{E}(\delta z_u\mid\mathcal{S})=\mathbb{E}_{x,t}\,\|\widetilde{\delta z}_{u\mid\mathcal{S}}\|^2\) is the mean squared Fisher norm of the conditional perturbation, averaged first over token positions within a prompt and then over prompts (equal weight per prompt).

• Top-\(r\) logits. The top-\(r\) index set is taken once from the clean distribution \(p_0\) and held fixed across all ablated passes, so features live in a common space.

• Seed ablation. The primary set \(\mathcal{S}\) is ablated jointly (all its heads zeroed together), not seeded one at a time, and the conditional baseline \(z_\mathcal{S}\) is shared across all units to make the pass \(O(|\mathcal{U}|)\).

• Self-exclusion. The score is computed only for \(u\notin\mathcal{S}\).

• Ranking. We rank by \(\mathrm{comp}_u(\mathcal{S})\) directly; no ReLU or thresholding. Negative values (units that lose effect once \(\mathcal{S}\) is gone) simply rank low.

• GQA units. Under grouped-query attention, a unit is a KV-aligned query group, so ablation respects the shared key-value head.

7.3 Hyperparameters and robustness↩︎

7.3.1 Hyperparameters↩︎

Top-\(r\) logits \(r{=}192\) (backup AUC stable within \(0.01\) for \(r\in\{96,192,384\}\)); \(96\) IOI-exercised prompts for discovery; \(48\) to \(64\) calibration windows for pruning. Zero ablation by default. Pruning interaction strength \(\lambda{=}1.0\), reduced to about \(0.5\) for GQA models where FFN units over-correlate. Primary set size is the documented primary count (three name-movers for IOI, four induction heads); results are stable for seed sizes \(2\) to \(3\) (Appendix 9.5.1). Table 6 consolidates every hyperparameter and random seed.

5pt

7.3.2 Robustness to the ablation value↩︎

Faithfulness conclusions can depend on how a component is ablated [34], so we recompute the backup-discovery AUC under four ablation values for the same CoAx score (Table 7): zero, mean (the expectation of resample), a single real resample activation per head, and Gaussian noise matched to each head’s per-dimension mean and standard deviation. The compensation AUC stays in \(0.87\)–\(0.92\) across all four while the single-ablation saliency stays at \(0.33\)–\(0.39\): the CoAx ranking is a property of the conditional geometry, not of one ablation choice.

8pt

7.3.3 Method analysis: efficiency, ablation, and when CoAx wins↩︎

Figure 9 collects three diagnostics of the score. (a) Data efficiency. Because CoAx is calibration-only, a practical question is how many prompts it needs: it is already strong at \(32\) unlabeled prompts (\(0.90\) AUC) and saturates by \(\sim\!64\) (even \(16\) reach \(0.86\)), so label-free discovery is also data-cheap. (b) What is load-bearing. The one design choice that matters is centering the features against the output distribution – worth \(+0.11\) AUC (\(0.91\!\to\!0.80\)), removing the shared logit-shift direction that otherwise inflates every affinity; the Fisher \(\sqrt{p_0}\) weighting over a plain \(\ell_2\) inner product is a small but consistent \(+0.01\). (c) CoAx is alignment-invariant. On the synthetic benchmark, sweeping the backups’ answer-alignment \(\beta\) shows CoAx’s full-distribution energy is flat in \(\beta\) while the answer-direction GIM gradient degrades from above CoAx(aligned backups) toward chance as backups move off the task metric; the clean-state scores stay at chance throughout. The measured real-IOI backups (\(\beta\!\approx\!0\), Appendix 9.1.4) sit at the off-answer end, where an answer-gradient is near-blind while CoAx holds.

8 Experimental Setup↩︎

8.1 Models↩︎

GPT-2 [17] (small 124M, medium 355M, large 774M), Pythia [35] (160M, 410M, 1.4B), GPT-Neo-1.3B [36], Gemma-2 [37] (2B, 9B), OLMo-2-7B [38], Llama-3.1-8B [39], and Qwen-2.5-7B [40]. All frozen; no fine-tuning, LoRA, or recovery is used for any method or baseline, which keeps every comparison at matched parameters and matched compute.

8.2 Circuit ground truth↩︎

IOI head-level labels are from [4]: name-mover, negative-name-mover, backup-name-mover (eight heads), S-inhibition, induction, duplicate-token, and previous-token heads. Induction, duplicate-token, and previous-token heads are additionally detected empirically by their attention offset on repeated-random sequences (previous-token attends to position \(p{-}1\), duplicate-token to \(p{-}T\), induction to \(p{-}T{+}1\)). Greater-than circuit heads are from [23].

8.3 Data↩︎

IOI prompts instantiate the template “When {A} and {B} went to the {place}, {B} gave a {object} to” with names, places, and objects drawn from the single-token pools of [4]; the indirect object (IO) is the name that appears once and the subject (S) the name that repeats. We sample \(96\) fillings for discovery and average attention patterns over \(40\) fillings of a fixed template (Figure 15). Two alternative surface templates are used for the robustness check of Appendix 9.5.2. Induction uses uniformly random token sequences repeated once (a prefix followed by an identical copy), with the induction behavior scored at the second occurrence; primaries are the heads whose attention offset matches the induction pattern. Pruning calibrates and measures perplexity on WikiText-2 [41] train/test windows. Zero-shot accuracy uses PIQA [42], ARC-Easy [43], and HellaSwag [44] with length-normalized log-likelihood, the lm-eval-harness convention.

8.4 Metrics↩︎

Pair-level vs-active ROC-AUC measures whether an affinity places two heads of the same documented circuit closer than two heads of different active circuits. Node-level ROC-AUC measures backup identification given the primaries. Attribution uses the IOI logit-difference. Pruning uses WikiText-2 perplexity and zero-shot accuracy. The two discovery targets – cluster-AUC (pair-level same-circuit) and backup-AUC (node-level backup detection) – are distinct measurements of the same geometry, named and reported separately throughout.

