+70.3 pp
Recovery from catastrophic structural collapse, where a parameter-matched baseline is permanently dead
383
Controlled experiments across four architecture families, every run reproducible from seed
5
Layers of causal telemetry emitted natively, from system health to per-parameter attribution
<30
GPU-hours to falsify the entire remaining research programme, on one card
Neural networks fail opaquely, and not because anybody built them carelessly. Global backpropagation diffuses every error signal across every parameter simultaneously, so precise fault localisation is not difficult — it is mathematically unavailable. When a layer dies mid-training, what a practitioner observes is a collapsed loss curve and no mechanism whatsoever for identifying which component failed, when, or why.
It is worth being precise about the size of this. Opacity is the single property standing between deep learning and every domain that requires an account of a decision before it will accept the decision. Not a performance ceiling — an admissibility one. And those domains are not small: medicine, finance, safety-critical autonomy, and every use of data belonging to somebody else.
For a decade the field has attacked this as an inference problem, asking what a trained network must have been doing. We treat it as a construction problem, and ask what a network would have to be built like in order to be able to say.
The bet
Transparency is not something to recover from a finished network. It is something to build into how the network trains.
One architectural decision — bounding each node's local gradient chain to exactly four operations — makes per-component attribution something the network computes on its way past, rather than something a second procedure estimates afterwards.
This is not a claim that the work is bad. It is careful work on a genuinely hard problem, and the summary below is drawn from that literature's own account of itself.
Mechanistic interpretability sets out to recover the algorithms a trained network implements and translate them into something a person can follow. It is a serious research programme and it has produced real results.
Published surveys record that many researchers doubt the ambition is achievable at scale, and that current work remains confined to toy models or to small fragments of larger networks.
With no unified evaluation, results rest on human interpretation — which leaves open the question of whether an explanation reflects the computation or is an artefact of the narrative imposed on it.
A single unit routinely encodes several unrelated features at once. There is no clean correspondence between the parts of the network and the concepts anyone wants to ask about.
All four difficulties share a cause: the account is being reconstructed after the network has already made up its mind, by a separate procedure that can itself be wrong. Constrain the network during training and the account stops being a reconstruction.
The whole mechanism, named. Everything on this page follows from the second signal being bounded to four operations.
Standard architecture
The path from one parameter to the loss runs through everything downstream. It has no fixed length, so per-node attribution cannot be computed — only estimated afterwards, by a separate model, which is what every interpretability tool is.
ORMAS
Four operations, through a shared 4,715-parameter bottleneck. The chain cannot grow with the network, so the contribution of each node is read directly off the backward pass.
SIGNAL 1
Standard cross-entropy over the full network. Unmodified — the ordinary learning signal is left exactly as it is.
SIGNAL 2
Each node carries its own bounded chain — LayerNorm, Linear, PReLU, Linear — anchored through one shared low-rank bottleneck of 4,715 parameters. This is the health baseline.
SIGNAL 3
Eight diagnoses, each routed to its own treatment, each capped as a fraction of the component's own weight, mean-centred and logged.
Emitted natively, as a property of the forward and backward pass
Gradient conflict between the signals is resolved by PCGrad projection. Every continuous correction satisfies a mean-centring conservation constraint and is bounded by an Input-to-State Stability argument under local strong convexity — and the observed correction rate settles exactly as that bound predicts, which is the part that matters: the stability argument is testable, and it was tested.
Two further results do not share this scale and are not forced onto it. Under 40% label noise the architecture decayed 2.5 pp from peak against 7.8 pp for standard training. On a 50-node graph at 30% noise it stayed stable through 22,014 attributed corrections, where standard training returned NaN and stopped.
Read the abstract in full
The neural network black box is not an inherent property of deep learning—it is a mathematical consequence of global backpropagation, where a single entangled error signal renders mid-training structural collapse invisible. We show that structurally isolating gradient chains to bounded 4-operation local paths transforms a standard neural network into a transparent, self-correcting system. Our protocol, ORMAS, extends backpropagation with a per-node local loss anchored through a capacity-constrained shared bottleneck and a health-gated self-correction mechanism that autonomously diagnoses and repairs structural pathologies in real time. Gradient conflicts between signals are resolved via PCGrad projection, and all continuous corrections satisfy a mean-centering conservation constraint, bounded by an Input-to-State Stability (ISS) convergence analysis under local strong convexity. The architecture natively emits five layers of causal telemetry—from system-level health to exact per-parameter attribution—as physical properties of the forward and backward pass, not post-hoc approximations. Empirically, correction frequency decays from 4.2 to 0.05 per epoch as the network stabilizes, consistent with the predicted ISS bound. Across 383 controlled experiments on four architectures (FC-DAG, CNN, Fat CNN, ResNet-18), ORMAS matches standard baselines on clean data while limiting accuracy decay under 40% label noise to 2.5 percentage points versus 7.8 for standard training. Under catastrophic mid-training structural collapse, ORMAS autonomously recovers to 80.3 ± 1.6% accuracy where parameter-matched baselines permanently collapse to 10.0% across all independent initializations. Under sequential task shift with no replay buffer or modularity constraint, the network self-organizes into partially factorized internal representations, achieving 58.8% mean zero-shot compositional accuracy on novel combinations versus 25% chance. These results establish architectural transparency as a structural prerequisite for autonomous robustness.
