{"id":"a36e1fe6-d092-48bd-8a70-337a826a0ff8","arxiv_id":"2506.19140","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"Command-V ports a finetuned behavior from a donor LLM to a recipient LLM by converting activations with linear maps at matched layers and applying the donor's intervention without backpropagation.","lead":"Command-V transfers a behavior, such as refusing harmful requests or reasoning step-by-step, from one AI model to another without retraining either model. It records how both models respond to a small set of sample prompts and computes simple linear maps between their internal activations to copy the donor's behavior over.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The Eq. (6) converter has rank at most 1,030 in 4,096-dim space, and the paper never checks that the donor intervention survives projection onto that subspace; the reported transfer failures match this signature.","rationale":"The paper's core contribution is that Eq. (6) transfers a donor's ReFT intervention into a different model using only cheap linear converters built from generic activation profiles. I read the compute claims as scoped to the pasting step: the method is defined as taking an existing trained adapter as input, so the omitted donor-training cost is a reporting issue rather than a challenge to the transfer mechanism. The load-bearing scientific premise is instead that the low-rank pseudoinverse converter preserves the behavior-relevant directions of the donor intervention. With N=1030 and hidden dimensions 3072-4096, both converters have rank at most 1030, and the donor profile matrix Y's row space is the only donor-space subspace that survives C_D_to_R. The appendix MSE numbers are computed on the profile-fitting prompts and therefore cannot reveal whether directions outside that subspace are needed for the behavior. The failure patterns the authors report, small-effect adapters, cross-family degradation, and output collapse, are consistent with exactly this rank-limited projection. The proposed diagnostic, measuring how much intervention norm survives projection onto the row space of Y and correlating it with transfer success across model pairs, would determine whether the converter's span is the bottleneck or whether layer correspondence or linearity is the limiting factor. Because the reader's conditional verdict already flags the alignment assumption as the weak point, my stress test does not change the verdict, but it sharpens the condition: the authors should provide a subspace diagnostic or an N-scaling study before the 'pasting' claim is taken at face value.","tokens_in":18292,"tokens_out":14562,"duration_ms":161247,"concrete_test":"For the refusal-transfer experiments, compute for each donor-recipient pair the ratio R = ||P_rowspace(Y)(Delta_I_lD(C_R_to_D h_R))|| / ||Delta_I_lD(C_R_to_D h_R)|| on a held-out set of 200 WildJailbreak/AdvBench prompts, where P_rowspace(Y) is the orthogonal projection onto the donor profile row space used in Eq. (5); then plot transferred ASR change against R across the model pairs in Figures 2 and 3. If low-R pairs are precisely the Gemma2 and cross-family failures, the rank-limited converter is the confirmed bottleneck; if high-R pairs also fail, layer correspondence or linearity is the limiting assumption instead.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central transfer mechanism is Eq. (6): h_R^intervened = h_R + C_D_to_R(Delta_I_lD(C_R_to_D h_R)). The converters are Moore-Penrose least-squares maps built from activation matrices X and Y whose rows are last-token activations on N=1030 LIMA prompts (Eqs. 4-5). Because N is far smaller than the hidden dimensions d_R, d_D (3072/4096), each converter has rank at most 1030. Consequently, every transferred intervention is confined to an at-most-1030-dimensional subspace of each residual stream: C_R_to_D maps into the row space of Y, and C_D_to_R annihilates any component of Delta_I_lD orthogonal to that row space. Faithful pasting therefore requires that the behavior-relevant output of the donor intervention lie approximately in the row space of the donor activation profile matrix Y. The paper does not test this. Appendix A.3 reports forward/cycle MSE on the same LIMA activations used to derive the converters, so it only measures fit on the profile manifold and cannot detect missing directions. The failure modes the authors themselves report, negligible transfer for small-effect adapters, degraded cross-family transfer, and collapsed or degraded CoT outputs, are exactly what a rank-limited projection would produce. Without a subspace diagnostic, the claim that Eq. (6) pastes the donor behavior rather than a rank-limited proxy is unverified.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces Command-V (⌘V), a backpropagation-free method for transferring a behavior encoded in a donor model's residual activation adapter (DiReFT) to a recipient model. The method profiles last-token activations on 1,030 LIMA prompts, derives linear converters between corresponding layers via Moore-Penrose pseudoinverses, and applies the donor intervention in the recipient's activation space through the round-trip formula in Eq. (6). The authors evaluate the approach on three case studies: safety-refusal enhancement, jailbreak facilitation, and chain-of-thought reasoning, reporting that Command-V matches or exceeds direct finetuning while using orders of magnitude less compute. The paper includes experiments across multiple Llama, Qwen, Gemma, Phi, and OLMo models and releases code and