Jul 28, 2025

Layerwise Development of Compositional Functional Representations Across Architectures

Jeyashree Krishnan, Ajay Mandyam Rangarajan

Understanding where and how neural networks represent internal computations is central to the goals of mechanistic interpretability and AI safety. We present a comprehensive empirical framework for studying circuit emergence, the process by which neural networks progressively encode and modularize functionally meaningful information across their depth and architecture. Using synthetic datasets and a hierarchy of function complexities, we investigate both MLPs and Transformers across seven axes of interpretability: complexity scaling, modular composition, symmetry, phase transitions, layer-wise decoding, and grokking. Linear probes trained on hidden activations reveal the internal structure of concept learning, including decomposed representations for composite functions, invariance to symmetric inputs, and early indicators of generalization. We observe consistent evidence of phase transitions in concept decodability, modular emergence of inner subfunctions in deeper layers, and divergence in how MLPs and Transformers encode complexity. Position embeddings in Transformers demonstrate gradual emergence, whereas other layers saturate instantly. However, our experiments reveal that while MLPs often exhibit modular, interpretable representations of composite functions, Transformers fail to decompose composite functions into their constituent parts, highlighting architectural limits to spontaneous circuit emergence.

Reviewer's Comments

Reviewer's Comments

Arrow
Arrow
Arrow

The authors run a suite of interesting experiments to look for "compositionality" in trained neural networks. Their most striking finding is that deep fully-connected MLPs appear to learn the function x->sin(x^2) compositionally, with x^2 being linearly decodable in earlier layers but not sin(x^2). It seems like the authors may not have had time to clarify some of their results - for example my summary of the x->sin(x^2) result is inferred indirectly from their prose, while the result is not clearly depicted in figure 3.

This project claims that their probes show that simple functions decompose across layers in an MLP but not in a transformer. The premise – comparing architectures in this way, changing task complexity, etc. – is good for a hackathon project. However, they don’t provide implementation details like how their datasets are constructed, or which architectures and datasets correspond to each plot. Similarly, the ‘7 axes of interpretability’ (I’m unsure that these are of the same type signature) are lightly evidenced. The phase transition is unmotivated, the authors seem to eyeball a heat-map threshold where probe accuracy jumps but never quantify this, so it seems like it was thrown in for some connection to physics. Many plots seem mislabeled, which adds to confusion (I think figure 2 should be something like layer index v. function, but it says complexity v. width). Finally: AI safety framing. Understanding modularity is good, but a model’s ability to do this is not correlated with performance or safety. The goal of interpretability is not necessarily to make models that are composable, but to understand models even when they are not.

AI Safety Relevance: While interpretability is an important subfield of AI Safety, and the authors seem to make a sincere effort towards contributing to the field, they fail to make contact with existing interpretability literature and current techniques, making many of their results moot. There is also no engagement with physics.

Innovation & Originality: Training models on ground truth composite functions and then training linear probes of each composite across model layers is a reasonable first thing to do if one is interested in interpretability. However, the field has significantly progressed beyond this and thus results, if they are to be trusted, offer little insight.

Technical Rigor & Feasibility: Most of the paper's plots show with incomplete information and at times information which contradicts what's written in the text, making it difficult to evaluate the claims.

In Figure 2 it is unclear what the unit of complexity (y axis) is. It is also unclear what the x axis is, Section 4.1 and caption underneath the figure claim that it’s across layers, but the axis label reads model width and the indices make sense for model width. There is also no mention of what the ground truth function which is being learned.

In Figure 3 Lines are overlaid on top of one another, it’s extremely difficult to understand what is being claimed. The favorable interpretation is that g(x) (blue) had perfect fit at layer 0 and f(g(x)) (brown) had perfect fit at layer 2, and g(x) had near 0 fit at layer 2 (green) and f(g(x)) had no fit at layer 0 (red). There is also no mention of how many layers the model which was trained has. Without knowing how many layers the trained model had, it’s unclear to know whether the results are trivial. There is also no interesting variation across the x axis, so it's unclear why the authors chose to include it.

In Figure 4 there is no mention of which layers the linear probe accuracy measurements are being performed. Additionally, since there seems to be no interesting variation across training it's unclear why the authors chose to include this.