All results on CIFAR-10 and CIFAR-100. Each figure carries its error bars and seed count in the manuscript, alongside the reproducibility checklist and the scripts that regenerate every run.
Not one of them is closed because the models are insufficiently accurate. Each is closed because a decision must be accountable before it is admissible, and no production architecture can produce the account. One property gates all four.
A clinical model is frozen at authorisation, because updating it on your population degrades what it knew about everyone else and because nobody can evidence what an update changed. Roughly 8% of authorised AI devices are permitted to change at all. The rest decay from the day they ship.
A model that cannot be audited component by component cannot be validated, and one that is not validated is not deployed. Institutions retrain on a schedule and book the destroyed prior-regime knowledge as a cost of doing business.
Software entering a controlled environment must be able to account for its own behaviour. "It modified itself and we cannot say how" is not a finding that gets remediated. It ends the programme, and correctly so.
Contracts increasingly require deletion of training data from model weights, with written attestation. The only exactly compliant method is retraining from scratch, and prevailing practice is to disclose that deletion is not feasible.
A network that can account for itself structurally does not make a better prediction. It makes the prediction admissible, and that is the thing which has been missing.
The published system resolves to a component: which part failed, when, by how much, under what limit. The next result resolves one level further, to the specific training examples that damaged that component. That is the difference between knowing a part broke and knowing what broke it.
Every established method for handling bad data decides what to discard, and discards the hard examples along with the wrong ones. The objective here is the opposite: corrupted data is kept, and it raises final accuracy rather than merely being survived.
Once the system can attribute to data, what a model learned from one hospital, one desk, one assay run or one licensed corpus becomes an object with a name and a boundary — which is the precondition for separating it, bounding it, and removing it on request.
What ships stays one network of unchanged shape and unchanged inference cost. On clean data the system is identical to the published one, so nothing is paid for capability that is not being used. And every structural decision remains derivable from the logged record, because an audit trail that needs a second opaque system to explain it is not an audit trail.
Each is falsifiable, each carries a written prediction against it, and each runs on hardware already in the building. The uncertainty in this programme is not spread across years of research. It sits in four measurements, and one of them is free.
Archive analysis
The weak form of the central question, answered on a laptop against 67 archived run records. It costs nothing and nobody has done it.
Monitoring lead time
How many steps before the global loss visibly degrades does per-component health cross its own threshold. Opens or closes an entire market.
Wrapper viability
Whether a model we did not train retains enough component independence for the attachment to work. Decides the lowest-friction application.
The separation study
Whether inter-component disagreement separates mislabelled data from data that is merely hard. Gates four of the seven applications.
None has been run. A negative result on any of them narrows the programme rather than ending it: the applications that ship on the published architecture depend on none of the four.
The intellectual property position
The completed architecture is released in full on acceptance of the manuscript — reproducible, free for research and teaching, permanently. That commitment is written into the licence rather than promised. It is the credential, and it is deliberately not the moat.
What is held is the programme above: the mechanism by which attribution extends from components to data, the artefact format, the calibration procedure that turns a general bound into a validated one for a specific deployment, and the record a customer accumulates by running it. The first is a trade secret until we publish it on our own terms. The last cannot be transferred at all, because it belongs to them.
A research page that lists only what worked is a marketing page wearing a lab coat. These are the boundaries of the evidence, and they are the first thing a serious evaluator should be able to find.
The scope of the claim, as the paper states it. We do not claim state-of-the-art accuracy on clean benchmarks, and we do not claim to replace specialised noisy-label algorithms. The claim is that a single-network architecture can achieve competitive accuracy while providing mechanistically logged, per-component causal attribution that no prior single-network method offers — and that this structural transparency is what enables recovery from failures standard architectures cannot detect.
The claim is transparency. The accuracy gap is its evidence.
Every engagement starts with one specific problem — a run that died, an audit that asked a question you could not answer, a dataset you cannot vouch for.
We reply within a few days. Every message is read by a person.
Tell us what you are trying to see inside your models, and we will say plainly whether this is the right thing for it.
Useful to bring