data.","tokens_in":18587,"tokens_out":5552,"duration_ms":56794,"significance":"If the claims hold, Command-V is a useful and inexpensive alternative to distillation or per-recipient finetuning for PEFT-style behavior transfer, and the idea of reusing a donor's residual adapter via linear activation converters is novel. The method is clearly described, the converter derivation is standard least squares, and the paper ships code and data, which are concrete strengths. The empirical scope is substantial, especially the cross-family jailbreak experiments in Section 4.3. However, the central claim is only partially supported: the reverse refusal direction (8B to 3B) does not match direct finetuning, and the rank-limited converter issue identified below means the method's mechanism is not yet fully verified.","major_comments":[{"comment":"Each converter C_R→D = X^†Y and C_D→R = Y^†X has rank at most N=1030, which is far below the residual dimensions (3072/4096). Consequently, the transferred intervention in Eq. (6) is confined to the row space of the donor activation-profile matrix Y: any component of ΔI_lD orthogonal to that row space is annihilated by C_D→R. The paper does not test whether the behavior-relevant part of the donor intervention lies in this subspace. Appendix A.3 reports only forward and cycle MSE on the same LIMA activations used to derive the converters, which measures fit on the profiling manifold and cannot detect missing directions. Because the reported failure modes in the Discussion (small-effect adapters, cross-family transfer, degraded or collapsed CoT outputs) are exactly what a rank-limited projection would produce, the central claim that Eq. (6) pastes the donor behavior rather than a rank-limited proxy is unverified. Please add a subspace diagnostic, for example by projecting the donor intervention onto the row space of Y and measuring its effect on held-out prompts, or by reporting the singular-value spectrum of the converters together with the overlap of ΔI_lD with that spectrum.","section":"Section 3.2, Eqs. (4)-(5), with N=1030 profiling prompts from Section 4.1"},{"comment":"The abstract's claim that Command-V 'matches or exceeds the performance of direct finetuning' is contradicted by the reverse transfer direction: for 8B→3B, Command-V reduces ASR to 16.4%, while direct ReFT training on the 3B recipient reaches a final ASR of 12.20% and an observed intermediate low of 5.65%. The paper also compares Command-V's final transfer against the direct method's final checkpoint while separately reporting the direct method's best intermediate value, making the 'surpasses direct training' statement for 3B→8B ambiguous (20.40% vs. final 28.55%, with ReFT intermediate 21.05%). Please report error bars or multiple seeds and state precisely which comparisons support the headline claim.","section":"Section 4.2, refusal enhancement results"},{"comment":"The jailbreak case study shows that Command-V can increase attack success rates substantially on many recipient models, but the paper does not compare against direct finetuning for each donor-recipient pair. Since the headline claim is that Command-V matches or exceeds direct finetuning, the absence of a direct-finetuning baseline in this case study means the central claim is not tested there. Please either add such baselines or explicitly reframe the claim as 'matches or exceeds direct finetuning in selected settings'.","section":"Section 4.3 and the general claim in the abstract"}],"minor_comments":[{"comment":"The phrase 'we next consider refusal enhancement' appears in the refusal-suppression section; it should read 'refusal suppression'.","section":"Section 4.3, first paragraph"},{"comment":"The caption contains a typo, 'sqaure', and should clarify that the reported MSE values are computed on the same prompts used to fit the converters, not on a held-out set.","section":"Figure 5 caption"},{"comment":"The notation for converters is inconsistent: the text uses C_R→D and C_D→R, while Eq. (6) uses C_lR→lD and C_lD→lR. Please unify the subscripts to avoid confusion.","section":"Equations (4)-(6) and surrounding text"},{"comment":"The appendix states that MSE-guided layer matching 'overwhelmingly' selects early recipient layers and performs poorly downstream, but does not provide a quantitative comparison to the linear mapping in Eq. (3); a small table or figure would make this claim checkable.","section":"Appendix A.2"},{"comment":"The main numerical differences in the refusal experiments are small in some cases (e.g., 20.40% vs. 21.05%), and no variance or number of seeds is reported. Adding error bars or a short seed-sensitivity statement would strengthen the comparisons.","section":"Section 4.2 and Figure 2"}],"recommendation":"major_revision","confidential_remarks":"The core idea is interesting and the empirical scope is broad, but the rank-limited converter issue should be addressed before publication because it bears directly on whether the method transfers the donor's behavior or only a low-rank projection of it. The headline claim in the abstract should also be softened to match the experimental evidence. I would not reject the paper; the method and released code are valuable enough to warrant a revision."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Bottom line: this is a genuinely new method—activation-profile pseudoinverse converters that port ReFT interventions across model boundaries—and it mostly works in the cases they try. The writing is clear, the math is standard least squares, and the authors openly report the failures (small-effect adapters, cross-family degradation, output collapse). That honesty earns them credit.