Overview

A technical overview of the geometry-to-function track: low-rank alignment updates, role gates, and the binding boundary.

This microsite tracks one research program: what small alignment updates are geometrically, and what behaviors they can actually control.

The motivating observation is that alignment / preference post-training does not appear to rewrite a model uniformly. In the studied runs, the useful update concentrates into a thin, low-rank surface on attention projections. The question is whether that surface is only a geometric curiosity, or whether it can be used as a reliable control mechanism for model behavior.

One-Screen Summary

The title-level thesis is:

Contrastive post-training can install behavioral primitive role gates, but does not automatically induce a compositional binding layer from custom roles to canonical permission vectors.

Terms

Low-rank alignment control surface. The part of weight space that the alignment update actually uses. It is measured by stable rank, not by raw parameter count.

Role-conditioned capability gate. A trained mechanism that says, for the active role, which primitive actions are open and which should be declined.

Compositional binding. The desired next step: a new role should work because the model maps it to a canonical permission vector, not because that exact role was memorized during training.

Evidence Chain

1. Geometry floor. Lazy-rudder / LRS1 measure a stable-rank floor for alignment updates. The floor is low and does not fall with width in the tested Qwen2.5 scale sweep.
2. Gate installation. RPCG3 shows that the surface can implement a role-conditioned primitive gate, but only with a contrastive objective plus an anchor. Positive-only finetuning is not enough.
3. Localization. RPCG5 shows the gate is low-rank within layers but depth-diffuse across layers.
4. Behavior. RPCG8 shows the gate changes free generation, not just probe logits.
5. Composition boundary. RPCG7 through RPCG11d all probe whether the model learns reusable permission parts across six orthogonal input-side levers. The failure modes differ, but the common boundary remains: fitting a local marginal is easier than composing unseen combinations.

Current State

The strongest positive claim is narrow but real: small, contrastively trained updates can install behavioral primitive gates.

The strongest negative claim is also narrow: the tested text-side recipes do not produce a robust role-to-permission binding layer. The program has varied objective, input format, primitive basis, nested training distribution, primitive frequency, and class-gradient weighting — six orthogonal input-side levers. None broke the compositional-generalization boundary.

RPCG11d is the final rung of the input-side ladder. It applied schedule-rescaled inverse-frequency class weighting to the RPCG11c setup, giving a 1.5× gradient pressure ratio toward DECLINE over OPEN. The always-OPEN class-marginal basin survived: forbidden_decline 0.000–0.167 against a 0.667 threshold, OPEN-coverage uniformly ~1.000. The input-side ladder is exhausted.

Latest Technical Result: RPCG11d (input-side ladder closed)

RPCG11c asked whether RPCG11 was mostly a data-balance problem. The answer was no, but in a useful way: primitive balancing fixed the under-trained primitive and exposed a different local optimum.

RPCG11d then asked whether that new local optimum — the always-OPEN class-marginal collapse — could be broken by reweighting the loss inversely to class frequency, without changing the corpus or sampler. It could not. The verdict is VOID/c1_failed (same failure pattern as RPCG11c, confirmed by bit-identical sanity arms). The full six-rung input-side ladder is now closed.

The decisive failure is the forbidden side of the gate. RPCG11c learned to open nearly everything: forbidden-decline rates were only 0.000 to 0.167, far below the 0.667 preregistered threshold. In other words, frequency balancing rescued per-primitive coverage but produced an OPEN-class marginal collapse, not a role-to-permission map.

Six input-side levers have now been tested, all failing:

RPCG11d ran class-weighted CE (schedule-rescaled inverse-frequency at w_open=0.83 / w_decline=1.25) and returned VOID/c1_failed: per-primitive OPEN-coverage uniformly ~1.000, forbidden_decline_rate 0.000–0.167 against a 0.667 threshold. The 1.5× gradient pressure ratio was insufficient to break the always-OPEN basin. The rung-1 input-side ladder is exhausted. The next serious levers are architectural or out-of-band tensor policy inputs rather than more prompt formatting — which is exactly what motivates the companion policy-rails typed-side-channel approach.

Companion Track: Policy Rails

The typed policy-rails microsite is the engineering sibling of this model-internals track. The research question is shared: can a model respect provenance and permissions at the substring level? The split is methodological.

In short: this site maps the internal boundary; the policy-rails site tests a systems design that works around that boundary by moving the policy lookup into trusted software.

How To Read This Site

• Explainer → — the landing page: the full geometry-to-function narrative with every claim labeled proven, empirical, or conjectured.
• Geometry → — the task-intrinsic stable-rank floor (lazy-rudder) and its cross-architecture replication (LRS1).
• Function → — the role-provenance capability gate: the RPCG experiment ladder, install through compositional boundary.
• Lean → — the machine-checked descriptive formalization of the gate’s ablation structure.

Papers on this track

• Behavioral Role Gates Without Compositional Binding — the role-provenance manuscript (research monorepo), draft.
• Lazy Rudder — the task-intrinsic stable-rank study (geometry root).

This is one microsite for the whole track, not one per paper; it grows as the track adds papers (next: the canonical-policy-IR / binding-layer program).