Vision Transformers Don't Need Trained Registers
Authors: Nicholas Jiang
Amil Dravid
Alexei A Efros
Yossi Gandelsman
Venue: NeurIPS 2025 spotlight ()
Keywords: interpretability
Vision Transformer
neurons
attention sink
CLIP
DINO
Primary area: deep_learning
TL;DR: We find a small set of neurons whose activations can be redirected at test-time to mitigate high-norm artifacts in Vision Transformers.

Abstract: We investigate the mechanism underlying a previously identified phenomenon in Vision Transformers -- the emergence of high-norm tokens that lead to noisy attention maps (Darcet et al., 2024). We observe that in multiple models (e.g., CLIP, DINOv2), a sparse set of neurons is responsible for concentrating high-norm activations on outlier tokens, leading to irregular attention patterns and degrading downstream visual processing. While the existing solution for removing these outliers involves retraining models from scratch with additional learned $\textit{register tokens}$, we use our findings to create a training-free approach to mitigate these artifacts. By shifting the high-norm activations from our discovered $\textit{register neurons}$ into an additional untrained token, we can mimic the effect of register tokens on a model already trained without registers. We demonstrate that our method produces cleaner attention and feature maps, enhances performance over base models across multiple downstream visual tasks, and achieves results comparable to models explicitly trained with register tokens. We then extend test-time registers to off-the-shelf vision-language models, yielding cleaner attention-based, text-to-image attribution. Finally, we outline a simple mathematical model that reflects the observed behavior of register neurons and high norm tokens. Our results suggest that test-time registers effectively take on the role of register tokens at test-time, offering a training-free solution for any pre-trained model released without them.

Vision Transformers Don't Need Trained Registers
Nick Jiang'
Amil Dravid
Alexei A. Efros
Yossi Gandelsman
UC Berkeley
"qqual contribution
{nickj, aaefros, yossi httpss/ssss..aeeeemmmaaa/brreeeo edu
Abstract
We investigate the mechanism underlying a previously identified phenomenon in Vision Transformers. the emergence of high-norm tokens that lead noisy attention maps (Darcet et al., 2024). We observe that in multiple models (e.g., CLIP, DINOv2), sparse of neurons is responsible for concentrating high-norm activations on outlier tokens, leading to irregular attention patterns and degrading downstream visual processing. While the existing solution for removing these outliers involves retraining models from scratch with additional learned register tokens, we use our findings create training-free approach to mitigate these artifacts. By shifting the high-norm activations from our discovered register neu- moss into an additional untrained token, we can mimic the effect of register tokens a model already trained without registers. We demonstrate that our method produces cleaner attention and feature maps, enhances performance over base models across multiple downstream visual tasks, and achieves results comparable to models explicitly trained with register tokens. We then extend test-time registers to off-the-shelff vision-language models, yielding cleaner iitention-based text-to- image attribution. Finally, we outline a simple mathematical model that reflects the observed behavior of register neurons and high norm tokens. Our results suggest that test-time registers effectively take on the role register tokens at time, offering training-free solution for any pre-trained model released without them.!
Introduction
Vision Transformers (ViTs) (Dosovitskiy et al., 2021) have become dominant architecture in computer vision, offering strong performance across wide range of tasks (Oquab et al., 2024; Radford et al., 2021). Recently, Darcet et al. (2024) observed a surprising property in these models: the emergence of high-norm intermediate tokens seemingly random locations in the image during the internal computation of the ViT (see "Original" column in Figure 1). These outlier tokens were shown to appear low-information image areas (e.g., uniform background patches) and were demonstrated to capture global image information.
Darcet (2024) interpreted these high-norm tokens as form of emergent global memory mechanism through which the model stores and retrieves global information, analogous to registers in CPUs. Based on this interpretation, they proposed eliminate these outlier image tokens by augmenting the input with dedicated non-image tokens during training, calling them "register tokens." " This allows the patch tokens to focus solely on encoding local content, leading to improved performance on dense visual tasks. However, this technique requires re- re-training existing models from scratch with these extra register tokens, limiting its applicability in practice.
Projject Page: httph:tppp.. httpttpp:///vvvaiid....mm githuu htwp://sttttieeeeriteeteeeeeee
Code: https://github: http://chhhhcbcmmcccccccaaaaaa/a -ttp////tt///tttttiiiieee test-tiim-registerr
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

