Language Models are Injective and Hence Invertible
Authors: Giorgos Nikolaou
Tommaso Mencattini
Donato Crisostomi
Andrea Santilli
Yannis Panagakis
Emanuele Rodolà
Venue: ICLR 2026 Poster (2026)
Keywords: transformers
language models
invertibility
injectivity
inversion
privacy
Primary area: foundation or frontier models, including LLMs
TL;DR: We prove that transformers are (a.s.) injective and propose an algorithm that provably inverts their hidden representations back to the original input prompt.

Abstract: Transformer components such as non-linear activations and normalization are inherently non-injective, suggesting that different inputs could map to the same output and prevent exact recovery of the input from a model’s representations. In this paper, we challenge this view. First, we prove mathematically that transformer language models mapping discrete input sequences to their corresponding sequence of continuous representations are injective and therefore lossless, a property established at initialization and preserved during training. Second, we confirm this result empirically through billions of collision tests on six state-of-the-art language models, and observe no collisions. Third, we operationalize injectivity: we introduce SipIt, the first algorithm that provably and efficiently reconstructs the exact input text from hidden activations, establishing linear-time guarantees and demonstrating exact invertibility in practice. Overall, our work establishes injectivity as a fundamental and exploitable property of language models, with direct implications for transparency, interpretability, and safe deployment.

Published as a conference paper at ICLR 2026
LANGUAGE MODELS ARE INJECTIVE AND HENCE INVERTIBLE
Giorgos Nikolaou 1.,+
Tommaso Mencattini 1,2, 1,2,
Donato Crisostomi
Andrea Santilli
Yannis Panagakis 4,5
Emanuele Rodola
EPFL
Sapienza University of Rome
Paradigma
University of Athens
"Archimedes/A Athena RC, Greece
ABSTRACT
Transformer components such as non-linear activations and normalization are in- herently non-injective, suggesting that different inputs could map the same out- put and prevent exact recovery of the input from a model's representations. this paper, we challenge this view. First, prove mathematically that trans- former language models mapping discrete input sequences to their corresponding sequence of continuous representations are injective and therefore lossless, prop- erty established at initialization and preserved during training. Second. we confirm this result empirically through billions of collision tests on six state-of-the-arr lan- guage models, and observe no collisions. Third, we operationalize injectivity: we introduce SIPIT, the first algorithm that provably and efficiently reconstructs the exact input text from hidden activations, establishing linear-time guarantees and demonstrating exact invertibility in practice. Overall, our work establishes injec- tivity as a fundamental and exploitable property of language models, with direct implications for transparency, interpretability, and safe deployment.
INTRODUCTION
A core question in understanding large language mod- els is whether their internal representations faithfully preserve the information in their inputs. Since Trans- former architectures rely heavily on non-linearities, normalization, and many-to-one attention mechanisms, it is often assumed that they discard information: dif- ferent inputs could collapse the same hidden state, making exact recovery of the input impossible. This view motivates concerns around transparency, robust- ness, and safe deployment, as it suggests that the link between text and representation is inherently lossy.
PROMPT SPACE
LATENT SPACE
LLM
Rd
SIPIT
8>0 0 5> 0
Figure I: The map from prompts to latent space is injective. SIPIT inverts it.
In this paper, we show that this intuition is misleading. Despite their apparent complexity, standard decoder-only Transformer language models (seen as maps from prompts to hidden states) are in fact almost-surely injective; for essentially all parameter settings and during the course of training, different prompts yield different last-token representations (e.g., see Figure 1).
Building upon this property, further provide practical algorithm, SIPIT, that reconstructs the exact input from hidden activations. To our knowledge, it is the first to guarantee exact recovery in provable linear time (worst case bound), often faster in practice, turning injectivity from theoretical property into an operational tool.
Our approach. To establish our result, take rigorous mathematical view of Transformers as functions. The key idea is that their components (embeddings, LayerNorm, causal attention,
"Equal contribution; author order settled via Mario Kart.
Corresponding authors: {georgios nikolaou, tommaso. tomaao..nocctttin1]1o......

---

Published as a conference paper at ICLR 2026
MLPs, and residual wiring) are smooth and structured enough that the model, as whole, behaves predictably with respect to its parameters. Using tools from real analysis, we show that collisions (two different prompts producing the exact same representation) can only occur set of parameter values that has measure zero; that is, they are mathematical exceptions rather than possibilities one prove that common training procedures (gradient descent
should expect in practice. Moreover, with standard step sizes) never move parameters into this exceptional set. In layman's 's terms, almost all models initialization are injective, and training preserves this property.
Technically, our proofs rely on two ingredients. First, we establish that Transformers are real- analytic functions of their parameters, which allows us reason precisely about when and where collisions could occur. Second, we construct parameter settings where no two prompts collide, and show that gradient descent (GD) does not collapse such separation, i.e., collisions remain a measure- zero event. The end result is finite-horizon guarantee: after any fixed number of training steps, and under mild assumptions, injectivity holds with probability one. We provide complete formal proofs of these statements.
Main result. Our central finding is that causal decoder-only Transformer language models are injective almost surely. Formally, consider one such model with embedding width d, least one attention head per block, real-analytic components, finite vocabulary V, and finite context length K. Initialize its parameters 9 at random, using any distribution that has density' (such Gaussian, uniform, or Xavier/Glorot), and train for any finite number T of GD steps with step sizes in (0, 1). Then, with probability one over the random initialization.
*
r(s; 0r) + r(s': 0r),
i... the map from prompts s to last-token representations r(s; 0r) is injective across all prompts in ysk In short, collisions in practical settings form measure-zero set, and neither initialization nor training will ever place a model inside that set.
Significance. Our result shows that in standard decoder-only Transformers, different prompts al- most surely yield different last-token representations across all practically relevant parameter set- tings and training procedures. The guarantee is both generic (it fails only on measure-zero set of pathological parameters) and practical (it holds at finite width, depth, and training time under common initializations).
Conceptually, we replace long-assuumed property with rigorous theorem, showing that injectivity not an asymptotic idealization but a structural consequence of the architecture itself. Techni- cally, our analytic framework pinpoints when collisions can arise (through deliberate non-analytic choices such as quantization or tying), and clarifies that otherwise the model is inherently lossless. Importantly, it establishes that last-token states almost everywhere identify the input.
Finally, we turn this theoretical guarantee into an operational tool: our algorithm SIPIT uses gradient-based reconstruction to recover prompts exactly from internal activations, efficiently and with provable linear-time guarantees. This confirms empirically that collisions do not occur in practice. Beyond transparency and safety, this elevates invertibility to first-class property of Trans- former language models, enabling stronger interpretability, probing, and causal analyses.
TRANSFORMERS ARE INJECTIVE
Summary. In this section we show that decoder-only Transformers almost surely map different prompts to different hidden states. Collisions can only occur under measure-zero parameter choices, and mradient-based training never creates them. In simple terms, Transformer representations are structurally lossless.
Approach. We consider causal decoder-only Transformer language models with vocabulary V. finite context window K, and embedding dimension d. For an input sequence E ysK let r(s; 0) denote the final hidden representation at the last token position", given parameters 0.
Put simply, parameters are not drawn from degenerate or hand-crafted set.
We focus the last-token state, since it alone drives next-token prediction; earlier rows matter only insofar they shape this final state. Injectivity at the last taken is the property of real operational interest.
2

---

Published as a conference paper at ICLR 2026
Our analysis relies on three facts:
(i) Real-anatinn Real-analyticity. Each component of the architecttre (embeddings, positional encodings, LayerNorm with e > O, causal attention, MLPs with analytic activations, residuals) real- analytic in its parameters (see Appendix A.2 for the mathematical background). This smoothness implies that the set of parameter values causing two distinct prompts to col- lide is extremely thin (measure zero).
(ii) Initialization. Standard initialization schemes (Gaussian, uniform, Xavier/Glorot, etc.) draw parameters from continuous distributions with densities, so they avoid measure-zero sets with probability one.
(ii) Training. Gradient-based updates (including SGD and Mumi-batch/full-bttee GD) preserve absolute continuity of the parameter distribution after any finite number of steps; thus, training cannot generate collisions.
These facts allow us to state and prove injectivity results without relying on asymptotics. We begin by establishing the analytic structure of the architecture.
Theorem 2.1 (Transformers are real-analytic). Fix embedding dimension d and context length K. Assume the MLP activation is real-analytic (e.g. tanh, GELU). Then for every imput sequence VSk, the map
(s. 0) r(s; 0) HER Rd
real-analytic jointly in the parameters O and the input embeddings.
Sketch of proof (full proof in Appendix B, Proposition B.3). Each building block is real-analytic: polynomials (embeddings. projections), exponential and softmax (attention), reciprocal square root (LayerNorm with > 0), analytic activations in the MLP, and affine maps. Real-analytic functions are closed under addition. multiplication, quotient, and composition. Since the Transformer is finite composition of such blocks, the entire map is real-analytic.
This smoothness result drives everything that follows: ensures that collisions, they exist, are confined to measure-zero parameter sets. We now ask: what happens at initialization?
Theorem 2.2 (Almost-sure injectivity initialization). Let 0 be drawn from any distribution with density (e.g. Gaussian or uniform). Then for any two distinct prompts s E ysk
fi
f2
Prir(s; 0) r(s'; 0)] 0.
(2)
f2 f1
Sketch of proof (full proof in Appendix C, Theorem C.2). Fix # s' and consider
Figure 2: Two real-analytic functions
fi and f2 and their difference f1 f2. Black contours show the zero sets, which form thin curves (measure zero) rather than regions of positive measure. (see Figure 2 for an illustration). There- suffices to exhibit a single parameter setting where
h(0) = ||r(s; 0) r(s'; 0)13
(3)
By Theorem 2.1, h is real-analytic. A fundamental di- chotomy of real-analytic functions states that either h is identically zero, or its zero set has Lebesgue measure zero fore, to rule out the pathological case h r(s; 0) & r(s'; 0).
This can always be done: if and s' differ at the last position (symbol or length), freeze the network so that the last state reduces to embedding plus position, and choose distinct rows; this already separates rss) and r(s'). If instead they differ earlier, let i* be the first mismatch and set one attention head so the last position attends almost entirely to i*, encoding its token in the value; this forces different outputs for s and s'.
Hence h is not identically zero, and so the collision set {e h(0) 0} has Lebesgue measure zero. Since standard initializations have densities, the probability of sampling such 0 is zero, and r(s; 0) a r(s:; ; 0) (injectivity) holds almost surely at initialization.
3

---

Published as a conference paper at ICLR 2026
According Theorem 2.2, initialization, collisions mathematically impossible except vanishingly small set of parameter values. Finally, with the following Theorem we ensure training does not break injectivity.
Theorem 2.3 (Injectivity preserved under training). Let Og be initialized from a distribution with density, and let Or be the parameters after steps of gradient descent with step sizes in (0, 1). Then with probability one,
$ s
r(s; OT) + r(s'; 0r),
(4)
Sketch of proof (full proof in Theorems C.I and C.5). At initialization, Og is drawn from distribu- tion with a density, hence absolutely continuous. To break injectivity during training. GD would need to map this continuous law onto the measure-zero collision set identified in Theorem 2.2. We show this cannot happen.
A single GD step is the map (00) - LV where L is the training loss. Because the network and the softmax cross-entropy loss are real-analytic, ø is also real-analytic. Its Jacobian determinant det De) is itself real-analytic and not identically zero (one can check this by evaluating simple parameter setting). Hence the set where det Dg 0 has measure zero. Away from that set, smooth, locally invertible change of coordinates that can stretch or bend space but cannot collapse regions of positive volume onto lower- swwerddimensionll sets. Therefore, pushing forward an absolutely continuous distribution through á yields another absolutely continuous distribution.
the Inverse Function Theorem applies:
Since this argument holds for each step, any finite sequence of GD updates preserves absolute con- tinuity of the parameter law. Combining with Theorem 2.2, which shows that collision sets measure-zero, we conclude that r(s; 0r) # r(s'; 0r) almost surely for s'.
Thus injectivity is not just an initialization property but remains true throughout training. A simple but important corollary follows.
Corollary 2.3.1 (SGD and mini-batch GD). Under the assumptions of Theorem 2.3, the same clusion holds when the updates are 0--1 O, TJ V V8LB, (0.) with arbitrary (possibly random or adversarial) batch selections B,, thus including the singleton case of SGD and the full dataset.
Proof. The proof argument of Theorem 2.3 is unchanged: for each fixed batch B, the update map (0) = 0 - VV (0)) is real-analytt with a Jacobian that is not identically zero. Indeed, the batch loss is the average Ls
El Li, the point O, from the single-sample proof (where the Jacobian determinant sample-indee independent and nonzero) the batch Jacobian coincides with the single-sample one by linearity of differentiation, and its determinant is therefore also nonzero. Thus, the finite composition of such maps preserves absolute continuity of the parameter law.
Together with this robustness to different training regimes, we can also strengthen the guarantee itself: injectivity holds not just pairwise, but globally across finite sets of prompts.
Corollary 2.3.2 (Distinctness for finite sets). For any finite set of prompts S C VSK, the represen- lations (r(s; 0r) : E S} are almost surely all distinct.
Proof. See Appendix C, Corollary C.2.1.
These results show that decoder-only Transformer language models are structurally injective: dif- ferent prompts almost surely yield different last-token states. Collisions can be manufactured, e.g., through deliberate non-analytic choices (quantization, non-smooth activations), but in practical training pipelines, injectivity is guaranteed; extensive experiments in $4.1 confirm this empirically.
Failure cases. We showed that non-injective transformers are overwhelmingly unlikely, though it is still possible for an adversary to construct collisions by hand. For instance, if two vocabulary items # y assigned exactly the same embedding vector, then any prompts differing only by swapping U/ and i yield identical representations. Likewise, two absolute positional embeddings made exactly equal and the remaining weights are tuned suppress other positional signals,
4

---

Published as a conference paper at ICLR 2026
10
12 Ditaace (min)
101-
10
10-1
10
10"9
10"
10-4
10-3
theedoo
Genma 3/1B
Gonas 3/ GB
Genman 3/ 12B
GPT-4/5
GPT-2/M
GFT-2 2
Figure 3: Seeking collisions in a large-scale prompt set: The minimum distances between last-token states are far above the collision threshold 10-6; 6; (left) across layers for GPT-2 and Gemma-3 families (one dot per layer), (right) across depth for GPT-2 Sma 11; distances grow with depth.
one can force collisions between sequences that differ only at those positions. These scenarios, however, require deliberately engineered parameter choices: under continuous random initialization and standard training, the probability of such coincidences zero.
3 EXACT PROMPT RECOVERY VIA SIPIT
In the previous section, we have proven that decoder-only Transformers are almost surely injective, iee. different prompts map to different hidden states. We now show how this property can be used in practice to reconstruct the exact input prompt given hidden states at some layer. We call this algorithm SIPIT (Sequential Inverse Prompt via ITTeaaive updates).
Threat model. This paper focuses on the injectivity result and its algorithmic consequence; we do not define full adversarial model. A natural setting where SIPIT applies is one in which an adver- sary obtains the hidden-state sequence-for instance, through a leaked K V-cache, shared-inference API that exposes intermediate representations. Our injectivity result guarantees that exact recovery from only the final embedding is possible in principle, but designing an efficient algo- rithm for that setting is nontrivial and left to future work; here assume access all per-position states at given layer f.
pipeline,
Recall from $2 that the mapping from prompt s to its last-token state is almost surely injective. Since the last state is itself a deterministic function of the hidden matrix at any layer f, injectivity extends to full representation
H (0)) E Txx
(5)
We denote by (s) the row of H() position the following, the parameters and target layer are considered fixed and omitted for simplicity.
The algorithm exploits the causal structure of Transformers: the hidden state position depends only on the prefix (s,,..., 8 8(1) and the current token This means that if we already know the prefix, then the hidden state at position uniquely identifies St.
Example. Suppose the vocabulary is a, b, and the true prompt is (a, b). At t 1, the hidden state depends only on 8₁- By comparing the observed state with the three candidate states produced by trying a, b, and know the prefix (a), so we try appending each candidate token and again match the resulting hidden state recover 52 b. Iterating this procedure reconstructs the full sequence.
can tell exactly which one matches, thus recovering iı Then at 2,
More generally, we can look at the "one-step" map
0y ト h1(T ① v2), B EV.
(6)
which gives the hidden state at step for each possible next token, given the fixed prefix क ( St-1) (here @ denotes concatenation).
Implementation available httptttt/////...... http://ggttttttttt com/ wwwp:ttww..ooooooooooooooooo.oaa kol aou// IPIT.

---

Published as a conference paper at ICLR 2026
Remark. By the analytic arguments of $2, the one-step map is almost surely injective: with fixed prefix, any two distinct tokens almost surely yield distinct hidden states.
This property makes sequence recovery straightforward. At each step t, given the hidden state h. and the already recovered prefix, simply check which candidate token produces a matching hidden state. That token must be the true Sy. Repeating this process recovers the entire sequence.
This leads to the SIPIT algorithm, shown Algorithm At every position, the algorithm cycles through vocabulary candidates (according to some policy such as random order or gradient-guidd guided search) until it finds the unique match", then appends the reconstructed prefix and moves on.
Algorithm SIPIT: Sequential Inverse Prompt via l'Terative updates
Require: Observed layer-f states H E RTxd; vocabulary V; tolerance 0.
Ensure: Recovered sequence = (81,...,87) 87).
1: x-( ()
2: for t = 1 to ['do do
3: C C+D
tested candidates
4:
for j = 1 to [ do
5:
Vj < POLICY (V,),3,6)
new candidate token vy (see Alg. and 3) b verify vy (see Def. D.2) hit!
6:
h E Ar,(U) E) then
7:
$ B
8:
break
9:
else
10: C cu(
11: end if
12: end for
13:
end for
14:
return S
To rule out edge cases and analyze the computational cost of SIPIT, state formal guarantee. Theorem 3.1 (Correctness of SIPIT). Under the assumptions Theorem 2.3, given observed hidden states (4) SIPIT recovers the true input sequence with probability one in most T steps.
Sketch of proof (full proof in Appendix D, Thm. D.2, Prop. D.4). At each step, local injectivity en- sures unique token matches the observed state. As the policy spans the vocabulary, this token will be found in at most [V] trials. Induction over = 1,..., completes the argument.
Theorem 3.2 (Robustness of SIPIT). Under the assumptions of Theorem 2.3, fix layer e and define, for any prefix n. and time 1
A = min |/ @v) he( ① d')ll2 veveey
Let = (s1,..., ST). define the prefixes me (8 and suppose access to the perturbed hidden states
( he(T @ @5)) e
leella S
Amd E [T].
Then SIPIT recovers the true sequence with probability one, and terminates in at most T|V steps.
Proof in Appendix D, Thm. D.2, Prop. D.2.
In short, SIPIT turss the almost-sure injectivity of Transformer representations into constructive procedure: not only are hidden states unique identifiers of prompts, but the exact input sequence can be efficiently recovered in linear time, and often faster in practice. It is structural property of Transformer representations, not a quirk of initialization or training.
'In practice, we accept matches if the observed hidden state within e-hall around the predicted one.

---

Published as a conference paper at ICLR 2026
GPT-2 Small
Gemma 3 -1B
1.2 Detaooe
107
L.2 Ditazees
1011
Collision threshold
Collision threshold
Sample Inder
Sample Indexe
Figure 4: Exhaustive collision search on the 10 closest prefix prompts. The boxplots look flat and uneventful, and that is the point: even under stress-test conditions with billions of candidate pairs, all minima stay well above the collision threshold, showing that nothing collapses.
4 EXPERIMENTS
We previously proved that decoder-only Transformers are injective ($2) and introduced an algorithm, SIPIT, that leverages this property recover the exact input prompt from hidden states at given layer ($3). We now provide extensive empirical evidence supporting our theory by showing that distinct prompts yield distinct embeddings, i.e., collisions oceur by large margin ($4.1). We then demonstrate that SIPIT successfully reconstructs the original input prompt ($4.2).
Environment. All experiments were run on a single NVIDIA A100-SXM (64 GB) GPU. Python 3.11, CUDA 12.2, PyTorch 2.8.0, and transformerz 4.50.0 were used for all experi- ments. Reported runtimes refer to this setup.
4.1 SEARCHING FOR COLLISIONS
We collected 100k prompts by uniformly sampling from a mixture of four datasets: wikipedia-en" C4 (Raffel et al., 2020), The Pile (Gao et al., 2020), and witthon-github-coodo prompt, extracted the last-token representation and systematically checked whether any two distinct prompts produced identical embeddings. This pro- cess required around 5 billion pairwise comparisons.
Model
&g Distance (min)
layer
layer 5
layer
Llame-3. 1-88
0.620
For each
Mi aaa77--7---
0.002
0.187
1.274
Phi-4-mini-ims
ZinyStories-33e
0.029
1.434
2.793
Minimum pairwise distance be- tween last-toked states in the first, middle, and final layers of four models. All values are well above the collision threshold 10-6 token states. Figure (left) shows the per-layer minimum distances for the Gemma pretrained (Team et al., 2025) and GPT-2 (Radford et al., 2019) families, with strictly positive values through- out. Table complements this by reporting the same statistic for Llama- 1-8B (Grattafiori al., 2024), Mistral-7B- 2025) and TinyStories 33M (Eldan & Li, 2023), again showing clear separation at the first, middle, and last layers. Finally, Figure (right) zooms in GPT-2 Small revealing that these distances typically increase with depth. Additional results for GPT-2 Medium, GPT-2 Large and Gemma (IB, 4B, 12B) appear in Appendix E, confirming the same trend.
Table 1:
We observed no collisions across all models and lay- ers: distinct prompts always yielded distinct last-
1 (Jiang et al., 2023), Phi- 4-mini------. -ii----mii-iinstrrc rnnttrcct (Microsoft et al.,
E, Distance (min)
fg Distance (min)
Model
Model
Size
FP4
INT8
FP32
layer
layer L/2
layer L
1..mm-3.1-88
2.281
6.597
1.274
phi-4 Llama 1.ama-331-200
14B
0.010 0.005
1.025 0.465
8.759
Miatral-9B-vd.11
1.748
2,692
1.136
-3.1-705
70B
3.975
Thi instruct
18.368
20.956
8.780
Quantized Models: Minimum pair- wise distance between last-token states in the final layer of three quantized models.
Table 2:
Table
Large Models: Minimum pairwise distance between last-token states in the first, middle, and final layers of two large models.
httpps//huugiingffcc.oo htgp://shhccc...taaaaaaaaaaaaaan http:p/////ggggnnn...../eaaaeeee
thub--cood

