Which paper-stated controls must a reader fix before treating an extracted circuit as a causal subgraph rather than a correlation: for Vi-CD (arXiv:2604.14477v1), clean versus foreground-segmentation-and-inpaint corrupted pairs, a task metric distinct from the target-logit-difference pruning criterion, and same-size random or non-circuit edge ablations on supervised ViT-B and OpenCLIP ViT-B/32; and for WeightLens and CircuitLens (arXiv:2510.14936v2), single-token forward-pass validation of weight-outlier tokens plus attention-head and logit attributions before an explainer description — and which of checkpoint, layer, threshold, epsilon, and dataset stay explicit unknowns rather than results to assume?

Two papers, two circuit objects

The controls below answer one reading rule: when does an extracted set of connections support an intervention claim, rather than a correlation between weights or activations and a label? They do not make the two papers describe the same object.

In Żukowska, Stammer, Schiele, and Fischer, a circuit is a subset of residual-stream edges in a vision transformer (Definition 3.1). Nodes are components; edges are additive residual contributions. A circuit is faithful, in the sense they adopt as Definition 3.2, only if restricting computation to that edge set preserves a task metric M_T up to a tolerance ε:

M_T(E) − M_T(E_C) ≤ ε,

and M_T must differ from the criterion used to prune edges. The experimental models named for this test are a supervised ViT-B trained on ImageNet and OpenCLIP ViT-B/32. The OpenCLIP weights used for the reported runs are laion/CLIP-ViT-B-32-DataComp.XL-s13B-b90K. The supervised ViT-B file is cited only through Dosovitskiy et al. (2021); the extracted text does not name a release, seed, or patch size.

In Golimblevskaia, Jain, Puri, Ibrahim, Samek, and Lapuschkin, the objects are transcoder features and attribution links among features, attention heads, and logits. An input-invariant connection is a fixed dot product of a decoder row and an encoder column, separated from the input-dependent activation (their Equation 1). That term is not an intervention. WeightLens and CircuitLens are procedures for deciding which of those links may enter a description. They are not a vision-transformer edge knockout, and a CircuitLens sentence is not a Vi-CD faithful subgraph.

This account follows the text of arXiv:2604.14477v1 (15 April 2026) and arXiv:2510.14936v2 (4 March 2026). Symbols that appear only as figure annotations, and passages that disagree, are left unresolved.

Vi-CD: controls required before a causal reading

Vi-CD casts discovery as edge selection on a reduced residual graph. Each attention block has one attention-input receiver, so head-specific receiver nodes are collapsed. The paper states that this cuts the candidate edge count by about a factor of H without changing the computed function. The edge types on that graph are input, attention, and MLP senders into attention-input, MLP, and logit receivers. “Same-size” later means the same count of these edges, not the same edges, and not a count on the unreduced graph. L and H for the experimental ViTs are not printed; a 2-layer drawing in Figure 3 is a toy.

Evaluation of a candidate edge set E_C is activation patching. For each receiver v, predecessors u contribute either the clean-run residual or the corrupted-run residual:

in^C_v(x̃) = Σ_{u ∈ P(v)} [ i_e r_u(x) + (1 − i_e) r_u(x̃) ],

with i_e = 1 if (u → v) is in E_C and 0 otherwise (Equation 3). Circuit edges carry clean activations; other edges keep corrupted activations. Figure 2’s caption states the same replacement. Without a corrupted run that actually removes the task signal, this swap does not separate a task pathway from edges that merely co-vary with the image.

Clean versus foreground-segmentation-and-inpaint pairs

For class circuits, a clean input contains the object evidence for the target class. A corrupted input removes that evidence by segmenting the foreground object and inpainting the mask, while the paper’s stated aim is to keep background statistics and low-level structure. The extracted text names ForAug (Nauen et al., arXiv:2503.09399) as the ImageNet images already processed with that pipeline. It does not name the segmentation model or the inpainting model. Those generators stay unknown; substituting another mask or another fill changes the contrast the patching test uses.

