Imprint Reader: From Weight-Update Readout to Behavioral Intervention
Guanxu Chen, Qihao Lin, Jing Shao
cs.AI
2026-09-28
SMaRT-trained Imprint Reader describes frozen Qwen3-14B updates at Pass@100 2%/16%. MetaEdit raises refusal 57.9% to 64.1% and BFCL 41.69% to 44.60% without task data.
Every training step leaves a trace in the weights. Humans can say what they just learned. Language models cannot: they neither feel their own learning the way people do, nor decode the updates they physically store.
Weight-space predictors mostly recover coarse properties such as test accuracy, optimizer choice, or which fine-tuning task was used. The few systems that verbalize weight differences sit in narrow domains and invent descriptions for updates that carry no information. Shanghai AI Lab and Shanghai Jiao Tong University reverse the usual setup. Instead of hanging a self-describing adapter on every fine-tuned model, they train one full Imprint Reader that mounts a frozen update onto itself and talks about it. Because the Reader shares parameter coordinates with its parent, the same gradients become an intervention signal.
Semantic Mount-and-Read Tuning (SMaRT) splits update construction from Reader training. Both the builder and the Reader start from the same post-trained Qwen3-14B, so a built update can be mounted as-is.
For each target k, a QA set is trained for 64 inner steps on a temporary copy of the parent. The resulting LoRA update Δθk = θk − θ0, rank up to 256, is frozen. Those QA pairs never reach the Reader. Inside an episode, the delta is the only item-specific carrier of k.
The Reader then sees an anchor-free meta-query: a prompt that specifies output form (summarize the knowledge-level change you just experienced) and is sampled independently of k, so it leaks no entity, question, or answer. The training target is the canonical statement of k. Two control episode types teach abstention: a zero update whose target says nothing new was learned, and a random perturbation whose target says the change cannot be read reliably. Each batch of 64 mixes 24 knowledge, 24 behavior, 8 no-change, and 8 random episodes.
Knowledge items are self-contained propositions mined from eight factual and scientific benchmarks, kept only if the base model fails before injection and succeeds after. Behavior items span seven tendency categories; user prompts must not name the target behavior. Screens drop 451 knowledge and 495 behavior items. The balanced training set has 8,592 of each type; 100 of each are held out. The full Reader trains on eight GPUs at 10^-4. All intervention gradients come from the step-2,800 checkpoint.
Because the Reader is initialized at θ0, the gradient of the negative log-likelihood of a target self-report b lives in the parent coordinates. MetaEdit copies that gradient onto Qwen3-14B: it can rank projection output rows by contrastive gradient magnitude and zero those with the most negative inner product, or apply a sparse signed update on the selected rows. Description-driven intervention without target-task training data is what the paper calls vibe alignment.
Free-form readout is still weak. On held-out updates the Reader draws 100 samples at temperature 0.6. Qwen3-30B-A3B-Instruct-2507 scores each sample against the canonical target; a pass needs score ≥ 0.8 and a cited span that actually appears in the reply. Pass@100 is 2% for knowledge and 16% for behavior. Successful cases recover a chemical structure or a writing procedure, but details often come out wrong. An adapter-swap control is cleaner. At step 2,800, a matching update lowers target NLL by 0.1255 nats/token versus a same-type mismatch and by 0.2227 versus no update. A mismatch still beats no update by 0.0972. Feasible, not reliable.
Intervention numbers are more usable. Safety pruning scores 2,088,960 projection output rows, keeps the top 50,000 by contrastive gradient magnitude, then zeros the k rows with the most negative inner product. At a 0.5% budget, harmful-prompt refusal on the original Qwen3-14B is 57.9%. Reader-guided MetaEdit moves it to 64.1% under a safety-maintenance target and 55.4% under refusal relaxation. Baselines are SetDiff, WANDA, ActSVD, Random, and MetaEdit (Base), which takes the same gradient on the untrained parent. Most baselines do not separate the two directions. WANDA and ActSVD garble heavily after pruning; MetaEdit stays near zero garbling. SetDiff needs 260 harmful plus 260 harmless calibration examples. MetaEdit uses only the self-report sentences and fixed control sentences.
Signed edits for math and tool use select 0.1% of rows (2,089) at strength α=0.35, coefficients frozen before test-set evaluation.
| Method | GSM8K | MATH-500 | Backtrack /1k | Sub-goal /1k | BFCL Overall |
| Qwen3-14B | 94.77% | 82.8% | 0.327 | 5.390 | 41.69% |
| Direct Prompt | 94.84% | 82.6% | 0.350 | 5.740 | 42.75% |
| MetaEdit (Broad) | 94.24% | 82.8% | 0.508 | 5.667 | 43.68% |
| MetaEdit | 95.00% | 83.0% | 0.687 | 6.015 | 44.60% |
Fine-grained MetaEdit lifts BFCL Agentic from 15.93% to 22.30%. The gains are uneven: Broad leads Multi-turn at 37.00%, Direct Prompt leads Live (82.61%) and Hallucination (83.72%), and the unedited model still wins Non-live (84.71%). Math accuracy moves by a few tenths of a point. The clearer change is in the traces: more backtracking and sub-goal talk.
For interpretability and alignment work, this moves weight-space learning from task-label prediction to natural-language readout, then to a differentiable edit. The practical claim is narrow and useful: name a desired behavior in words, skip target-task training data, and skip putting that behavior into the system prompt at inference. Safety pruning separates two opposite targets with little garbling, cleaner than activation-based WANDA and ActSVD at the same row budget.
This is not a production mind-reader. A 2% knowledge Pass@100 is not an audit log. The usable object is the Reader as a differentiable proxy; the gradient is more trustworthy than the sentence. Math scores barely move. BFCL Overall rises by about three points. That is description-driven style alignment, not a capability jump. Code and the model are public.
The paper's own next step is reliability across updates. Free generation is rare and unfaithful. Updates are inner-loop LoRAs from synthetic QA, one item or one tendency per update, not the mixed traces of real large-scale training. The ethics statement is explicit: this setup does not show training-example reconstruction.
Refusal is classified by fixed keyword patterns, not humans or a strong judge. The safety figure spaces prune rates as equal categories and visually compresses refusal below 45%. The judge is a Qwen3 30B, same family as the Reader. MetaEdit (Base) failing shows that only the trained Reader's gradient has the right sign, and that the interface is tied to one parent and one coordinate system; a new base model means retraining. Refusal relaxation works too. Dual use is real.