8.5 Baselines↩︎

First-order attribution: single-ablation saliency; AtP [6] (gradient times activation); EAP-IG [11] (integrated gradients [10], \(5\) steps); a GIM-style conditional adaptation [29] (gradient attribution on the primary-ablated model, so backups are no longer dormant when scored); and AtP\(^\star\) GradDrop [7] (\(L\) backward passes, each zeroing the gradient through one block output to cut its indirect path, mean of per-head absolute scores). We implement the GradDrop component of AtP\(^\star\), the part relevant to self-repair’s gradient cancellation; the QK-fix targets attention saturation, not head-output nodes. Input- and weight-side controls: co-activation correlation and the projection kernel [16]. Pruning: random, magnitude, Wanda [9], and gradient Taylor [45].

9 Discovery, Full Results↩︎

This part is organized into five groups: the statistical strength of the recovery and its controls (§9.1); mechanistic evidence that the surfaced heads are genuine backups (§9.2); what the score keys on (§9.3); generalization, completion, and scope (§9.4); and robustness (§9.5).

Two views frame the discovery results that follow: Figure 10 shows why CoAx reaches its headline AUC on GPT-2-small – the documented backups are inseparable under first-order saliency but separate cleanly under conditional co-ablation – and Figure 11 shows the same first-order blind spot recurring across the GPT-2 family.

9.1 Statistical significance and controls↩︎

9.1.1 Per-seed backup AUC↩︎

Table 8 gives the backup ROC-AUC of CoAx and every baseline on each of the four prompt seeds. What matters here is not the mean but its stability: the method ordering is identical on all four seeds and CoAx has the smallest spread (\(\pm0.004\), an order of magnitude tighter than the gradient baselines’), so the headline \(0.91\) reflects the conditional geometry rather than a favorable draw of prompts. This per-seed invariance is also what licenses the across-seed paired test of Appendix 9.1.3, which treats each seed’s AUC as an independent sample.

4pt

9.1.2 Co-activation ranks the backups but cannot complete the circuit↩︎

An input-side co-activation score ranks the IOI backups highly (\(0.93\) AUC here, ranking each head by its mean \(|\text{correlation}|\) of attention-output norm with the name-mover primaries), because backups co-fire with the primaries. We give this signal every advantage on the downstream task and run its top-\(k\) through the identical attribution-recovery test as CoAx(Table 9). The high AUC does not transfer: ranking by co-firing cannot tell a dormant backup from any other co-active circuit head, so the co-activation top-\(8\) pulls in an S-inhibition head (\(8.10\)) and two negative-name-movers (\(10.7,11.10\)) alongside three real backups. Adding that set to the primary ablation over-ablates the circuit – the IOI logit-difference flips sign (a drop of \(2.60\) from a clean \(2.53\)) – rather than recovering the name-mover circuit’s masked effect (documented backups \(1.15\); CoAx \(1.97\)). Co-activation is thus a strong same-circuit ranking signal but not a causal completion score: it conflates roles where CoAx’s conditional-growth signal isolates the compensators. This is the controlled version of the qualitative claim in §3.1; it is also why we keep Table ¿tbl:tab:backup? to causal node-ranking scores and analyze co-activation separately.

6pt

9.1.3 Statistical significance↩︎

The CoAx advantage over the strongest first-order baseline (AtP\(^\star\) GradDrop) is small in absolute AUC (\(0.909\) versus \(0.815\)) but extremely consistent: CoAx wins in all four seeds, with per-seed gaps \(+0.071,+0.064,+0.055,+0.134\). We report two tests. A paired test across seeds, treating each seed’s AUC as one independent sample (the seeds draw independent prompt sets), gives mean gap \(+0.081{\pm}0.036\), \(t_3=4.48\), \(p=0.021\): significant. A per-ROC DeLong test on the seed-averaged scores gives \(p=0.16\) and a \(95\%\) bootstrap CI (resampling candidate heads) of \([0.82,0.98]\) for CoAx versus \([0.74,0.92]\) for AtP\(^\star\), which overlap. The per-ROC test is underpowered by design: the IOI ground truth documents only eight backup heads, so a single ROC has high variance. The across-seed test is the appropriate one for the head-to-head comparison; the small documented-backup set is a limitation of the benchmark, not of the effect, which is monotone across every seed and every feature variant (Table 17).

9.1.3.1 The fair, same-seed comparison is significant.

The DeLong test above pits CoAx against the seed-free AtP\(^\star\) – a baseline that never receives the primary seed CoAx uses, so the \(0.094\) gap conflates the score with the seed and the comparison is, if anything, stacked against us. The apples-to-apples baseline is the seeded GIM-style gradient, computed on the same primary-ablated model (\(0.648\) on the seed-averaged scores, \(0.626{\pm}0.045\) across seeds), which isolates the form of the score. Here the gap is \(0.26\) and it clears significance on both tests: a per-ROC DeLong on the seed-averaged scores gives \(p=2.0{\times}10^{-3}\), and the across-seed paired test gives mean gap \(+0.266{\pm}0.045\), \(t_3=11.9\), \(p=1.3{\times}10^{-3}\) (wins \(4/4\), per-seed \(+0.20,+0.30,+0.27,+0.29\)). The earlier \(p=0.16\) is thus an artifact of comparing against an unfairly seed-free baseline, not evidence that the effect is underpowered: against the baseline that holds the seed fixed and varies only the score, CoAx’s IOI advantage is significant.

Two further exact, non-parametric tests confirm the ranking is far from chance and do not rely on the \(n{=}4\) approximation. A hypergeometric top-\(k\) test (population \(141\), \(8\) positives) on the CoAx ranking gives \(3/8\) in the top-\(8\) (\(p{=}6.0{\times}10^{-3}\)), \(4/8\) in the top-\(10\) (\(p{=}8.1{\times}10^{-4}\)), \(5/8\) in the top-\(15\) (\(p{=}3.2{\times}10^{-4}\)), and \(6/8\) in the top-\(20\) (\(p{=}9.2{\times}10^{-5}\)). A label-permutation test (\(10{,}000\) shuffles of the backup labels against the fixed CoAx scores) places the observed AUC of \(0.91\) entirely outside the null (null mean \(0.50\), \(95\)th percentile \(0.68\), \(p<10^{-4}\)). Both are exact under their nulls and appropriate to the small positive set.