OpenCLIP
DINOv2
w/ Test-time Register
w/ Test-time Register
Input
Original
Shifted
Original
Shifted
Figure 1: Controlling high-norm tokens in Vision Transformers. shown Darcet et al. (2024), high-norm outlier tokens emerge in VITs and lead noisy attention maps ("Original"),. By identifying the mechanism responsible for their emergence, we demonstrate that we can shift these outlier tokens to arbitrary positions at test time ("Shifted"),. Shifting the outlier tokens outside of the image mimics register behavior at test-time ("w/ Test-time Register"), resulting in more interpretable attention patterns and downstream performance comparable models retrained with registers.
In this work, we argue that while registers are indeed useful, models don't tt need to be retrained with them. Instead, show that registers can be added post hoc, without any additional training. To do this, we first investigate the mechanism underlying the emergence of high-norm tokens. We identify sparse of neurons- register neurons that create the outlier tokens by contributing high-nom norm values to them. By directly editing the activation maps of the register neurons during the forward pass of the network, we can induce formation of the high-norm activations arbitrary token positions (Figure 1). We use it to create new register tokens at test-fime, even in models that were never trained with them, by appending new tokens and activating the register neurons their positions.
We show that models with test-time registers provide comparable performance to models with trained registers on various downstream tasks (e.g.. classification, segmentation, and depth prediction) and largely improve over models without registers for unsupervised object discovery (20-point correct localization improvement) and attention-basse zero-shot segmentation (+5 mIOU). Next, we demonstrate that test-time registers reduce high-norm artifacts in vision-language models, improving the alignment between textual outputs and relevant visual regions. Finally, we present a simple mathematical model capturing the observed behavior of register neurons and high-norm tokens, empirically finding that test-time attention biases can mitigate outliers and attention sinks without any additional tokens.
In summary, our contributions are as follows:
We determine the mechanism behind the creation of high- figh-norm tokens in VITs by finding register neurons that, when activated, cause the appearance of these outliers (Section 3.1). A simple mathematical model captures the observed behavior of these neurons (Section 6).
We demonstrate that activating the register neurons at test-time in other image locations shifts the high-norms to the corresponding tokens (Section 3.2).
We present training-fres method for adding registers to models that were trained without them, by appending additional tokens and activating register neurons in their positions (Section 4).
We evaluate the performance of models with test-time registers and show that it is comparable to models with trained registers, thus eliminating the need for retraining models with registers from scratch (Section 5).
2
Related work
Feature visualization in vision models. Visualizing features of computer vision models has been used for diagnostics long before the transition of the field to deep-learning (e.g., Vondrick al. (2013)). Features in early CNN-based models were visualized to interpret their emergent computation (Zeiler