---

Published as a conference paper at ICLR 2026
Figure 5 shows how pairwise distances between last- token states vary with prompt length in GPT-2 Small. Three patterns emerge: (i) the minimum dis- tance is never close to zero at all lengths, and (ii) grows rapidly short lengths but then levels off, sug- gesting that beyond a moderate context size, adding to- kens does not affect separability; (iii) the overall spread (min-max, stays bounded, with no sign of pathologi- cal collapses. Similar behavior is seen in Gemma (see Appendix E, Figure 9). Overall, clear margins emerge quickly and then stabilize, making collisions unlikely at any sequence length.
-01
1.2 Ditanno
min
10-3
10"9
Collision threshold
200
300
Sequencce length
Figure 5: Sequence length vs. pairwise distance for GPT-2. Min, mean, and max distances rise at short lengths and then sta- bilize, indicating consistent separabilityy
Exhaustive collision test. Different from previous ex- periments, in this setting (Figure 4), we restrict our analysis to the 10 prompts from the dataset mixture whose embeddings have the smallest last- token distances. For each of these prompts, we appended every vocabulary token and com- puted all pairwise distances between the resulting last-token states, effectively performing haustive search over continuations and yielding more than 343 billion prompt pairs per model. This exhaustive experiment helps rule out the possibility that earlier observations were simply due to chance in random sampling rather than a true absence of collisions. While a complete search over all possible prompts would be ideal, it is computationally infeasible. The number of unique prompts grows exponentially with sequence length, and the number of pairwise comparisons grows even faster. For context, even with single-token prompts and the vocabulary size of Gemma 3-1B, there are already over 34 billion possible prompt pairs, making exhaustive evaluation entirely impractical. Our compromise still revealed structure: we identified prompt pairs with highly similar last-token embeddings, suggesting overlapping semantic content and motivating to ask whether distinct next tokens could preserve meaning, i.e., yield essentially identical last-token hidden states.
Figure 4 reports the resulting distributions as boxplots for both GPT-2 Small and G -BBB with distances far from zero (no collision), confirming local injectivity as predicted by our theory.
FP4 INT8 weight quantization. To assess how weight quan- tization affects pairwise representation distances, we conducted additional experiments with FP4 and INT8 quantization sev-
eral models (Ll ama -3 1. 1-8B, Phi-4-mine -indiiiiinttucce ruct, and
Mistral -0 1). We further extended this analysis FP4-
quantized 14B and 70B parameter models, namely Phi-4 (14B)
10
and Llama-3 1OB. As shown in Tables 2 and across all
tested models quantization (1) does not introduce any collisions, (2)
12
150
more than doubles the minimum distance between representations, thereby preserving the integrity of the representation space, and (3)
Lavendon Lime (6)
Figure 6: Inversion time as a function of depth. Runtimes rise only mildly across layers.
maintains this separation even as model size increases substantially.
4.2 INVERTIBIITTY RESULTS
We now test whether the theoretical injectivity translates into exact recovery on pre-trained models. Using SIPIT with only the hidden states at fixed layer, we attempt to reconstruct the full prompt token-by-token for GPT-2 Small. We sample 100 prompts, with a 90%-10% split between mean- ingful sentences and random token sequences (to test robustness in unstructured cases), and attempt to reconstruct them from hidden states. We compare against HARDPROMPTS (Wen et al., 2023), which leverages gradient signals for approximate prompt discovery, and against a SIPIT ablation that replaces the candient-guider candidate policy with the uniformly random policy (BRUTEFORCE).
Other inversion approaches (Morris et al., 2023a;b; Nazir et al., 2025) tackle a different setting altogether: they operate in black box access, using sequences of next-token logprobs encoder logits rather than hidden states, and train auxiliary inverters to reconstruct text, at high computational cost. Their outputs are typically approximate and not guaranteed exact. These differences make
8

---

Published as a conference paper at ICLR 2026
Inversion Performance
Model
Vocab size
Accuracy
Time (8)
Vocab explored (%)
Mistral- 7B- v0.
32000
100%
111.78
46.50
0.19 0.08 %
Llama-3.
128255
100%
549.48
265.75
0.21 - 0.10 %
Table 4: Inversion performance on FP4-quantized models with different vocabulary sizes. SIPIT re- covers all tokens with 100% accuracy while exploring less than 0.22% of the vocabulary on average.
them complementary but not directly comparable to our setting of training-free free, exact inversion from hidden states in decoder-only LMs.
Results are reported in Table 5. Across all prompts (20 tokens each), SIPIT recovers the exact sequence with 100% token-level accuracy (no errors, no colli- sions), matching the theoretical guarantee of linear- time convergence. In contrast, HARDPROMPTS com- pletely fails to recover the input, while BRUTEFORCE eventually succeeds but at prohibitive computational cost, requiring several orders of magnitude longer.
Methed
Mean Time (8)
Accuracy
HARDPROMPTS
6132.59-
104.61
BRUTEFORCE (ours)
3889.61 691.17
1.00
SurTT (ours) 28.01 01 35.87
1.00
Table 5: SIPIT ensures efficient exact re- covery, unlike HARDPROMPTS (no recov- ery) or BRUTEFORCE (infeasible runtime).
Robustness and vocabulary scaling. The theoretical analysis in Theorem 3.2 shows that our in- version algorithm is robust to a certain level of noise while maintaining linear scaling in vocabulary size. To empirically validate this, we use FP4-quantized versions of Mistral-7B-- vocabulary size) and 3lamm-33.. 1-88BB (z 128K). We sample 50 prompts (10 tokens each) and attempt to reconstruct them from hidden states corrupted by FP4 weight quantization. As shown in Table 4, SIPIT reconstructs all inputs with perfect accuracy while exploring, 0.22% of the vocabulary, demonstrating that the gradient-base heuristic is both robust to quanti- zation noise and highly efficient. From complexity perspective, the nearly constant percentage of tokens explored across the two vocabulary scales empirically confirms the predicted linear scaling.
(+= 32K
average, less than
Effect of layer depth. Finally, Figure 6 shows inversion times by layer for longer prompts (ranging from 20 to 200 tokens). Although deeper layers are costlier principle (since verifying a candidate and computing gradients require traversing more blocks), the effect is minor: runtimes rise only slightly from first to last layer, and the scaling remains graceful overall. Likely, earlier layers need more iterations to converge, while deep layers store richer information that reduces the search effort. As a result, the net cost remains stable, confirming SIPIT is efficient across depth.
5 RELATED WORK
Our results connect to two active lines of research: theoretical analyses of Transformer architectures, and inverse problems in language modeling. We briefly review both to position our contributions. Analytical properties of Transformers. Viewed as functions Rdd individual Transformer components are clearly non-injective: LayerNorm collapses along per-example statistics (Ba al., 2016), residual connections can cancel, and in attention-only stacks, rank decays doubly- exponentially with depth (Dong et al., 2021). Likewise, on the output side, the softmax bottleneck constrains the distributions reachable by language models (Yang al., 2018). From this algebraic perspective. Transformers seem inherently many-to-one, an intuition echoed by classical complete- ness and universal universal-approxine approximation theorems for Transformers. which show that highly many-to-one maps can be represented in principle; we briefly review these results in Appendix F.
Our focus is different: we study the discrete-to-continuoor map from prompts VSK hidden states in Rdd In this setting, analytic viewpoints on Transformer computation become powerful: treating each layer as real-analytic map yields almost-sure guarantees that hold at finite width, depth, and training horizon (Appendix F surveys which modern LLMs satisfy this assumption and proves the analyticity for all activation functions encountered in practice). Recent work has adopted this angle for related properties: Jiang & Haghtalab (2025) show that building blocks of modern architectures are almost always surjective, while Sutter et al. (2025) prove that Transformers at random initialization are almost surely injective with respect the entire hidden-state matrix (and only at initialization). Differently, we prove injectivity with respect to the parameters and at the task-relevant last-token state; crucially, show that injectivity is not initialization artifact but persists under training.

---

Published as a conference paper at ICLR 2026
Inverse problems in language modeling. Model inversion asks whether can reconstruct model's 's imput prompt from outputs or internal signals (Sun et al., 2021). In the context of lan- guage models, this question has motivated growing body of work exploring practical inversion strategies. Output-to-promy methods infer prompts from generated continuations but yield only approximate reconstructions (Zhang al., 2024). Recent work shows that even black-box outputs are information-rich: Morris et al. (2023b) train a separate inverter to map next-token probability vectors to text, and Nazir et al. (2025) extend this by taking sequences of logprobs, applying lin- ear compression to embedding dimension, and training an mncoder-ddeoded inverter; this achieves higher exact-match rates but still without guarantees. Complementarily, Morris al. (2023a) recon- struct text from encoder logits via a trained iterative inverter. These contributions highlight privacy risks when probabilities or embeddings are exposed, but they differ from our setting: they rely on trained inverters, remain approximate, and do not invert hidden states of decoder-only LMs.
related line of work frames the task as automated prompt optimization, casting prompt design as discrete sequence optimization aligned with downstream performance (Guo et al., 2025; Sun et al., 2022; Deng et al., 2022); methods such as AutoPrompt (Shin et al., 2020) and Hard Prompts Made Easy (Wen al.,, 2023) use gradient signals to discover effective, but approximate, prompts. Most closely related to ours, Thomas et al. (2025) recover prompts from hidden states via a sequential algorithm that uses L.L.-based policy rank candidates; lacking injectivity guarantees, however, it must score all vocabulary tokens before committing, with no formal exactness guarantees.
Unlike all prior work, our approach is training-free, efficient, and comes with provable linear-time guarantees for exact recovery from internal states.
DISCUSSION AND CONCLUSIONS
This work establishes that decoder-only Transformers are almost surely injective: distinct prompts produce distinct hidden states under standard initialization and training. Building on this structural result, we introduced SIPIT, the first algorithm that can recover the exact input sequence from hidden activations, with provable linear-time guarantees. Together, these contributions move injectivity from an informal belief to rigorously grounded and operational property of language models.
The scientific impact is clear. Our findings reconcile two competing views in the community: Trans- formers "lossy" due to nonlinearities, normalization, and many-to-one attention, versus language models as injective in their hidden representations. We advocate viewing language models as maps on the sequence space rather than the embedding space; under this perspective, we prove that all information about the input sequence is almost surely preserved end-to-end. The constructive in- version offered by SIPIT strengthens this point in practice, establishing a clean baseline for inter- pretability and auditing: if probes or inversion methods fail, it is not because the information is missing. For mechanistic interpretability in particular, injectivity guarantees that last-token states faithfully encode the full input, giving a sound foundation for causal and probing analyses.
Beyond theory, the findings carry practical and legal implications. Hidden states are not abstractions but the prompt in disguise: any system that stores transmits them is effectively handling user text itself, with direct consequences for privacy, deletion, and compliance (Miranda et al., 2025). The evolving regulatory landscape has not yet fully reckoned with this fact. The Hamburg Data Protection Commissioner, for instance, argued that LLM parameters do not constitute personal data because training data is transformed into abstract mathematical representations during learning, and that it "remains doubtful whether any extractable data records constitute personal data" (HmbBfDI, 2024). That analysis. however, concerns training data encoded in model weights; it does not address the hidden representations computed at inference time. Our results reveal that these representations are lossless encodings of the user's exact input, recoverable in full via SIPIT. Consequently, any system that stores, caches, transmits hidden states is effectively handling the user's verbatim text, and the corresponding pipelines should be subject to the same data-protcction obligations as the raw prompts they encode.
Finally, this work opens several directions. Extending the analysis to multimodal architectures such as music and vision Transformers is T or quantization will clarify how robust invertibility remains in practice. Bridging these technical insights with evolving regulatory frameworks will be crucial for safe and responsible deployment.
open problem. Studying approximate inversion under noise
10

---

Published as a conference paper at ICLR 2026
REPRODUCIBILITY STATEMENT
The experimental setup (hardware, software versions, and dataset construction) described in $4; the 100k-prompt benchmark uses uniform sampling from four public datasets detailed in $4.1. On the theory side, every theorem stated in the main text is accompanied by a complete proof in the appendix: analytic preliminaries Appendix A, the formal definition of the Transformer language model and the proof that it is real-analytic in Appendix B, almost-sure injectivity and its preservation under training in Appendix C, and SIPIT correctness and robustness in Appendix D. Appendix provides Implementation Details and Additional Experiments, and Appendix F verifies that all acti- vation functions used in all modern L.MMs satisfy the analyticity assumption.
ACKNOWLEDGMENTS
Figure is adapted from Autoencoder Diagrams by Keenan Crane (2025), used under CCO 1.0 Universal. We further acknowledge Adam Barla for the initial discussions on LLMs invertibility.
This work has been supported by project MIS 5154714 of the National Recovery and Resilience Plan Greece 2.0 funded by the European Union under the NextGenerationEU Program, the MUR FIS2 grant n. FIS-2023-00942 "NEXUS" (cup B53C2500103000) and partly by Sapienza University of Rome via the Seed of ERC grant "MINT.AI" (cup B83C250010400011,
REFERENCES
W. E. Aitken. General topology. part 4: Metric spaces, 2020. URL httpt:://tppplc.eeeeeesee edu/at Saxen__tmmm/ssatee
html /Essays / Topo ogy /tayy//mtae mwt.rerrrrr c_spa .pdf. 26
Shane Arora, Hazel Browne, and Daniel Daners. An alternative approach to fréchet derivatives.
Journal of the Australian Mathematical Society, 111(2):202-220, 2021. 25
Jimmy Lei Ba, Jamie Ryan Kiros, and Geoffrey E. Hinton. Layer normalization. arXiv preprint
arXiv:1607.06450 2016. URL https: httpaaixvvvv.iio org. wwt.oor.////oooooooo.o....t..aet 1177 06450. 9
José E Chacón and Tarn Duong. Higher order differential analysis with vectorized derivatives. arXiv preprint arXiv:2011.0188. 2020. 20
Mingkai Deng, Jianyu Wang. Cheng-Ping Hsich, Yihan Wang. Han Guo, Tianmin Shu, Meng Song, Eric P. Xing, and Zhiting Hu. Riprompt: Optimizing discrete text prompts with reinforcement learning, 2022. URL httpt:ttt///eeteettetee http://www...////./..../ abs 2205 12548. 10
Yihe Dong, Jean- -aptisttitt Cordonnier, and Andreas Loukas. Attention is not all you need: Pure attention loses rank doubly exponentially with depth. In Proceedings of the 38th International Conference on Machine Learning (ICML), volume 139 of Proceedings of Machine Learning Re- search, 2021. URL https::///.o http:///ooeeedeeeeeeo mlr press / vv13//11/////// (1113//////g11
html.
Ronen Eldan and Yuanzhi Li. Tinystories: How small can language models be and still speak coherent english?, 2023. URL / wwwpiii.rrg//bbs..... 0373007799....
Gerald B Folland. Real analysis. Pure and Applied Mathematics: A Wiley Series of Texts, Mono- graphs and Tracts. John Wiley & Sons, Nashville, TN, 2 edition, March 1999. 26, 41
Leo Gao, Stella Biderman, Sid Black, Laurence Golding, Travis Hoppe, Charles Foster, Jason Phang, Horace He, Anish Thite, Noa Nabeshima, Shawn Presser, and Connor Leahy. The pile: An 800gb dataset of diverse text for language modeling, 2020. URL https: hittps://axxiv..o abs/2101. 00027.
Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, Amy Yang, Angela Fan, Anirudh Goyal, Anthony Hartshom, Aobo Yang, Archi Mitra, Archie Sravankumar, Artem Ko- renev, Arthur Hinsvark. Arun Rao, Aston Zhang, Aurelien Rodriguez, Austen Gregerson, Ava Spataru, Baptiste Roziere, Bethany Biron, Binh Tang, Bobbie Chern, Charlotte Caucheteux, Chaya Nayak, Chloe Bi, Chris Marra, Chris McConnell, Christian Keller, Christophe Touret,

---

Published as a conference paper at ICLR 2026
Chunyang Wu, Corinne Wong, Cristian Canton Ferrer, Cyrus Nikolaidis, Damien Allonsius, Daniel Song, Danielle Pintz, Danny Livshits, Danny Wyatt, David Esiobu, Dhruv Choudhary, Dhruv Mahajan, Diego Garcia-Olano, Diego Perino, Dieuwke Hupkes, Egor Lakomkin, Ehab AlBadawy, Elina Lobanova, Emily Dinan, Eric Michael Smith, Filip Radenovic, Francisco Guzmán, Frank Zhang, Gabriel Synnaeve, Gabrielle Lee, Georgia Lewis Anderson, Govind That- tai, Graeme Nail, Gregoire Mialon, Guan Pang, Guillem Cucurell, Hailey Nguyen, Hannah Kore- vaar, Hu Xu, Hugo Touvron, Iliyan Zarov, Imanol Arrieta Ibarra, Isabel Kloumann, Ishan Misra, Ivan Evtimov, Jack Zhang, Jade Copet, Jaewon Lee, Jan Geffert, Jana Vranes, Jason Park, Jay Ma- hadeokar, Jeet Shah, Jelmer van der Linde, Jennifer Billock, Jenny Hong, Jenya Lee, Jeremy Fu, Jianfeng Chi, Jianyu Huang, Jiawen Liu, Jie Wang, Jiecao Yu, Joanna Bitton, Joe Spisak, Jong- s00 Park, Joseph Rocca, Joshua Johnstun, Joshua Saxe, Junteng Jia, Kalyan Vasuden Alwala, Karthik Prasad, Kartikeya Upasani, Kate Plawiak, Ke Li, Kenneth Heafield, Kevin Stone, Khalid El-Arini, Krithika Iyer, Kshitiz Malik, Kuenley Chiu, Kunal Bhalla, Kushal Lakhotia, Lauren Rantala-Yeary Laurens van der Maaten, Lawrence Chen, Liang Tan, Liz Jenkins, Louis Martin, Lovish Madaan, Lubo Malo, Lukas Blecher, Lukas Landzaat, Luke de Oliveira, Madeline Muzzi, Mahesh Pasupuleti, Mannat Singh, Manohar Paluri, Marcin Kardas, Maria Tsimpoukelli, Mathew Oldham, Mathieu Rita, Maya Pavlova, Melanie Kambadur, Mike Lewis, Min Si, Mitesh Ku- mar Singh, Mona Hassan, Naman Goyal, Narjes Torabi, Nikolay Bashlykov, Nikolay Bogoy- chev, Niladri Chatterji, Ning Zhang. Olivier Duchenne. Onur Çelebi, Patrick Alrassy, Pengchuan Zhang, Pengwei Li, Petar Vasic. Peter Weng, Prajjwal Bhargava, Pratik Dubal, Praveen Krishnan, Punit Singh Koura, Puxin Xu, Qing He, Qingxiao Dong, Ragavan Srinivasan, Raj Ganapathy, Ra- mon Calderer, Ricardo Silveira Cabral, Robert Stojnic, Roberta Raileanu, Rohan Maheswari, Ro- hit Girdhar, Rohit Patel, Romain Sauvestre, Ronnie Polidoro, Roshan Sumbaly, Ross Taylor, Ruan Silva, Rui Hou, Rui Wang. Saghar Hosseini, Sahana Chennabasappa, Sanjay Singh, Sean Bell, Seohyun Sonia Kim, Sergey Edunov, Shaoliang Nie, Sharan Narang, Sharath Raparthy, Sheng Shen, Shengye Wan, Shruti Bhosale, Shun Zhang, Simon Vandenhende, Soumya Batra, Spencer Whitman, Sten Sootla, Stephane Collot, Suchin Gururangan, Sydney Borodinsky, Tamar Herman, Tara Fowler, Tarek Sheasha, Thomas Georgiou, Thomas Scialom, Tobias Speckbacher, Todor Mi- haylov, Tong Xiao, Ujjwal Kam, Vedanuj Goswami, Vibhor Gupta, Vignesh Ramanathan, Viktor Kerkez, Vincent Gonguet, Virginie Do. Vish Vogeti, Vítor Albiero, Vladan Petrovic, Weiwei Chu, Wenhan Xiong. Wenyin Fu, Whitney Meers, Xavier Martinet, Xiaodong Wang. Xiaofang Wang, Xiaoqing Ellen Tan, Xide Xia, Xinfeng Xie, Xuchao Jia, Xuewei Wang, Yaelle Gold- schlag, Yashesh Gaur, Yasmine Babaei, Yi Wen, Yiwen Song, Yuchen Zhang, Yue Li, Yuning Mao, Zacharie Delpierre Coudert, Zheng Yan, Zhengxing Chen, Zoe Papakipos, Aaditya Singh, Aayushi Srivastava, Abha Jain, Adam Kelsey, Adam Shajnfeld, Adithya Gangidi, Adolfo Victoria, Ahuva Goldstand, Ajay Menon, Ajay Sharma, Alex Boesenberg, Alexei Baevski, Allie Feinstein, Amanda Kallet, Amit Sangani, Amos Teo, Anam Yunus, Andrei Lupu, Andres Alvarado, An- drew Caples, Andrew Gu, Andrew Ho, Andrew Poulton, Andrew Ryan, Ankit Ramchandani, An- nie Dong, Annie Franco, Anuj Goyal, Aparajita Saraf, Arkabandhu Chowdhury, Ashley Gabriel, Ashwin Bharambe, Assaf Eisenman, Azadeh Yazdan, Beau James, Ben Maurer, Benjamin Leon- hardi, Bernie Huang, Beth Loyd, Beto De Paola, Bhargavi Paranjape, Bing Liu, Bo Wu, Boyu Ni, Braden Hancock, Bram Wasti, Brandon Spence, Brani Stojkovic, Brian Gamido, Britt Mon- talvo, Carl Parker, Carly Burton, Catalina Mejia, Ce Liu, Changhan Wang, Changkyu Kim, Chao Zhou, Chester Hu, Hainng Chu, Chris Cai, Chris Tindal, Christoph Feichtenhofer, Cynthia Gao, Damon Civin. Dana Beaty. Daniel Kreymer, Daniel Li, David Adkins, David Xu, Davide Testuggine, Delia David, Devi Parikh, Diana Liskovich, Didem Foss, Dingkang Wang, Due Le, Dustin Holland, Edward Dowling, Eissa Jamil, Flaine Montgomery, Eleonora Presani, Emily Hahn, Emily Wood, Eric-Tuan Le, Erik Brinkman, Esteban Arcaute, Evan Dunbar, Evan Smoth- ers. Fei Sun, Felix Kreuk, Feng Tian, Filippos Kokkinos, Firat Ozgenel. Francesco Caggioni, Frank Kanayet, Frank Seide, Gabriela Medina Florez, Gabriella Schwarz, Gada Badeer, Georgia Swee, Gil Halpem, Grant Herman, Grigory Sizov, Guangyi, Zhang, Guna Lakshminarayanan, Hakan Inan, Hamid Shojanazeri. Han Zou, Hannah Wang, Hanwen Zha, Haroun Habeeb, Harri- son Rudolph, Helen Suk, Henry Aspegren, Hunter Goldman, Hongyuan Zhan, Ibrahim Damlaj, Igor Molybog, Igor Tufanov, Ilias Leontiadis, Irina-Flena Veliche, Itai Gat, Jake Weissman, James Geboski, James Kohli, Janice Lam, Japhet Asher, Jean-Baptiste Gaya, Jeff Marcus, Jeff Tang, Jen- nifer Chan, Jenny Zhen, Jeremy Reizenstein, Jeremy Teboul, Jessica Zhong, Jian Jin, Jingyi Yang, Joe Cummings, Jon Carvill, Jon Shepard, Jonathan McPhie, Jonathan Torres, Josh Ginsburg, Jun- jie Wang, Kai Wu, Kam Hou U, Karan Saxena, Kartikay Khandelwal, Katayoun Zand, Kathy Matosich, Kaushik Veeraraghavan, Kelly Michelena, Keqian Li, Kiran Jagadeesh, Kun Huang,
12