9.1.4 Controlled-redundancy synthetic benchmark (Table 10)↩︎

Because the IOI ground truth documents only eight backups, the per-ROC comparison of CoAx against the baselines is underpowered there. We therefore build a synthetic benchmark in which the number of planted backups is a free parameter. We stress that this is a mechanistic instrument, not a realism claim: realism is established on IOI; the synthetic only isolates which property of a score lets it see a conditionally-active backup – conditioning (not magnitude or a clean-state gradient), and full-distribution energy (not an answer-direction projection).

7pt

9.1.4.1 Generative model.

We plant the self-repair mechanism, not the score. Fix an “answer” direction \(e\in\mathbb{R}^{r}\) (\(r{=}192\), the top-\(r\) logit support). Each unit \(u\) has an output direction \(w_u\) and a scalar gate \(a_u\); its clean ablation effect is \(\delta z_u^{\text{clean}} = a_u^{\text{clean}} w_u + \varepsilon\) with i.i.d.Gaussian observation noise \(\varepsilon\) (\(\sigma{=}0.05\), the scale of a dormant gate and a realistic stand-in for the low across-prompt variance of an ablation effect averaged over the calibration set; we sweep it below). We draw three populations. Primaries (\(K{=}4\)): directions aligned with the answer, \(w_p = \gamma e + \sqrt{1-\gamma^2}\,w_p^{\perp}\) (\(\gamma{=}0.7\)), with large clean gate (\(\approx 0.9\)). Backups (\(M{=}100\)): each shadows a random primary, \(w_b = \mathrm{norm}(w_{p} + \text{small jitter})\), so it writes the answer direction; it is near-dormant on the clean pass (\(a_b^{\text{clean}}\!\approx\!0.04\)) but its gate opens once the primaries are removed (\(a_b^{\text{cond}}\!\sim\!0.42\), with across-unit spread so wake-up is graded). Inert (\(Z{=}100\)): random directions, small clean gate (\(\approx 0.13\)), and no gating change. The conditional effect \(\delta z_{u\mid\mathcal{S}}\) uses the wake-up gate for backups and the clean gate otherwise. This is exactly the regime of Proposition 2: backups are invisible to a clean-state magnitude score yet have large conditional growth.

9.1.4.2 Scores.

On these effects we compute four scores per unit. First-order energy \(\|\delta z^{\text{clean}}\|^2\) (full-space magnitude). AtP\(^\star\)-style \(|\langle\delta z^{\text{clean}},e\rangle|\): the answer-aligned clean signal (activation \(\times\) metric-gradient). Both are clean-state scores, and both are blind to a near-dormant backup: its clean effect \(\delta z^{\text{clean}}\) is tiny (\(a_b^{\text{clean}}\!\approx\!0.04\)), so neither its energy nor its answer-projection separates it from an inert unit – exactly Proposition 2. GIM-style \(|\langle\delta z^{\text{cond}},\hat{e}\rangle|\): answer-aligned but conditional, along a noisily estimated direction \(\hat{e} = \mathrm{norm}(e + \text{noise})\) (a gradient estimate has error). CoAx \(\|\delta z^{\text{cond}}\|^2 - \|\delta z^{\text{clean}}\|^2\) (conditional growth, Eq. 1 ).

9.1.4.3 Task, test, and trials.

The positive set is the \(M{=}100\) backups, the negative set the \(Z{=}100\) inert units (primaries excluded). We report per-ROC AUC for each score and a paired DeLong test of CoAx against each baseline over the same units, across \(40\) independent trials (fresh directions, gates, and noise per trial; the global seed is fixed only for reproducibility). Table 10 reports mean\(\pm\)std AUC and the median DeLong \(p\). The clean-state scores sit at or below chance: the AtP\(^\star\)-style gradient is at chance (\(0.51\)), and first-order energy is below chance (\(0.42\)) because a dormant backup carries less clean magnitude than an inert unit, so an energy ranking actively places backups beneath the negatives. A dormant backup leaves no clean-state trace, so no clean-pass score can find it. The conditional scores clear chance: CoAx\(0.90\), beating both clean-state scores decisively (\(p<10^{-15}\)), and the conditional GIM-style proxy \(0.85\). Conditioning is what lifts a score above chance; the two conditional scores separate by how a backup compensates (next paragraph). Robustness to the noise level \(\sigma\) is in Table 12.

9.1.4.4 CoAx is alignment-invariant; an answer-gradient is not.

The two conditional scores measure different quantities, and they part company by how a backup compensates. CoAx reads the full-distribution conditional energy, so it is invariant to whether the backup writes the task-answer direction; the GIM-style answer-gradient only sees the component of the backup’s effect on that direction. Sweeping the backups’ answer-alignment \(\beta\) (Table 11): CoAx holds at \(0.90\) throughout, while the answer-gradient GIM ranges from \(0.95\) when backups write the answer directly (\(\beta{=}0.9\)) down to \(0.59\) when they compensate off the answer direction (\(\beta{=}0.1\)); the two are close only in a narrow band of high alignment. Where do real IOI backups sit? We measured it head by head: decomposing each documented backup’s conditional ablation effect (primaries ablated) into the task \((\text{IO}-\text{S})\) direction and its orthogonal complement, the answer-direction energy fraction is tiny and tightly clustered – all eight backups have \(\beta<0.01\) (per head: \(9{.}0{:}0.000\), \(10{.}2{:}0.000\), \(11{.}9{:}0.001\), \(10{.}1{:}0.001\), \(9{.}7{:}0.001\), \(10{.}10{:}0.002\), \(10{.}6{:}0.004\), \(11{.}2{:}0.010\); mean \(0.002\), across-head s.d.\(0.003\)), at or below the random-direction reference \(\beta_{\text{rand}}\!=\!1/|\text{supp}|\!=\!0.005\).