\n\nWhat's new: using last-token activation profiles on a generic prompt set to derive linear maps between different models' residual streams, then applying a donor's learned low-rank intervention in the recipient's space. No backprop, no task-specific converter data. They validate on refusal enhancement, jailbreak facilitation, and CoT, across Llama, Qwen, Gemma, and others. The efficiency claim is real for inference and converter derivation, though the compute comparison omits the donor ReFT training cost; that's amortizable when one adapter is pasted into many recipients, but it should be stated explicitly.\n\nThe main soft spot is a missing subspace diagnostic. With N=1,030 LIMA prompts and hidden dimensions 3,072/4,096, both converters have rank at most 1,030. So the pasted intervention is confined to the row space of the activation matrix. The paper's forward/cycle MSE (Figure 5) is measured on the same activations used to fit the converters, so it only shows fit on the profile manifold and can't detect whether the donor intervention's output leaks outside that subspace. The reported failure modes—negligible transfer for small-effect adapters, degraded cross-family transfer, collapsed CoT—are exactly what a rank-limited projection would do. I'd want to see, for at least one successful and one failing transfer, the norm of the donor intervention projected onto the profile row space versus orthogonal to it.\n\nOther issues are minor. No error bars or multiple seeds; the Figure 2 ASR numbers are point estimates. The layer-matching heuristic l_R = floor(alpha l_D) is acknowledged as fragile, and the overrefusal rate for Command-V is about double that of ReFT in Table 1. The abstract's 'matches or exceeds' overshoots; in the 8B-to-3B refusal direction it doesn't match direct finetuning. Missing references to some linear representation prior art, but not a fatal omission.\n\nWho this is for: anyone working on activation steering, model merging, or cheap safety alignment. The code is public and the method is cheap to reproduce. I'd send it to peer review, asking for the subspace diagnostic and error bars. It's a solid proof-of-concept, not yet a general-purpose 'paste' method.","headline":"A training-free, plausibly useful method for porting ReFT adapters across models, with a real rank-limitation blind spot that deserves a diagnostic before the paste-behavior claim is taken at face value.","tokens_in":19140,"tokens_out":3631,"would_cite":true,"duration_ms":36544,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A behavior trained into one LLM can be pasted into another with no backpropagation or task data, using linear converters between activation spaces.","keywords":["activation transfer","behavior pasting","residual adapters","linear converters","activation profiles","representation finetuning","jailbreak transfer","chain-of-thought transfer"],"falsifier":"Recompute the converters for the Llama3.2-3B-to-Llama3.1-8B refusal transfer using 10 randomly sampled LIMA prompts instead of 1,030; if the attack-success-rate reduction vanishes, the profile size is load-bearing.","tokens_in":18093,"feed_emoji":"📋","tokens_out":6342,"duration_ms":55675,"temperature":0.7,"pith_summary":"Command-V claims that the behavioral effect of a low-rank residual adapter can be copied from one large language model (the donor) to a different model (the recipient) without any gradient training or task-specific data. The transfer works by profiling each model's layer activations on a generic set of 1,030 prompts, fitting linear maps between corresponding layers with a Moore-Penrose pseudoinverse, then applying the donor's activation-space intervention inside the recipient's forward pass. In three case studies—safety-refusal enhancement, jailbreak facilitation, and default chain-of-thought reasoning—the pasted behavior matches or exceeds directly finetuning the recipient, at a fraction of the compute. If the claim holds, trained behaviors become portable assets that can be reused across models and architectures, including on devices that cannot run the larger donor model.","feed_headline":"LLM behaviors transfer without finetuning, via activation pasting","feed_subtitle":"Command-V copies a donor's trained adapter into a new model using only generic prompts and matrix math.","key_machinery":"The load-bearing object is the bidirectional layer converter built from activation profiles: for each matched layer pair, the paper collects last-token activations across the same 1,030 LIMA prompts from both models, then sets $C_{R\\to D} = X^\\dagger Y$ and $C_{D\\to R} = Y^\\dagger X$, where $X$ and $Y$ are the activation matrices of recipient and donor. Layers are matched by the linear depth map $l_R = \\lfloor \\alpha \\cdot l_D \\rfloor$ with $\\alpha = |L_R|/|L_D|$, following the view that layer functions scale roughly linearly with depth. The donor intervention is a DiReFT module $I(h) = h + W_2^{\\mathsf{T}}(W_1 h + b)$ of rank 4 to 32, applied only to last tokens. The mechanism converts the recipient's hidden state into donor space, applies that low-rank intervention, converts the delta back, and adds it to the recipient's hidden state.","core_discovery":"The central claim is that a behavior encoded in a donor model's residual adapter transfers to a recipient as $h_R^{\\text{intervened}} = h_R + C_{D\\to R}\\big(\\Delta I_{l_D}(C_{R\\to D} h_R)\\big)$, Equation (6). Here $\\Delta I_{l_D}$ is the