Furthermore, the codebase which the authors have provided is difficult to parse. There is about 50 python scripts in a single folder. Granted they did provide the names of relevant files in the readme, but the lack of internal organization of the codebase makes quick sanity checks unnecessarily difficult.

My suggestion is for the authors to adopt cleaner code and paper writing practices, as well as closer engagement with relevant mech interp literature.

The project uses linear probes to investigate how functional representations are distributed across layers for MLPs and transformers trained on composite function tasks. The basic idea makes sense, and is clearly relevant to AI safety. Regarding the empirical finding that transformers learn positional embeddings more slowly than later layers, the authors may be interested in theoretical work that predicts this, and recommends using a larger learning rate for the positional embedding layer: https://arxiv.org/abs/2304.02034

However, I have a number of concerns about this project.

1) While this interpretability study is relevant to AI safety, the connection to physics is limited.

2) Several of the figures do not show what is claimed in the text or caption. For example, neither Fig. 7 nor Fig. 15 show any evidence of grokking, and Fig. 7 in fact shows hardly any learning at all. This makes me doubt the validity of the claimed results.

3) At 8 pages + appendices, the report exceeds the page limit of 6 pages + appendices.

Cite this work

@misc {

title={

(HckPrj) Layerwise Development of Compositional Functional Representations Across Architectures

},

author={

Jeyashree Krishnan, Ajay Mandyam Rangarajan

},

date={

7/28/25

},

organization={Apart Research},

note={Research submission to the research sprint hosted by Apart.},

howpublished={https://apartresearch.com}

}

Recent Projects

Apr 27, 2026

OliGraph: graph-based screening of large oligopools

Existing synthesis screening tools cannot evaluate short oligonucleotide pools, whose overlapping fragments can be reassembled into regulated sequences via polymerase cycling assembly (PCA) yet fall below gene-length detection thresholds. We present OliGraph, an open-source tool that constructs a bi-directed overlap graph from an oligonucleotide pool and extracts contigs for downstream gene-length screening. An optional PCA mode retains only cross-strand overlaps consistent with PCA chemistry. We validated OliGraph in a blinded study across ten simulated pools (70–9,184 oligonucleotides, 30–300 bp) spanning four risk categories. BLAST screening of individual oligonucleotides failed to identify sequences of concern in most pools: three returned zero hits, and vector noise obscured true positives in the remainder. After OliGraph assembly, contig-level BLAST matched the longest assembled sequences (up to 1,905 bp) to sequences of concern at 97–100% identity. In one pool, assembly collapsed 1,634 individual BLAST results into 10 hits from a single contig, all assigned to the same source organism. PCA mode correctly distinguished assemblable from non-assemblable fragments within the same pool. Two pools with no assemblable structure yielded no contigs. OliGraph processed all pools in under 0.2 seconds, fast enough for real-time order screening and consistent with proposals to bring oligonucleotide orders within the scope of synthesis screening regulation.

Read More

Apr 27, 2026

BioRT-Bench: A Multi-Attack Red-Teaming Benchmark for Bio-Misuse Safeguards in Frontier LLMs

Frontier AI laboratories are expected to maintain safeguards against biological misuse, but whether deployed models actually refuse bio-misuse queries under adversarial pressure is largely unmeasured in the public literature. We introduce BioRT-Bench, a benchmark that runs four attack methods (direct request, PAIR, Crescendo, and base64 encoding) against four frontier models (Claude Sonnet 4.6, GPT-5.4, DeepSeek V4-flash, Kimi K2.5) across 40 prompts spanning five biosecurity-relevant categories. Responses are scored by a calibrated judge extending StrongREJECT with two bio-specific dimensions: specificity and actionability. We measure Attack Success Rate (ASR), where 0 means the model fully refused and 1 means it provided specific, actionable bio-misuse content. Our results reveal a sharp robustness divide: Chinese frontier models (DeepSeek, Kimi) have under 5% refusal rates even under direct request (ASR 0.88 and 0.79), while Western models (Claude, GPT) maintain substantially stronger safeguards (ASR 0.15 and 0.16). Crescendo is the most effective attack across all models, both in bypassing refusal and in eliciting actionable content. Claude Sonnet 4.6 is the most robust model tested, achieving 100% refusal against base64-encoded prompts.