---

Published as a conference paper at ICLR 2026
Kunal Chawla, Kyle Huang, Lailin Chen, Lakshya Garg, Lavender A, Leandro Silva, Lee Bell, Lei Zhang, Liangpeng Guo, Licheng Yu, Liron Moshkovich, Luca Wehrstedt, Madian Khabsa, Manav Avalani, Manish Bhatt, Martynas Mankus, Matan Hasson, Matthew Lennie, Matthias Reso, Maxim Groshev, Maxim Naumov, Maya I Lathi, Meghan Keneally, Miao Liu, Michael L.. Seltzer, Michal Valko, Michelle Restrepo, Mihir Patel, Mik Vyatskov, Mikayel Samvelyan, Mike Clark, Mike Macey, Mike Wang, Miquel Jubert Hermoso, Mo Metanat, Mohammad Rastegari, Munish Bansal, Nandhini Santhanam, Natascha Parks, Natasha White, Navyata Bawa, Nayan Singhal, Nick Egebo, Nicolas Usumier, Nikhil Mehta, Nikolay Pavlovich Laptev, Ning Dong, Norman Cheng, Oleg Cherngguz Olivia Hart, Omkar Salpekar, Ozlem Kalinli, Parkin Kent, Parth Parekh, Paul Saab, Pavan Balaji, Pedro Rittner, Philip Bontrager, Pierre Roux, Piotr Dollar, Polina Zvyagina, Prashant Ratanchandani, Pritish Yuvraj, Qian Liang, Rachad Alao, Rachel Ro- driguez, Rafi Ayub, Raghotham Murthy, Raghu Nayani, Rahul Mitra, Rangaprabhu Parthasarathy, Raymond Li, Rebekkah Hogan, Robin Battey, Rocky Wang. Russ Howes, Ruty Rinott, Sachin Mehta, Sachin Siby, Sai Jayesh Bondu, Samyak Datta, Sara Chugh, Sara Hunt, Sargun Dhillon, Sasha Sidorov, Satadru Pan, Saurabh Mahajan, Saurabh Verma, Seiji Yamamoto, Sharadh Ra- maswamy, Shaun Lindsay, Shaun Lindsay, Sheng Feng. Shenghao Lin, Shengxin Cindy Zha, Shishir Patil, Shiva Shankar. Shuqiang Zhang, Shuqiang Zhang, Sinong Wang, Sneha Agarwal, Soji Sajuyigbe, Soumith Chintala, Stephanie Max, Stephen Chen, Steve Kehoe, Steve Satter- field, Sudarshan Govindaprasad, Sumit Gupta, Summer Deng, Sungmin Cho, Sunny Virk, Suraj Subramanian, Sy Choudhury, Sydney Goldman, Tal Remez, Tamar Glaser, Tamara Best, Thilo Koehler, Thomas Robinson, Tianhe Li, Tianjun Zhang, Tim Matthews, Timothy Chou, Tzook Shaked, Varun Vontimitta, Victoria Ajayi, Victoria Montanez, Vijai Mohan, Vinay Satish Ku- mar, Vishal Mangla, Vlad Ionescu, Vlad Poenaru, Vlad Tiberiu Mihailescu, Vladimir Ivanov, Wei Li, Wenchen Wang, Wenwen Jiang. Wes Bouaziz, Will Constable, Xiaocheng Tang, Xiao- jian Wu, Xiaolan Wang, Xilun Wu, Xinbo Gao. Yaniv Kleinman, Yanjun Chen, Ye Hu, Ye Jia, Qi, Yenda Li, Yilin Zhang, Ying Zhang, Yossi Adi, Youngjin Nam, Yu, Wang. Yu Zhao, Yuchen Hao, Yundi Qian, Yunlu Li, Yuzi He, Zach Rait, Zachary DeVito, Zef Rosnbrick, Zhao- duo Wen, Zhenyu Yang. Zhiwei Zhao, and Zhiyu Ma. The llama 3 herd of models, 2024. URL https: / rxxiv org/ als 2207 21 783.
Qingyan Guo, Rui Wang, Junliang Guo, Bei Li, Kaitao Song, Xu Tan, Guoqing Liu, Jiang Bian, and Yujiu Yang. Evoprompt: Connecting Ilms with evolutionary algorithms yields powerful prompt optimizers, 2025. URL https:///// / arxia. www.iiorg./......oooooooo.ooeeee /abg//b////// abs /abbs/225 23003 08532. 10
Harold V Henderson and Shayle R Searle. The vec-permutation matrix, the vec operator and kro- necker products: A review. Linear and multilinear algebra, 9 1-28,, 1981. 20, 38
HmbBIDI. Discussion paper: Large language models and personal data, 2024. URL
https: fttps:://dttescchtze hamburg de/ wtwllleemeeeeeuullllllla hwt.o/a/ww.bbbbb/b//mm inneaatiionnn/nn oneno Baap:c11__isssssssee httprassoonaapee_aaarrrrrr_o
Datenschutz/
KI _T__Models..e 10
Roger A. Horn and Charles R. Johnson. Matrix Analysis. Cambridge University Press, Cambridge, 2 edition, 2013. 37
Albert Q. Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chap- lot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, Lélio Renard Lavaud, Marie-Anne Lachaux, Pierre Stock, Teven Le Seao, Thibaut Lavril, Thomas Wang, Timothée Lacroix, and William El Sayed. Mistral 7b, 2023. URL https: //arxiv. org abs / 2310. 06825.
Haozhe Jiang and Nika Haghtalab. On surjectivity of neural networks: Can you elicit any behavior from your model? arXiv preprint arXiv:2508. /9445, 2025. URL https://arxiv.cr
abs/ abs/2508.. 19445. 9
Tamara G. Kolda and Brett W. Bader. Tensor decompositions and applications. SIAM Review, 51(3):555-500 2009, doi: 10.113700707011XX URL 07070111x.
Steven Krantz and Harold R Parks. A primer of real analytic functions. Springer Science & Business Media, 2002. 23
13

---

Published as a conference paper at ICLR 2026
Andrew D. Lewis. Chapter 1: Holomorphic and real analytic calculus. Notes on Global Analysis, Vol. 1, Queen's University, February 2014. URL https:/ /mast. www.stt..eeesuuue queensu. ca/ wwwp/a/aaaaaai "andrew/
beaccinng/mat942/ppeg wtw.d///chapeerr..coomm pppeerrppp..... påf. Version: 2014-02-28. 19, 40
David G. Luenberger. Optimization by vector space methods. Willey-ntersccienee, 1997. 25
Jan R. Magnus and Heinz Neudecker. Matrix differential calculus with applications in statistics and Econometrics. John Wiley & Sons, Inc, 2019. 25,
Microsoft, :, Abdelrahman Abouelenin, Atabak Ashfaq, Adam Atkinson, Hany Awadalla, Nguyen Bach, Jianmin Bao, Alon Benhaim, Martin Cai, Vishrav Chaudhary, Congcong Chen, Dong Chen, Dongdong Chen, Junkun Chen, Weizhu Chen, Yen-Chur Chen, Yi ling Chen, Dai, Xiyang Dai, Ruchao Fan, Mei Gao, Min Gao. Amit Garg, Abhishek Goswami, Junheng Hao, Amr Hendy, Yuxuan Hu, Xin Jin, Mahmoud Khademi, Dongwoo Kim, Young Jin Kim, Gina Lee, Jinyu Li, Yunsheng Li, Chen Liang, Xihui Lin, Zeqi Lin, Mengchen Liu, Yang Liu, Gilsinia Lopez, Chong Luo, Piyush Madan, Vadim Mazalov, Arindam Mitra, Ali Mousavi, Anh Nguyen, Jing Pan, Daniel Perez-Becker, Jacob Platin, Thomas Portet, Kai Qiu, Bo Ren. Liliang Ren, Sambuddha Roy, Ning Shang, Yelong Shen, Saksham Singhal, Subhojit Som, Xia Song. Tetyana Sych, Praneetha Vaddamanu, Shuohang Wang, Yiming Wang. Zhenghao Wang. Haibin Wu, Haoran Xu, Weijian Xu, Yifan Yang. Ziyi Yang. Donghan Yu, Ishmam Zabir, Jianwen Zhang, Li Lyna Zhang, Yunan Zhang, and Xiren Zhou. Phi-4-mini technical report: Compact yet powerful multimodal language models via mixture-of-loras. 2025. URL https:: /ttsss//aaxvvvvii org/ abs / 2503. 01 1774..
Michele Miranda, Elena Sofia Ruzzetti, Andrea Santilli, Fabio Massimo Zanzotto, Sébastien Bratières, and Emanuele Rodolà. Preserving privacy in large language models: A survey rent threats and solutions. Transactions on Machine Learning Research, 2025. ISSN 2835-8856. URL https::///// wwwpppeeeeiiieeeeeeeeee http:/neee/ooooee forum? id S 9MTTN70L. 10
Boris Mityagin. The set of real analytic function. arXiv preprint arXiv: arXiv:1512.072276 2015. 19, 20
John X. Morris, Volodymyr Kuleshov, Vitaly Shmatikov, and Alexander M. Rush. Text embeddings reveal (almost) as much text, 2023a. URL Itt
06816
John Morris, Wenting Zhao, Justin T. Chiu, Vitaly Shmatikov, and Alexander M. Rush. Language model inversion, 2023b. URL
abs /ats//231111 1111111114477 8, 10
James R. Munkres. Topology. Prentice Hall, Upper Saddle River, NJ, 2 edition, 2000. 25, 26
Murtaza Nazir, Matthew Finlayson, John X. Morris, Xiang Ren, and Swabha Swayamdipta. Bet- language model inversion by compactly representing next-token distributions, 2025. URL https: http:p:://rxxi..rrt obtps////5saa/////55// 17090. 8, 10
Jorge Pérez, Javier Marinković, and Pablo Barceló. On the turing completeness of modern neural network architectures. In International Conference on Learning Representations, 2019. URL
net. /tt////ommiidiiaaaaaeee wtwprrewwwweeeeeooueeeieeeeee
58
Alec Radford, Jeff Wu, Rewon Child, David Luan, Dario Amodei, and Ilya Sutskever.
Language models unsupervised multitask learners. 2019. URL https://api.
semanticscholar.c www.:o/orrrrrgoooooooooo :.DDD:::602333 7,51
Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J. Liu. Exploring the limits of transfer learning with unified text-to- text transformer. Journal of Machine Learning Research, 21(140):1-67, 2020. URL http:
/ 074 html.
Anton Razzhigaev, Matvey Mikhalchuk, Elizaveta Goncharova, Ivan Oseledets, Denis Dimitrov, and Andrey Kuznetsov. The shape of learning: Anisotropy and intrinsic dimensions in transformer- based models, 2024. URL https: //aas///avvii oogg /arg/bb////eer /tabs//311111 2211 0.5905922 92... 54
14

---

Published as a conference paper at ICLR 2026
Anton Razzhigaev, Matvey Mikhalchuk, Temurbek Rahmatullaev, Elizaveta Goncharova, Polina Druzhinina, Ivan Oseledets, and Andrey Kuznetsov. min-micoosoop::: Uncovering the hidden role of punctuation in context memory of transformers, 2025. URL https://azxiv..o 2bss2502..0 15007. 54
Walter Rudin. Principles of Mathematical Analysis. McGraw Hill, New York, 3 edition, 1976. 26, 41,57
Taylor Shin, Yasaman Razeghi, Robert L. Logan IV, Eric Wallace, and Sameer Singh. Autoprompt: Eliciting knowledge from language models with automatically generated prompts, 2020. URL
https://aaaat org/ abs/ 2010.15980. 10
Ravid Shwartz-Ziv and Naftali Tishby, Opening the black box of deep neural networks via informa- tion, 2017. URL https: /arxivvvivv org/ a /00.. 00810. 55
Michael Spivak. Calculus on manifolds. Westview Press, Philadelphia, PA, January 1971. 26
Tianxiang Sun, Yunfan Shao, Hong Qian, Xuanjing Huang, and Xipeng Qiu. Black-box tuning for -aseg-e-----l---------ee--
2022. URL https: http///axvvvvo/// abs /2001. 03514. 10
Zhaodong Sun, Fabian Latorre, Thomas Sanchez, and Volkan Cevher. age prior. In ICASSP 2021 2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 8103-8107. IEEE, June 2021. doi: 10.1 1..110///asss339728..222 2021. 9414879. URL http: / /xx. doi. org/ooogg//.oooooooooooooo /0/.//1.... 111111111111 10111199/AAS9999210
plug-and-play deep im-
2021 9414879 10
Zhiqing Sun and Yiming Yang. An em approach to non-autoregressive conditional sequence gen- eration. In International Conference on Machine Learning, 2020. URL https://api.
semanticscholar.orr wwwpo///////../-.ooo 220265582222222277 58
Denis Sutter, Julian Minder, Thomas Hofmann, and Tiago Pimentel. The non-linear representation dilemma: Is causal abstraction enough for mechanistic interpretabilityy, 2025. URL https:
//arxiv. org ats///b///// 2500.55000000 08802. 9,
Gemma Team, Aishwarya Kamath, Johan Ferret, Shreya Pathak, Nino Vieillard, Ramona Merhej, Sarah Perrin, Tatiana Matejovicova, Alexandre Ramé, Morgane Rivière, Louis Rouillard, Thomas Mesnard, Geoffrey Cideron, Jean bastien Grill, Sabela Ramos, Edouard Yvinec, Michelle Cas- bon, Etienne Pot, Ivo Penchev, Gaël Liu, Francesco Visin, Kathleen Kenealy, Lucas Beyer, Xi- aohai Zhai, Anton Tsitsulin, Robert Busa-Fekete, Alex Feng, Noveen Sachdeva, Benjamin Cole- man, Yi Gao, Basil Mustafa, Iain Barr, Emilio Parisotto, David Tian, Matan Eyal, Colin Cherry, Jan-Thorsten Peter, Danila Sinopalnikov, Surya Bhupatiraju, Rishabh Agarwal, Mehran Kazemi, Dan Malkin, Ravin Kumar, David Vilar, Idan Brusilovsky. Jiaming Luo, Andreas Steiner, Abe Friesen, Abhanshu Sharma, Abheesht Sharma, Adi Mayrav Gilady, Adrian Goedeckemeyer, Alaa Saade, Alex Feng. Alexander Kolesnikov, Alexei Bendebury, Alvin Abdagic, Amit Vadi, András György, André Susano Pinto, Anil Das, Ankur Bapna, Antoine Miech, Antoine Yang, Antonia Paterson, Ashish Shenoy, Ayan Chakrabarti, Bilal Piot, Bo Wu, Bobak Shahriari, Bryce Petrini, Charlic Chen, Charline Le Lan, Christopher A. Choquette-Chin Chou,, CJ Carcy, Cormac Brick, Daniel Deutsch, Danielle Eisenbud, Dee Cattle, Derek Cheng. Dimitris Paparas, Divyashree Shivaku- mar Sreepathihalli, Doug Reid, Dustin Tran, Dustin Zelle, Eric Noland, Erwin Huizenga, Eu- gene Kharitonov, Frederick Liu, Gagik Amirkhanyan, Glenn Cameron, Hadi Hashemi, Hanna Klimezak-Plucinska. Harman Singh, Harsh Mehta, Harshal Tushar Lehri, Hussein Hazimeh, Ian Ballantyne, Idan Szpektor, Ivan Nardini, Jean Pouget-Abadie, Jetha Chan, Joe Stanton, John Wi- eting, Jonathan Lai, Jordi Orbay, Joseph Fernandez, Josh Newlan, Ju yeong Ji, Jyotinder Singh, Kat Black, Kathy Yu, Kevin Hui, Kiran Vodrahalli, Klaus Greff, Linhai Qiu, Marcella Valentine, Marina Coelho, Marvin Ritter, Matt Hoffman, Matthew Watson, Mayank Chaturvedi, Michael Moynihan, Min Ma, Nabila Babar, Natasha Noy, Nathan Byrd, Nick Roy, Nikola Momchev, Ni- lay Chauhan, Noveen Sachdeva, Oskar Bunyan, Pankil Botarda, Paul Caron, Paul Kishan Ruben- stein, Phil Culliton, Philipp Schmid, Pier Giuseppe Sessa, Pingmei Xu, Piotr Stanczyk, Pouya Tafti, Rakesh Shivanna, Renjie Wu, Renke Pan, Reza Rokni, Rob Willoughby, Rohith Vallu, Ryan Mullins, Sammy Jerome, Sara Smoot, Sertan Girgin, Shariq Iqbal, Shashir Reddy, Shruti Sheth, Siim Pöder, Sijal Bhatnagar, Sindhu Raghuram Panyam. Sivan Eiger, Susan Zhang, Tianqi Liu, Trevor Yacovone, Tyler Liechty, Uday Kalra, Utku Evci, Vedant Misra, Vincent Roseberry, Vlad Feinberg, Vlad Kolesnikov, Woohyun Han, Woosuk Kwon, Xi Chen, Yinlam Chow, Yuvein
15

---

Published as a conference paper at ICLR 2026
Zhu, Zichuan Wei, Zoltan Egyed. Victor Cotruta, Minh Giang, Phoebe Kirk, Anand Rao, Kat Black, Nabila Babar, Jessica Lo, Erica Moreira, Luiz Gustavo Martins, Omar Sanseviero. Lucas Gonzalez, Zach Gleicher, Tris Warkentin, Vahab Mirrokni, Evan Senter, Eli Collins, Joclle Bar- ral, Zoubin Ghahramani, Raia Hadsell, Yossi Matias, D. Sculley, Slav Petrov, Noah Fiedel, Noam Shazeer, Oriol Vinyals, Jeff Dean, Demis Hassabis, Koray Kavukeuoglu, Clement Farabet, Elena Buchatskaya, Saan-Baptstte Alayrac, Rohan Anil, Dmitry, Lepikhin, Sebastian Borgeaud, Olivier Bachem, Armand Joulin, Alek Andreev, Cassidy Hardin, Robert Dadashi, and Léonard Hussenot. Gemma 3 technical report, 2025. URL https: : / arxiv. org/ abs 2 2503. ...33..... 19786. 7
Rahul Thomas, Louai Zahran, Erica Choi, Akilesh Potti, Micah Goldblum, and Arka Pal. Hidden no more: Attacking and defending private third-party LLM inference. In Proceedings of the 42nd International Conference Machine Learning (ICML), 2025. URL fittps://arxiv.... abs/ 188188333 33... 10
Yuxin Wen, Neel Jain, John Kirchenbauer, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Hard prompts made easy: Gradient-based discrete optimization for prompt tuning and discovery, 2023. URL https: www.a.iwvooo....oo...oaaoooo.o.. aabeeg///////// /2ops/23322 20.. 03668. 8, 10, 49
Zhilin Yang, Zihang Dai, Ruslan Salakhutdinov, and William W. Cohen. Breaking the softmax bottleneck: A high-rank rnn language model. In International Conference on Learning Represen- tations (ICLR), 2018. URL https: / www.iiwwg.......ee....o.a..eoooe org. abs///a///ta 1711. 03953.
Chulhee Yun. Srinadh Bhojanapalli, Ankit Singh Rawat, Sashank Reddi, and Sanjiv Kumar. Are transformers universal approximators of sequence-to-sequene functions? In International Con- ference on Learning Representations, 2020. URL https::///// opwerevieeeeeeeeeeeeeeeeee net forum?
1d=ByxRMONE.v. 58
Collin Zhang, John X. Morris, and Vitaly Shmatikov. Extracting prompts by inverting Ilm outputs, 2024. URL https: / /arxiv.vvvv. org. /2405. 15012. 10
16

---

Published as a conference paper at ICLR 2026
APPENDIX OVERVIEW
Preliminaries
17
A.1 Notation
17
A.2 Real-Analyticity..
18
A.3 Differential, Measure-Theoree and Topological Tools
25
Transformer Language Model
27
C Almost Sure Injectivity
32
C.I Absolute continuity ensures almost sure injectivity
33
C.2 Absolute continuity of the parameter distribution preserved under GD
35
Left-Invertbbility Via SipIt
43
D.1 One-Step Last-Token Maps
43
D.2 The Core Routines: Local Verifiers, Acceptance Regions, and Policies
D.3 Global Inversion via SIPIT
46
E
Implementation Details and Additional Experiments
48
E.1
Implementation Details
48
E.2 Additional Ablations
50
E,3 Identical Next-Token
................................
E,4 Prompts with Similar Representations
52
E.5 Relation with Anisotropy and Intrinsic Dimension
54
Real-Analytic Activation Functions in Modern LLMs
56
A PRELIMINARIES
This section fixes the notation used throughout the main paper and the appendix (subsection A. and it introduces real- analytiiyyy as the organizing theme (subsection A.2). We first review the vector-space notion and its basic closureccomposition properties (subsubsection A.2.1), together with a zero-set principle used measure- zero arguments. We then extend these ideas to maps between matrix spaces (subsubsection A.2.2) via vectorization/aatriiiaatoo and note that analytic- ity is preserved under matrix compositions. To streamline later proofs, we summarize real-analytic building blocks commonly used in transformer layers-polynomial,, exponential//ogarihm. softmax, row normalization, matrix products, Hadamard scaling, and stacking (subsubsection A.2.3). Finally, in subsection A.3, we collect differential and topological tools Fréchet derivatives and the Hessian, standard facts on RP, the inverse function theorem, and pushforwards/absoltte continuity which we use for local invertibility and insolute-conninuity arguments. Readers already comfortable with these topics can skim now and return to specific subsections as needed.
A. NOTATION
For arbitrary T' E N. we write [7] = ,1, to denote the set of positive integers up to T. Additionally, we denote the strictly positive real numbers R (0, oo) and the non-negative real numbers TR. [0, Do). Similarly, we let No N U (0).
17

---

Published as a conference paper at ICLR 2026
Discrete sets denoted by uppercase calligraphic letters V, and sequence of length K is denoted by lowercase letters: S = ($1...., Sk) ......,,)))
y* We write |s] = K to denote the length of the sequence. The set of non-empty sequences of length at most K' is denoted as y = - VR Non-discrete sets are denoted by uppercase calligraphic bold-face letters B.
Remark 1. We will often refer discrete set V the vocabulary and to element E VSK as an imput, context, or prompt.
Matrices (vectors) are denoted by uppercase (lowercase) bold-face letters: X Rd (x Rd). For vectors and matrices, we frequently use standard norms and common matrix operations. The Hadamard and Kronecker products are defined following Kolda Bader (2009):
p-norm: For vector Rd, the Ep norm is defined
d
||x||
=
X
P
Frobenius norm: For matrix E Rdd xd2, the Frobenius norm defined as
da
| tx(XXx)=
Hadamard product: The Hadamard (element-wise) product defined for vectors and matrices of the same shape:
(x x y); x,Yi,
for all i E [4], for all E [di,, [d2],
(X O Y) = Yij
where x, y E Rd and X, Y Rdd
Kronecker product: The Kronecker product of X Rddixd, and Z E Rddxdd is denoted X @ Z and defined blockwise as
X
X X
X & Z
E (((d)))))()))))
Xd, iZ
Xd Z
We denote the all-zeros matrix of size m x n as Omx.. and the all-zeros vector of length m as Om- Similarly, write 1. for the all-ones vector of length m, and I, (or Imxm when dimensions must be explicit) for the m x m identity matrix.
Let VSK R Rdd be function over finite vocabulary V and K N. We refer to f as the model, to its first argument as the input sequence, and to its second argument as the parameters.
Remark 2. Throughout our analysis, we assume a finite set of possible input sequences, reflect- ing the practical limitations and design choices of modern LLMs, specifically the bounded context length.
Remark 3. take the codomain of the model TRd, corresponding to the space of token embeddings. This allows to study how the final embedding (typically used to compute next-token probabilities) depends on both the input sequence and the model parameters.
A.2 REAL-ANALYTICITY
We introduce the central notion for analysis: real-analyticity. In its standard form, real- analyticity is detined for functions f 24 - R", where 24 C IR" is an open set. Since the transformer architecture naturally expressed terms of matrices, it will be convenient extend this notion to maps of the form f mmmx + Baxt
Multi-index notation. We use multi-index notation for both vectors and matrices.
18