Appendix A fixes the class-circuit sample: N = 128 images from the ImageNet class, retained only if the base model already classifies them correctly. Definition 3.3 then packages the circuit as (D_A, M, E_C): a dataset of diverse inputs correctly classified as A, a scalar performance metric such as accuracy, and a faithful edge set, evaluated by activation patching. The authors’ rationale for this corruption, restated in the discussion, is that background-correlated edges then carry no clean-versus-corrupted activation difference, so the discovered path is pushed toward object-level routing rather than a background shortcut. That is an assumption about the mask, not a proof that every retained edge is object-causal. If the mask misses the cue the model uses, or the inpainting inserts a new cue, the patching contrast is no longer the intended deletion.

The pair is task-dependent. For typographic attack circuits the paper reverses the labels relative to ordinary class corruption: the typographic image is the clean input and the image without the overlay is the corrupted input. Applying ForAug object-removal to an attack circuit, or treating the attack image as the corrupted member of a class pair, extracts a different path. OpenCLIP logits in this setup are dot products of the image embedding with text embeddings; the zero-shot ImageNet matrix is taken from ViTPrisma. Supervised ViT-B logits come from the classification head. The target logit is therefore not the same object in the two models, and the text-prompt templates behind the ViTPrisma matrix are not printed.

A task metric distinct from target-logit-difference pruning

Membership is decided by sequential activation patching, following the automated circuit-discovery procedure of Conmy et al., with target logit difference as the edge criterion. After extraction, faithfulness is classification accuracy when computation is restricted to the circuit. That split is the operational content of Definition 3.2’s requirement that M_T differ from the pruning criterion. Using target logit difference both to select edges and to declare the subgraph faithful would not meet the definition the paper adopts, even if accuracy later looks high. Appendix F compares Kullback–Leibler pruning with target-logit-difference pruning over 15 thresholds, on batches of 128, with at most 900 visited nodes. The main extraction still uses target logit difference. The appendix ranges are a sensitivity check, not a second faithfulness metric.

The comparison of an edge score with a threshold is not consistently stated, so it cannot be treated as a result. The sequential-pruning paragraph says that if the loss after removing an edge is small enough, the edge is removed from the candidate circuit. Figure 2’s annotations say the opposite direction if EdgeMetric is that loss: EdgeMetric > τ means the edge is out of the circuit, and EdgeMetric < τ means it is in. Appendix A agrees with the figure, not with the removal sentence: edges whose target logit difference is below the threshold are included, and edges above it are pruned. A reader cannot choose one inequality from this text alone. What is stable is the identity of the two metrics: target logit difference for pruning, classification accuracy for the faithfulness report, with thresholds set in an attempt to keep more than 80% performance retention and to favor sparsity.

Table 4 prints the per-class δ values used under that retention target. They are not one constant, and they are not printed for every ImageNet class.

A separate binary-circuit setup on CLIP uses target logit difference at 4×10⁻⁴ over 8 seeds, on datasets that are half correctly classified examples from each class. That number is not Table 4’s δ and does not transfer to class-circuit extraction.

Definition 3.2’s ε is not identified with the 80% retention target. No numeric ε is reported for the inequality M_T(E) − M_T(E_C) ≤ ε. Steering uses a different ε, a stability term in the denominator of a projection coefficient, and that value is also unstated. Neither symbol may be filled in.

Same-size random or non-circuit edge ablations

High accuracy at low edge count is still compatible with “any compact set of edges would have done this” unless a size-matched null is worse. The paper’s extraction benchmark therefore includes random edge pruning as a lower bound, on the same simplified graph, for both the supervised ViT-B and OpenCLIP ViT-B/32. Faithfulness in that comparison is classification accuracy on the target class; sparsity is the fraction of edges retained. That random-pruning baseline is not the same intervention as a same-size draw from outside an already discovered circuit.

