Context. Circuit-level reverse engineering had worked for vision models because many conv-net neurons are individually interpretable, so one can read the weights between two of them. A transformer has no such interpretable units: the residual stream has no privileged basis (no coordinate direction with a special meaning), attention is a softmax-gated bilinear operation, and the keys-queries-values description hides how the parts connect. This paper strips the model down (attention only, no biases, layer norm folded into the weights) and reads zero-, one- and two-layer models off their weights. The residual stream is a sum, so the model is a sum over paths, each a product of weight matrices. With the attention patterns frozen every path is linear in the tokens, and each head splits into a QK circuit that decides where to look and an OV circuit that decides what looking there does to the logits. Depth adds composition, a later head's queries or keys reading what an earlier head wrote, and that is how two layers build induction heads, the in-context copying mechanism.
Setting. Attention-only decoder transformers. Positional information enters only the inputs of and , never the residual stream. With one-hot tokens , embedding , unembedding , per-head and , define two matrices of rank at most and the causally masked pattern. On an activation matrix with one row per position, acts as : mix positions with , transform each position's vector with . Biases fold into the weights, and layer norm is a fixed affine map times a per-vector scalar. The identities below are exact for this simplified model; the readings of trained weights (copying, induction) are empirical.
Main results. (i) A zero-layer model is , so it can only learn bigram statistics. (ii) A one-layer model is exactly a bigram table plus one skip-trigram model per head (patterns "A … B C"), all tables that can be read without running the model. (iii) In a two-layer model the logits gain virtual-head terms , and a second-layer head's attention scores gain terms in which first-layer heads have moved information on the query side, the key side, or both. Empirically, most one-layer heads copy (10 of 12 in one model have strongly positive OV eigenvalues), and the trained two-layer model relies on K-composition (a second-layer head's keys reading a first-layer head's output) between a previous-token head and several second-layer heads, which form induction heads.
The residual stream is the sum of every layer's output, so heads act independently and add. Every layer reads from the stream with a linear map and adds its output back, so the stream at any depth is the embedding plus everything written so far. Any two layers are therefore joined by virtual weights , the later layer's read times the earlier layer's write, however many layers sit between them. The concatenate-then-project form of multi-head attention is likewise a sum, so each head writes to the stream on its own and can be studied alone. Rotating the stream together with every matrix that touches it leaves the model unchanged, so the paper works with weight products, never stream coordinates.
A head is an attention pattern tensored with one low-rank matrix. Write a head's three stages (a value vector per position, mixing across positions, an output projection per position) as tensor products and collapse them by the mixed-product property: So a head does two separate things. , computed from the bilinear form , says between which positions information moves, and says what is read at the source and written at the destination. Queries, keys and values are only one factorization of these two matrices. The softmax is the only nonlinearity, so running the model once to record every pattern and again with the patterns frozen makes the logits linear in the tokens. Products of heads are again heads, , which is where virtual heads come from.
A one-layer model is a bigram table plus skip-trigram tables. Expand into the sum over paths in (ii). The direct path cannot move information between positions, so it is a bigram table (Barack is followed by Obama). Each head adds two vocabulary-by-vocabulary tables, the QK circuit , which scores how much a destination token attends to a source token, and the OV circuit , which gives the logit change from attending to that source. Together they encode skip-trigrams "A … B C": from B attend back to A and raise C. The largest entries are mostly copying: attend back to tokens that could plausibly come next and raise them. Because the form is factored, the logit effect depends only on the attended source, so a head that raises "keep … in mind" and "keep … at bay" also raises "keep … in bay". Copying is summarized by the OV circuit's eigenvalues (cheap to compute, since ): a copying matrix maps a combination of tokens to the same combination of logits, so its eigenvalues are positive. The authors call this suggestive only, since non-orthogonal eigenvectors allow an all-positive spectrum while some tokens lower their own logits.
