Safe Error Correction for Language Models: Frozen-Base Adjustment with Capability Preservation
Gautam Kishore
cs.AI, cs.CL, cs.LG, cs.NE
2026-09-15
CRN v2, a 34M logit head on frozen Gemma 4 E2B, hits 53.3% on a 60-question exam with no MMLU/BoolQ drop; 6.6M LoRA hits 83.3% but MMLU falls from 62.5% to 32%.
Language models in production get facts wrong, miss arithmetic, and misread implicit goals. The usual patch is LoRA or full fine-tuning on the domain. Updating weights typically erases other skills: the model fixes one error set and forgets what it already knew. The paper calls this the correction-capability tradeoff.
The question is whether that swap is required. Freeze the base entirely, add a small module on top, and test whether errors can be patched with no score change on unrelated tasks. The base is Gemma 4 E2B: 4.65B text parameters inside a 5.12B multimodal checkpoint, 35 layers, hidden size 1536, vocabulary 262,144.
CRN v2 reads only the frozen last-layer hidden state and adds a logit offset: a rank-128 down-projection, GELU, an up-projection to the vocabulary, and a scalar gate initialized near zero. The base gets no gradients. Trainable size is 34,013,185 parameters, 0.73% of the text module.
Training uses 83,400 error-correction pairs from 17,810 unique prompts, covering facts, arithmetic, and implicit-goal reasoning.
KL is there so the head stays still where the base is already right. The baseline is LoRA matched to the CRN v1 budget: rank 19, about 6.6M parameters on all linear layers at 8 depths, same data and DPO objective, plus 1,000 extra SFT steps. A second variant injects a low-rank residual into hidden states at layer 4 or 7 (about 1.6M parameters) so frozen layers above can amplify it.
The exam is CEHRI, 60 in-house questions, scored by substring match. A 120-question reworded set only adds prefix and suffix templates, mean character overlap 71.6%. All 60 original prompts appear verbatim in training, so the original exam is in-distribution correction and the reworded exam is near-duplicate correction. Neither is out-of-distribution.
| Method | Original 60 | Reworded 120 |
| Frozen base | 7/60 = 11.7% | not measured |
| CRN v2 (r=128, λ=0.1) | 32/60 = 53.3% | 52/120 = 43.3% |
| CRN v2 (r=256, λ=0.01) | 21/60 = 35.0% | 31/120 = 25.8% |
| LoRA (r=19, 6.6M) | 50/60 = 83.3% | 93/120 = 77.5% |
Relative to the frozen base, CRN v2 adds 25 correct answers and LoRA adds 43. With N=60, Wilson 95% intervals are [40.9%, 65.4%] and [72.0%, 90.7%]. The base already got 7 right, so 25 of 53 errors were fixed, about 47%.
Capability uses the same prompts and greedy decoding:
| Benchmark | Base | CRN v2 | LoRA |
| MMLU (N=200) | 125/200 = 62.5% | 125/200 (Δ=0) | 64/200 = 32.0% (Δ=-30.5 pp) |
| BoolQ (N=200) | 144/200 = 72.0% | 144/200 (Δ=0) | 110/200 = 55.0% (Δ=-17.0 pp) |
| car-wash (N=8) | 6/8 = 75.0% | 6/8 (Δ=0) | 0/8 = 0% (Δ=-75 pp) |
CRN v2 matches the base to the exact count on all three probes. LoRA scores 0/8 on car-wash.
Lowering λ from 0.1 to 0.01 drops the original exam from 53.3% to 35.0% and the reworded set from 43.3% to 25.8%. That run also changed rank and DPO steps, so λ is not isolated. Capability does not move at either setting: the base is frozen, and KL only shapes the head.
No injection-depth run beat rank-128 logits. Layer 4: 30.0%/28.3%. Layer 7, SFT only: 50.0%/55.8%. Multi-depth concatenation at about 35M: 40%. Longer training stays at 53.3%. DPO at layer 7 leaves correction flat, drops MMLU to 13%, and turns BoolQ into a constant B. Most of these rows are single-run and session-observed; only the layer-7 SFT line has retained logs.
Wall time on an Apple M4 is about 25 minutes. Inference has no KV cache: each new token reruns the full sequence through the frozen base, about 1 second per token.
Same data, same DPO, 6.6M LoRA reaches 83.3%, then MMLU falls from 62.5% to 32.0% and an 8-question probe hits zero. Freeze the base, correct only the final logits, pin the head with KL, and the exam score is lower while the probed capability ledger stays flat.
This is an engineering principle, not a new architecture. The formula is a standard low-rank bottleneck, and the paper says so. Code and main-result weights are released. The useful setting is narrow: chosen/rejected error pairs, plus a hard constraint that base skills must not move. 53.3% on this exam is not enough for high-stakes use, and uncached decoding is not a serving path.
All 60 exam items sit in the training file verbatim. The reworded set has median cosine similarity 0.972, with 118 of 120 items at 0.9 or above. The number measures whether memorized prompts get rewritten, not whether new prompts do. Capability N is 200 or 8; zero drop holds only on those three probes. The KL ablation confounds rank, λ, and DPO steps. Most deep-injection checkpoints were not kept, and eval logs were deleted during disk cleanup. Training covers 17,810 unique prompts; scaling is unknown. HellaSwag evaluation is broken (0/200 for both) and is not evidence.
Parameter count is unmatched: 34M versus 6.6M, about 5x, and LoRA trained longer. The paper discloses this. LoRA still corrects more and still collapses the probed skills, so the directional contrast holds. A 34M LoRA rerun could move the numbers.