---

& Fergus, 2014; Bau et al., 2017) and to approximate saliency maps (Itti et al., 2002). In ViTs, the attention map from the [CLS] token has been used for various attribution methods (Caron al.. 2021; Chefer et al., 2021), and has also been steered to improve model performance (Shi et al., 2023). Darcet et al. (2024) showed that the newer ViT-based models (Qquab al., 2024; Radford et al., 2021) exhibit artifacts in their attentions, affecting their applicability for visualization and downstream tasks. These artifacts were connected to high-norm tokens that emerge in the Transformers.
High-norm tokens in Transformers. Transformers tend to create high-norm tokens during their internal computation, when trained on language tasks (Xiao et al., 2024) or on vision tasks (Darcet et al., 2024). For language models, Xiao et al. (2024) showed that Transformers allocate excessive attention these high-norm tokens, and named them "attention sinks." Sun et al. (2024) demonstrated that "attention sinks" emerge due to previous massive activations in the residual stream. Yona et al. (2025) linked the emergence of "attention sinks" to the inability of language models to repeatedly generate a single token, and suggested a test-time fix by zeroing out the relevant activated neurons. For vision models, Darcet et al. (2024) demonstrated the emergence of high-norm tokens in low- informative areas and suggested retraining the model with extra tokens ("registers") to remove these large norms from the image patches. Wang et al. (2024) used a simpler fine-tuning approach in DINOv2 to avoid complete re-training. Nakamura et al. (2024) suppressed artifacts during inference by modifying last-layer attention, showing that it improved image clustering performance. In contrast, we remove high-norm outliers their source by editing the activations of the neurons that create them, aiming to eliminate their effect on later computations.
Explaining neural functionality in vision models. The role of individual neurons (post non-linearrty single channel activations) has been broadly studied in vision models, demonstrating that some neurons recognize low-level image features as well as high-level perceptual and semantic properties of the inputs (Schwettmann et al., 2023; Bau et al., 2017: Hernandez et al., 2021; Gandelsman et al., 2025; Dravid et al., 2023). Nevertheless, most of the research has focused on linking neural behavior to features of the input or output, neglecting other possible neural functionality that may not be related to any specific image feature. Robinson et al. (2024) discovered sparse neural activations that indicate the absence of features rather than serving as feature detectors. Sun et al. (2024) found massive activations in ViTs that operate as constant biases for attention layers. Differently, discover and edit neuron activations responsible for creating high high-norm tokens in ViTs to mimic registers.
3 Interpreting the outlier tokens mechanism in ViTs
As shown by Darcet et al. (2024), high-norm outlier patches emerge during inference in various pre-trained ViTs. These patches strongly draw attention from the [CLS] token, resulting in artifacts in the attention maps (Figure 1). Outlier patches appear primarily in areas that exhibit high similarity to their neighboring areas (e.g., uniform background patches). Moreover, they were shown to capture global image information and lose their local patch contents (pixel + position). In this section, we study how the outlier tokens emerge in ViTs during the forward pass and discover sparse set of neurons whose activations dictate the location of outliers. We use the term "neuron" to denote a single hidden unit in the MLP layers of Transformer block, i.e., the scalar output after the linear transformation and nonlincarity. We then show that we can edit these neurons to move the outlier positions. Our main analysis applied OpenCLIP ViT-B/16 (Cherti et al., 2023), with similar findings on DINOv2-L/14 (Oquab et al., 2024) shown in Section 1.
3.1 How do outliers emerge in ViTs?
Outlier patches appear after MLPs. To identify the Transformer component most responsible for outlier patches, we track the maximum norm of image patches after attention blocks and MLPs across 1000 ImageNet images (Deng et al., 2009). Figure shows that outliers appear after the MLP of layer 6 in OpenCLIP. We also measure the maximum weight the [CLS] token attends to any patch across all heads in each layer and observe that high attention occurs after the layer 6 MLP. This observation suggests that the MLP increases the norms of certain patches, consequently creating attention sinks.
small, consistent set of neurons activate highly on outlier positions. Examining layer 6, we find that just five MLP neurons exhibit consistently high contributions at the top outlier patch across images (see Section A. 1). When inspecting the activation maps of three such neurons (Figure 3, more in Section 10), we observe that they sparsely activate on all outlier positions, not just the top
3