For typographic steering on the named OpenCLIP checkpoint, the paper adds that control. Section 4.4 states that the attack-success pattern is not observed for random circuits of the same size. Appendix G compares three edge sets of matched size: discovered circuit edges, random edges, and random edges drawn from outside the circuit. Steering strength α ≥ 0 and the deepest receiver layer included are sweep axes, not a single layer result. The extracted text says circuit-edge steering can suppress attack success while retention stays high, including when only early receivers are included; matched-size random edges suppress attack success less; non-circuit edges can fail to reduce attack success and, under strong steering through middle layers, can raise it. Figure 8’s caption likewise plots same-size non-circuit edges as dashed controls on clean accuracy, corrupted accuracy, and attack success rate. The sampling distribution behind “random” and “matched size”, uniform over edge types, layer-matched, or otherwise, is not specified. Three seeds are stated for the RoCOCO means; typographic panels are averages over 20 circuits. A reader cannot assume a particular random-edge law.

On RoCOCO image-to-text retrieval, Table 9 reports the same size-matched contrast at steering strength 0.4, mean ± standard deviation over three seeds. Baseline recall of manipulated samples (RSMS) is 11.68%. Assault Rifle, Revolver, and Rifle circuit steering give RSMS 5.15±0.24, 5.69±0.41, and 4.86±0.21. The matched-size random counterparts give 9.09±1.15, 9.23±1.09, and 8.79±1.74. The paper reads the gap as evidence that the weapon-circuit edges concentrate the manipulated-caption pathway more than an arbitrary equal-sized set. The RoCOCO subsection does not repeat the OpenCLIP checkpoint string; tying those rows to laion/CLIP-ViT-B-32-DataComp.XL-s13B-b90K is an inference from the surrounding vision-language setup, not a sentence in that subsection. The extracted appendix does not report the three-way non-circuit steering ablation on the supervised ViT-B. Random edge pruning on that model is the extraction lower bound, not a license to import the OpenCLIP steering controls.

Even when these controls hold, the paper does not claim a unique causal subgraph. Same-class circuits from different 128-image draws are not identical. The discussion cites Jaccard similarities of 0.6–0.8 against other draws from the same class, and higher similarity to that class than to non-class circuits. The authors treat that imperfect overlap as redundancy, a distribution over sufficient subgraphs, not as failure of the metric. A separate appendix count pools edge-inclusion frequencies across Imagenette classes; in that pooled distribution, 34.5% of edges appear in 90–100% of runs for the same class circuit. Sufficiency under Equation 3 is the causal claim the controls support. Identity of “the” circuit is not.

WeightLens and CircuitLens: validate, attribute, then describe

Circuit Insights studies transcoders on GPT-2 Small, Gemma-2-2B, and Llama-3.2-1B, with qualitative examples concentrated on Gemma-2-2B. A transcoder feature’s link to an earlier feature splits into an input-dependent activation and an input-invariant connectivity term (Equation 1). A later form multiplies in a Jacobian that treats attention, normalization, and other nonlinearities as constants on that input (Equation 2). WeightLens uses the weight term, not that Jacobian. Strong weight links can match edges in an input-specific attribution graph, as in the paper’s “all” example, and they can also be tokens that never activate the feature. Assumption 1 therefore restricts interpretation to connections whose magnitude is an outlier relative to other connections. Assumption 2 adds a behavioral check: if the outlier is supposed to be the feature’s inherent token, the feature should activate on that token with no context.

Single-token forward-pass validation of weight-outlier tokens

WeightLens builds a token description in three stated steps, applied from earlier layers to later ones.

Project the encoder vector through the embedding matrix and the decoder vector through the unembedding matrix. Mark z-score outliers. The stated outlier threshold is 4 for GPT-2 and 4.5 for Gemma-2-2B and Llama-3.2-1B. Embedding-space outliers are input candidates; logit-space outliers are an optional output side. For each earlier layer, multiply that layer’s decoder by the target encoder and keep feature outliers at z-score 3. Inherit those features’ token descriptions as further input candidates. Then run a forward pass and keep only tokens that activate the feature. The case studies describe this check as a single-token pass with no surrounding context. Output-logit outliers are not validated the same way; the paper marks that side optional because it can be noise.