This does not contradict the backups being load-bearing. \(\beta\) is an energy fraction on a single ray, not a backup’s causal weight on the answer: any head’s ablation reshapes the whole next-token distribution, so even the name-mover primaries place only \(\beta\!\approx\!0.002\) on the \(\text{IO}-\text{S}\) ray. The backups demonstrably do repair the answer – patching their dormant activations removes \(55\%\) of the self-repair (§3.2) and DLA shows the hand-off – but that repair lives in a sliver of the energy they move, consistent with copy-suppression / anti-erasure heads reshaping the full distribution [27]. An answer-gradient score sees only that sliver, at vanishing signal-to-noise; CoAx reads the full conditional energy and is blind to \(\beta\). That is precisely why on the synthetic sweep the answer-gradient GIM collapses off-answer (\(0.90\) vs \(0.59\)–\(0.75\), DeLong \(p<10^{-3}\) for \(\beta\le0.3\)) while CoAx stays flat, and why the real GIM reaches only \(0.63\) on IOI while CoAx reaches \(0.91\). We place the primary novelty on the task formulation and Propositions 2–3, not on this statistic dominating every conditional score.

5pt

6pt

9.2 The discovered heads are real backups↩︎

9.2.1 Top-\(k\) recall and qualitative top-10↩︎

ROC-AUC measures how highly backups rank among all \(141\) candidate heads. As a complementary, more interpretable view, top-\(k\) recall counts documented backups in the top \(k\) of the CoAx ranking: \(3/8\) at \(k{=}8\), \(4/8\) at \(k{=}10\), \(5/8\) at \(k{=}15\), and \(6/8\) at \(k{=}20\), all far above the chance rate of \(k{\cdot}8/141\). Table 14 lists the top-\(10\) heads with their two mechanistic signatures. The documented backups among them have high activation ratio and positive conditional causal drop; the non-documented heads split into plausible additional backups with the same signature (e.g.\(11.6\), ratio \(1.15\)) and a few early-layer heads ranked by raw energy that lack it, which the signature check screens out. This is why we rely on the mechanistic signatures, not the ranking alone, to claim the surfaced heads behave like backups.

9.2.2 Mechanism: wake-up curve and direct-logit hand-off↩︎

Figure 3 traces how the backups take over as the primary name-movers are progressively ablated (\(k=0,1,2,3\), strongest first), averaged over \(96\) prompts; the underlying numbers are in Table 13. Two signals rise monotonically for the documented backups and stay flat for a matched random control: the output-norm activation ratio (\(1.00\to1.15\)) and the conditional causal drop (\(+0.05\to+0.11\)). The direct-logit attribution (DLA) decomposes each head’s contribution to the \(\text{IO}-\text{S}\) logit at the final position through the frozen final LayerNorm and the unembedding (the standard logit-lens decomposition): we freeze the LayerNorm scale at the full final-residual statistics and project each head’s residual contribution onto the unembed direction \(W_U[\text{IO}]-W_U[\text{S}]\). The name-movers’ large positive clean DLA (\(+0.76\)) is the sanity check that they write the answer; the backups’ DLA more than doubles once the primaries are ablated (\(+0.07\to+0.21\)), a direct measurement of the hand-off, while the random control stays negative.

6pt

9.2.2.1 Counterfactual patching (causal test).

The wake-up curve and DLA are observational. To establish causation we patch activations at the final position (Figure 3d). The clean IOI logit-difference is \(2.53\); ablating the primaries leaves \(2.42\) (the backups have already repaired most of the drop). If we ablate the primaries but freeze each backup’s final-position output to its clean (dormant) value, the logit-difference falls to \(1.86\), versus \(1.37\) when the backups are removed entirely. Freezing the backups to clean thus removes \(0.55\) of the \(1.04\) total repair, i.e.\(53\%\), whereas freezing a matched random set leaves the repair intact (\(2.62 \approx 2.42\)). The backups’ state change – their wake-up – is therefore causally responsible for about half of the self-repair, and the effect is specific to the discovered heads. This is the causal complement to the (correlational) wake-up curve.

The hand-off is not an averaging artifact. Repeating the patch-out across four prompt seeds, the fraction of self-repair removed by freezing the backups to clean is remarkably stable – \(53\%, 53\%, 55\%, 57\%\) (mean \(55\%\)) – while freezing a matched random set removes none at any seed (patch-out-random logit-difference \(2.6/2.4/2.2/2.3\) versus the primary-ablated \(2.4/2.4/2.2/2.3\)). The causal hand-off therefore holds per seed, not merely in aggregate.

9.2.2.2 The synergy structure CoAx reads.

The wake-up and hand-off above are the intervention view; the geometry view is the pairwise co-ablation synergy \(S_{uv}\) over the IOI circuit heads (Figure 12). The name-movers and their backups form a high-synergy block that single-ablation saliency leaves dark – the off-diagonal interaction Proposition 3 shows the CoAx score reads. This is the structure that makes a dormant backup’s conditional growth large.

3pt

9.2.3 Signature filter: precision↩︎

The two label-free signatures (output-norm wake-up under primary ablation, conditional causal drop) are not only descriptive: used as a filter they sharply raise precision. Keeping only top-ranked heads with wake-up ratio \(>1.05\) and positive conditional drop removes the high-energy early-layer false positives, leaving (near-)pure documented backups (Table 16). The conditional-drop signature is, however, noisy at the individual-head level: the \(+0.21\) vs.\(-0.12\) separation in the main text is a mean, and a few true backups buck it – the top-ranked head \([11,2]\) has conditional drop \(-0.11\) (Table 14) and would be dropped by the filter. This individual-head noise is a property of self-repair itself, which is documented to be partial, prompt-dependent, and unevenly distributed across heads rather than a clean per-head effect [13], [14]; a per-head behavioral threshold inherits that variance. We therefore treat the filter as a precision aid, not a per-head oracle, and rely on the CoAxranking (which places \([11,2]\) first) as the primary output. This is why we report the AUC ranking and the signatures: the ranking surfaces candidates, the signatures confirm which behave like backups. One caveat is that the conditional-causal-drop signature is computed from the same conditional ablation as the CoAx score, so it is not fully independent of the ranking. We therefore add a validator that has nothing to do with ablation effects, using the defining structural property of a name-mover: at the position where the model predicts the answer it attends back to the indirect-object (IO) name token and copies it [4]. Reading this final-position QK attention directly (no ablation, no score), the documented backups attend to the IO token \(5.8\times\) more than other heads (\(0.19\) versus \(0.03\)), and this pure-structural IO-attention by itself ranks the backups at \(0.96\) ROC-AUC. Crucially it correlates with the CoAx conditional-growth score at only \(\rho=0.09\) (Spearman): two near-independent signals – one causal-functional, one structural – agree on the same heads. That agreement is strong evidence the discovered heads are genuine backup name-movers, not an artifact of the scoring statistic (we report the per-head IO-attention of the CoAx top-\(10\) in Table 15).