Read More

Apr 27, 2026

PROTEUS (PROTein Evaluation for Unusual Sequences): Structure-Informed Safety Screening for de novo and Evasion-Prone Protein-Coding Sequences

AI protein design tools like RFdiffusion, ProteinMPNN, and Bindcraft make it trivial to produce low-homology sequences that fold into active, potentially hazardous architectures. However, sequence homology-based biosafety screening tools cannot detect proteins that pose functional risk through structurally novel mechanisms with no sequence precedent. We present a tiered computational pipeline that addresses this gap by combining MMseqs2 sequence alignment with structure-based comparison via FoldSeek and DALI against curated toxin databases totaling ~34,000 entries. AlphaFold2-predicted structures are screened for both global fold similarity (FoldSeek) and local active/allosteric site geometry (DALI), capturing convergent functional hazards that sequence screening misses. The pipeline was validated against a panel of toxins, benign proteins, structural mimics, and de novo-designed Munc13 binders, as well as modified ricin variants with residue substitutions. We additionally tested robustness to partial-synthesis evasion, where a bad actor submits multiple shorter coding sequences intended for downstream reassembly into a full toxin-coding gene. We found that while sequence-based screening did not identify any de novo ricin analogues with high certainty, the combined pipeline with FoldSeek and DALI identified all 24 tested de novo ricins as toxic.

Read More

Apr 27, 2026

OliGraph: graph-based screening of large oligopools

Existing synthesis screening tools cannot evaluate short oligonucleotide pools, whose overlapping fragments can be reassembled into regulated sequences via polymerase cycling assembly (PCA) yet fall below gene-length detection thresholds. We present OliGraph, an open-source tool that constructs a bi-directed overlap graph from an oligonucleotide pool and extracts contigs for downstream gene-length screening. An optional PCA mode retains only cross-strand overlaps consistent with PCA chemistry. We validated OliGraph in a blinded study across ten simulated pools (70–9,184 oligonucleotides, 30–300 bp) spanning four risk categories. BLAST screening of individual oligonucleotides failed to identify sequences of concern in most pools: three returned zero hits, and vector noise obscured true positives in the remainder. After OliGraph assembly, contig-level BLAST matched the longest assembled sequences (up to 1,905 bp) to sequences of concern at 97–100% identity. In one pool, assembly collapsed 1,634 individual BLAST results into 10 hits from a single contig, all assigned to the same source organism. PCA mode correctly distinguished assemblable from non-assemblable fragments within the same pool. Two pools with no assemblable structure yielded no contigs. OliGraph processed all pools in under 0.2 seconds, fast enough for real-time order screening and consistent with proposals to bring oligonucleotide orders within the scope of synthesis screening regulation.

Read More

Apr 27, 2026

BioRT-Bench: A Multi-Attack Red-Teaming Benchmark for Bio-Misuse Safeguards in Frontier LLMs

Frontier AI laboratories are expected to maintain safeguards against biological misuse, but whether deployed models actually refuse bio-misuse queries under adversarial pressure is largely unmeasured in the public literature. We introduce BioRT-Bench, a benchmark that runs four attack methods (direct request, PAIR, Crescendo, and base64 encoding) against four frontier models (Claude Sonnet 4.6, GPT-5.4, DeepSeek V4-flash, Kimi K2.5) across 40 prompts spanning five biosecurity-relevant categories. Responses are scored by a calibrated judge extending StrongREJECT with two bio-specific dimensions: specificity and actionability. We measure Attack Success Rate (ASR), where 0 means the model fully refused and 1 means it provided specific, actionable bio-misuse content. Our results reveal a sharp robustness divide: Chinese frontier models (DeepSeek, Kimi) have under 5% refusal rates even under direct request (ASR 0.88 and 0.79), while Western models (Claude, GPT) maintain substantially stronger safeguards (ASR 0.15 and 0.16). Crescendo is the most effective attack across all models, both in bypassing refusal and in eliciting actionable content. Claude Sonnet 4.6 is the most robust model tested, achieving 100% refusal against base64-encoded prompts.

Read More

This work was done during one weekend by research workshop participants and does not represent the work of Apart Research.
This work was done during one weekend by research workshop participants and does not represent the work of Apart Research.