---

Average Max Norms (Attention vs MLP)
Average Max Attention Score
Average Max Norm
150
Average Max Score
Attention
100
MLP
0.2
50
0.1
0
2
8
9 10
11
1
2
3
7 8 9 1011 Layer
Layer
Figure 2: Outlier patches appear after MIPs; attention sinks appear after outlier patches. Left:
Max across image patches (OpenCLIP ViT-B/16). Right: max attention scores of the [CLS] token in the last layer. In both plots, we average across 1000 images. The outlier norms and attention sinks occur in consecutive layers.
Input
Patch Norms
L6 Neuron 980
L6 Neuron 61
L6 Neuron 2372
Figure 3: Highly activated neurons on the top outlier activate on all outlier positions. We present activation maps of three neurons from layer 6 that activate highly on the top outlier patch. These maps near-perfectly align with the high-norm outliers ("Patch Norms").
outlier position. This suggests that these high-activating neurons are not position-specifii but rather, responsible for outliers generally. Given these observations, we develop method to automatically detect these neurons in the next section.
3.2 Register neurons
Based on our previous analysis, we hypothesize that small, consistent set of sparsely activating neurons control where outliers emerge. These neurons appear in the preceding layers before outliers form. Given their importance for the formation of outliers, we call them "register neurons."
Detecting register neurons. Based on our hypothe- sis, formulate simple algorithm to find register neurons in Algorithm 1. Our method finds neurons whose average activation at outlier positions con- sistently high across images. To detect outlier po- sitions (FINDOUTLIERS within Algorithm 1), we follow Darcet et al. (2024) and output the positions for which the norms of the corresponding image to- kens are above predefined threshold. Our algorithm searches for neurons preceding layers before out- liers start, set by the top_layer parameter. We output top_k: neurons with the highest average activations. We present discussion of hyperparameters in Sec- tion A.4. For OpenCLIP, we set paa_aayyerr_ = 5. the outlier threshold at 75, and top_k _ = 10. Since regis- ter neurons determine where outliers emerge, we can also intervene upon them to move outliers to arbitrary positions, as demonstrated next.
Algorithm FINDREGISTERNEURON.
Input: Image set T = (J..... Tar maxi- mum layer index top_ poplayer, number reg- ister
return top_k, ki number of neu- rons in each layer N
2: Output: top_k register neuruns
3: avg_act < OtopllaperxX instialize
array for average activations for all T
FindOutliers(.) get indsices of top-norm patches for & 0 top saplaayeree do for n t N
O
avg n] avg prg_acr(E.v n]
[0] Σpco (4t.v
end for end for
10:
1I:
12: return top_ neurons with largest ave_act
Moving outliers with register neurons. To demonstrate the importance of these register neurons, we can use them to "move" outliers to different image locations. We first apply FINDREGISTTER to detect the register neurons. We then modify their activation pattern during the forward pass for each register neuron, we copy the highest neuron activation across the tokens into the locations the tokens to which want to move the outliers. We zero out the activations of the neuron elsewhere.