3.4pt

6pt

9.2.4 Case study: the anatomy of one backup head↩︎

To make the mechanism concrete, we trace a single CoAx-discovered head, the documented backup name-mover \([10,6]\), through every signal in the paper (Figure 14); the other documented backups behave similarly. It is a textbook dormant backup, and each step is exactly what first-order scoring cannot see.

(i) Silent on the clean model. Ablated on its own, \([10,6]\) moves the IOI logit-difference by a negligible amount – its clean single-ablation saliency sits near the bottom of the \(141\) candidate heads, which is why every additive and gradient baseline ranks it low.

(ii) It reads the indirect-object name. Its defining structural behavior is intact even while it is dormant: at the prediction position it attends to the IO name token with weight \(0.29\) – \(5.8\times\) a random head’s \(0.03\), squarely in the name-mover family (Figures 15 and 13, Table 15). A first-order score sees none of this, because the head is not yet using that read.

(iii) It wakes up under intervention. As the primary name-movers are ablated one by one, \([10,6]\)’s output norm rises (activation ratio \(>\!1\)) and its direct contribution to the IO\(-\)S direction grows from near zero to load-bearing – the hand-off of Figure 3 (a,c). Freezing it and the other discovered backups to this clean, dormant value removes over half of the self-repair (Figure 3d): the model was relying on its wake-up.

(iv) The score surfaces it, and the sign matters. Because its conditional ablation energy grows once the primaries are gone, CoAx ranks \([10,6]\) among the top backups (Table 14), whereas the negative name-mover \([10,7]\) – which also attends to the IO token (\(0.56\)) but suppresses it (copy suppression, [27]) – has a conditional effect of the opposite sign and is correctly separated by the behavioral signatures. The same unit is invisible first-order, structurally a name-mover, causally load-bearing only under conditioning, and functionally distinct from a same-attention suppressor – the four views CoAx ties together.

9.2.4.1 A contrasting case: a false positive the signatures reject.

CoAx’s ranking is not infallible, and a second head shows why we pair it with the behavioral signatures rather than trusting the ranking alone. The early-layer head \([1,10]\) also lands in CoAx’s top ten, because ablating it perturbs the output with high energy. But it is not a backup name-mover: it attends to the IO token at only \(0.04\) (versus \(0.19\)–\(0.61\) for the name-mover family, Table 15) and shows no wake-up under primary ablation. The structural IO-attention read and the wake-up signature both flag it, and the signature filter removes it (Table 16) – which is precisely why we report the ranking and the signatures: the ranking surfaces candidates with high conditional energy, including a few early-layer heads whose energy is not name-mover self-repair, and the label-free signatures confirm which candidates actually behave like backups. The two together, not either alone, give the precision of Table 16.

9.2.5 Visualizing the discovered circuit↩︎

Beyond the compact schematic of Figure 2 (c,d), Figure 16 draws the recovered circuit as a detailed node-link re-wiring diagram with head identities. We then visualize the recovered circuit three further ways: as a token\(\times\)layer information-flow map on the IOI prompt (Figure 17), as a functional information-flow diagram (Figure 18), and as a spatial map of the model (Figure 19).

The diagram makes the self-repair structure explicit: ablating the orange (primary) path alone leaves the blue (backup) path intact to restore the output – the reason a first-order knockout of “the circuit” barely dents behavior (§3.3). CoAx recovers the blue path label-free.

Together the two views give a complete picture of one discovered circuit: what the backups do (a parallel write path to the answer), where they are (the late name-mover band), and why first-order scoring misses them (they are dormant until the primaries are removed).

9.3 What the CoAx score keys on↩︎

9.3.1 Component ablation of the CoAx score↩︎

We ablate the two ingredients that separate CoAx from a first-order score in turn (Table 17). Conditioning is the dominant lever: a node-additive single-ablation saliency reaches only \(0.33\) backup AUC, and conditioning the score on the primaries – reading the growth in ablation effect (Eq. 1 ) – lifts it to \(0.80\) even with the plain uncentered feature. Centering against the output distribution then adds the rest, \(0.80\to0.91\); Fisher weighting on top is a consistent but small gain (\(+0.01\)). The increments are cumulative and each is far larger than the seed spread (\(\le 0.04\)), so neither is an arbitrary choice.

We also varied \(r \in \{96, 192, 384\}\) and found backup AUC stable within \(0.01\).

9.3.2 Empirical non-additivity of the name-mover module↩︎

Proposition 2 predicts that a redundant circuit’s importance is non-additive: the damage from ablating a set exceeds the sum of the per-unit damages. We confirm this directly on the GPT-2-small IOI name-mover module (Table 18). Ablating the three name-mover primaries jointly drops the IOI logit-difference by only \(0.11\) (clean \(2.53\)) – the self-repair headline – yet the full module (primaries \(+\) the eight backups) drops it by \(1.15\), nearly twice the \(0.60\) that summing the eleven single-head ablations predicts (super-additivity \(1.9\times\)) and \(10\times\) the primaries-alone effect. A node-additive score therefore sees a small fraction of the module’s true joint importance. The super-additivity is specific to the redundant module: a size-matched random set is additive (joint \(\approx\) sum), and the individual primaries are mildly sub-additive (\(0.6\times\)), exactly because their backups absorb each single ablation.

8pt

9.4 Generalization, completion, and scope↩︎

9.4.1 Induction generalization across scale↩︎

Table 19 reports the induction-completion attribution factor at each GPT-2 scale.