---

Published as a conference paper at ICLR 2026
Vector case. Let (01,....
am
No and x, E R.. Define:
m
m
m
|o|
Σ
a!!
II Lzhh
()-
Xx) y,,
Matrix case. Let A (Awe) E No Nox and X, Y E Rmxx, Define:
A
Chen
A!
Cany
(X- Y)
Y Jau
1a mm
10m1
Given open set 44 C Rd and a map f u
we write
① f
d' f(x
Oxim (x)
0x
for the mixed partial derivative (when it exists). Unless stated otherwise, we assume f E C (U). d f exists and is continuous for all Ni;; for vector-valued maps f = (fi,..,, - fn) the operator d acts componentwise. We also use the convention f=
A.2.1 REAL-ANALYTIC FUNCTIONS WITH VECTOR INPUTS
We begin with the standard vector-space definition and its basic algebraic properties. These are the building blocks from which all later analyticity arguments are assembled.
Definition A.1 (Real-analytic functions, Lewis 2014, Definition 1.1.3). Let S Rm be open. A function f + TR real-analytic 24 for every y E U, there exist coefficients (Ca E RR RR and r > 0 such that
everr
[(x) Σ (x- KENT
for all x E. U with |x yll2 < The set of real- real-analytic functions on U is denoted by C* (L).
map U + Rn real-analytic on U if each of its components fi...., Sn. real-an cral-analytic. The set of such maps is denoted C (u: R²).
R is
Remark 4. To establish real-analytiche of vector-valued mapping (e.g., MLP, attention mech- anism, or LayerNorm), it suffices to prove real-analyticity of each scalar component.
Proposition A.1 (Closure properties, Lewis 2014, Proposition 1.2.1). Let S.g Rm + R be real- analytic maps. Then, the following hold:
Addition: + g E C (R.)..
2. Product: fg E (IR"))..
3. Quotient: If g(x # for all x E R., then f/g e (R"M)...
Proposition A.2 (Composition, Lewis 2014, Proposition 1.2.2). Let J Rm - R. and g IR R be real-analytic maps. Then, the composition g o m - TR. is real-analytic.
form, Remark 5. For simplicity, we do not state the closure properties in their most general form, where and g may be defined different open subsets of T This avoids additional notation involving intersections of domains. Since every function of interest in our later analysis is defined on the whole space Th, this restriction entails loss of generality.
Theorem A.1 (Zero sets nontrivial real-analytic maps Mityagin 2015). Letld C 1 be connected and open, and lei f E Cu IR). If # On. then its zero set
z(f) = f ((0ml))
ex: f(x) =0,}
has Lebesgue measure zero in RT (i.e. Lebm (Z())) 0). Equivalently, if there exists E U with f(x) # On. then Leb,n (J- (J-1((0,))) 0.
19

---

Published as a conference paper at ICLR 2026
Remark 6. The result in Mityagin (2015) is stated for scalar-valued maps u - R. The extension to vector-valued maps f= .i.....;.. fn) U - is immediate: the zero set of f the intersection of the zero sets of its scalar components.
2 z(h);
and if f = Ou then least one component f3 # so Z(f) E Z(f)), which has measure zero by the scalar case.
A.2.2 REAL-ANALYTIC FUNCTIONS WITH MATRIX INPUTS
Since transformer layers operate on matrices (e.g., X E R2'xd), we need to extend real-analyticity from vector spaces matrix spaces. The key tool is the vectorization operator, which lets reduce matrix-analyte questions to the vector case treated above.
Definition A.2 ehealttnalytic on matrix spaces), Letul C R be open. A function f : - R is real-analytic U for every Y U, there exist coefficients {cA E R] Aengxx and r >> 0 such that
f(X)
Σ cA -)A
AEN
for all X E U with |X Y <.
map f + Raab is real-analytic on if each of its components fúj : u - R is real-analytic. The set of such maps is denoted C (u: ; T
Remark 7. In the special case where = = the domain and codomain reduce m and IR'", respectively. Then Definition A.2 recovers Definition A.I. Thus, Definition A.2 generalizes real-analyine ceal-analyticity to functions between matrix spaces.
Definition A.3 (Vectorization and matricization Operators). Let veCm. Rm + Rm denote the standard vectorization operator, which stacks the columns of a matrix into single column vector (Henderson & Searle, 1981).
We also define the corresponding matricization operator malm,n Chacón Duong 2020, the vectorization and malricization operators are mutual inverses:
R
m As shown in
mahm (veCm,m (X)
X VX E Buxn
veCm, (matm, (x))
(8)
Furthermore, ifx mm and X m related by vectorization and matricization, i.e., x VeC,, (X) and X matm,n then their norms coincide:
|x|12
|X||e-
Definition A.4 (Vectorized Form of Function). Les U C [gmx be open and út vecm, in (U) (also open since vec is a linear homeomorphism), We denote the vectorized form of a function - Raxb as
f == voca,b o f matm,n ū + Ra
Equivalently, for all X Ud
f(X) mata,6 (f(vecm,z())
(9)
Lemma A.1 (Equivalence real-analyticitty. Let U C guxn be open, ú vec (U), and let
u gaxb with its vectorized form i Rab,
Fix Y l and y vo (Y) U. Then the following equivalent:
1. f is real-analytic Y (in the sense of Definition A.2).
2. i is real-analytic y (in the sense of Definition A.I).
20

---

Published as a conference paper at ICLR 2026
Proof. We begin by establishing the correspondence between matrix and vector indices in IR* and Rht. For s E [ke], define:
u(s) == 1 + 1) mod kt
(row index)
8 s-1
v(s) = 1 +
(column index)
k
Then (w()), v())) E [k] x [e] gives the matrix coordinates corresponding to the sth entry of the vectorization. Conversely, for (u,v) E [k] [e] define:
su,, v) = + (v 1)kk [k]]
recover the linear index.
When clear from context, we omit arguments and simply write us n, or s for readability.
Let X, Y E R=xx, with vectorizations = vecm,n (X) and vecm.n (Y). For a vector multi- index a E Ng define the corresponding matrix multi-index Aa = ma) so that:
(x k)-)²= (x. y&)
II (X.. Yuu) (X -X-
(10)
Similarly, for a matrix multi-index A E Nmxx define the corresponding vector multi-index &A VCCm, (A), giving:
X - Y-
X Yuv) Xx yo) yo) =(x- a)
(11)
u=1v=1
Now let M E U. and let m vecm, (M) U. By definition of the vectorization,
Sao (M) = [m(m, where 8 =(u, v).
This coordinate- wise correspondence underlies the equivalence stated in the lemma.
(=) Assume ff is real-analytic Y. Then by Definition A.2, there exists 0 and, for each (u, e),
coefficients (ax) A such that:
Sav (X)
Σ
(uv] (X YX-
vX - - <r.
(12)
AENmX
Using Equation 11, each component Fo of ff can be expressed as:
(x(
Σ
al [ a where a(e) == o (u()),((s))
QEN
This series converges for all E U with ||x yl12 = |X X < Hence, each scalar component
of f has convergent power series at y, proving that f is real-analytic there.
(+) The reverse direction follows by symmetry: assume is real-analytic at write the expan- sion at y using definition Definition A, and repeat the argument using Equation construct component wise expansions for fao at Y.
Remark 8. Consider the function J = vecm.. RMxX + R m which vectorizes an m X n matrix by stacking its columns. Its corresponding vectorized form is
f(x) (vecman,1 VCCm,n mattm,.))() voCmm.,1 =
since x E Imme is already a column vector This composition yields the identity map on Rmn, which is clearly real analytic. Therefore, by Lemma A. both vecm,n is real analytic, and similarly, so is matm.n. It is now evident that the composition of two matrix-valued real-an analyiia function is real-analytic, and we will prove it.
21

---

Published as a conference paper at ICLR 2026
Proposition A.3 (Composition matrix spaces is real-analytie), Suppose f Rmxx - R and 9 Raab + R2xa are call-analytic (in the sense of Definition A.2). Then o Rmxx - R is real-analytic.
Proof. Consider the vectorized forms
== V f matm,n R + Rh
I == vecp.q o g mat bb R + 12
By Lemma A. I' is real-analytic iff f is, and is real-analytic iff is. Hence f and ğ are real- analytic maps between Euclidean spaces.
The vectorized form of the composition is
go f v.cp.q 2 (g o f' a matm.a = (vecp.g o g o mata,)) o (veca.6 f mabm,.) 9 J.
where we inserted the identity (mala, o veca, 6.) (X)
X. By the vector-space composition property (Proposition A.2), o f is real-analytic on Rmmn. Applying Lemma A.1 once more, we get that g realyanalytie.
A.2.3 REAL ANALYTICITY OF COMMON COMPONENTS
We now catalogue the specific functions that appear inside transformer layers, proving each one is realytnalytic. These building blocks boocks-polynomiltd exponentials, softmax, row normalization, matrix products, Hadamard scaling, and stacking- wwill composed in Appendix establish the real-analyticity of the full model. Throughout, all maps are defined on Rmmx (or an open subset thereof), so Definition A.2 applics.
Proposition A.4 (Polynomials real-analytic). Let p I R be polynomial in the coor- dinates of x E 12m, ie., p(x) = -jalsa x for some d E No and coefficients da E R. Then P E C (Rm).
Proof. Polynomials are C and p = whenever |a] > Hence the Taylor expansion of p at any y E I truncates:
p(x) = Σ ply(y)
(x y)
ad
Jalse
which holds for all R (radius +.o). Therefore p is real-analytic.
Proposition A.5 (The exponential is real-analytic). The map exp IR (0, is real-analytic
R.
Proof. Define = TT. By the ratio test this power series has infinite radius of conver- gence, hence converges absolutely for all E R. Standard results on power series imply that E is O on IR and can be differentiated termwise within its radius of convergence; in particular, for every j E No.
20 k(k
1) (k- j + 1)
8
x"
BGI x
Σ
k
E(xx.
k!
Fix y E R. Taylor's theorem for power series then yields
E (v) (I
rr y)
B(x)
-
Σ 3=0
j!
1=0
which is a convergent power series in x with infinite radius of convergence. Hence E is real- analytic every R. As E is the usual exponential function defined by its power series, exp real-analytic on R.
Proposition A.6 (The logarithm is real-analytio) The map log : (0, 00) - R real-analytic on (0, oc).
22

---

Published as a conference paper at ICLR 2026
Proof. For brevity, present only proof sketch;
The exponential map exp IR (0, oo) is real-analytic with exp' * 0 for all y. By the real- analytic inverse function theorem (see Krantz & Parks 2002, Thm. 2.3.1), its local inverse log is real-analytic on oo).
The next three results handle the attention-specine operations: softmax, row normalization (used in the causal projection form), and entrywise matrix polynomials.
Proposition A.7 (Softmax real-analytic). The map softmax Rm -> R with components
ex
softmax;(x)) =
m,
Ej ex
real-analytic mm
Proof. Fix The numerator x ++ 6xi is the composition the coordinate projection T;(x) x; (a linear, hence real-analytic, map) with exp; by Proposition A.5 and the composition rule in Proposition A.I, it is real-analytic. The denominator
m
H(x) = Σ x
finite sum of real-analytic functions, hence caalyanalytic. Moreover, H(x) > 0 for all R because " > 0. Therefore, by the quotient rule in Proposition A.1, the map
X +
H(x)
is real-analytic on R".. Since this holds for each 1,..., the vector-valued map softmax is real-analytic.
Proposition A.8 (Row normalization is real-analytic positive row-sum domain). Let
Dr = ( TxT, Y1, E (0,
Define RN(Y) = diag Ylr)
Y -Y Dr. Then RN Dr - TxX is real-analytic (in the sense
of Definition A.2).
Proof. The map Y + s == Y1, is linear, hence real-analytic. On (0, oo) the entrywise ciprocal + g (0-1) is real-analytic (componentwise Matrix multiplication (A, Y) + AY is real-tna (Proposition A.10). Composing these gives RN(Y) diag( (Yr)) 'Y real-analytic the open set Dr.
1/t). The map diag(s) is linear.
Proposition A.9 (Entrywise matrix polynomials are real-analytic). Fix m, E N. For coefficients (cA [R) AeNgxx and some No, define the function p Ruxn IR by:
x():
Σ XA
(13)
PAISA
where X II II= XA as defined in the multi-inee index notation above. Then p is real- analytic R. (in the of Definition A.2).
Moreover, if Tpaxn - Raxb has component functions fiz of the form Equation 13, then f is
real-analytic.
Proof. Consider the vectorized form ş == matm,x Rmn + R. Using the coordinate identifi- cation from equation !1-equation 10, each monomial satisfies
(matm, (x)) x aA
23

---

Published as a conference paper at ICLR 2026
where aA v.Cm,,(A)) Hence:
p(x)
Σ IA|Sa
CA xa
which is standard multivariate polynomial in IR By Proposition A.4, such functions real-analytic on all of Rmn,, 80 p E C (Ik.).) By Lemma A.I, this implies p is real-analytic on Rmx=.
For the second claim, observe that if each fúj is a scalar polynomial of the form Equation 13, then each fúj is real-analytic by the argument above. Hence, by Definition A.2, f real analytic.
Finally, we record the algebraic operatiios--aaee multiplication, Hadamard scaling, concatena- tion, and noncommutative matrix polynomials- that allow us to compose the above primitives into full transformer layers.
Proposition A.10 (Matrix product real-analytic factors). Let the functions : :' + R and g : Rm xkx be real-analytic. Then, h R=xn TRxx defined as h(X) ((X) is real-analytic on mxxx.
Proof. For each (i,j) [p] x [4], holds that hig (X) Ei= (X) 9ki
Each factor fike and gky is real-analytic scalar map by assumption; their product is real-analytic by Proposition A.I, and finite sum of real-analytic functions real-analytic. Thus every hig is real-analytic, hence h is real-analytic.
Li
Proposition A.11 (Hadamard (element-wing scaling). Ler E Rm be a fixed matrix. Then, the map f pmxn Rmxn defined fXX A @ X is real-analytic mmx
Proof. Componentwise, (A ② x) Aij X.j is a product of a constant and a coordinate function, hence polynomial (degree < and thus real-analytic.
Proposition A.12 (Concatenation/stttking of real-analytic blocks). Let fe R - RPXX be real-an real-analytic for & E [L]. The horizontal concatenation operation Rmxx -> (ox defined as:
9(X)= (f(()) f2(X) fx(X)
is real-analytic. Likewise, fe mx + Roex9 are real-analytic, then the vertical stacking operation h. RRxx + R(PL+"+D2))* defined as:
h(X) = [x( fx(X) ... fL(X)
real- real-analytic.
Proof. Each sealar component of g (respectively h) is exactly one scalar component of some Se. hence real-anate -nalytia Therefore g and h are real-analytic by definition Definition A.2.
Proposition A.13 (Noncommutaaiiv matrix polynomials are real-analytic). Let n,p,q E N, let X E ga and fix coefficient matrices A E Rpx= and B E gaxg for k = O,..., Define
f(X) = Σ A ROx0,
0 In, X x
k=D
Then f is real analytic in the sense of Definition A.2.
Proof. The identity map X X is linear, hence degree-1 entrywise polynomial; by Proposi- tion A.9 it is real-analytic. Assume X + X is real-analytic. With f(X) = X and g gX) X. Proposition A.10 yields x f(X) (X) real-analytic; by induction, all powers X + X are real-analytic.
For each k left/right multiplication by fixed matrices preserves real-analyticity via Proposition A. 10: since the constant maps X + Aş and X BN are real-analytic (components constant polyno- mials), the composition X + A₁ X B& is anal-analytic. Finally, f a finite sum of real-tnalytic maps, hence real-analytic by closure under addition (apply Proposition A.1 componentwise).
24

---

Published as a conference paper at ICLR 2026
Remark 9. We highlight several standard constructions that yield real-analytic maps, omitting proofs for brevity:
Affine and bilinear maps. Functions of the form X + AXB C are real-analytic as they are obtained via matrix multiplication and addition of constant matrices (Proposition A. 10, Proposi- tion A.
Algebraic expressions in X. Any expression constructed from X using finitely many additions and matrix multiplications with fixed coefficient matrices, e.g. As A AAXBByXC, defines a real-and caalyanalytic map. This follows from repeated application of Proposition A.10 and closure under addition.
Scalar polynomial invariants. Coordinate functions Xaj. the trace tr tx(),, all principal and non- principal minors, and the determinant det(X) scalar polynomials in the entries of X, and hence real-anan call-analytic by Proposition A.9.
A.3 DIFFERENTIAL, HEASCRE-THIEORETEE AND TOPOLOGICAL TOOLS
This subsection collects the minimal calculus, measure, and topology will use later. In finite di- mensions, Fréchet derivatives let us speak uniformly about Jacobians and Hessians; basic Euclidean topology lets control neighborhoods and compactness; the inverse function theorem gives lo- cal invertibility; and pushrorwarddsabsslute continuity formalize how distributions transform under measurable maps.
Definition A.5 (Fréchet derivative (Luenberger, 1997, $7.2-$7.3)). Let C IR" open, and consider a function f i RR We say that f is Fréchet differentiable at x E U if there exists bounded linear map A IRm - Tk" such that
[[[x ((() Ahl 0.
lim
h2
[
The unique operator A denoted by Df(x) and called the (Fréchet) derivative of f at x. Definition A.6 (Second Fréchet derivative (Magnus & Neudecker, 2019, Ch. 18)). Let U C RT open, and consider a function f Fréchet derivative of f at x is the bounded bilinear map D fx ) Rh x RR + RR" defined as:
R Suppose f is Fréchet differentiable x. The second
DJ(x + (h) - DS(x)(k]
D2 (² k) == lim h
t
Proposition A.14 (Connection to the Hessian). If u - E is C², then f²f(x) is symmetric (Arora et al., 2021, Thm. 5.1) and can represented by the Hessian matrix 22 f²)(x)
f(xxx)(, lh,,k k] = h (V²f(x)) k, as noted Magnus & Neudecker 2019, Ch. 18.
Euclidean topology. The following standard definitions and facts about R. are used in the local- to-global measure argument Appendix C. Definition A.7 (Closure of set in IRP). Let C RP. The closure UI, denoted U, is the smallest closed subset of containing 2t
Definition A.8 (Fuclidean balls in IRP). Fix E N and equip TRP with the Euclidean norm || l|2-
For x E Rp and r we define:
B(x,r) = (y RP: Ily x||2 <r)
B(x,r) T.P [ly - x112551
In Rp with the Euclidean topology one has B(x,r) B(x,r), i.e. the closed ball equals the topological closure of the open ball.
Definition A.9 (Second-countable subspace of R2 (Munkres, 2000, $30)). Let X C RD be equipped with the subspace topology Tx : (un& X open in T.P). ). We say X is second-countable if there exists a countable family F C Tx such that every O E is a union of members of F. Equivalently, the countable family
Fe (B(x,)) n x Q E @
basis for TX--
25

---

Published as a conference paper at ICLR 2026
Proposition A.15 (Standard facts for IR"), Fix p N. The following hold:
1. Hausdorff (Aitken, 2020, Prop. 18): RP with its Euclidean metric Hausdorf..
2. Heine-Borel (Munkres, 2000, Thm. 27.3): A subset of TRP is compact iff it is closed and bounded: in particular, each closed Euclidean ball (xx, r) is compact.
3. Second countability (Munkres, 2000, $13 and Thm. 30.2) IR has a countable base (in- tervals with rational endpoints); hence IR,, being a finite product of second-countable Moreover, subspaces of
spaces, is countable.
spaces are second-
4. Lindelöf consequence(Muunres 2000, Thm. 30.3(a)): Every recond-countable space is Lindelöf; consequently, every open cover of any subspace of R² admits countable sub- cover.
5. Local compactness of (Munkress, 2000, Thm. 29.2): For any X E IRP and open neigh- borhood W 3 x, there exists E >> 0 with B(x,E) E) W.W. and B(x, E) is compact by Heine- Borel; hence T&P is locally compact. Furthermore, in a Huusdorff space, local compactness is equivalent to shrinking neighborhoods with compuct closures: for every neighborhood W 9 x there exists an open V with x E V V W and V compact.
Invertibility and measure transport. The inverse function theorem and the pushforward for- malism are the two tools that connect local diffeomorphism charts to global measure preuureeereeeeattoonn statements.
Definition A.10 (C* diffcomorphism Spivak 1971, Ch. 5). Let U, C Rp be open sets and let NU U {oo}. A map f : -V C diffeomorphism if:
f is bijective;
2. f is Ch (all partial derivatives up to order k. exist and are continuous):
3. the inverse map f-1 -> is Ck
When k we simply say diffeomorphism. Equivalently, C diffeomorphism is bijective C map whose inverse is also C*
Theorem A.2 (Inverse Function Theorem Rudin 1976, Thm. 9.24), Let U RD be open and f: 1 + R be C Suppose E l satisfies det Df # O. Then there exist open sets Uo l with a Uo and Vo C RP with (a) Vo such that
Ilu. U4 - Vo
a C-ddiffeomorphiss Moreover, the inverse 8 1-: Vo + Uo Ch and
(f(x))((()) (Df(x)) -1
Vx E Uo.
Remark 10. In Theorem A.2 we assume f u S R + RP, so the Jacobian Df(a) is a (square) matrix. this setting,
det Df(a) #0 = Df(a) is invertible,
and this is exactly the hypothesis that yields local C inverse.
Definition A.11 (Pushforward and absolute continuity (Folland, 1999, $3.2)), Consider a Borel- measurable map T IPP - I2? and let be Borel measure on IR. The pushforward measure T the Borel measure on Iº' defined by
T=p(U) = ( (U),
u E B(R).
If is another Borel measure IP, we say Tap is absolutely continuous with respect v, and write Tap < v. for every Borel set E B(RP):
v(U) = 0 - T4u = =0
In particular, for Lebesgue measure Lebp. to prove T &. Leb, for every μ &. Lebp. it suffices to verify that
(eb Leb, (T- ( 0 for all Borel U R..
26

---

Published as a conference paper at ICLR 2026
B TRANSFORMER LANGUAGE MODEL
This appendix section gives a concise, shape-accurate specification of the decoder-only Transformer analyze. We include it both to keep the paper self-contained and because the measure-zero argu- ments later hinge on architecture-deeeddent witnesses and exact dimension bookkceping. We begin with token and positional embeddings (Definition B.3), define self-attention and its causal variants (Definition B.5, Definition B.6, Definition B.7), assemble multi-head attention, layer normalization, and MLP into pre-LN residual block (Definition B.8, Definition B.9, Definition B.4, Defini- tion 111 stack L such blocks to obtain the model (Definition B.12), and conclude with the unem- bedding+softmax head (Definition B.10), isolating the last-token representation used in downstream proofs (Equation 29).
Input processing. The first stage of the model maps discrete token sequence into continuous matrix representation via learned embeddings.
Definition B.1 (Token Embedding Layer). Let V be vocabulary, and let d N be the embedding dimension. For any input sequence = (si, ST) E VSK, the Token Embedding Layer is the function defined as:
E(() = (E....... ".r...,,,,,, ERRxd
(14)
where E E V is trainable embedding matrix indexed by elements V, and Eg, E &R& denotes the embedding vector for token St.
Definition B.2 (Positional Embedding Layer). Let V be a vocabulary, and let E N be the em- This mapping is applied element-wise and is independent of the sequence length T.
bedding dimension. For uny input sequence = (.,,...,,77 ,8T) E VVS with T = [s), the (learned absolute) Positional Embedding Layer is the function defined as:
(15) where E RxKd is a trainable matrix indexed by positions E [K], and P; Rdd denotes the embedding vector for position i. This mapping depends only on positions (not on token identities) and returns the first rows P.
PE(s) = (PI...,,PT) E Rxxd
Definition B.3 (Embedding Layer). Let V be vocabulary, K E N a context bound, and d E N the embedding width. For any input sequence = (5) VSK with
[s], define the
embedding layer as the sum of the token and positional embeddings:
Emb(s) = E(s) + PE(s) = EE,, + P1, P...... E PT) E R
(16)
where E E RIVixd is the trainable token-embeddee matrix and P Rxdd is the trainable positional-embeddinn matrix.
Sub-layer modules. The Transformer block is built from four reusable sub-layers MLP, (causal) self-attention, multi-head attention, and layer normalization each defined next.
Definition B.4 (Multi-Layer Perceptron). A Multi-Layer Perceptron (MLP) with M layers is func- tion mlp _do RRdM, defined recursively as:
(1) w b()
(17)
h (m) = ((m) o (h((m-1) + (m), m 2
(18)
mlp (x) (M)
(19)
where x E do is the input, (W(m) E Rdmxxm-11 mm=1 and (b(m) E Rdm J are trainable
parameters and is an activation function.
Definition B.5 (Self-An Attentinnn) Self-Artention module a function Txd + Txx, defined as:
( ; Q.K. = softmax (XQ)(K))
XV,
(20)
Ja
where X E Tx is the input, Q K. V E Rdhux are trainable parameters (query, key, and value matrices), softmax is applied row-wise, dy is the attention dimension (typically d,, < diuh and T is the sequence length.
27

