Causality experiments
Localization on the deployed model shows where a paraphrase flip is decided and what feature toggles it. Neither shows why the flip exists, because a deployed model's data, architecture, and objective are frozen together. To ask why, we built a small model that reflects MedGemma's architecture and varied one factor at a time: the distribution of question phrasings it is trained on.
On MedGemma-4B, a lens-free residual patch and the Jacobian lens agree that the paraphrase answer is committed at layer 16 of 34; a single-layer swap flips 73% of pairs. This is causal about the locus, but silent about the origin.
A GemmaScope sparse autoencoder finds Feature 3818 at layer 17, a clinical-query register gate that, toggled alone, flips a yes or no. This names the direction. Why the model learned it remains open.
A small MedGemma-faithful probe supports the one intervention the frozen model cannot: varying the training-phrasing distribution while holding everything else fixed. That turns the localization into an origin.
The probe pairs the same medical vision encoder family as MedGemma, MedSigLIP-448, kept frozen, with a small Gemma-3 decoder carrying MedGemma's own components: rotary position embeddings, RMSNorm, grouped-query attention, and the gated feed-forward and interleaved local and global attention of Gemma-3. The encoder runs at 896 pixels, MedGemma's own resolution. The 257 image tokens are projected and prepended inline and read by the same causally-masked decoder, which is how MedGemma fuses vision and text rather than through cross-attention, and the yes or no answer is read from the tied Gemma-3 language-model head as MedGemma generates it, not from a separate classifier. Because the encoder is frozen and returns identical features for every paraphrase of a question, any answer that changes across paraphrases is language-side by construction.
We train the probe under three phrasing regimes that differ only in the questions the decoder sees, holding architecture, parameter budget, seed, and evaluation fixed. Canonical shows one fixed phrasing per question, augmented shows every paraphrase, and adversarial ties the register to the answer independently of the image. Because only the training-phrasing distribution changes, a difference in the resulting flip rate is an identified cause.
| Regime | Trained on | Flip % |
|---|---|---|
| Augmented | every paraphrase | 4.8 ± 1.1 |
| Canonical | one fixed phrasing | 67.1 ± 10.7 |
| Adversarial | register tied to the answer | 88.4 ± 1.5 |
Broad paraphrase coverage cuts the flip rate by a factor of fourteen. Scored only on wording withheld from training, augmented rises to 26.6% against canonical's 65.9%, so the invariance generalises to unseen phrasing rather than reflecting familiarity. Correlating register with the answer is a distinct and larger harm than narrow coverage alone.
Given a flipped cluster, we transplant the answer position along a single rank-1 direction, the difference between a phrasing the model answers one way and one it answers the other, at one layer at a time. It restores the flipped answer with net recovery near 1.0 across the early layers, while a norm-matched random direction and a non-flip-cluster control leave the answer unchanged. Naturally occurring flips show the same low-rank, language-side, readout-stage behavior as the injected adversarial ones. And because a flip rate is read off an argmax, we also check a statistic with no decision boundary in it at all: the ratio of within-cluster to between-cluster margin spread, which reproduces the same regime ordering at maximal effect size (0.023 augmented, 0.498 canonical, 1.362 adversarial; Cliff's delta -1.00 against augmented). Paraphrase sensitivity is a property of the representation, not of where the threshold sits.
The probe's controlled origin, the deployed model's layer-16 commit, and the Feature 3818 register gate are three independent methods that agree: the paraphrase flip is language-side, decided in a narrow early-to-middle band, and set by the training-phrasing distribution. The probe grounds only weakly and manipulates adaptation-stage data, leaving pretraining untouched. It shows where the flip is decided and why it is learnable; the deployed model's pretraining provenance rests on the localization results.