3pt

With detected rather than documented primaries on GPT-2-small the result is robust: conditional drop \(1.86\) versus \(0.26\) random, attribution \(6.6\times\) and \(4\times\) over matched-random, confirming independence from the exact primary list.

9.4.1.1 Cross-architecture induction completion.

To test that conditional completion – not just the output-space geometry of Appendix 11.6 – generalizes beyond GPT-2, we run the fully label-free pipeline (detect induction-head primaries by their own effect, seed CoAx on them, recover a compensating set) on eight models spanning six architecture families beyond GPT-2 (the main-text dumbbell, Figure 4b, plots \(+\)CoAx versus \(+\)random; Table 20 gives the full numbers). On every model the CoAx-completed circuit is far more causally complete than the primary-only circuit and than a matched random completion, with the CoAx attribution factor ranging from \(2.1\times\) (Pythia-160M) to \(12\times\) (Pythia-410M). The ordering \(+\)CoAx\(>\) \(+\)random holds on all eight models, so conditional completion is not a GPT-2-specific phenomenon.

9.4.1.2 Is completion CoAx-specific, or does “more induction heads” suffice? A \(+\)own control.

The weak point of the \(+\)random control is that random heads barely move the metric. We therefore add a stronger control, \(+\)own: extend the circuit by the model’s own next-strongest induction heads (ranked by the same attention-offset detector that finds the primaries), matched in size to the discovered set – the induction analogue of the IOI \(+\)own knockout control. The result is honest and informative (Table 20). Both \(+\)CoAx and \(+\)own greatly exceed \(+\)random on every model – induction is genuinely redundant across many homogeneous heads, so adding more of them does complete the circuit – and the two are comparable: CoAx recovers a strictly larger drop than \(+\)own on four of eight models (decisively on Llama-3.1-8B, \(5.7\times\) vs \(1.9\times\), and Qwen2.5-7B) and a smaller one on the other four. This is exactly what the regime account of §3.5 predicts: induction’s redundancy is shared among co-firing homogeneous heads, so “more of the same kind” completes the circuit much as CoAx does. It is the opposite of IOI, whose backups are a distinct, dormant class – there the model’s own next heads instead overshoot into the core circuit (Table 2, \(+\)own knockout accuracy \(0.24\) vs CoAx\(0.70\)). The discriminating “right heads, not more heads” result is therefore IOI’s; on induction we claim only that CoAx recovers a load-bearing compensating set label-free, with \(+\)random as the floor confirming the set is far from arbitrary.

5pt

9.4.2 Completion of automatically discovered circuits↩︎

The headline seeds CoAx with documented primaries; the completion experiment seeds it with the primaries an actual first-order method returns. We take the top-\(3\) heads of each finder (AtP, EAP-IG, AtP\(^\star\)) as the seed \(\mathcal{S}\), run CoAx conditioned on \(\mathcal{S}\), add its top-\(4\) positive-direction backups, and measure the joint-ablation IOI logit-difference drop (clean \(\approx 2.6\)). Per-seed numbers (seeds \(42\), \(1\)) are in Table 21; the main text reports their mean.

5pt

We are deliberately precise about what this shows. The completion gain is robust to finder and seed and always far exceeds random, so it is not an artifact of ablating more heads. On raw faithfulness it is tied with the first-order top-up. The CoAx-added heads sit at a lower mean first-order percentile (\(0.69\)) than the next-\(4\) heads (\(\approx 0.97\)), so CoAx does reach functional compensators a top-up would skip; but their wake-up ratio is \(\approx 1.0\) (not the \(1.15\)–\(1.21\) of the documented-primary setting), and recall of documented backups is \(0/4\). We therefore do not claim that completing an automatically discovered circuit isolates cleanly dormant backups. When the seed is a noisy first-order guess rather than the documented primaries, CoAx recruits mid-ranked compensators of that seed; the clean low-saliency, high-wake-up backup result holds in the controlled documented-primary setting (Table ¿tbl:tab:backup?, §9.2.2), and completion quality tracks seed quality exactly as §9.5.1 predicts. We present completion as evidence CoAx operates end-to-end and label-free, not as a backup-identity claim under noisy seeds.

9.4.3 Scope boundary: greater-than and a preliminary FFN-group probe↩︎

On the MLP-dominated greater-than circuit [23], head-level CoAx does not recover a clean compensating set: the discovered heads show no wake-up (activation ratio \(1.01\) versus \(1.00\)) and are not more load-bearing than random (conditional probability-difference drop near zero). This is consistent with greater-than’s self-repair being mediated by MLPs that our head-level units do not observe.

Because CoAx is unit-agnostic, we ran a preliminary FFN-group instantiation: a unit is a contiguous slice of a layer’s MLP intermediate neurons (\(96\) groups on GPT-2-small), ablated by zeroing that slice of the layer’s down-projection input; we detect primary FFN groups label-free by their own probability-difference (pd) drop and seed CoAx on them. The mechanics transfer – the score is well-defined and computable on FFN units – but the signal does not strengthen: the discovered compensating set has conditional pd-drop \(0.176\) versus \(0.115{\pm}0.094\) for a matched random set, only \(1.5\times\) over random and within one standard deviation, far weaker than the strong self-repair recovery on IOI and the \(2.1\)–\(12\times\) over-random factors of cross-architecture induction. We read this as evidence that greater-than is weakly self-repairing at both head and FFN-group granularity – a property of the circuit, not an artifact of the unit choice – making it a clean scope boundary: CoAx recovers redundancy where it exists, and greater-than has little. Demonstrating a strong FFN-group recovery requires an MLP-mediated circuit with documented redundancy, which we leave to future work.

9.5 Robustness↩︎

9.5.1 Robustness to the primary seed↩︎

CoAx discovers backups conditional on a primary seed \(S\), so we ask two questions: how sensitive is the result to \(S\), and can \(S\) itself be obtained label-free? We sweep \(|S|=1,2,3\) and compare three ways of choosing \(S\): the documented name-movers (ordered by their own energy), a label-free task-directed seed (top heads by AtP on the IO-vs-S logit, which uses the task but no head labels), and a label-free undirected seed (top heads by unconditional ablation energy). Table 22 reports backup AUC, averaged over two prompt seeds.