---

Published as a conference paper at ICLR 2026
TXT
Definition B.6 (Causal Self-Attentio,, masked form). Define the "causal mask " M E I
as:
0,
js i,
Mij -00,
j>
Then, Causal Self-Attention module is function Rxdu
Txdd defined
(XQ) (XK) M
ij(X; Q.KKV -softmax
+M XV,
(21)
Vān
where X E RTxxd is the input, Q K. V E Rduxdd are trainable parameters (query, key, and value matrices), softmax is applied row-wise, dr is the attention dimension (typically d, < diu). and T is the sequence length.
Definition B.7 (Causal Attentonnn,on, projection form). Define the unit lower-triangular matrix E R Lij 1iss) and consider the row normalization operation RN DT + R of
Proposition A.8. Then, Causal Self-Attention module is a function vj TR.xxd _ R defined
as:
7X;QQKKV = RN (L exp
(XQ) (XK) (X))
XV,
(22)
Vdn
Xxdin is the input, Q, V E RRdixdy trainable parameters (query, key, and value matrices), RN is applied row-wise, dy is the attention dimension (typically dn < din), and T is the sequence length.
where X
Remark 11. Consider Z = I (xQ) (XK) Siice Lus for all [T], we have that Vd,
Q exp Z] ?.n > O, hence the row sum Ejsi 2 e
Z., > and RN is well-defined.
Definition B.8 (Multi-Head Self-Attention). Multi-HHea Self-Attntion module with H heads is map from Definition B.5 or
a function attng TTxd - B xdous defined using the
Definition B.7 with different parameter sets per head:
na (X) : K()) V(M), he [M]
(23)
attn (X) [m (X),
NH (
(24)
where (Q(h), (h),, V(A) Rd.. 1== are the head-specific parameters and W E Hd,,
the output projection matrix.
Definition B.9 (Layer Normalization). Layer Normalization is a function LN Bd - Rdd defined as:
LN(x) = O x-1xxa +
(25)
V +E - and 2²
where x E Rdd is the input, Hxx variance of x, vectors B,Y E Rd are learnable parameters, and E E RR is a small constant that ensures we don't 't divide by zero.
Di (x; 2x) are the mean and
Definition B.10 (Unembedding Layer). Let V be a vocabulary and E N and E R be a trainable projection matrix. Define the unembedding map UnEmb IRd + RM by
UnEmb(h) softmax ULN(h)), h hegd
Full architecture assembly. With all sub-layers in place, assemble them into single pre-LN residual block, stack such blocks into the Transformer backbone, and append the unembedding head form the complete language model.
Definition B.11 (Transformer Block). A Transformer Block consists of composition of a Multi- Head Self-Atiention layer with H heads (Definition B.8) and MLP with M layers (Definition B.4 B,4), each preceded by layer normalization (Definition B.9) and wrapped with residual connections. Given input X E xxxd the output TB(X) E Txd computed as:
H = X attn X
(26)
TB(X) H m mlp
H
(27)
28

---

Published as a conference paper at ICLR 2026
where X,H RTxx are the results of applying layer normalization row-wise to X and H, respec- tively. each with its own set of learnable parameters and mlpM is applied row-wise. All sub-layer parameters are dimensioned appropriately.
Definition B.12 (Transformer). Fix E N. For each i E [L]. let TB R - RRxd denote a Transformer Block (Deftnition B.I1) with its own parameters. Define the module
Trr == TB o...o TB())
Each TB() maps RTxd + Rxx, so the residual additions in Definition B.11 are dimensionally valid at every depth.
Definition B.13 (Transformer Language Model). Let V denote a finite vocabulary and K E N fixed context length. A Transformer Language Model with L layers the composition of an embed- ding layer (Definition B.3), a Transformer with L blocks (Definition B.12), and an Unembedding Layer (Definition B.10).
Formally, it is a parameterized
I V.VE x RR - A
X
defined as follows. Without loss of generality, consider (0) E R O2 E R 03 (RP)) E IR,, which collects all the model parameters.
For an input sequence ,8) with T S K:
H(s; 0) = Embbss: 01)
(embedding)
(28)
r(s; 0) = [r H (s; 0) 02))
(last-token representation)
(29)
f(s 0) UnEmb r(s: 0): 0g)
(next-token prediction)
(30)
Then, the probability of the next-token being V: is given by: Pr ST+1 = V4 |s| = (f(s; O)), e [[V]].
(31)
Verification of real-analyticity. We close this section by showing that every module defined above is jointly real-analytic in its inputs and parameters. This is the technical property that lets the measure-zero arguments Appendix C go through. We first record the equivalence between the two causal-softmax formulations, then verify analyticity of the embedding layer and of each sub-layer and their compositions.
Proposition B.1 (Equivalence of masked and projection causal softmax). For any logits Z E RXT let M and be in Definitions B.6-B.7. Then, row-wise,
softmax (Z M) RN O Z).
Consequently, the two definitions of the Causal Self-Attention are identical.
Proof. Fix row i. By the mask:
Zhi
j jši. i
[softmax(Z+ +MM)
Eusse
j>i, i
interpreting via limit. On the other hand, it holds that:
L ② exp Z]a = 1igs e Z,.
Therefore, L O exp Z keeps exactly the entries with j < i. Then, for each row, row normalization divides the kept entries by the same positive sum Σ Etsi Zi and leaves the others at 0, yielding the same above. This holds for every row i, proving the identity.
29

---

Published as a conference paper at ICLR 2026
Proposition B.2 (Embedding layer is real-analytic in the parameters). Fix sequence ($1,..., ,ST) E VSK with T ss.. Consider the map
(E,P) - Emb(s) = E(s) + PF((s) E RTxd EERM PERKx,
Then this map is real-analytic V x RKxd (in the sense of Definition A.2).
Proof. Let Sg E (0, (0.1) select rows {s [m and RT {0, select the first T rows. Then
E(s) = S.E. PF(s) RrP, Emb(() S.E R.P.
Each map (E.P) + S.E. and (E.P) - P is matrix product of constant matrix with the variable (constant maps are real-analytic as degree-O polynomials by Proposition A.9; the product real-analytic by Proposition A.1 Their is real-analytic by closure under addition (Proposi- tion A. Hence (E, P) + Emb(s) is real-analytic
Proposition B.3 (Joint real-analy -nalytiityy of core modules and stacks), Assume the pointwise activation IR E used in the MLP is real-analytic (e.g., tanh, GELU). Fix T E [K]. For notational convenience define the parameter tuples
attnn == (1Q (1) K(h),
V WO).
LN = (7)))11)))
6 =
mll = (LW(m) , ((m)) I== ÔTB == (Oattn: f ( mmlp): On, = (0fB..... (L)
Then the following maps are are jointly real-analytic in their inputs and parameters:
MLP. (x, @mlp) + ml) is real-analytic: each affine layer (W, (,) Wx + b is a
matrix product plus addition (Proposition A.10 and Proposition A.I); the activation a is real- analytic by assumption, and composition preserves real-analytccity (Proposition A.2). Iteration over M layers is repeated composition (Proposition A.2).
2. Layer Normalization. (x, (,) + LN(x) =
x x-1x + B is real-analytic: Fx and of are 2
(entrywise) polynomials in x (Proposition A.9); g(x) = o + satisfies g(x) > 0 (definition of 6 > 0), and the scalar map h(t) = 11/2 is real-analytic on (0, oo) (classical binomial series). Thus o is real-analytic (Proposition A.2); division by g is a quotient by a nonvanishing real-analytic function functitoottiiion (Proposition A.1); Hadamard scaling by 7 and addition of [3 preserve real- analyticity (Proposition A. and Proposition A. Row-wise application is handled by stacking (Proposition A.1 and the vectorization equivalence (Lemma A.
3. Unembedding. (b, U. B) + softmax U LN(h)) is real-analytic: LN is real-analytic by (2); multiplication by U is real-analytic (Proposition A.))); softmax is real-analytic (Proposi- tion A.7); the overall map is a composition (Proposition A.2) and stacking across coordinates (Proposition A.1
Self-Attention (vanilla or causal) and Multi-Head. Let Z 1 (XQ) ( Vdn
(a) Vanilla SA: (X, Q,K, + softmax (Z)V is real-analytic by: matrix products (Propo- sition A. A.),), scaling, row-wise softmax (Proposition A.7 with stacking, Proposition A.12, and Lemma A.1), and final matrix product.
(b) Causal SA (projection form): With unit lower-triangular and using Definition B.7,
(X, Q,K, V) - (L O exp Z)
is real-analytic: cxp is real-analytic (Proposition A.5); Hadamard scaling by fixed L is real- analytic (Proposition A.11); 111;;bb by Remark 11, every row of L & exp(Z) sums to a strictly positive value (the diagonal term), so the argument lies in the domain Dr of Proposition A.8; hence RN is real-analytic there; the final multiplication by XV is caal-analytic (Proposition A.10).
Therefore, each single attention head is real-analytic whether it is vanilla or causal (projec- tion). For Multi-Head Self-Attention (Definition B.8), horizontal concatenation across heads is real-analytic (Proposition A.12), and the output projection by Wo is matrix product (P (Proposi- tion A.10). Hence (X, aattn) + attn; (X) real-analytic regardless of which attention variant each head uses.
30

---

Published as a conference paper at ICLR 2026
5. Transformer Block (fixed T). (X, (I)) + TB(X) E TRxx is real-analytic: apply LN row- wise to get X (item 2 with stacking, Proposition A.12, and Lemma ). apply attention (item 4) to X; add the residual (closure under addition, Proposition A.1); apply LN row-wise to get H (item 2 with stacking and Lemma A.1); apply the row-wise MLP (item I with stacking, Proposi- tion A.12); add the residual again (Proposition A.I). All intermediate matrix multiplications use Proposition A. 10, and the overall structure composition (Proposition A.3 via Lemma A.
Transformer (fixed T). (X. θT,T)) + T X) TB ..... TB()) (X) is composition of real-analytic maps from (5), hence real-analytic by Proposition A.3.
All statements extend from vector-valued to matrix-valued, row-wise applications via Proposi- tion A.12 and Lemma A.I, and every cumpproductquooeenccoooooo step above invokes Propo- sition A.I, Proposition A010, and Proposition A.3 as indicated.
31

---

Published as a conference paper at ICLR 2026
C ALMOST SURE INJECTIVITY
This section establishes a foundational structural result: for causal Transformer Language Models with standard architectural widths and least one attention head per block, the final hidden state at the last token is almost surely injective with respect to the input sequence, assuming the model parameters are drawn from any absolutely continuous distribution initialization. Crucially, we show this injectivity is preserved after any finite number of gradient descent (GD) updates.
We organize the section two parts; (i) Measure-7ero collisions via real-analyticity and a witness construction and (ii) Preservation of absolute continuity under gradient descent. Each piece builds toward the main theorem, which asserts that under mild width and head assumptions, the Trans- former map from input sequences to last-token representations is injective almost surely, even after multiple rounds of training. The main theorem follows.
Assumption C.1 (Minimum Embedding Dimension). We assume the embedding dimension satisfies d 2 4 and d 2 1. Furthermore, we assume that each transformer block has least one attention head. These conditions are trivially satisfied in practice: for modern large language models, embed- ding dimensions are typically in the hundreds thousands, and each layer has multiple atlention heads, so the assumptions impose no practical restrictions on the models under consideration.
Theorem C.1 (Finite-horizon a.s. injectivity under GD). Fix a finite vocabulary V, a context bound K E N. time horizon T E N, and consider the causal Transformer Language Model (TLM) of Definition B.13 under Assumption C.I. Let { {(s E VSk ,Pt E =) be any sequence of samples and let {n (0,1))T= be any sequence of step-sizes. Assume the parameters randomly initialized and updated by gradient descent:
0n ~ po
1r & Lebp:
Oc+1 O. T/. V L... (0t),
where Leb, denotes Lebesgue measure on IRP and La.p IRP + E is the standard cross-entropy loss
(.) = CrossEntropy (f(s: 0). p)-
Then, with probability one over the draw of to. the last-token, last-layer representation map is injective. Equivalently,
VSk 38 r(s; 0r) E RRd
Priss rr(s 0r) r(t; 0r)] O, where r(;; OT) denotes the last-token representation defined Equation (29).
Proof.
Let On ~ n with & Leby. For a fixed training horizon T, define the GD update map
RP
RP,
((0)) = Or,
i.c. & is the composition of T gradient-descent steps with step sizes (n (mo C. (0, 1) on the loss C.
1) Absolute continuity after 7' steps. By Corollary C.5.1, since μ Leb,, the pushforward law
d # μ of Or remains absolutely continuous:
0r 4up < Leby.
2) Global almost-sure distinctness. Let S VSK which is finite. By Corollary C.2.1, under any absolutely continuous parameter law.
Pr r(s: θr) + r(t: θr) Vs te VSK) = 1.
Thus the map r(s; 0r) is injective almost surely, claimed.
32

---

that the network acts as Published as a conference paper at ICLR 2026
C.I ABSOLUTE CONTINUITY ENSURES ALMOST SURE INJECTIVITY
We begin by fixing two distinct sequences and asking when their last-token representations can coincide. As before, in this subsection we will consider finite vocabulary y and finite context window K E N. Additionally, recall that for = (02, 02,,02,00 02) E RP:
r(u; 0) = [Trjul (Emb(u: 01): 02) ER.
and for 8 + t, we define the discrepancy:
h(0) == r(s; ; 0) r(t; 0)112-
By Proposition B.3, this map is real-analytic. To invoke the zero-set theorem, it suffices to show that h o O. We construct a parameter configuration 0, such that r(s; 0.) o r(t; 0.), treating two exhaustive cases:
Case A: If the sequences differ their final token in length, isolate this distinction via selective initialization of embeddings and positional encodings.
Case B: If they differ earlier, we construct orthogonal embeddings and exploit attention heads to differentiate the contributions the final representation.
In both cases, we demonstrate explicit parameter settings under which the discrepancy is nonzero. This confirms h * 0, and the zero set {0 r(s; 0) r(t; 0)} has measure zero by Theorem A.1. Hence, if the parameter distribution is absolutely continuous, the probability of collision is zero union bound extends this to any finite set of inputs.
Theorem C.2 (Almost-sure pairwise distinctness of last-token representations). Let the parameter vector TRP be drawn from any distribution absolutely continuous with respect to Lebesgue measure. Then, for any fixed #
Pr [r[s; 0) = r(t; 0)] = 0.
Proof. Let T, [s] and T. = [t], and h(0)= = [| -)-r(t;; 0 Since h is real-analytic (Proposition B.3), it suffices to show that it is not the zero function on IR; then h h=0())) has Lebesgue measure zero by Theorem A. and absolute continuity transfers this to probability zero
We construct a parameter setting 0, for which h(0)) > 0, treating two exhaustive cases:
Case A: T, * T₁ ST, Ur. Set all Transformer parameters the identity: (X) X.
ST. # tr. set E ei, Et,, e2 + e1, and all other rows of E to zero. Set P 0K Then r(s; 0.) = e,, r(; 0.) = e2, so h(O,) = |le - -2 0.
If T. * Tú, set E = 0v xd and Pr, = e1, Pr. = e2 + el (all others zero). Then, again, r(s; 0.) C1, r(t: 0.) C22 so h(0))
Case B: T = Tg = Ti and ST tr, but s; # for some i [T 1]. Let it be the smallest such index. Note T 2.
We construct model with (i) all blocks after the first set to identity (zero parameters), (ii) in the first block, all heads set to zero except head 1 and the MLP is zero
We explicitly construct embeddings and head- 1 parameters (Q, K, V), as well the output projec- tion WO so that r(s; 0.) # r(t: 0.).
1) Embedding Construction. Choose orthogonal vectors e, p, q Rd satisfying:
(e. = (e, q) = (p. q) O, (1,,e) = (1d, p) (1a, q) = 0, ||e||2 = ||l|z = || = 1.
Such vectors exist due to Assumption C.I (requires d 2 4). Set embeddings:
p. i=
cc u (sr,sr)
E,
P
q j=T
0a: otherwise
0a otherwise
33

---

Published as a conference paper at ICLR 2026
Thus, the input rows before LayerNorm are:
c P. e q, E Od),
j ==
P.
j=
Hi: 0.)
j j=T otherwise
H(t: 0.1], = e q. E Oz}.
j=T otherwise
2) LayerNorm Output. Use LayerNorm with (7, (1, Since all components have zero mean, the normalization is:
LN(x)
x
=: =(xxxxx
/x +E
Define:
Cep = (2 +) -122 -
Ce ce:= (2 +5) ())
Then:
Cep(C p),
j=
ceP: Caple q). Coc,
j= 1" j=T
H(s; 0.)1,
Caple + q), E (0d, c.e),
j=T T otherwise
H(t: Mt::o.],
otherwise
3) Head Parameters. Let e₁ E Rd be the first standard basis vector. Set:
Q aee T
K = Spee.
V= = ee T
where a, B >>0 0 are scalars to be chosen.
Then for any j. attention vectors are:
qi - -a ([I 0.1 e el, k; kj= k ([HC::0)) P p)er, v, = ([AC 0.)), e e)er.
))e1
At row T, 94 = acope1. Only the key at it is nonzero:
(3) (1)
k, BCepe1,
k Bc.01-
Value vectors at it differ:
v Cepe1
(!!) 0g-
And C1
4) Attention Weights. The only nonzero score is at it:
ag ddn
S = aB
S Ts3
2
CepCe:
$ = 0 for j + i*
v dd
Fix 8 (0, ) and define L log (5- (T - 1)).
Set o3
VT. so S/
I. and
(()) L. Then:
8
T. 21 21-5, 6, T.3' > - 8,
A <
for j i
T
5) Self-Attention Output.
yr = - 5)cppr + EA
10 = Σ - A
VJ
yT
Tails are bounded by:
Σ
A
$ óc..
2
34

---

Published as a conference paper at ICLR 2026
Since both outputs lie in span(er), we compare:
ei) 2 (1 (1-d)cep - 28c
Choosing
Gep 2ng
makes this strictly positive.
and all other entries zero. Then the head output is projected into coordinate 1, making the last row of the first transformer block differ between s and the first coordinate. Since the original rows at T were identical and the rest of the network is identity, this difference propagates to the final output, and we get r(s: 0.) F r(t; 0.).
6) Output Projection and Propagation. Let W be the matrix with (W"),,
Remark 12 (Causal Self-Attention). The same construction works for causal self-attention. In our setup, attention at position ' only needs to consider tokens at positions j S. T, and we only rely on attention from to i" < T. All nonzero scores occur at these allowable indices, so causal masking does not affect the computation or the argument.
Corollary C.2.1 (Almost-sure global distinctness over finite input family). Let S S VSK be any finite collection of imputs. If 0 is drawn from a law absolutely continuous w.rl. Lebp, then
Pr [(s; 0) # r(t: 0) for all distinct 8, 8, E. =
In particular, the last-token representations are pairwise distinct almost surely across all inputs.
Proof. For each unordered pair (s, t) C S with s * 1, Theorem C.2 gives Pr[r(ss; 0) = r(t: 0)) = 0. By the union bound over the finitely many pairs ((15 in total),
Pr 3s + te S: r(s 0) r(t: 0)
Pr r(s; 0) r(t; 0) 0.
8,1
Hence the complement event has probability 1.
Remark 13 (Pointwise vs. last-token injectivity). Sutter et al. (2025) establish a related but distinct guarantee. They analyze the mapping from prompt to the entire sequence (matrix) of hidden states, which already rules out collisions for inputs of different lengths. Their result is pointwise injectivity: if two prompts differ position I, then the 1-th hidden state (row) differs. This does not, by itself, imply injectivity of the map to the final hidden state / last-token embedding that we study, so two different prompts could still coincide at the last token-our quantity of operational interest.
C.2 ABSOLUTE CONTINUITY OF THE PARAMETER DISTRIBUTION PRESERVED UNDER GD
Our goal in this subsection is to explain why absolute continuity of the parameter law initialization survives any finite number of gradient-descent (GD) steps, thereby allowing the almost-sure injec- tivity argument from the previous subsection to persist throughout training. The argument proceeds in four steps.
Step 1: Regularity of the GD map. By Propositions A.6 and B.3, the loss Cs.p real-analytic, and anlyyiityy is closed under differentiation and composition. Consequently the GD map (()) = 7/ Ca.p (0) is real-analytic, its Jacobian DΦ(0) = I, L real-analytic, and so is 0 + det Do) (the determinant is a polynomial in the matrix entries).
Step 2: Witness and measure-zero critical set. We rule out the degenerate case by a witness: at 0, Op. our Hessian calculation (Lemma C.4) shows det Do(0.) 0, hence det Dó is not identically zero and its zero set C == {det Dø = 0} has Lebesgue measure zero by the analyina zero-set theorem (Theorem A.1; summarized in Theorem C.3).
35

---

Published as a conference paper at ICLR 2026
Step 3: Local-to-global via countable chart covers. On the complement R \ C, the Inverse Function Theorem (Theorem A.2) provides, for every 6, a neighborhood on which & is a C' dif- feomorphism. Although these neighborhoods form priori uncountable cover, the second count- ability of IR" (and of its subspaces) ensures a countable subcover of such charts (Proposition A. A.15, global Lemma C.5). This countability is crucial because lets pass from local statements formula measure statement via countable unions. With this cover in hand, the change-of-variable on each chart (Theorem C.4) implies that the image under the local inverse of any null remains null; piecing the charts together and adding the null set C shows that preimages of Lebesgue-null sets under @ are null (Lemma C.6).
Step 4: Preservation of absolute continuity and conclusion. Equivalently, & pushes absolutely continuous laws to absolutely continuous laws (Theorem C.5); iterating across finitely many GD steps preserves absolute continuity (Corollary C.5.1). Finally, combining this preservation with the almost-sure pairwise distinctness of last-token representations over any finite input family (Corol- lary C.2.1) yields the main consequence need for training: the last-token representation map remains injective almost surely after any finite GD horizon.
C.2.1 WITNESS CONSTRUCTION
The goal of this subsubsection is show that the GD Jacobian determinant is not identically zero by evaluating it at the all-zeros witness 0, Op- The argument proceeds bottom-up: we first establish "zero-gate" lemma that zeroes out most Hessian blocks when the gate matrix vanishes (Lemma C.I), derive the resulting spectrum (Lemma C.2, Lemma C.3), and then assemble these into the full Hessian at the witness (Lemma C.4).
Lemma C.1 (Zero-gate through scalar loss). Letll CRm+ be open and write points = (E. with & E Ihm and ap E R2, Let π IR=+y - Ih. be the projection T=E, (b) = &. Consider
g C2
C (R"; Rnxx),
HE Ce RR),
and define f :44 + RR by
[( 1b) = (()))(())E). ME, w) = (( ub) li(E, 4p).
Let (RRR" R) and set
: fo 4 RR R(E. +b) C(g(E) h(E,
Fix Vo = (Eo. bbo E u and assume g(Eo) = Onxr- Then the Hessian of R at vo has block form
VEe R(vo) V2 R(vo)
V R(vo)
2e R(vo)
0mxq
Vap R(vo)
0 0pmm
0 0axy
i.e. all mixed and ab on-only second partials vanish.
Proof.
1) Introduce the bilinear multiplication map Raxr x R - R"" p(M,y) = My, and the C2 map -4 - Raxr RR,, H (E, 2b) = (g(E), MEE, +)). Then f= l a H and we write:
9o = g(En) Onxr
ho = h(En, vb
H(vo) = (go, An)
Because y is bilinear, D Ay)] = AMy M Ay. By the chain rule:
(h( hb)] Du(go, ho) (e(())(be), Dh(vo)((he h
DDg(Eo)(be)) ho + go. Dh(ya)(((h,))) hx)]
Dg(Lo)(be)/ig
In particular, (v( [(.m. - -)] O,, The second-order chain rule for Fréchet derivatives (e.g.
Magnus & Neudecker 2019, Thm. 18.4) yields:
D2 j(vo))(h, k] D) [DH [H() ()(H)(vo)) (D
36