Two layers add composition, and only Q- and K-composition adds expressiveness. A second-layer head reads instead of the embeddings. In the logits this only adds the virtual heads of Step 2 (V-composition), with pattern , which still only moves information between positions. What is new appears in the attention scores. Substituting on both sides of gives terms , where are or a first-layer pattern according to whether a head first moved the query-side or key-side information and is the bilinear form, for example A second-layer head can thus attend by what an earlier head moved into a position, which no table over token pairs expresses. The paper scores each pair of heads by against random matrices. Most heads do not compose, and the significant composition is K-composition from one first-layer head that attends mainly to the previous token.
An induction head is K-composition with a previous-token head plus a copying OV circuit. An induction head completes [a][b] … [a] [b]. Take the K-composition term with a previous-token pattern : the key at position carries the token at , so a same-token bilinear form raises the score of exactly the positions whose predecessor matches the current token, and a copying OV circuit raises the token found there. Unlike one-layer copying heads, it uses how the token was used earlier, whatever the corpus statistics. Two checks support this. The heads behave the same way on uniformly random tokens repeated three times, where corpus statistics cannot help. And every induction head has strongly positive eigenvalues in both its OV circuit and its K-composition QK term; the authors note this is not circular, since the heads were selected for large composition, which says nothing about its sign.
Path ablations show that the virtual heads barely matter here. Freeze every attention pattern at its recorded value and rerun the model several times. The first frozen run replaces every head's output with zero, leaving the direct path, and each later run adds to the stream, in place of each head's current output, the output that head produced on the run before. The -th run then contains exactly the OV paths through at most heads, and successive loss differences give the marginal value of each order. In the two-layer model the second-order (V-composition) terms add little, and among first-order terms the second-layer heads carry most of the gain. Since the patterns are frozen, this says nothing about Q- and K-composition, which act only through the patterns.
Consequences and limits. For attention-only models, interpretation becomes the problem of summarizing large, very low-rank matrices: nothing algorithmic is hidden, but each vocabulary table has billions of entries. The sharp qualitative finding is that one layer can only build skip-trigrams while two layers build an algorithm, so in-context copying changes character at depth two. The main limit is the one the authors stress: MLP layers hold about two thirds of a standard transformer's parameters, a GeLU cannot be linearized through, and the path picture then needs interpretable neurons, which were rare. They expect superposition in the residual stream, far narrower than the heads and neurons that read and write it, which the later superposition papers take up.
Terms
- Residual stream
- embedding plus every layer's output; linear, with no privileged basis
- what a head reads at the source and writes at the destination; rank at most
- bilinear form that produces the head's attention scores
- acts as : mix positions by , map each vector by
- QK circuit
- token-by-token table of attention scores
- OV circuit
- token-by-token table of logit effects of attending to a token
- Skip-trigram
- A … B C: from B attend to A and raise C; one-layer heads are made of these
- Q-, K-, V-composition
- a later head's query, key or value reads what an earlier head wrote
- Virtual head
- , the path through two heads
- Induction head
- [a][b] … [a] [b]; K-composition with a previous-token head plus copying
Quiz
- Why does freezing the attention patterns make a trained attention-only model's logits linear in the tokens?With fixed each head is , a linear map on the stream, and the embedding, residual additions and unembedding are linear already. The softmax is what makes depend on the tokens; low rank and layer norm play no role here.
- Why does the paper never look for interpretable coordinates in the residual stream?Only linear maps read and write the stream, so any rotation can be absorbed into the adjacent weights and no coordinate has a special meaning. The paper studies weight products such as instead.
- Positive OV eigenvalues are used as the paper's summary of copying. What is the authors' caveat?With non-orthogonal eigenvectors a matrix can have all-positive eigenvalues and still lower some tokens' own logits, so the spectrum measures copying only on average. Factor order does not matter, since , which is what makes the statistic cheap.
- Induction heads behave the same on uniformly random tokens repeated three times. What does this check establish?On random tokens no bigram or skip-trigram table can predict the next token, so success means the head looked up what followed the earlier occurrence of the current token. That is the in-context mechanism, distinct from one-layer copying heads, which rely on which tokens plausibly follow.
Sources
- Nelson Elhage et al. A Mathematical Framework for Transformer Circuits. Transformer Circuits Thread, 2021.