Until that forward pass, a weight outlier is a structural candidate. Appendix E.1’s counterexample is feature L20F8684: the strongest embedding-projection tokens include “Penh”, “Gaulle”, and “Permanente”, and those tokens do not activate the feature, whereas the input-dependent graph attributes the feature to “all” and to an upstream feature that does respond to “all”. The validation step is what drops the random projection outliers.

Passing the check is still not a full causal account of the feature, and failing it is not proof that a weight link is meaningless. For L3F9607, the token “receptor” is supported by the embedding projection and by the single-token pass. An upstream feature associated with “plots” and “plotted” has a strong weight connection and is thematically related in the activating code snippets, but those tokens do not activate L3F9607 in isolation. The paper calls this a false negative of the context-free check. A reader who treats only validated tokens as the circuit will miss context-dependent causes; a reader who skips the check will treat noise outliers as causes. Both errors are stated in the source.

Coverage is limited even after validation. The paper reports validated input-invariant descriptions for 32.7% of Gemma features, 58.8% of GPT-2 features, and 25.4% of Llama features, on the order of 250 features per layer in the comparison they plot. Where weight descriptions fail, the paper also reports that activation-based descriptions perform poorly. Middle layers, especially Gemma-2-2B layer 12 in their account, are described as highly context-dependent. A token-level WeightLens description is not available for most features of Gemma and Llama in this text, and it must not be assumed for a feature that was not validated.

Attention-head and logit attributions before any explainer description

CircuitLens is the control for features that do not have a context-free token. The stated order is: cache activations, sample, attribute, mask, cluster on the attribution pattern, and only then call an explainer model. The explainer is not the evidence. The paper’s criticism of activation-only descriptions is that highlighted activations often do not show which tokens caused the feature to fire, so the explainer returns a vague label or only the dominant mode in the top activations.

Input-side attribution uses their Equation 4. For an attention head at an earlier or equal layer, the contribution of an earlier token to the feature at the analyzed token is the attention score from source to target times the projection of the feature encoder onto that head’s output-value path, applied to the pre-attention residual. The paper does not state that this attention-head term treats nonlinearities as constants. Outlier (head, token) pairs are selected by z-score against the contribution distribution. The numeric z cutoff for those pairs is not stated. The input is then masked to tokens that either activated the feature directly or contributed through those heads.

Output-side attribution uses Equation 5: feature activation times decoder, times a Jacobian from the final residual to the feature’s post-residual, times the unembedding vector of the generated token. That Jacobian, like the Jacobian in Equation 2, treats nonlinearities and attention patterns as constants on the given input. Only generated tokens that this term marks as influenced are highlighted. The paper’s L21F91 example is the reason this step is not optional if the description is supposed to state function: input activations sit on tokens such as “on” or certain verbs, while logit attribution points to output phrases such as “the basis of” and “based on”. An explainer that sees only input activations does not get that effect. Computing it is expensive in their setup: each new generated token needs another forward and backward pass. They generate 15 new tokens per sample and report that early-layer features rarely affect those tokens, and that when they do the effect is usually the immediate next token. Later layers can show multi-token output patterns. Those depth claims are Gemma-layer results, not a license to skip logit attribution on an untested layer.

The sampling frame is also a fixed condition, and the two Pile extracts do not share one sampler. Subsection 3.3, used on the smaller extract, splits activations into B = 20 quantile bins, weights them by inverse frequency with exponent 0.9, and draws N = 100 activations without replacement. Appendix B calls that procedure frequency quantile sampling and assigns it to the 24M-token (40MB) uncopyrighted Pile extract only. The comparison on 2.3B tokens (6GB) samples from the top; Appendix B specifies top-percentile sampling for that larger extract, not quantile sampling. Descriptions still depend on that choice. The paper says the larger set is stronger on input-centric metrics, while weight tokens plus circuit descriptions reduce, but do not remove, sensitivity to corpus size. An explainer sentence from a different corpus is not the result in their figures.