---

Published as a conference paper at ICLR 2026
Because i is bilinear, D2 0 and the first term is O. Furthermore.
(2H(vo) D2 u(Eo) kel, D2h(vo)[ ha), (ke, kw ):
and it holds that:
D2 kj Du(go: ho) D' kel, D'h((vo hn)) (ke koo (En kel) ho + go
(PPh(vo) hep) (ke, kpp)]
Onxr
(D* g kEl) ho-
If at least one of the two directions has component zero, then (ig(EE)(lhe kg] = 0. so the bilinear form vanishes.
2) Apply the second-order chain rule to R L f at Vo:
Dd R(vo)) kj = (fv())t) Df(vo)(ki]
(+)
By (1), if at least one of the two directions is pure ub, both terms on the right-hand side of vanish. Therefore
R² h, k] = whenever at least one of h, k is of the form (0m. ))
Invoking Proposition A. this is exactly the statement that the &xb &f and v/rb Hessian blocks are The remaining block Ve ((v)) whatever is induced by (+) for pairs
(h, k) ((hg. 0g), (kg, 02)).
Lemma C.2 (Spectrum under block-diagonal extension). Let f E (T IR), and fix v (Co, vh IR myy, Assume the Hessian of f at v has the block form
B
0mxq
H H V=]V)
BE mmmm
0pxm
0
0ax9
Then the characteristic polynomial factorizes as
XH(A)= == det (AIm+a - H) = det (AIm - B) X².
Consequently,
(H) = U (0), and multH( mult (0) + g.
i.e., the spectrum H consists of the eigenvalues of B together with q additional zeros, and the algebraic multiplicity of the eigenvalue for H equals that for B plus
Proof. Since is block diagonal,
AIn
B
O
Omxq
XIm+y H
0pxm
AI,
The determinant of block triangular (in particular block diagonal) matrix equals the product of the determinants of its diagonal blocks (e.g. Horn & Johnson 2013, Cor. 0.8.5). Hence
(A) = det(AL AI -B) B) dde((A,)) det(XI, - -
The zeros of XH are the eigenvalues of H counted with algebraic multiplicity, which yields o (H)) (B) U {0} and mult (0) multz +
Remark 14. If O E o (B), then 0 appears (H) with multiplicity strictly larger than q: the statement above accounts for this by adding q to the algebraic multiplicity of carried over from B.
37

---

Published as a conference paper at ICLR 2026
Lemma C.3 (Hessian of L w.r.t U. at 0. and its spectrum). Let | and d be the embedding width. Fix (s. E VSR x An-1 and consider the Transformer Language Model of Definition B.13. In the unembedding layer. the LayerNorm scale to zero, 7 O Let the parameter be ordered as
0 = (u.3,7,0))
u: vec (U) E Rndd BERE.
Restrict attention to the (u, cooordiaass and the base point
0. 0p i.e.
U = 0nxd: B = Od, Od, 0' = 0.
Write := 1,,, and b p E R
Then the Hessian of the cross-entropy loss
( = CrossEntropy (f(s: 0), p)
with respect to (u. 3) at 0, is the symmetric block matrix
Ondxad
La 2 w
V ((,))
Oaxd
The spectrum of this Hessian is spec( ((O.)) =
||| .w........
|w|l2 O....,0}. 0. 1(n-1) 1)
Proof.
1) Logits in vectorized form. With y Os, the LayerNorm output at the unembedding is constant: LN(h) 3 (Definition B.9). Thus the logits before the final softmax
Z U E R
Using vec( vec(AXb) (bT @ A) vec(X (standard identity for vectorization, ef. Henderson & Searle (1981)), with = I, and b = B,
z = vec(Z) = vec( (BT 2 I, u.
Therefore, near (u, 3) (Ond, Oa), the logits map the bilinear function
2 <u, = (3 2 I,) u.
2) First and second differentials. Let (h, m7) and (k, { be directions in Rnd x Rd. Differentiating =(u, 3) (33 < I, J gives
Dz(u, B) n) = (BT s I,)h + (17 I,)uu
At (u, 33 (Ond, Oz).
Dz(Ond, 0a) 17) (nx(nd+2)
(since both terms are multiplied by (3). Differentiating once more (or, equivalently, using bilinearity of 2) yields the constant symmetric bilinear form
Dd (0nd 0..) (h, m), (k, {)] = (E @ h. (n ② I,,) k.
3) Gradient of the CE-in-softmax at the origin. Let F(z) (ross/atrrpy(ooftuxxx()) p). A standard computation (softmax Jacobian) gives
V (z) softmax(z) - pp.
At O₂ softmax (0..) 11, b, hence
((D.).)) b
38

---

Published as a conference paper at ICLR 2026
4) Second-order chain rule for F o Z at (0.0). Similarly to the proof of Lemma C.I, the second differential of a composition is
(F o (v) kj D F ( Dz(v)k] (D At (Ond. Oa). D2(v) (nd(nd+d) and (F((2v)) = (O,) =wT.s
D' (h,, (k, - =:: = (b. 7), (k,
= =WT(EE @ 1, + (m @ L,)k)
k (L, w) n
where we used the mixed-produce rule for Kronecker products and the identity
w (5 @ I. = @ w
Identification of the Hessian blocks. By definition of the Hessian as a bilinear form,
D [(v) 4)]
hh -n_
n7)
0 Ondxnd GPC 838u
8f dnd3
k
Oaxa
E
Comparing with the expression obtained in Step 4 for arbitrary (h, n) and (k, E) forces
S C ōu (0.) Ia & w,
0 (0.)
(Ia w) La T
a du
and, because Dz(v)= = 0 (xddd+d) (so no quadratic term survives in either u or f alone),
+L L
(0.) Ondxnd:
0303 (0.) 0 Odxd-
Eu Ōu This gives exactly the claimed block matrix. 6) Spectrum. Let
Ondxnd
La & w Oaxd
H = 2 (u.3) ((0,)
La 8 T
Then
(L
Ondxd
La & (ww
Ondxd
H
w)
Odxnd
IL
(La
Odxnd
La X (w w)
The eigenvalues of ww are ||w]|2 (multiplicity 1) and 0 (multiplicity n 1); the eigenvalues of w w equal || (scalar). Therefore the eigenvalues of H are
w 12
1| 0,...,
2d times
Because H is symmetric, its eigenvalues are the real square-roots of those of H namely =||w/] ||2 (each with multiplicity d) and (with multiplicity d(n 1)). This exactly the stated in the lemma.
= |V] and be the Lemma C.4 (Full Hessian the witness: block form and spectrum). embedding width. Write the parameter
((,,3) (3, (7, ("),
= vecn, (U) Rnd B,7 E Rdd, 0' eRe
so p nd 2d + p'. Consider the witness point
0, 0p
(U = Onxds 3 02, 7 = 02,, = 0z).
Let = 1n, and w == b E R". Then the Hessian of the cross-entropy loss L(0) at 0, admits the block-diagonal decomposition
B
Ondxnd
I @ Oaxd
V²C(0.) =
B =
0 0
Ia ②
T
Consequently,
spec ( L(0.)) +|| w/l2,,... .,.... [wwl w/ wl|2g,..., |/|l2, 0
2d
39

---

Published as a conference paper at ICLR 2026
Proof. Set Og. Then the unembedding LayerNorm output is constant, LN(h) B, the logits equal 2 = U.3. Hence, a neighborhood 0., the loss depends only on (u, ()) and is independent of (y,0'),
We will apply Lemma C.1 with the open 4 1nnd+2+tr coordinates &
(u, () and ab
(7, 0*) and with n [V. r = d. Define
g = natt, E Raxd
h(g, 2b) :- 3 ERR
so that
f(E, 2/) == g(E) h(E, 2b) = UB E E
and, with C(z) == CrossEntropy (softmaxz))t
RIE, 1b) = C(((s +b) = CrossEntropy (softmax (softttaa (00tmaax(U33)0000 UB).p).
At the witness Vo (Eo, 26) we have g(En) Onxds so by Lemma C.I all mixed and ab-only second partials of R vanish at Vo. i.e.
V2 (u, (
0)
R² =
Identifying R(E, v)) C()) under the correspondence above yields
V ((),) ((O.)
0 )
V²C(0))
Combining, Lemmas C.2 and C.3, we get that
spec (V2C((.)) = spec V ((O.) U {0)4tr'
={ || ll (each mult. d), (mult. d(n - ddp)}
Since p- 2d p/, the multiplicity of 0 equals p 2d, which yields the claimed spectrum.
Theorem C.3 (GD Jacobian is nondegenerate a.e.). Fix finite vocabulary V, context bound
K. and the Transformer language model f of Definition B.13. For any sample (s. VSK A VI-1 and any learning rate n (0, let Φ IRP IRP be the gyadient-descen update,
defined as:
( 0 1j VoLs.p(0).
where Ce.p: : TRP - the standard Cross Entropy loss:
Cx.p ( = CrossEntropy (J(s; 0).
Then the critical set
C = {0 E IR: det De(0) = 0}
has Lebesgue measure zero in TRP.
Proof. By Propositions A.6 and B.3 and the closure properties of real analyticity, Ls.p is real- analytic: hence so are its gradient and Hessian. Therefore & is real-analytic (Lewis, 2014, Thm. 1.1.15) and
DØ(0)= = I, (. Since the determinant is a polynomial in the entries, 0 + det (o( is real-analytic.
not identically zero: at the witness O, Op. Lemma C.4 gives spec L(O)) = [||/w|/,,
[wwl2 - mlll.,................. w ||2, O,
41 -
p-
Hence the eigenvalues of Do(O.) = I, 11 V2C(O.) are
1-7/|w|le
+ m/ ///wlll
dtimms
d times
2et times
so
[|]l)) det ()(0.) ) = (1 17 [| 2) 0. Thus det Do is a nontrivial real-analytic function. By Theorem A.1, its zero set has Lebesgue measure 0.
40

---

Published as a conference paper at ICLR 2026
C.2.2 GRADIENT DESCENT PRESERVES ABSOLUTE CONTINUITY
With the witness in hand and the critical set shown be measure-zero (Theorem C.3), we now carry out Steps 3-4 of the roadmap: cover the non-critical region by countably many diffeomorphic formula show preimages of null remain null (Lemma C.6), and conclude that one GD step preserves absolute continuity (Theorem C.5), Iterating yields the finite-horizon corollary (Corollary C.5.1).
charts (Lemma C.5), use the sauuge-of-varialte
Lemma C.S (Countable chart cover of IPP \ C). Consider the selup Theorem C.5. In particular, let Rp + R2 be the one-step GD map from that theorem:
( = 0 - VoL..p(0),
(32)
with stepsize 17 (0, and the measure-zen zero critical-set (Theorem C.3):
C (0 TRP det Dx)(0) =0}-
Then there exist open sets (Ux)221 covering X == Rp \ C such that, for each k, the restriction Φx Φlue Uu + Vv p(U)) is a C diffeomorphism with C inverse the 0x 1-1
Proof.
1) X open: By Propositions A.6 and B.3 and the closure rules of real-analyticity. C..p is C², hence & is C. The map 0 + DØ(0) () is continuous, and the determinant is continuous polynomial in the entries, so g(0) == det ()( is continuous. Therefore C =9- ({0}) is closed (Rudin, 1976, Thm. 4.8) and X R2 \ open.
2) Local diffeomorphisms by the Inverse Function Theorem: Fix 0 E X. Then g(0) j 0. so by the Inverse Function Theorem (Theorem A.2) there exist open neighborhoods Ul and
Ve s()) such that
Φ == @lua U2 + Ve is a C diffeomorphism with C inverse the 05 Moreover, Dee( (Do(x))
VXEUg Ug.
In particular Do(x) is invertible for all x E Uo. whence Uo C X. Thus Too) is an open cover of X by charts.
3) Select a countable subcover: By Proposition A.15(3), IRP is second-countable; subspaces of second-countable spaces are second-countable, hence X' second-countable. By Proposi- tion A.14, every open cover of second-countable space admits countable subcover. Therefore there exist points 0,, O2.... X such that X = U Us.
Set U == Uo.. V4 = VeL and Φb olu, deg. thx v'o Each Φ& C¹ diffeomorphism with C' inverse t/ by Step 2. This yields the desired countable chart cover of X.
Theorem C.4 (Change of Variables Folland 1999, Thm. 2.47(b)). Let u. S IRP be open and wi: - C diffeomorphism. I V Lebesgue measarable, then
Leb (1b(E) = = -fo |det Dub(y)
Lemma C.6 (Pre-images of null sets are null). Consider the setup of Theorem C.5, in particular the C gradient descent map:
(0)) 0 (oL.,
1j (0,1),
and its critical set = (0 E RRP det DØ(0) = 0}. Then, for every measurable A C RP,
(A) = 0 =
=0 0.
Proof. Let X IRP and decompose the pre-image:
(AA) (0- nc) (A)
41

---

Published as a conference paper at ICLR 2026
The first set is contained in C, measure set (Theorem C.3), hence has Leb, measure 0. By Lemma C.5, cover X by countably many charts {U4x which Φx Ulu, is C diffeomorphism onto V = ((lxx) with inverse 4 E CV2 x) Then, holds that:
o (A) u v/u (An Vn).
Since (A) and both A and V measurable, By Theorem C.4 applied to dxx with An Anvk.
is measurable and has measure O.
/ Anv. det Div (y) dy =
Leb, (1x VK))
Therefore, each (-) is null and because countable union of null sets is null, it holds that:
Lebp ( O.
Theorem C.5 (Preservation of absolute continuity under GD step). Consider the setup The- orem C.3. In particular, let Φ : IR" - R2 be the one-step GD map from that theorem:
- (
(33)
with stepsize E (0, 1). Then, gradient-descen preserves absolute continuity: for every absolutely continuous probability law u on RP, its image under ó remains absolutely continuous:
Lebp-
Therefore, the updated parameters 0' = (0)) are absolutely continuous.
Proof. By Proposition B.3 and closure properties, Ce.p is C², hence E C and is Borel- measurable. From Theorem C.3 the critical set
C {0 RP det De(()) 0}
has Leb, measure 0. Therefore, the hypothesis of Lemma C.6 holds, and we have the property:
Leb, = 0 =
Lo = 0 for every measurable A C R..
Let A be any Borel set with (A) 0. Then
(*1(A) = (( = 0,
because 1 < Lebp and (ebp(o- 0 by (t). Since this holds for every Lebl-null set A, conclude @411 < Teb,
Corollary C.5.1 (Preservation of absolute continuity under finitely many GD steps). Fix a finite vocabulary V, context bound K N, and the Transformer language model I of Definition B.13, For 1,.... T, (8,, Pt) VSK x A -1 and T) E (0, 1), and define the 1-th GD update
(0) 0 VeLe.pp (0),
Ce.pp (0) CrossEntropy (f 0).P:)
Let the T-step update map be the composition
+
Φt o...oo 01 : Rp + R?.
Then, for every absolutely continuous probability law μ RP, its image under & remains absolutely continuous:
$# < Tebg-
Equivalently, if (0) with < Leb, and
(t-11) or (0(t)),
t=0,..,
then the T-step parameters (TT) $ (0(10) are absolutely continuous.
Proof. Since the result of Lemma C.6 holds for each Φi, for any null set A, repeated preimages remain null:
o.. og)) 0.
The same argument as in the proof of Theorem C.5 then yields the claim.
42

---

Published as a conference paper at ICLR 2026
D LEFT-INVERTIBILITT VIA SIPIT
Goal. We study when and how the hidden states causal decoder-only Transformer admit a left inverse: given the layer-& representation at position and the true prefix $1:t-1, recover the next token 8,?
Main idea. Under mild randomness in the parameters and causal masking, the one-step last-token map that sends candidate token u to the layer- representation at position (conditioning on x) is almost-surely injective, and in fact has positive separation margin. This yields a simple verifier: declare correct iff the observed hidden state lies in small ball around F F(e; xt, t).
Algorithmic consequence. Because causality localizes the dependence to (m, we can invert an entire sequence sequentially with single pass over the vocabulary per position. We call this procedure SIPIT (Sequential Inverse Prompt via l'Terative updates), and we show exact (and robust) recovery holds almost surely, with worst-case time (1))
Standing conventions for this section. Fix layer index & E [L]. For any input sequence s ($....., ,T) define the layer outputs row-wise by
(0) (s) == Emb(s),
TD (s) == TB H (s)) E Txd
and write (s) to denote the row of (0) (s) at position t. Furthermore, we use i for sequence concatenation: if ($1, .s 8t-1)
and v E V. then
St_
The parameters O and target layer are considered fixed and omitted for simplicity.
Assumption D.1 (Causal self- atffnittentinn throughout). Every attention layer in every block is causal in the sense of Definitions B.6 and B.7. Consequently, for any s and any [T].
(s) depends only on the prefix (s.....,8s))
(34)
Assumption D.2 (Injectivity Assumption). SIPIT applied to models initialized with parameters drawn from an absolutely continuous distribution and trained via (mini-batch) gradient descent with step sizes in (0, 1), as described in Appendix Under these conditions, any network considered in the sequel is almost-sures injective (Theorem C.I).
D.1 ONE-STEP LAST-TOKEN MAPS
We first isolate the positionwise map that drives inversion. Fix a position and prefix ग E D The one-step map F-: ., t) sends candidate token the layer-& hidden state at position t obtained when the prefix is π and the token at is v. Causality implies that h, depends only on (T,, v) (not on any future tokens), and show that, for almost all parameter settings, F is injective with strictly positive pairwise margin over V.
Definition D.1 (One-step map at time under prefix T). Let w E y be a fixed prefix (possibly t= 1, when is empty). Define
F-V-R.
(lU == ()
Remark 15. F is simply a function that returns the hidden output of token u at the transformer block given that n is used fixed prefix. This map allows to have convenient notation for introducing results about inversion. Furthermore, since F is built using transformer blocks, is parameterized by O. Nevertheless, for the sake of simplicity, will refer Fi, simply as F.
Once the One-step map (Definition D.1) is introduced, one can present its a.s. injectivity through an application of the previously obtained result (Theorem C.I). Furthermore, one can deploy the common prefix to introduce a stronger notion of injectivity: margin separation (Lemma D.I).
Theorem D.1 (A.s. one-step injectivity). Fix t and the prefix æ E Dt-11, Under Assumptions D.1 and D.2, it holds that:
Pr e F(u; n,t) = F(u': n,t)] =
Equivalently, F is injective almost-surely.
43

---

Published as a conference paper at ICLR 2026
Proof. Set the finite family St ( v v EEV) C Vi and view h,(s) as the last-token representation of the truncated Transformer consisting of the first & blocks. All assumptions used in Corollary C.2.1 remain valid for this truncated model. Applying the corollary with S S yields, almost-surely, hy ( e v) * he( @ v') whenever u # v'. This is exactly the injectivity of F. 17
Lemma D.1 (Strict separation margin a.s.). Under the conditions of Thhoremm D.I, define the (data- dependent) margin
A. = min F(1; x(t F(v': ;
VV
Then,
Pr|An, > 0.
Proof. By Theorem D.I, with probability the set
(F(u:m,t):00
consists of | distinct points in Rd. On this event of full probability, every pairwise distance among these finitely many points strictly positive, so their minimum strictly positive well.
Thus, the event (Ax., > 0} coincides with the event that F is injective on V. Since injectivity holds almost-surely by assumption, we conclude that Pr[An,e
D.2 THE CORE ROUTINES; LOCAL VERIFIERS, ACCEPTANCE REGIONS, AND POLICIES
Given F(;; t). inversion reduces to local hypothesis test: for observed he which token's predicted representation closest? We formalize this with acceptance regions-closed balls around F(u; π, l)-and a verifier that accepts iff hū lies in its ball. Almost-sure injectivity yields unique- ness at radius and a positive margin yields uniqueness for any & < A,,1/2 To explore candidates efficiently, we couple the verifier with any policy that enumerates untried tokens (c.g.. uniform with- out replacement or a gradient- guided ranking).
Definition D.2 (Local verifier and acceptance tolerance). Given a tolerance 2 0, define the ac- ceptance region for symbol e as the closed ball (Definition A.8):
An,(0;;) = B(F(u: n,t),
A candidate token V is verified for observation by if and only if by Ar;(U;;).
Remark 16 (Decoding via acceptance regions). Given a prefix a Vt-1 and the observation he at position t, we identify the next token by checking in which acceptance region hy lies: declare verified iff he E An,((,,),, By Lemma D.I, for any < Ana/2 the regions {Ar,a ()) are pairwise disjoint; hence there is at most one verified token (and in the noiseless case 0, exactly one).
Building on the intuition in Remark 16, we introduce two radii to define acceptance regions that avoid collisions:
Proposition D.1 (Probabilistic soundness and uniqueness of the local verifier). Fix position t and prefix क E yt-1, Under Assumptions D.1 and for, all v* E V, the following hold with probabil- ity one:
1. Noiseless soundness. I 0 and hy F(u" t),,, then of is the unique verified symbol.
2. Robust uniqueness. I Arit/2 and hy E Ar,(v" E), then v² is the unique verified symbol.
Proof. Recall that under Assumptions D. and D.2, F is injective and Ax, > allmost-surely.
(1) Noiseless soundness. For any E V, (v: 0) (F(u: r. lf, F(u* n. and some v # v" were also verified at O, we would have F(u; न. = F(u"; ग. t). which is a probability zero event under the assumptions made. Hence o* is uniquely verified almost-surely.
44

---

Published as a conference paper at ICLR 2026
(2) Robust uniqueness. Assume Ari//2 and ||h, - F(e"; n, TTt)lla If some * ut were also verified, then ||,; ( n, t)ll I e. By the triangle inequality.
[[ n. F(e": ;, f)21 - [h Fle; n. t)]l2 |b, Flv"; n, f.t) < 2e < AR,t
contradicting the definition of A (again, valid under the assumptions made). Thus of is uniquely verified almost-surely.
Candidate enumeration. Finally, we introduce the last conceptual block required to build the inversion algorithm: policy algorithm that systematically enumerates candidate tokens that the verifier is guaranteed to encounter the true one.
Definition D.3 (Policy algorithm). Let V be a finite vocabulary. policy algorithm is a (possibly randomized) map
I:
- V such that II(C) V for all C & V.
(When C V the map is undefined.)
Remark 17 (Enumeration property). Intuitively, a policy chooses any token not tried yet. Starting from Co- and iterating
U/ = II(),-1),
C. C-= (i=1....,|V)),
produces a sequence (vy)) that is a (possibly random) permutation of V. Thus, in exactly [V] steps, every loken is output once with repetitions.
Two examples of policy algorithms. We give (i) a uniform-random without replacement policy and (ii) a gradient-guide policy.
Algorithm Policy (Random)
Require: Vocabulary V; visited set C; embedding matrix E E RDxxd
Ensure: Next token and embedding
1: Sample permutation L = (Vi...., flvl) uniformly from V
2: Define p(u: T) as the rank of in T,
3: = arg min p(u: T
4: return v², E."
Algorithm 3 Policy (Gradient-basee)
Require: Vocabulary V: visited set C; embedding matrix E RR [V prefix т E Dt-1; layer E;
previous continuous embedding eli-1); step size 7 >> O; gradient-based update rule
Ensure: Next token ID and embedding
g Vo 1 F (eli (eli-1); n,t) h
2: eb0 + ((eli-1),,77))
3: Get L - (v v by ordering based on (E, e(i)
4: Define p(u; T) as the rank
5: 8² arg min p(u: T)
6: return v², e())
Remark 18 (Bypassing the embedding layer). We slightly overload notation and write F(e; n. t). Here we bypass the token embedding lookup and inject a continuous vector at the current position: the first t-1 rows of ( are set to Emb((T) and the t-th row is set to e. This extension is used only to guide the search (e.g.. in Policy-Gradient). All theoretical guarantees are stated for F(u; n. t) with V and are unaffected by allowing F to accept continuous proxy during candidate scoring. Any extra inputs/side outputs used by a policy (such as the updated proxy) are orthogonal to the correctness statements.
45

