Cross-Format Representational Similarity Measures Output Form, Not Knowledge

Multiple-choice benchmarks are gameable, and everyone knows it. Models score above chance without seeing the question, flip answers when options are reordered, and shed double-digit accuracy when the same items are asked open-ended. The open problem is per-item attribution: which questions did the model answer from knowledge, and which did it answer by working the options?

There is an obvious mechanistic move here. Look inside. Snapshot the residual stream at the last prompt token - the moment before the model must commit to an answer - for the same question rendered with options (mcq) and without (oe). If the model held its answer from the question alone, the two states should look alike. If the options did the work, they should diverge. Take the cosine. Call it FIRS, the Format-Invariant Representation Score.

I built it, and it does not work. Not in the sense of a weak effect that needs more data - in the sense that it measures a different construct than the one it was built for. The score reads the shape of the prompt and the form of the required output, not knowledge. This project is that negative result, plus the checklist of cheap diagnostics that would have caught it in an afternoon.

Every MMLU question gets rendered four ways, all sharing a trailing Answer: suffix so the final token aligns across formats:

• mcq - the question plus four lettered options
• oe - the question alone, options stripped
• mcq_shuffle - options rotated so the correct one leaves its original position
• mcq_nota - the correct option's text replaced by "None of the above", keeping its position and the question's own three distractors

Activations come from resid_post at the final token, every layer, averaged over the 50-80% depth band (layers 12 to 19 of 26 in Gemma-2-2B):

$\text{FIRS}(q)=\frac{1}{|L|}{\sum }_{\ell \in L}\cos (h_{\text{mcq}}^{(\ell )}(q),h_{\text{oe}}^{(\ell )}(q))$

The companion renderings are the interventions. mcq_shuffle isolates positional invariance. mcq_nota is the sharp one: it destroys exactly one thing, the surface content of the correct answer, and leaves everything else standing.

500 MMLU test questions, proportionally stratified over all 57 subjects. Two elicitation regimes kept side by side - 0-shot bare templates, and 5-shot with same-subject exemplars rendered in each format's own style. Open-ended correctness follows a protocol fixed before any results were seen: deterministic normalized string match, hand-audited, escalating to a blinded LLM judge that re-scores only the match-negatives, so it can flip false negatives and nothing else. Both regimes tripped the audit threshold, so everything is reported under both scorers. That duplication was meant as a robustness formality. It became the finding.

At 0-shot the primary correlation is null under both scorers, with the two point estimates sitting on opposite sides of chance (match AUC 0.521, judge 0.446).

At 5-shot the metric appears to work. Under exact string match it predicts open-ended success at AUC 0.698 [0.634, 0.760] - a real-looking effect with a confidence interval clear of chance. Then add back the 57 correct paraphrases the judge recovers, and the same activations give 0.530 [0.471, 0.588]. On the self-contained-question subset it lands at 0.465, the wrong side of chance entirely.

Nothing about the model, the prompts, or the representations differs between those rows. Only the definition of correct changed. At this effect size the scoring rule moves the estimate further than any signal in the representations does, and a claim that survives only under the lexical scorer is not a claim about knowledge.

The hero figure above explains how the manufacturing works. Partition the 5-shot answers into disjoint groups and take mean FIRS: verbatim-correct 0.641, judge-confirmed wrong 0.577, correct paraphrases 0.538. The paraphrase group is the one set of items where the model demonstrably knew the answer without options. A knowledge metric must score them high. FIRS scores them last, because their surface form departs from the gold string. That ordering is unproduceable by a metric measuring knowledge and forced for a metric measuring output form - and it is the same property the exact-match scorer rewards. The two correlate with each other, not with knowledge.

Everything in the section above depends on labels, a judge, and an audit. The construct-validity case needs none of them, and all four diagnostics replicate across both elicitation regimes.

• Not format-specific. A format-exploitation score should track open-ended fragility specifically. FIRS predicts plain MCQ accuracy about three times more strongly than the open-ended outcome at 0-shot ($r=-0.252$ vs $-0.088$), twice as strongly and with the opposite sign at 5-shot ($-0.195$ vs $+0.098$), and predicts shuffled-MCQ accuracy just as well. A score that anticipates every behavioral outcome equally is measuring general item difficulty.
• Template-dominated, blind to option content. Any two MCQ-shaped prompts sit near cosine 0.97 regardless of what their options say. Any MCQ/OE pair sits far below regardless of shared content. The one intervention that changes what the options mean barely registers.
• Contaminated by prompt geometry. Option-token fraction alone explains over a quarter of the variance.
• At chance where the construct is defined. Format exploitation only means anything for items the model gets right with options: an exploiter is MCQ-correct and open-ended-wrong, a knower is correct both ways. On that subset ($n=271$ at 0-shot, $280$ at 5-shot) FIRS separates knowers from exploiters at AUC 0.469 to 0.491 across every cut, scorer, and condition. The metric's entire reason to exist, and it is a coin flip there.