low-rank intervention learned by a DiReFT module at donor layer $l_D$, and $C_{R\\to D}$, $C_{D\\to R}$ are the pseudoinverse-derived linear converters computed from activation profiles. The paper argues that this three-step conversion—recipient to donor space, apply intervention, back to recipient space—preserves the functional effect of the adapter without backpropagation, training data, or weight updates. It supports this with results where refusal rates, jailbreak success rates, and chain-of-thought accuracy on Big Bench Hard after transfer are comparable to or better than direct ReFT finetuning of the recipient, and with converter derivation taking seconds on a CPU.","pith_inferences":["If the linear-converter mechanism is as general as the case studies suggest, then the residual streams of different instruction-tuned models share a geometric structure that can be aligned with a small generic sample; one testable corollary is that converter cycle-consistency MSE should predict porting success across model pairs.","The method's reliance on LIMA prompts implies that the 1,030-prompt profile acts as a universal basis for behavior-relevant directions; replacing LIMA with random tokens or code prompts and checking whether jailbreak transfer survives would directly test that basis.","Because the donor intervention is applied in the donor's space and only its delta is pasted, the recipient's own representations are otherwise untouched; this suggests Command-V could be combined with other editing methods additively, though the paper does not test composition.","The authors note output collapse and formatting failures after transfer; a natural extension is to treat the converter as a learned but frozen projection and study which adapter ranks and layer choices minimize that collapse."],"forward_implications":["Behaviors become portable: an adapter trained once on one model can be reused on any recipient with compatible profiling, so finetuning need not be repeated per architecture.","Edge deployment becomes practical: with activation profiles precomputed, a small recipient model can gain an 8B model's adapter behavior without ever loading the 8B weights or running generation on it.","The same pipeline transfers jailbreak behavior, so safety alignment can be weakened across model families at low cost; the paper flags this as a broader-impact concern.","Task composition becomes plausible: small specialist adapters trained separately could be pasted into one recipient to build a generalist, a direction the paper suggests for future work.","Cross-family transfer is uneven: jailbreaking ports across families relatively well, but refusal and reasoning transfers weaken with architectural divergence, so model pairing matters."],"supporting_citations":[{"why":"Supplies the DiReFT adapter form $I(h) = h + W_2^{\\mathsf{T}}(W_1 h + b)$ that the transfer mechanism assumes.","marker":"Wu et al., 2024"},{"why":"Provides the 1,030 LIMA prompts used for activation profiles; this is the generic data premise.","marker":"Zhou et al., 2023"},{"why":"Justifies the linear depth-matching rule $l_R = \\lfloor \\alpha \\cdot l_D \\rfloor$.","marker":"Tenney et al., 2019a"},{"why":"Establishes the last-token activation profiling convention used to build profiles.","marker":"Zou et al., 2023a"},{"why":"Supplies WildJailbreak training and evaluation data for the refusal-enhancement case study.","marker":"Jiang et al., 2024"},{"why":"Supplies AdvBench training and evaluation prompts for the jailbreak-facilitation case study.","marker":"Zou et al., 2023b"},{"why":"Supplies the Big Bench Hard tasks used to evaluate transferred chain-of-thought reasoning.","marker":"Suzgun et al., 2022"},{"why":"Supplies OpenMathReasoning examples used to train the chain-of-thought adapters in the donor.","marker":"Moshkov et al., 2025"}],"fun_headline_variants":["Command-V: copy-paste LLM behaviors via activation maps","Paste learned behaviors into new LLMs with zero finetuning","Activation profiles transfer skills between LLMs instantly","No-backprop behavior transfer: Command-V pastes adapters","Swap LLM traits by matching activation fingerprints"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"A linear map fitted on 1,030 generic prompts aligns the residual activation spaces of two models at depth-matched layers well enough that the donor's low-rank intervention produces the intended behavior when pasted; if the alignment is wrong, the pasted behavior degrades or collapses.","fun_headline_variants_meta":{"raw":{"variants":["Command-V: copy-paste LLM behaviors via activation maps","Paste learned behaviors into new LLMs with zero finetuning","Activation profiles transfer skills between LLMs instantly","No-backprop behavior transfer: Command-V pastes adapters","Swap LLM traits by matching activation fingerprints"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000411,"raw_usage":{"total_tokens":2105,"prompt_tokens":901,"completion_tokens":1204,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":517,"completion_tokens_details":{"reasoning_tokens":1124}},"tokens_in":517,"tokens_out":1204,"duration_ms":9982,"temperature":1.0,"reasoning_tokens":1124,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T18:36:13.724622+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Recompute the converters for the Llama3.2-3B-to-Llama3.1-8B refusal transfer using 10 randomly sampled LIMA prompts instead of 1,030; if the attack-success-rate reduction vanishes, the profile size is load-bearing.","supporting_citations":[],"review_version":1}