---

Published as a conference paper at ICLR 2026
Remark 19 (Practical choice of policy). Both Algorithms 2 and 3 satisfy Definition D.3. In practice we use the gradient-guided policy with standard gradient descent updates, as it tends to find the verified token with far fewer proposals: the next token is chosen by ranking V by the distance [| e(d) 2l2 to the updated proxy eld), This preserves the same worst-case guarantees (single pass over V) while improving empirical efficiency.
D.3 GLOBAL INVERSION VIA SIPIT
We now compose the local verifier into sequential decoder. At step t, causality ensures h, F(s n, t) for the true prefix π = S1:--1- Since the verifier uniquely accepts st (noiselessly, and robustly under perturbations below half the margin), any covering policy must encounter and accept the true token within a single pass over V. Iterating from t = to T yields exact recovery almost surely; we also quantify robustness and the worst-case runtime.
We are now ready to introduce our inversion algorithm: SIPIT (Algorithm 1). The algorithms applies to decoder-only transformers with causal self-attention (Assumption D.1), and assumes injectivity, which occurs with almost-surely (Assumption D.2). We assume access to the layer- hidden states
per position h and to the parameters needed to evaluate the local verifier from Definition D.2
t=1 for arbitrary (t, n, ;) well the gradient (when needed), namely the model up to layer f. A policy algorithm is fixed (e.g., Algorithm 3).
We begin by recording the following standard lemma and omitting the proof, is immediate from causal masking: under causal self-attention, the representation at position is independent of future tokens.
Lemma D.2 (Causal factorization and prefixwise identifiability). Under Assumptions D.I and D.2, fix position t. E [T]. For any s = ($1,...,8r7) 8T) with π = (81,...,8t-
(s) F((s n.
where the one-step map map from Definition D.
Proof. With causal masking, position attends only to positions S Evaluating the network up to layer& therefore yields representation at that is a function of the prefix and the current token St only, i.e. F(s;; n. l), as claimed.
Proposition D.2 (The verifier is the right primitive). Fix and a true prefix π -..,,..., ..1.....,,----. 85 81-1): Un- der Assumption D.I, the observed hidden state at step satisfies h₂(s) = F(s:: n, (Lemma D.2). In addition, under Assumption D.2, F is injective and has positive margin An, > O almost- surely (Theorem D.. and lemma D. Consequently, for the local verifier of Definition D.2, the following hold with probability one:
1. (Noiseless) With 0 and observation h, = -s),s), the unique verified token is
2. (Robust) h, (s) + e, with ||ell2 < An./2, then st is the unique verified token.
Proof. Immediate from Lemma D.2 and Proposition D.1 applied with e St, which holds almost- surely by Theorem D.1 and Lemma D.I.
Proposition D.3 (Eventual acceptance under increasing enumeration). Fix a position and the true prefix (s 8)-1). Under Assumption D.I and Assumption D.2, let 2 0 and work the probability-one event where the local verifier uniquely accepts the true token St (e.g., E = 0 or
8 < 2,, see Proposition D.2).
Let IT be any policy algorithm (Definition D.3). Define the increasing visited sets by Co = Ø,
2 = II(C.-1), and C, ;= C--1 (vx) for 1, and stop at the first index
T: min { {i21: 1: h, E Ar,(v:))))
Then (k:)22 enumerates V without replacement and S [V] almost surely. In particular, for the fixed prefix n. the policy's increasingly expanding search over V eventually proposes the unique verified token St and accepts it with probability 1.
46

---

Published as a conference paper at ICLR 2026
Proof. Work the probability-one event of Proposition D.2 (under Assumptions D.1 and D.2 with the stated E), on which the local verifier at step uniquely accepts the true token Sy. Equivalently,
he A E)
(35)
Enumeration without replacement. By the definition of policy algorithm (Definition D.3), V/ (T) V. C--1 and C, = C {u:). Hence v C and C.I = [C--1++ Inducting on é yields that (#:)/21 has no repetitions and C; contains exactly distinct tokens. Since V is finite,
after [V] steps we have C4y = V. i... (v.) is a permutation V (this holds pathwise, for any realization of the policy's 's internal randomness).
Eventual acceptance. Because (ut) is a permutation of V, there exists a unique index j E (1...., [V] with v, St. By equation 35,
T min 2 1: h, E (x.((;))) min i 2 1: is = =
s r S [V] and the process accepts 8t-
Since the event which equation 35 holds has probability the conclusion (eventual acceptance at finite 7) holds almost surely.
Theorem D.2 (Correctness of SIPIT (noiseless & robust)). For each E {I...., T} let mi (s1,.... 8t-1) .t--)). and let A >> O be the margin of the one-step map F(; () from Lemma D. Under Assumptions D.I and D.2, run SIPIT (Algorithm 1) with a tolerance 2 and observations
h = (s) +
(t=
where the perturbations satisfy ||e, 12 S for all and
E 1/4 Ar.t
for all
Then, with probability over the model parameters: (i) for every t, the inner for-loop over (the loop over vocabulary candidates) terminates within [V] iterations by accepting the true token sti and (ii) after the outer for-loop over (the loop over positions) finishes, the algorithm outputs the exact sequence s.
In particular, this covers the noiseless case by taking 0 and h. h₂(s), and the robust case with any uniform & such that max, ||el|22 S & < min, A
Proof. By Assumption D.2 and theorem D.I, and Lemma D.I, there is a probability event on which, for all t, F(: Te, is injective with strictly positive margin A Intersecting across finitely many & preserves probability Work on this event.
By Assumption D.1 and lemma D.2, (s)s) = F(SETT, t). Since ||e/|/2 s.
h (86 m.. 1) + e, E B(F(st; me, (),e) = (stre)
so the local verifier accepts Moreover, because & 1 Am Proposition D21 implies robust uniqueness:
h, E (u))( When = 0, equation 36 also holds by Proposition D.1(1). We now analyze SIPIT and proceed by induction on
U St-
(36)
Base case (t = 1). The outer for-loop over begins with 3 = () loop over j (the loop over vocabulary candidates), the policy (Definition D.3) enumerates V without replacement. By Proposition D.3, there exists j* < [V] such that Vz- Sı. which is accepted and triggers the break; the algorithm appends $1-
Inside the inner for-
Inductive step. Suppose after completing the inner loop at step t the algorithm has appended 8t-1, so the prefix entering step is S = Tr. By equation 36, within the inner loop the verifier accepts exactly when ,; st. Because the policy enumerates V without replacement, some < [ satisfies By St, which is accepted, appended, and the inner loop breaks.
Thus for every t, the inner loop terminates by accepting s, within |V] iterations, and after the outer loop finishes we have appended (s,..... .i.....,,,, ST), v i.c., $ = s. Since the reasoning holds on probability- one event (independent of the policy's internal randomness). the conclusion is almost sure. n
47

---

Published as a conference paper at ICLR 2026
Termination and complexity. Having established correctness, record the worst-case iteration count and discuss its relation to wall-clock time.
Proposition D.4 (Termination and linear step bound). Run SIPIT (Algorithm 1) on a length-T se- quence with any policy that enumerates V without replacement. Then the algorithm halts after finite number of iterations. Moreover, in the worst case the inner for-loop over j executes at most [V] iterations at each position t, so the total number of verifier tests across the entire run is most T [V. In particular, the number of loop iterations grows linearly with T [V].
Proof. Fix position The inner for-loop over j proposes unvisited tokens and stops when candidate verifies, or after exhausting V. Because the policy enumerates without replacement, the
loop can execute at most |/ iterations at step t. The outer for-loop over t runs for exactly T
positions, hence the total number of inner-loop iterations (i.e., verifier tests) is at most Ei= [
TIV < 00. Therefore the algorithm halts and the total number of tests is linear in T [V].
O
Remark 20 (Iterations vs. wall-clock time). Proposition D.4 bounds the number of iterations/tests: the inner loop performs at most [V] verifier tests per position, so the total is (T())). This is an iteration complexity statement that holds for any policy satisfying the " "enumerate V without replace- ment" property. Actual wall-clock time also depends on the per-lest cost (one call to F(u, k, (,, plus a distance) and on any policy overhead (e.g.. forward/backward proxy updates, scoring, sorting). A generic decomposition is
T Σ t=1
time e(TIV) Crest)
+
Cpoliey( (t);
where Cien is the cost of one membership test and Cpoliey(t) (t) captures policy-specific work at step t. Thus, if [V is treated as fixed and Creas Cpoticy() (t) are bounded (e.g., a constant number of proxy updates and most one ranking per update), wall-clock time is ( [V grows the policy sorts per update, additional factors like [V] or log [V] may appear in the time, but the termination and the (TTVV) iteration bound remain unchanged.
Remark 21 (Choosing the tolerance z). Theory guarantees uniqueness whenever E < L/A,tt (Proposition D.I). Since An, is unknown, two practical choices work well: (i) backoff: start with small and increase only if no token verifies; (ii) calibration: set e from held-out hidden states at layer& f. In all cases the decision rule remains simple yes/no membership test.
Remark 22 (Why SIPIT sequential). The algorithm never solves a global assignment. At position t it conditions the current prefix π and queries the local verifier for a single token. Causality (Assumption D.1) ensures h depends only on (T, so these local, prefixwise decisions compose recover the full sequence.
E IMPLEMENTATION DETAILS AND ADDITIONAL EXPERIMENTS
This section collects implementation details (SE.1), additional ablations collision experiments and STPIT ($F.2), controlled experiments with identical next-token predictions ($E.3), qualitative inspection of the closest hidden-state pairs ($E.4), and connections anisotropy and intrinsic di- mension ($E.5).
E.1 IMPLEMENTATION DETAILS
What is collision in practice. In the theoretical parts of the paper we use "collision" in the usual functional sense: two distinct prompts * s' such that their last-token representations coincide exactly,
r(s; 07) r(s': Or).
This is the event whose probability is controlled in theorems 2.2 and 2.3 and in Section C, and all proofs are carried out at the level of exact equality (no numerical threshold required).
In the experiments, however, representations r(s; 0r) and r(s'; 0r) may not be a meaningful or robust criterion. We therefore adopt numer- ical proxy: given two prompts s, s' and their embeddings r(s: 0r), r(s'; Or) E IRd, we declare
stored in floating-pont point format, so exact equality of
48

---

Published as a conference paper at ICLR 2026
practical collision only if
torch. alw.aaaeeceeeessss. 0r), r(s': 0r)) True,
i.e, every coordinate falls within PyTorch's prescribed tolerances, namely 10-5 and 10- for rele- vant and absolute tolerance respectively. Across all of the billions to trillions of empirical checks, every pair of distinct prompts # s' failed this criterion: torch allclose always returned False, and the observed & distances were consistently bounded away from zero. Thus, the resolution of our numerical precision, we did not observe any collisions in practice.
SIPIT implementation. We implement SIPIT exactly in Alg. with the gradient- guidedd policy. To stabilize the continuous proxy used for ranking, we apply gradient clipping (capping the gradient norm at 1) and periodically project it back the nearest token embedding every K 50 candidate proposals:
(())
Egg,
arg min el:i
E DEViC
without taking gradients through this projection. These heuristics affect efficiency only; the verifier and all correctness guarantees remain unchanged.
The original HARDPROMPTS method Wen et al. (2023) tar- gets multimodal vision-language models and optimizes prompts via CLIP-based similarity objec- tive. In our text-only setting lack the vision branch and CLIP loss, so adapt Algorithm of Wen et al. (2023) to language models by replacing the objective with the same la loss used in SIPIT's gradient calculation, and setting the optimization steps T 1 tokens- V/. All other details (step sizes, stopping rules) mirror our SIPIT setup to ensure fair comparison.
HARDPROMPTS implementation.
gpt2
13 Distarze
10-1
10
Collision thresbold
gpt ept2-medium
Distance
Collision taresbold
gpt22-aage
1.2 Distance
10-1
10
Collision Fhrsshald
16 Layer
06
Figure Seeking collisions in a large-scale prompt set ($4.1). For each layer, boxplots show the distribution (log scale) of the minimum pairwise l distances between last-token states across prompts for the GPT-2 model family (Small, Medium, and Large); red bars mark medians and the dashed line indicates the collision threshold 10
49

---

Published as a conference paper at ICLR 2026
E.2
ADDITIONAL ABLATIONS
E.2.1 COLLISION EXPERIMENTS
We report three complementary ablations that probe how separation behaves across depth, length, and model family.
GPT-2 family across depth. For GPT-2 Small, GPT-2 Medium, and GPT-2 Large, the per-layer boxplots (log scale) of the minimum pairwise Eg distances between last-token states in Figure show that all minima sit orders of magnitude above the collision threshold 10 10-6 at every depth, and the typical separation increases with depth (median red bars drift upward). This rules out collisions in practice and indicates that deeper blocks monotonically sharpen last-token distinctions in these models.
Gemma-3 family across depth and scale. Across Genma 3-1., Gemma3-4B 3-B,, and Gemma3-122 the layerwise boxplots (log scale) in Figure 8 again show minima far above 10-6 at all depths. Both depth and model size trend positively with separation: medians and lower whiskers move upward in deeper layers and larger models, indicating progressively stronger margins and no observed collisions.
1.2 Distance
10'
ineat
10'
maX
Effect of sequence length (Gemma-1B). Varying the prompt length reveals that min/mean/mma pairwise distances rise quickly for short sequences and then plateau, with the minimum never approaching zero (see Fig- ure 9). This suggests that beyond modest context size, additional tokens do not erode separability; margins stabilize rather than collapse, making collisions unlikely for any prompt length explored.
100
200
300
400
500
Sequence length
Figure 9: Sequence length versus distance over all pairs of distinct prompts for Gemma-11 1B.
gemma--3-1b--
10
L3 Distarce
101
Collision taresbold
genume-3 3--e--3----- 3-1b-pt
Distance
301
Collision tareboold
gemmaa- 12b-p
10
1a Distance
201
Collision Farsshald
Layer
Figure 8: Seeking collisions in a large-scale prompt set ($4.1). For each layer, boxplots (log scale) show the distribution of minimum pairwise Eg distances between last-token states across prompts for the Gemma-3 model family (IB, 4B, 12B); red bars denote medians and the dashed line marks the collision threshold 10
50

---

Published as a conference paper at ICLR 2026
Overall, these ablations corroborate the main text: last-token states remain well-separated across architectures and depths, separation typically grows with depth (and scale for Gemma), and margins stabilize with sequence length, aligning with our almost-sure injectivity guarantees and with SIPIT's exact recovery behavior.
E.2.2 SIPIT
Inversion performance
Model
Vocab size
Accuracy
Time (s)
Vocab explored ( (%)
Mistral-7B-vo.1
32000
100%
72.99 37.57
0.21 + 0.11 %
Llama -amaa-31-- 3311-B
128255
100%
345.35 = 181.30
0.22 + 0.12 %
Table 6: Performance of SIPIT on different vocabulary sizes
Vocabulary Size. To further validate our findings (as presented in Section 4) regarding the scaling of SIPIT with vocabulary size, conducted additional experiments the two models with substan- (+e 32K vocabulary) and Llama-3. 3. 1-8B construct sentences that tokenize to exactly the same
tially different vocabulary sizes, Mistral-7B--- (=s 128K). For fair comparison, quence of tokens across both models. The results are reported in the Table 6. We observe that, in practice, the inversion time grows linearly with vocabulary size, expected, reflected by the nearly constant percentage of tokens explored between the small-vocabulary model (Mi stral) and the lurger-vocabulayy model ama) Importantly, for both models, the fraction of tokens explored mains below 0.25%, indicating that the gradient- -ased heuristic is both robust and highly efficient.
Dataset
Inversion Time (s)
Accuracy
Train Data
146.48 91.52
100%
Test Data
128.62 + 83.40
100%
OOD
106.87 39.10
100%
Table Performance of SIPIT on in-distribution vs. out-of-distribution data
Robustness of SIPIT on unseen and random sequences. Based on GPT-2 2, we constructed three datasets, which refer Train, Test, and OOD (Out-of-Distibbution) The Train set is formed by sampling sentences from WebText (the dataset used to train GPT-2 Radford et al. (2019)); the Test set contains sentences sampled from Wikipedia (not in the training set); and the OOD set sists of random token sequences. Each dataset contains 50 prompts of length 100 tokens. We report the findings in Table 7. Interestingly, the OOD samples are significantly faster invert than the Train and Test samples. We hypothesize that this difference stems from the geometry of the hidden representations: natural language sentences (Train and Test) tend to lie on structured, clustered manifold, which can make the inversion landscape locally flatter and less well-conditioned. In con- trast, random token sequences produce more dispersed and isolated hidden states, yielding clearer descent directions and effectively stronger gradient signals, which accelerates convergence. Across all three datasets, we obtain exact recovery for every sequence, further supporting the theoretical guarantees of SIPIT.
E.3 IDENTICAL NEXT-TOKEN
The collision and ablation experiments above use generic prompt sets. A natural stress test is to ask: what happens when we deliberately construct prompt pairs that produce the same next-token prediction? To answer this question designed set of experiments where two different prompt are specifically constructed to yield the exact same target answer. First, we focused on word- to-word machine translation (googles smol) and math tasks (ProCreati ons / 5 mpl eMath)
51

---

Published as a conference paper at ICLR 2026
fg Distance (min)
E Distance (min)
Model
Model
layer
layer L/2
layer L
layer
layer L/2
layer
11ammm3.1--2 3-118a
0.694
1.632
4.202
Llama-3 31mm--3.1-B
0.789
2.126
8.245
Mistral-7g-v0.-
0.207
1,056
2.348
xistral-7e-vO.n
0.222
1.664
4.362
Phi-4-mini-instee
6.974
17.328
Phi-4-mini-
8.497
37.262
Table Distances for Translation (En-Fr) separator-token embeddings across layers.
Table 9: Distances for Math separator- embeddings across layers.
on Llama- 1ama--3.. -.. 3311-B, Mistral-7B, and Phi-4-mini-instrun built few shot prompts that differed only in their delimiters (c.g. -> vs :) while preserving identical translations arithmetic solutions. Some qualitative examples are shown below:
From these datasets,
Delimiter:
Delimiter:
Translate into French.
Translate into French.
Hello Bonjour Goodbye -> Au revoir House
Hello Bonjour
Goodbye Au revoir
House
Delimiter:
Delimiter:
Do the additions.
Do the additions.
2790 + 6698 -> 9488
2790
6698
9488
8262 3848
12110
8262
3848
12110
1628 + 132 ->
1628
132 =
We then assessed collisions involving four different separator token embeddings across all dataset pairs, specifically ->, :, =, and -. Despite producing the exact same answer the corresponding embeddings remain clearly distinct (no "collision") since the minimum &a distance is well above the collision threshold over the ~ 140K possible pairs, as seen in tables 8 and 9.
Furthermore, we constructed a dataset of random prefixes sampled from internet text, each followed by the fixed suffix "Complete this: The quick brown fox jumps over the lazy". To build the dataset, sampled 10K prefix sequences of length 50 tokens from Wikipedia and appended the tokenized suffix to each. The minimum & distances obtained are re- ported in Table 10. Even this setting, although the next token prediction is exactly "dog", all last-token embeddings remain far above the tolerance threshold.
t Distance (min)
Model
layer
layer T./2
layer T.
Mistral-7B-va
0.012
0.265
3.494
Llama 3. 1.11-8 883
0.046
0.733
6.227
Phi 1:4-mmii--- iiliiiiiinstuuce
0.087
2.302
18.913
Table 10: Distances for random-prefix dataset with fixed "quick brown fox" suffix.
E.4 PROMPTS WITH SIMILAR REPRESENTATIONS
To complement the quantitative injectivity results in the main text, we inspected qualitative examples of sequences whose last-token hidden states among the closest observed. For given model,
52

---

Published as a conference paper at ICLR 2026
computed the Euclidean distance between last-layer representations h2 (s) and h2 (t) of the final token two sequences s and t, and manually examined pairs with the smallest lz distances.
For both L1ama-33 13.1-8.. 1--8 and Mistral-7B-93 1. the closest pairs correspond to Python code snippets that are almost identical, typically differing only by a small shift such as one or more trailing newline tokens. In most of the close pairs examined, the sequences satisfy
(new line token)*
for small A 2 1. Even in these extremal cases, however, the last-token representations remain clearly separated in &2 distance.
Llama-3.1-8B. One of the closest pairs we found for Llama-3 1.0e-3.1--00 1-88 shown below. The only difference between the two sequences is the presence of several trailing newline characters at the end the second snippet. The last-token &2 distance at the final layer for this pair 1.274, which is small relative typical distances but still far from zero, and thus consistent with the absence of collisions observed in our exhaustive tests.
ama- 3. 8B: Sequence s
Theme options are theme seene--pecific and customize the
{}
Add any paths that contain custom themes here #html
L1 Alama- - 3. 1-:B: Sequence
Theme options theme-specific and customize the @etmml_theme_optinne
{}
Add any paths that contain custom themes here #htm1 An
An
In
Mistral-7B-v0.1. A similar phenomenon occurs for Mistral-7B-v0.. Again, one of the closest pairs consists of two almost identical code snippets, where the second sequence appends single newline token: For this pair, the last-token & distance at the last layer is 1.146. As in the Llama example, the nearest neighbors arise from almost identical contexts differing only in trailing whitespace tokens, and even these extremal cases exhibit non-negligible separation in representation space.
Mistral 7B- Sequence
The reST default role to use for all documents. #default_role None
If true, ')' will be appended to func: sadd_ffunction__areethee
True
If true, the current module
53

---

Published as a conference paper at ICLR 2026
Mistral-7B-vo 1: Sequence
The reST default role to use for all documents. #delault_role None
true, ')' will be appended to func: wtt.auuniioopprrenteeeeeeeee = True
# If true, the current module An
Summary. Across all models and pairs we inspected, we did not observe qualitatively different prompts whose last-layer, last-token embeddings were comparably close. Instead, the nearest neigh- bors consistently involved near-duplicate snippets (often code or documentation) differing only by whitespace other minor formatting tokens. These qualitative observations align with the injectiv- ity margins reported in the main text and support the view that small perturbations formatting do not lead to collisions in the representations used by SIPIT.
E.5 RELATION WITH ANISOTROPY AND INTRINSIC DIMENSION
As part of our broader investigation, also examined connections to the analyses presented in the works Razzhigaev et al. (2025) (LLM-Microscope) and Razzhigaev et al. (2024), and ran targeted experiment in this spirit.
Experimental setup. We performed proof-of-concept study using GPT-2 Sma 1 1.. We sampled 100 natural-languuge prompts of fixed length K and, for each prompt, generated 1000 single-token continuations by appending each token from a fixed vocabulary subset of size 1000. For every layer f, we extracted the hidden representation 1000 d matrix for each (layer, prompt) pair. On each matrix computed (i) anisotropy and intrin- sic dimension as in LLM-Microscope, and (ii) simple "injectivity margin" statistics: the minimum pairwise Euclidean distance between continuation embeddings, averaged over prompts. Aggregat- ing over the 100 prompts yields, for each layer, a triple consisting of anisotropy, intrinsic dimension, and injectivity margin.
study
the last token for all 1000 continuations, producing a
Experiment 1: anisotropy injectivity margin. Across layers, correlated mean anisotropy with the mean injectivity margin. The resulting Pearson correlation is 0.72, and the Spearman corre-
Layer
Anisotropy (mean)
ID (mean)
Margin (min)
0.089579
20.754620
1,850306
2
0.076049
17.565538
1.956753
3
0.071429
16.765265
2.064488
0.075067
16.679382
2.241199
5
0.083282
17.183246
2.382355
0.089542
17.697870
2.499817
7
0.088463
17.018419
2.704958
8
0.083261
16.296431
2.886434
0.081803
16.040713
3.025268
10
0.083083
15.730601
3.330774
0.090206
15.635035
3.918343
12
0.288352
16.434897
4.640457
Table 11: Laser-wise anisotropy, intrinsic dimension, and injectivity margin.
54