The last one is the cheapest and the most damning, and it takes minutes to compute from the same forward passes that produce the metric.

The failure is structural rather than a matter of tuning. At the scored position the MCQ prompt must emit a letter and the open-ended prompt must emit a content word, so the cosine there largely measures letter-mode versus word-mode. And there is nowhere better to look: the two prompts are token-identical up to the question and diverge only after it. Every capture point is either before the divergence, where causal attention makes the activations identical and the cosine is exactly 1.0, or after it, where the required output types differ and the comparison is contaminated. No hook placement escapes.

My own pre-registration checked the wrong invariant. I verified that the final token matched across formats - both prompts end in the colon of Answer: - and treated that as licensing the comparison. Token identity is not task identity. What mattered was that the next token's job differed.

Two follow-ups close the obvious escape routes. If output mode were a separable additive component, projecting it out might expose knowledge underneath: the dominant shared direction carries 48-61% of the MCQ-to-OE difference energy, and removing it raises mean cosine from 0.703 to 0.845 while leaving every diagnostic correlation essentially unchanged. What remains is still difficulty, still not format-specific. And the natural template repair - moving the options before the question so both formats end in an identical suffix - fails differently: the model regurgitates the option block instead of answering. That redesign did not merge the two output spaces, it invented a third. The confound belongs to the metric family, not to my template.

The first extraction truncated open-ended continuations at the first newline. Gemma-2-2B is a base model, and base models routinely open with a newline and answer on the next line, so roughly nine in ten answers were silently discarded. The "non-empty" cut quietly meant "answered without a leading newline".

That run produced a statistically significant reversal, AUC 0.334. And I believed it, reasoning that label noise attenuates effects toward chance and cannot manufacture one. That reasoning is true of noise and irrelevant here: the bug was a selection rule correlated with the outcome, not noise. Repairing it sent the effect to chance.

I kept the episode in the write-up because "the effect strengthened as the labels improved, so it must be real" is an inference pattern other people will find exactly as persuasive as I did.

The separate elicitation lesson: 5-shot demonstrations fixed every base-model pathology at once - option copying, boilerplate, the newline habit - which confirms the degeneracy was framing rather than capability. MCQ accuracy 0.560, 100% letter parsing, all 500 continuations non-empty. Cleaner behavior made the construct failure sharper, not better.

The instrument is fine. It reliably measures final-token representational similarity across formats. What failed is construct validity - the gap between what it measures and what I claimed it measures. A thermometer that turns out to reliably measure humidity is not broken, but you cannot call it a thermometer. The deflating part is that what it actually tracks - prompt shape, output mode, item difficulty - is all measurable directly and more cheaply, so it is not even a useful proxy.

Five lessons that transfer past this metric:

• Token identity is not task identity. Align what the model must do at the compared position, not the token sitting at it.
• A scorer-fragile effect is no effect. Report a lexical and a semantic scorer, and distrust anything that survives only the lexical one.
• Label repair is not evidence. Movement under improving labels carries no weight when the original error was a selection rule.
• Similarity conflates content with form. "Does the model know this" is a decoding question. Invariance is not a substitute for recoverability.
• Run the construct checks first. Every diagnostic here except one computes without any correctness label, in minutes, from forward passes you already have. I ran the expensive primary validation first because it was the headline. The cheap checks would have killed the design before the headline existed.

The reframe that survives the negative result: stop asking how similar two representations are, and start asking whether the answer content is recoverable and whether the options assist the readout. Four designs in rising order of evidential strength:

1. Decode answer text from the options-free representation. (My originally planned probe targeted the correct letter - information the open-ended prompt never contains, so it was invalid by construction.)
2. Rank each option's text by its likelihood as a continuation of the bare question.
3. Grade format assistance by where the correct option sits in that options-free ranking.
4. Activation patching: transplant the open-ended hidden state into the MCQ forward pass and see whether the correct letter still emerges - the causal form of the question FIRS asked correlationally.

The third is the practical next step, and it runs on artifacts this pipeline already produces. Bucket MCQ-correct items by the options-free rank of the correct answer: rank 1 means the model knew it, rank 2-3 means the options lifted it, rank 4 or absent means position or guessing. If the middle bucket comes back empty the mechanism is not there and the follow-on dies in an afternoon. If it is populated, that is a graded, behaviorally-defined format-assistance signal - the thing FIRS never had.

Either way it runs as a new project. This one is a finished unit with a claim, four diagnostics, a scorer-robustness check, and a mechanism. Bolting a half-built successor onto it would dilute a crisp story, and a second dead end under the same banner would retroactively muddy the first.