5pt

Two conclusions. (i) Robustness: once \(S\) contains the true primaries the AUC is stable (\(0.91\)–\(0.93\) for \(|S|\!\geq\!2\)), and even one primary suffices for \(0.80\) – the discovery does not depend on the exact primary list. (ii) Honest scope: the seed must capture the functional primaries. An undirected energy-top seed fails (\(0.30\), below the first-order floor) because high-energy heads are not the name-movers; a task-directed AtP seed does much better (\(0.60\)) but still trails, because self-repair mutes the primaries’ own first-order signal so a purely automatic finder recovers them only partially. CoAx is therefore not a fully unsupervised black box: it completes a first-order-identified primary circuit by returning the backups that circuit hides. This is the intended use and the source of the headline number, which seeds CoAx with the documented primaries.

9.5.2 Template robustness↩︎

The headline uses one IOI surface template. Recomputing the backup AUC on two alternative surface forms that exercise the same indirect-object name-moving circuit (“After …arrived at the …, … handed a …to” and “While …were at the …, …passed a …to”) gives backup AUC \(0.96\) and \(0.88\), versus \(0.91\) for the standard template. The discovery is not an artifact of one prompt form.

10 Attribution, Full Results↩︎

Ablating the name-mover primaries alone drops the IOI logit-difference by \(0.22\) on average over four seeds, from a clean \(2.53\) (and \(0.11\) at the single seed shown in the main-text figure). Adding the label-free discovered backups recovers \(1.76\), roughly eightfold, exceeding the documented backups (\(1.15\)) and a matched random-set control over \(20\) draws (\(1.0{\pm}0.7\)). The discovered set beats the documented backups at every seed, and \(3\) to \(4\) of the eight discovered heads match the documented list. The random control has high variance because a random eight-head set occasionally hits real circuit heads; CoAx beats it in the mean at every seed.

10.0.0.1 Relation to behavior-faithfulness.

On the MIB-style faithfulness curve, where one keeps the top-\(k\) ranked heads, mean-ablates the rest, and integrates the recovered logit-difference, the label-using AtP leads our label-free CoAx order (circuit-performance ratio CPR \(0.29\) versus \(0.22\); EAP-IG \(0.04\)), as expected for a behavior-agnostic primitive. The point is the converse: the same AtP that wins faithfulness misses the backups (\(0.59\) versus \(0.91\)), because removing a redundant backup barely changes the behavior a faithfulness curve rewards. The two measurements are complementary, and the backups a faithfulness-greedy method discards are exactly what CoAx is for.

10.0.0.2 Capability removal, per seed.

Table 23 gives the per-seed IOI behavioral accuracy behind the main-text knockout result. Ablating the documented name-mover primaries leaves accuracy at \(0.96\)–\(1.00\) (self-repair holds at every seed); adding the CoAx backups is what degrades it, to \(0.62\)–\(0.85\) (mean \(0.70\)), matching the documented-backup oracle (\(0.69\)–\(0.75\), mean \(0.72\)) and below the matched random control (\(0.73\)–\(0.89\), mean \(0.81\)). A first-order top-up of the same size (\(+\)own, the next-\(k\) heads by single-ablation saliency) instead drives accuracy to \(0.23\)–\(0.24\) (mean \(0.24\)), well below the \(0.5\) chance level: it over-ablates into the core name-movers rather than selecting the compensating set. The accuracy under CoAx does not reach \(0.5\) because IOI retains redundancy beyond the name-mover family (S-inhibition and induction heads still bias the answer); the result is about the ordering – \(+\)own (over-ablates) \(<\) CoAx\(\approx\) documented \(<\) random \(<\) primaries-only – which shows the primary circuit is an incomplete knockout set, CoAx supplies exactly the missing backups label-free, and a first-order top-up does not (it removes the wrong heads).

6pt

11 Pruning and Cross-Scale Geometry, Full Results↩︎

11.1 Protocol↩︎

We calibrate the co-ablation energy on WikiText-2 train windows without labels, prune the least-important heads first at matched sparsity, and evaluate WikiText-2 test perplexity and zero-shot accuracy. The orders are random, magnitude, Wanda [9], gradient Taylor [45], co-ablation energy in static order, and the self-repair-aware sequential order. The Taylor baseline requires a backward pass; for the \(7\)B model it exceeds memory in our environment and is omitted there, while the other baselines are retained.

11.1.0.1 The baselines are head-native and isolate the contribution.

Two of these orders double as the head-native controls a reviewer should demand. The magnitude order is exactly the head output-norm baseline (it ranks heads by their mean attention-output-slice norm), so beating it rules out “CoAx just keeps high-norm heads”. The co-ablation static order is exactly the single-ablation Fisher-diagonal baseline (it ranks heads by the unconditional energy \(\mathcal{E}(\delta z_u\mid\emptyset)\), the diagonal of \(\boldsymbol{H}\)), so the gap between it and the self-repair-aware sequential order isolates the value of conditioning from that of using a better diagonal score: both use the identical signal and differ only in conditional re-measurement. Wanda and Taylor are the weight-magnitude and gradient head-native baselines respectively.

11.2 Perplexity: GPT-2-small, full sweep↩︎

Table 24 lists the WikiText-2 perplexity of every pruning order at every sparsity on GPT-2-small.

3pt

11.2.0.1 On the non-monotonic baseline curves.

The magnitude and Wanda rows are non-monotonic in sparsity (Wanda goes \(51, 609, 2810, 192, 337\) over \(10\) to \(50\%\)), and the dips reproduce across runs. We do not interpret these dips mechanistically; they show that magnitude and Wanda, adapted to head pruning, give unstable orders, which is precisely why we report full sparsity curves rather than a single budget. The co-ablation orders are by contrast smoothly monotonic. Taylor is monotonic and far stronger than magnitude or Wanda, yet still trails co-ablation and collapses at \(70\%\).

11.3 Perplexity: cross-model, full sweep↩︎

Table 25 extends the full perplexity sweep to the larger models.