Clustering is a further condition, not a discovered partition. Contributors from Equations 2 and 4 are filtered by a frequency fraction ρ, which is not given a number. The methods section then clusters with DBSCAN on Jaccard similarity and does not print eps or min samples. The appendix states the applied numeric setting under a different name: HDBSCAN with eps = 0.7 and min samples = 3, and shows that eps = 0.8 merges sub-patterns that 0.7 splits, including color and material examples that can be one cluster or several. Those values are not a DBSCAN setting. Reported cluster counts in the main-text analysis are about 1.05 per feature in layer 0, 4.5 in layer 7, 2.8 in layer 12, and 2.95 in layer 21. The main text does not tie those counts to a numeric eps. They are not unique circuits, and ρ cannot be assumed.

The explainer then sees the masked pattern, with the single most activating token marked, not the raw sentence with activation highlights. Cluster descriptions are merged into one feature description. For the WeightLens variant that adds an explainer after validated tokens, the stated model is gpt-4o-mini-2024-07-18. The extracted CircuitLens evaluation section does not name the explainer checkpoint. Do not assume it is the same model. Lemmatization is the non-explainer cleanup for WeightLens token lists; it does not add a causal test.

FADE faithfulness, whether steering the feature moves generations toward the described concept, stays low across WeightLens, CircuitLens, and the activation baselines they plot. The authors attribute that to transcoder features writing into the residual stream like MLP outputs, plus redundancy, so one feature rarely moves the output. Low faithfulness means a validated description is still not a demonstration that the feature, or its attribution cluster, is a sufficient causal subgraph of the model in the Definition 3.2 sense.

Checkpoint, layer, threshold, epsilon, and dataset

The five names in the question are not uniformly unknown, and none of them is a single number a reader may copy onto a new run. The split below is what the two extracted papers state versus what they do not.

What remains correlational even after the controls

Fixing the controls changes the claim from “these edges or tokens co-occur with the label” to “under this patch, this mask, this metric, and this null, the restricted computation still carries the measured behavior,” or, for the transcoder papers, “this token fires the feature with no context” and “these attributed tokens are what the explainer was allowed to see.” It does not yield a unique mechanism.

On the vision side, Equation 3 tests sufficiency of clean activations on E_C against a corrupted background, not necessity of every edge, and not stability across draws. Partial Jaccard overlap is the paper’s own counterweight to a single-subgraph reading. The pruning inequality conflict means a reimplementation can disagree about membership even with Table 4 in hand. Background preservation is only as good as the unnamed segmentation and inpainting models. Steering specificity depends on the size-matched null; where that null was not run, a drop in attack success is not yet evidence against generic ablation. Random pruning on supervised ViT-B does not stand in for the OpenCLIP non-circuit steering ablation.

On the transcoder side, an input-invariant dot product remains a correlation in weight space until the single-token pass, and that pass misses causes that exist only in context. The Jacobians in Equations 2 and 5 are local linearizations that treat nonlinearities as constants on the sampled input. Attention-head attribution in Equation 4 is not stated to freeze nonlinearities. Those attributions pre-empt an unconstrained explainer story; they do not replace a knockout faithfulness test. Reported FADE faithfulness stays low for these methods and for the activation baselines, which the authors tie to redundancy. Validated token coverage is a minority of features for Gemma and Llama in the stated percentages. Cluster grain in the appendix moves with HDBSCAN eps. Dataset size still moves description metrics.

The practical rule is therefore narrow. Use the clean/corrupted pair that matches the task, keep pruning and faithfulness metrics distinct, and require a same-size random or non-circuit ablation on the model for which the paper actually reports it, before calling a Vi-CD edge set a causal subgraph rather than a correlated one. Use the single-token forward pass on weight outliers, and attention-head plus logit attributions, before treating an explainer description as circuit evidence. Leave checkpoint, layer, threshold, epsilon, and dataset at the values the text prints for that run, and leave them unknown where it does not. Do not attach the appendix HDBSCAN pair eps = 0.7 and min samples = 3 to methods-section DBSCAN, which prints no such values. Quantile-sample only the 24M-token Pile extract; the 2.3B-token extract is top-percentile sampled.