---

Published as a conference paper at ICLR 2026
lation is 0.45. In this setting, layers with higher anisotropy tend exhibit larger injectivity margins: continuation clouds become both more structured (anisotropic) and farther from collisions. This suggests that anisotropy is compatible with, and may reinforce, numerically robust injectivity.
Experiment 2: intrinsic dimension vs. injectivity margin. Repeating the analysis with intrinsic dimension, we observe Pearson correlation of -0.60 and Spearman correlation of -0.79 between intrinsic dimension and injectivity margin. Thus, layers with lower intrinsic dimensionality tend to have larger margins: compressed-looking manifolds are, if anything, more separated. This aligns with our theorem that injectivity rules out information-destrooing collapses.
Discussion. This line of analysis is highly complementary to our injectivity framework. Whereas our results establish that internal representations are almost surely lossless, LLM-Microscope offers fine-grained geometric diagnostics of how these representations evolve across depth and training. Particularly notable is the observation that anisotropy and intrinsic dimension follow a reverse-U profile: representations become more anisotropic and dive-ddmensional in intermediate layers, then partially re-expand near the output, offering concrete geometric picture how structure is carved into aligned directions and low- www-iiensional manifolds.
This is especially relevant given that our paper challenges classic accounts of learning via bottleneck compression (e.g. Shwartz-Ziv & Tishby (2017)). If information is preserved along the residual stream, learning cannot proceed layer by layer purely through compression. Our preliminary exper- iments suggest different picture: depth increases, margins grow, intrinsic dimension decreases, and anisotropy follows a concave trajectory with late spike. Early layers expand and reorganize, intermediate layers carve information into dow-dineniional directional manifolds, and upper layers sharpen this structure. Overall, this is consistent with a network that preserves injectivity while funneling information into increasingly structured, well-separated representations.
Model (HF example)
Activation in FFN
Real-analytic?
alama-2
SwiGLU
Yes
Llama-3
SwiGLU
Yes
Mistral-7B-vO.
SiLU
Yes
Mixtral-8x7B--
SiLU
Yes
Gemma
GeGLU
Yes
Gemma
GELU
Yes
Qwen2MoE
SwiGLU
Yes
Qwen-2
SiLU
Yes
Owen3MoB
SiLU
Yes
Qwen-3
SiLU
Yes
Phi
GELU
Yes
Phi-3
SiLU
Yes
GPT-2
GELU
Yes
GPT-J
GELU
Yes
OptOss
SiLU
Yes
Grok-1
GELU
Yes
DeepSeek-V2
SiLU
Yes
DeepSeek-V3
SiLU
Yes
Table 12: Activation functions used in the feed-forward networks of representative modern LLMs.
55

---

Published as a conference paper at ICLR 2026
F REAL-ANALYTIC ACTIVATION FUNCTIONS IN MODERN LLMS
natural question raised by our analysis is to what extent modern large language models actually real-analytic activation functions in their feed-forward networks. Since results apply most directly when the non-linearities are real-analytic, it is important to check whether this assumption holds in practice.
To get concrete picture, we surveyed a set of widely used open-source and proprietary-style ar- chitectures and recorded the activation function used in their feed-forward blocks. The models and their reported activations are summarized in Table 12. For each model, we also indicate whether the activation is real-analytic. Activations such as SiL.U/wish, SwiGLU, GeGLU, and GELU are all real-analytic, being compositions and products of elementary analytic functions (e.g., linear maps, exponentials, and the error function).
Across this representative sample, we find that all models (18 out of 18) use real-analytic activations their feed-forward blocks. In other words, the analyticity assumption is not merely a technical convenience but accurately reflects common design practice. This supports the relevance of our theoretical results for real-world large language models: the vast majority of modern transformers already operate in regime where the non-linearities real-analytic, and hence fall directly within the scope of our analysis. We now formally prove that SiLU and GELU are real-analytic scalar functions, and that the corresponding gated constructions SwiGLU and GeGLU define real-analytic vector-valued maps. The proofs build from elementary ingredients upward: sigmoid (Proposi- tion F.I) - SiLU (Proposition F.2); error function (Proposition F.3) + GELU (Proposition F.4); then coordinatewise lifting (Proposition F.5) and GLU gating (Proposition F.6). Proposition F.1 (Logistic sigmoid real-tnalytic). The logistic sigmoid
(z) 1
x IR,
x
is real- I.
Proof. By Proposition A.5, the map + e- is real-analytic on R. By Proposition A.1, the sum + e- is real-analytic; moreover 1 ee for all E. never vanishes. By the quotient rule in Proposition A.I, the reciprocal
1
therefore real-analytic R.
Proposition F.2 (SiLU/ Swish is real-analytic). The SiLU (or Swish) activation
SiLU(x) = x xo(x) = 1 x BER,
is real-analytic on I.
Proof. The identity map x - a polynomial, hence real-analytic by Proposition A.4. By Propo- sition F.I, o is real-analytic. The product of two real-analytic functions is real-analytic by Proposi- tion A. so x + x (x) is real real-analytic on R.
Proposition F.3 (Error function is real-and analyinaly The error function
2 -t dt, I IR,
1"
erf(x)
V
real-analytic on R.
Proof. By Proposition A.5, exp is real-analytic on I with power series e E radius of convergence. Substituting -t2 yields
and infinite
(-1)*
e
Σ
2k
te R.
h!
k=
56

---

Published as a conference paper at ICLR 2026
This series has infinite radius of convergence, so it converges uniformly every bounded interval. By standard results on termwise integration power series (e.g. Rudin 1976), we may integrate termwise:
!
{ 0
(-1)* 1:k +
e dt
1 dt =
a 2k+1
k!
k=
k=0
Multiplying by 2/ obtain
(-1)* 2b+11
erf(*)
k!(2k + 1)
0=0
a power series with infinite radius of convergence. Hence erf is real-analytic on R by Definition A.1.
Proposition F.4 (GELU is real-analytic). Let
1 ((x) == 2 (1+
erl erl (2
be the CDF of a standard normal random variable. The (exact) GELU activation
GELU(x) x ((x))
is real-analylic on R.
Proof. By Proposition E.3, orf is real-analytic. The map x + x is linear, hence real-analytic; by Proposition A.2, the composition x + orf [2 is real-analytic. Adding the constant and scaling by 1/ preserves real-analyticity by Proposition A.I, so is real-analytic. The identity map + x is a polynomial (Proposition A.4), hence real-analytic; their product æ + x (2z is therefore real-analytic by Proposition A.I.
V2
Having established that SiLU and GELU are real-analytic as scalar functions, now lift them to the vector-valued setting and show that the GLU-style gating used modern architectures preserves real-analyticity.
Proposition F.5 (Vector- valued SiLU and GELU are real-analytic). Let E N. Define the coordi- natewise maps
SILU (x) (SILU(X))... (SI
GELU (x) (GELU(x)), GELU(Xm))
for x E RT where SiLU and GELU are as in Proposition F22 and Proposition F44 Then both SiLUm m and GELUm are real-analytic maps Rmm -> Rmm.
(x, (resp. GELU(X;)) is the composition of the projec- tion onto coordinate i (a linear map) with the real-analytic scalar function SiLU (resp. GELU). By Proposition A.2, each component is real-analytic. Therefore, by Definition A.1, the vector-valued maps SiL.U,,, and GELU,. are real-analytic.
Proof. Each scalar component
Proposition F.6 (GLU-style blocks are real-analytic). Let dhns daia E N and consider affine maps
Ai(x) Wix bI,
A2(x) W2x ba,
with W1, W2 IRdaia and b b2 Rdme, Let $ Rddd dddi be either SiLU or GELUdaa dai from Proposition F.5. Define the GLU-style block
GLU = A1(x) 3 (AA(()))
X E Rdd..
where 2 denotes the Hadamard product.
Then GLU Bd Rduia is real-analytic. In particular:
Taking e = SiLUAaa recovers SwiGLU, which is real-analytic.
Taking GaLUd recovers GeGLU, which real-analytic.
57

---

Published as a conference paper at ICLR 2026
Proof. Each affine map A, is real-analytic matrix product plus addition (Proposition A0 Proposition A.I). By Proposition F.5, o is real-analytic, so x H ((A2(x)) is a composition of real-analytic maps (Proposition A.2), hence real-analytic. The map x Y A (x) @ ((A2(x)) is a Hadamard product of two real-analytic vector-valued functions; componentwise this just the product of real-analytic scalars, so it is real-analytie by Proposition A. (equivalently, by Proposi- tion AII.). Thus & is real-analytic. The SwiGLU and GeGLU cases follow by choosing accordingly.
Relation to universal-approximaati and expressivity results. The material above concerns only the analyticity of the non-linean non-lincarities used our analysis. For completeness, we also record here how injectivity theorem fits alongside existing expressivity results for Transformers; this discussion is logically independent of the real-analyticity assumptions.
Classical expressivity results for Transformers primarily existential. Universal-approximatti theorems (e.g. Yun et al. (2020); Sun & Yang (2020)) show that for any continuous sequence-to- sequence function / on compact domain and any depth and width whose outputs are within ε of those of f. "Tuiin-coomleteness results for en- coder-decoder Transformers (e.g. Pérez al., 2019) similarly establish the existence of parameter settings that simulate any Turing machine. Taken together, these works characterise what the archi- tecture can represent principle: they do not model random initialization or gradient-based train- ing, and they are not formulated in our discrete setting with finite context length, fixed decoder-only architecture, and analytnayticc activations.
0, there exists Transformer with suitable
Our results are complementary and instead concern what happens typically under standard training. We fix a conerete decoder-only architecture and a finite prompt set, and study the map from prompts to last-token representations. In this setting we prove that (i) for any fixed architecture, the set of parameters for which this map is non-injective has Lebesgue measure zero, and (ii) gradient- based training from standard random initializations preserves absolute continuity of the parameter distri- bution and therefore almost surely avoids this "collision set". Non-injective Transformers certainly exist (we explicitly construct such failure cases in Section 2), but our results show that they form thin subset that typical optimization trajectories do not reach.
Our contribution is thus orthogonal to prior expressivity theory. We do not claim that Transformers can only represent injective functions. Rather, within the specific regime we study (decoder-only. real-analytic activations, cross-entropy loss, GD-type training from standard initialization), we show that the resulting last-token map is injective with probability one over initialization and training. In short, classical expressivity results describe what mathematically possible for the Transformer function class, while our analysis characterizes what is almost surely implemented when that class explored via standard training procedures.
58


Reviews:
[{"review_id": "5qmwowMJ1M", "reviewer": "Reviewer_D7YR", "summary": "The authors make a significant theoretical and practical contribution by rigorously establishing that standard decoder-only transformer language models are almost surely injective - meaning different input prompts map to distinct last-token hidden representations under common initialization and training regimes. The authors leverage real-analyticity to prove that collisions (non-injective behavior) occur only on a measure-zero set of parameters, and they further demonstrate that gradient descent preserves this injectivity. Building on this foundation, the paper introduces SipIt, a novel algorithm that efficiently reconstructs the exact input prompt from hidden activations with provable linear-time guarantees. This work bridges theory and practice, offering new insights into model transparency, interpretability, and safety.", "questions": "1. How does SipIt perform under noisy or quantized hidden states, and can the theory be extended to account for such perturbations?\n2. Could the injectivity results generalize to encoder-decoder Transformers or models with non-analytic components (e.g., ReLU)?\n3. The paper claims gradient descent preserves injectivity - does this hold for adaptive optimizers like Adam, or only for GD?\n4. Are there practical scenarios where the linear-time complexity of SipIt becomes prohibitive, e.g., for very large vocabularies?", "limitations": "", "rating": 6, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 4, "strengths": "The following strong points can be highlighted:\n1. The theoretical analysis is rigorous, leveraging real-analyticity and measure theory to derive almost-sure guarantees.\n2. The injectivity results are novel and counter widespread assumptions about information loss in Transformers.\n3. SipIt is both theoretically grounded and empirically validated, demonstrating exact recovery with linear-time complexity.\n4. Extensive experiments across multiple models (e.g., GPT-2, Gemma, Llama) confirm the absence of collisions in practice.\n5. The paper clearly discusses implications for privacy, interpretability, and model auditing.\n\nThe paper’s core contribution is proving injectivity and enabling exact inversion, which addresses foundational questions in deep learning and has immediate relevance to interpretability and safety. The proofs are meticulous, and the experiments are comprehensive, spanning multiple model families and scales. The introduction of SipIt provides a tangible tool for future research, while the theoretical guarantees are robust and well-supported. These qualities align with ICLR’s emphasis on impactful, rigorously evaluated work.", "weaknesses": "Whereas the paper is technically solid, there are several weak points I would like to mention:\n1. The scope is limited to decoder-only Transformers with analytic components, excluding architectures with non-analytic activations (e.g., ReLU) or encoder-decoder models.\n2. The practical utility of SipIt, while theoretically appealing, is primarily evaluated in a noiseless setting; its robustness to quantization or approximate hidden states is less explored.\n3. The discussion of related work, while adequate, could better contextualize how these results complement or challenge prior beliefs about Transformer expressivity.\n4. Some proofs in the appendix are highly technical and may be inaccessible to readers without deep mathematical backgrounds.\n5. It will be very interesting to analyze injectivity correlation with other internal transformer characteristics like anisotropy and intrinsic feature dimension using such frameworks as LLM-Microscope (https://arxiv.org/abs/2502.15007, https://github.com/AIRI-Institute/LLM-Microscope)", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "NEQrw2fPom", "reviewer": "Reviewer_uusJ", "summary": "This paper presents a strong theoretical study showing that decoder-only Transformer architectures are (almost surely) injective: different prompts map to distinct last-token hidden states. Building on this, the authors introduce SIPIT, an algorithm that recovers the exact input prompt from the final hidden state. The method is theory-driven and, across extensive experiments on a wide variety of models, the authors find no collisions, providing compelling empirical support for injectivity.", "questions": "My questions to the authors are as following:\n\n1. Have you estimated, how SipIt works on datasets that were seen by the models during training, and on OOD samples, that were not observed by the model. Or even some random sequences of tokens? Does inversion speed or accuracy change compared to natural text?\n2. Instruction-tuned models with identical answers: For instruction models (or even pre-trained ones) where many prompts lead to the same answer (e.g., \"yes\" or \"no\"), do the hidden states remain well separated? Have you measured how close they get?\n3. Did you ever find prompts whose hidden states were almost identical? If so, what kind of prompts were they?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "The main strength of the paper are as follows:\n\n1. This paper makes a significant theoretical contribution by proving that standard decoder-only Transformer language models are almost surely injective – different input prompts will (with probability one) produce distinct hidden representations. The authors use real analysis to show that collisions (two different prompts yielding the same last-token state).\n2. Building on the injectivity result, the novel algorithm (SipIt) to recover the exact input text from a model’s hidden activations with provable efficiency is introduced. As prior approaches could only approximate prompts via heavy training of inversion models, whereas SipIt achieves exact recovery by directly using the model's own representations.\n3. The paper backs up its theory with comprehensive experiments on two models (a kind of old GPT-2 and more novel Gemma). The authors performed an exhaustive search for representation collisions using 100k prompts drawn from diverse sources, amounting to billions of pairwise comparisons. They report no collisions in any model or layer tested, distinct prompts always yielded distinct last-token embeddings, with clear separation margins.\n4. The SipIt algorithm is shown to be not just theoretically sound but practically effective. On GPT-2, SipIt was able to reconstruct 20-token prompts perfectly (100% token-wise accuracy) in reasonable time, without any additional training or approximation.\n5. By establishing invertibility as a fundamental property, the work has broad implications. It provides a sound basis for interpretability: knowing that the full input is encoded in the last-layer state means any failure to probe knowledge is due to method limits, not information loss.", "weaknesses": "I would highlight the following weaknesses of this paper:\n\n1. Large vocabulary scaling. How does SipIt handle very large vocabularies (e.g., 100k+ tokens)? Does runtime grow linearly in practice, or do the gradient-based heuristics keep it manageable?\n2. Uncertain theoretical result of not-analytic estimation. Most modern models use SwiGLU or SiLU activations. Since your proofs assume analytic activations, can you confirm that these fit the theory?\n3. In continuation to the previous point, it is not clear, what happens with the quantized models. It seems that it can be the main source of the collision.\n4. The experiments are provided for models of relatively small size, thus, we cannot asses what empirically happens with the larger number of parameters.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "N3esymTKtb", "reviewer": "Reviewer_yqXp", "summary": "The authors claim that a common thought is that language models are have a many to one relationship with regard to input and latent representation (respectively). The authors argue that language models are injective and that this suggests that there is an invertible relationship such that given a latent state, the input provided to arrive at this state is recoverable. \n\nThe authors base the analysis on the belief that initialized transformers don't typically create collisions between prompts and that after a fixed number of training updates, the parameters have not been changed sufficiently to induce collisions. \n\nThe authors propose a method to obtain the input to a language model. However, the method requires knowledge of the total last layer hidden state of the model for every substring of the prompt whose first token is the first token in the prompt.", "questions": "Decoder-only models are claimed to be a lossless representations of their input. This seems to be in contradiction to existing results that transformers are universal function approximators - a universal function approximation ought to be able to learn a many to one mapping if appropriate. However, function approximation is based on an epsilon bound. This seems to suggest that if instead of examining the size of the zero set, one were to examine the set which is epsilon close to the zero set, this would have no theoretic guarantee of being measure-zero. How does this not eliminate the practicality of the paper's analysis?\n\nWhat degree of fidelity is necessary for this result to hold? If lower precision approximations are used, online batching for practical serving, or significant context information is present, these will create random noise which ought to obscure any such precise mapping as is necessary for the analysis to hold.", "limitations": "", "rating": 4, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 1, "strengths": "This paper presents an interesting analysis I have not seen of the transformer architecture and convinced me that the transformer is often real analytic (though that depends on the choice of activation functions).", "weaknesses": "Terms like measure-zero and injective need to be defined. \n\nA collision must be defined. It's not sufficient to say that a collision didn't occur because a value differed in any way. Some bound must be placed on the distance between the output representations that constitutes a collision. \n\nMany activation functions are not real analytic functions. \n\nMy understanding is that the zero set necessarily is measure-zero (given that the model is real analytic and we know the model is not the zero function). This doesn't seem to necessarily imply that no two inputs to the function will provide a similar output. I believe the authors intend for the reader to understand that the difference of two activations given dissimilar prompts is itself a real analytic function which then suggests that the difference between any two prompts whose value is zero is a measure-zero set. The problem with this logic is that it is possible that the difference between the last stage activations for two prompts is either the zero function or epsilon close to the zero function for some small epsilon without violating anything in the proof. \n\nMy primary contention is that showing that the zero set is measure-zero is not sufficient to make the strong claim that there are no collisions. A collision should reasonably be considered anything within some small distance of zero rather than those items which have identical values given the reality of executing floating point operations a real machine.   \n\nThe SipIT method is trivial - given one knows the latent representation of every substring (which is less probable than simply knowing the input text to begin with), the algorithm can produce the substring by evaluating every possible token in this location. Further, the analysis of the algorithm seems to be either obscured or incorrect. For a prompt of length N and vocabulary of k, the algorithm will in the worst case require k^N time. This is exponential where the paper claims a linear time guarantee. Perhaps the paper meant linear with respect to vocabulary? But this is meaningless since the vocabulary is stationary and the input length is the changing factor.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "RBlejdM4WN", "reviewer": "Reviewer_fDrk", "summary": "This is a primarily theory paper that discusses decoder only transformers being injective. Specifically that each unique prompt maps to a unique last token embedding (from final transformer layer). Paper provides theoretical setup and justification for this argument under acceptable assumptions at initialization (Theorem 2.2) and post SGD-like gradient based training (Theorem 2.3). It is to be noted, that the theorems state how injectivity is very high probability (1 or near 1) event under stated assumption and not proven. For eg., paper discusses how collisions (two different input mapping to same last token representation) can still occur if an adversarial crafts data specifically so (end of Section 2). \n\nPaper also introduces a prompt recovery method from last token representation. The method \"Sequential Inverse Prompt via ITerative updates\" or SIP-IT. This method says that at each index position given a current + previous token hidden representation, check each token in vocab to see which will produce current index hidden representation (formal algorithm describe in Algorithm 1). The paper further discusses computational cost of SIP IT.\n\nReview Note: Since the primary results are theoretical, I reduce my confidence to 3 in the reading and review.", "questions": "1. What is \"measure-zero parameter choices\"? \n1. If you consider the prompt length progressively growing (i.e. --> \\inf) with no upper bound, but the model width (i.e. embedding or hidden representation size) is fixed, then the model's representation has to be overloaded to some extent. This would challenge the injectivity directly since it won't be lossless anymore. So I would argue, in the limit, since the vector dim of hidden dim is capped, transformers are not injective and infact more and more lossy. What do the authors think?\n1. Since the language follows power law of Zipf distribution [1], the words occurs as per an exponentially decaying frequency. One example, let us have LLM predict the next token on \"Complete this: The quick brown fox jumps over the lazy [dog]\" where \"dog\" is not part of prompt. If this exact phrase is used use with two distinct prompts (i.e. prefixes of this phrase), the next token would always be \"dog\" for most useful LLMs. Can you please run this as experiment with varied internet data used as prefix? If the next token prediction is same, I expect the last token to be super close if not identical and see if it meets the threshold of 1e-6 used in paper. There can be other examples as well, like cases where \"should\" is followed by \"have\" (assuming \"should have\" token is not part of vocab) with vastly different prompts. This is more inline with Zipfian distribution argument.\n1. Why threshold of 1e-6?\n1. Can you explain what exactly is the BRUTEFORCE method in Table 2?\n1. \"distinct prompts produce distinct hidden states under standard initialization and training\" is good summary of the paper.\n1. I think that under high precision, lookup of hidden activation against data is already expected. This steps from how deterministic models are. Can you clarify, under your threat model, the extractor of data have ONLY the last token embedding/representation with none of the prompt (and no knowledge of it's length either) or its access to each of previous token's embedding/representation as well? Because latter is kind of trivial (to me at least) and former is very difficult and the experiments might be convincing in that case. So yeah, the exact threat model is unclear to me, and kind of not stated clearly enough in the paper.\n\n[1] https://en.wikipedia.org/wiki/Zipf%27s_law", "limitations": "", "rating": 4, "confidence": 3, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "- This is a unique and very science paper on LLMs, something we rarely see. Thanks for working on this. (I have what takeaways from this concern but more on that below).\n- It cites most related work I know and use proper baselines in experiments.", "weaknesses": "The paper seems poorly organized, I felt lot of important results were pushed into appendix and main paper felt very repetitive at times. I have listed my main qualms in the questions section.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)