2.6pt

The self-repair-aware gain over the static co-ablation order grows with scale and sparsity: it is negligible on Pythia-1.4B (the static order is already near-optimal, and at \(60\)–\(70\%\) the two tie within noise), moderate on GPT-2-large (\(37\) vs.\(44\) at \(50\%\), \(52\) vs.\(91\) at \(70\%\)), and largest on Qwen-7B (\(54\) vs.\(91\) at \(50\%\), \(240\) vs.\(1341\) at \(70\%\)), consistent with larger models carrying more backup redundancy to preserve.

11.4 Zero-shot accuracy across sparsities↩︎

The main-text figure plots the three-seed accuracy curves of PIQA, ARC-Easy, and HellaSwag to \(50\%\). Across every confirmed budget the co-ablation orders dominate magnitude, Wanda, and Taylor, which fall toward the chance levels (PIQA \(50\), ARC-E and HSw \(25\)); the self-repair-aware order helps or ties on every model-task cell, with seven of nine strict wins at \(50\%\). That the conditional re-measurement never hurts accuracy, on any model-task cell, is the practical form of the paper’s claim: anticipating what a backup will do once its primary is gone can only sharpen a removal order, never coarsen it, so the self-repair-aware variant is a safe default rather than a tuned one.

11.5 Module-partition negative↩︎

Cutting the curvature graph into signed eigen-modules and pruning within-module does not beat flat second-order pruning (Qwen-2.5-7B at \(30\%\): \(29.4\) versus \(28.4\) flat; both collapse by \(50\%\)), because flat pruning already accumulates the full off-diagonal interaction while a hard partition discards it. The graph’s compression value is in the self-repair-aware ranking, not a partition. We report this as a second honest negative.

11.6 Cross-scale geometry↩︎

Table 26 gives the per-circuit cluster-AUC on GPT-2-small (the second-order/co-activation contrast in detail), and Table 27 gives the per-model vs-active ROC-AUC behind Figure 20.

4pt

3.2pt

Pairwise synergy wins duplicate-token on \(11/12\) models (the exception is Pythia-1.4B) and previous-token on \(10/12\) (exceptions GPT-2-large and GPT-Neo-1.3B), while co-activation wins induction on all \(12\). The first-order co-ablation affinity shows the same qualitative split (output-side wins movement, loses induction) but is weaker on duplicate-token, so we report the second-order signal as the principled fixed choice. The reversals occur where the empirically-detected circuit is small or noisy, making the vs-active split unstable; they are not concentrated at any scale. The pattern, output-grounded synergy for movement-by-output circuits and input-grounded co-activation for co-firing induction under repeated-token calibration, is the output-versus-input complementarity the paper argues for.

12 Limitations, Broader Impact, and Reproducibility↩︎

12.1 Limitations↩︎

The explicit pairwise route is \(O(|\mathcal{U}|^2)\), mitigated by candidate sets and the \(O(|\mathcal{U}|)\) conditional route. Head-level backup ground truth exists mainly for GPT-2-small’s IOI circuit, so the labeled backup AUC is anchored there. This is a field-wide constraint rather than a quirk of our setup: the community’s hand-verified circuits remain a small set (IOI, induction, greater-than, docstring) [4], [5], [18], and only IOI documents backup heads specifically. We reduce – but do not eliminate – this single-circuit dependence three ways: a powered controlled-redundancy synthetic benchmark that supplies the head-to-head statistical comparison the eight documented backups cannot (Appendix 9.1.4); the label-free completeness criterion, which validates the completed circuit without backup labels (§3.3); and label-free generalization on induction across scales and architectures. A second circuit with documented head-level backups would nonetheless strengthen the labeled evaluation, and none is currently available. The signal is instantiated primarily at attention-head granularity: it transfers to the attention-mediated induction circuit but not to the MLP-mediated greater-than circuit. A preliminary FFN-group probe (Appendix 9.4.3) finds only weak recovery on greater-than, indicating it is weakly self-repairing at both head and FFN-group granularity – a property of the circuit, not of the unit. Conditional discovery is seeded by a primary set, and finding the primary components automatically is an open problem in its own right – automatic circuit discovery remains an active, unsolved area [5], [18] and is further hampered here by the same self-repair that masks the backups. Three natural extensions follow: joint primary-and-backup discovery that breaks the masking on both sides at once; a full FFN-level treatment of strongly MLP-mediated self-repair (which greater-than lacks); and decomposing discovered backups into their known self-repair mechanisms (LayerNorm rescaling versus anti-erasure), of which our activation-ratio check is a first step.

12.2 Broader impact↩︎

CoAx is an analysis tool for frozen models and trains nothing. By making redundant and backup components visible without labels, it can improve the faithfulness of interpretability audits and the safety of pruning, since a pruner unaware of backups can silently remove the components that keep a behavior robust. We see no direct path to misuse beyond that of interpretability methods in general.

12.3 Assets, licenses, and ethics↩︎

All models are public pretrained checkpoints used under their respective licenses: GPT-2 and GPT-Neo (MIT), Pythia and OLMo-2 (Apache-2.0), Gemma-2 (Gemma Terms of Use), Llama-3.1 (Llama Community License), and Qwen-2.5 (Qwen License); we use them unmodified for inference-only analysis. Evaluation data are WikiText-2 (perplexity), the templated IOI prompts of [4], and PIQA, ARC-Easy, and HellaSwag (zero-shot accuracy), each used through the standard lm-eval-harness under its public research license. No human subjects, private, or personally identifying data are involved; the IOI templates use common given names only.

12.4 Reproducibility↩︎

All discovery and attribution experiments run on a single GPU in seconds to minutes (Table 4); the pruning sweeps to \(70\%\) on the \(7\)B model are the most expensive, at a few GPU-hours, and no training is performed at any point. GPT-2-scale discovery (kernel build, conditional co-ablation, and all baselines) also runs on CPU in minutes, so the headline IOI results reproduce without a GPU. Experiments use a single \(24\) GB GPU; the \(13\)B variants were out of scope for this budget. All weights are loaded frozen, and the random seeds for prompt sampling and ablation-value draws are fixed and listed in Table 6.

References↩︎