---

Shifting Outliers to Random Patches
200
400
Other Patches
Frequency
Frequency
Randem Patch
200
Other Patches Random Patch
20
40
60
80 Norm Value
100
120
140
0.0
0.2
0.4
0.6
0.8
Attention Value
Figure 4: Intervening on activations of register neurons effectively shifts outliers to random patches and test-time registers. For all register neurons, copy their highest activation into selected patch and zero out the activations elsewhere. Left: norm of chosen random patch (yellow) and max norm of any other patch (blue). Right: [CLS] attention to chosen random patch (yellow) and max [CLS attention (blue) to any other patch. Our intervention can shift outliers to randomly selected patches well as test-time registers (see Section A.11.2).
Register neurons causally set the position of outliers. To test ability to move outliers to arbitrary spots, we assign the highest activation to a random patch and measure its last-layer output norm, the maximum norm of other patches, and the highest last-layer [CLS] attention, both to the selected outlier and any other patch. Successful interventions yield high norms and attention for the targeted patch, with low values elsewhere. As shown in Figure 4, modifying the activations of register neurons effectively controls where outliers emerge. In contrast, intervening on random neurons has little effect (Section A. 11.3.. Figure demonstrates that intervening on register neurons can make outliers appear in various counts and spatial patterns (e.g. a heart). We use this technique to mimic registers, as follows in the next section.
Adding registers at test-time
Given that register neurons can be used to move outliers arbitrarily, we investigate moving outliers outside the image entirely into extra tokens we call "test-time registers."
Moving outliers to added tokens. As outlier patches lose their local patch information (Darcet et al., 2024), it is undesirable to have them within the image since it may affect downstream performance. Previous work has suggested retraining ViTs with extra tokens to remove high-norm artifacts and attention sinks. However, retraining existing ViTs is expensive, so we propose to add an extra input token and move the outliers there with register neurons. Algorithm (Section A.3) with accompanying visualization in Figure 11, specifies our test-time register edit. At each register neuron, we copy the maximum patch activation to the register token, set all other token activations to zero, and resume the forward computation. Importantly, these outliers are essential to the model's internal computations and must appear within a token. For instance, zeroing out the register neurons' activation maps instead of moving the outliers causes OpenCLIP ViT-B/16's zero-shot ImageNet performance to drop 15%. Ablating a set of random neurons results in minimal drop: 69.3% 1.1.
Test-time register initialization. We initialize our extra token to be a vector of zeros. We assess several initialization strategies, but we find that they do not significantly affect the ability of test-time registers to store the high norms (Section A.6). Additionally, we focus our investigation on using one test-time register and report the impact of using more registers in Section A.5.
Outliers move outside the image after adding test-time registers. To evaluate whether test-time registers absorb the outliers, we apply our intervention and measure the max norms of image patch outputs and the test-time register. Our intervention results are nearly identical to the distribution of patch norms and [CLS] attention after shifting outliers random patches, previously shown in Figure 4 (see results for test-time registers in Section 11.2..). The image patches no longer have outliers, whereas the test-time register absorbs the outlier norms. This change is also present in the attention maps (Figure 5), which no longer have noisy artifacts and match the quality of attention maps from models with trained registers. See Section A.9 for attention maps in all model layers.
As there is open-source OpenCLIP trained with registers, only present comparisons DINOv2.
5

---

w/ Test-time Register
w/ Trained
Input
Original
Register
IN1k
CF10 CF100
[CLS] token
85.6
99.4
93,4
central token
73.3
98.0
88.1
outlier token
84.5
99.2
92.8
trained register
83.1
99.2
93.0
test-time register
84.5
99.1
93.0
NECHIRGAN
Table I: Linear probing classification re- sults (DINOv2 ViT-I/14), Test-time reg- isters achieve higher performance on linear probing than non-outlier tokens, suggest- ing that they hold global information simi- larly to trained registers. They match the performance of outlier tokens, indicating that they have absorbed the role of outliers.
Figure 5: Qualitative results on attention maps w/ test-time registers. We present the last layer's 's mean [CLS] attention maps DINOv2 and compare them to the model with trained registers. Test-time registers produce similarly high-quality maps as trained registers.
Test-time registers hold global information. We verify that test-time registers encapsulate global image information (c.g., image class) similarly to trained registers (Darcet et al., 2024). To assess this, we perform linear probing on both trained and test-time registers for classification on Ima- geNet (Deng et al., 2009), CIFAR-10, and CIFAR-100 (Krizhevsky et al., 2009). We also compare their performance to the [CLS] token and token that corresponds to central patch in the image. As shown in Table I, the classification accuracy of test-time registers closely matches that of trained registers and is slightly lower than the [CLS] token performance. These results suggest that test-time registers, like their learned counterparts, effectively capture global image-level information.
5 Experiments
We evaluate how adding test-time registers affects the downstream performance of models trained without registers. We begin by detailing the evaluated models, then compare performance across classification, dense prediction, unsupervised object discovery, and zero-shot segmentation tasks, finding that test-time registers perform comparably to their retrained counterparts. Finally, we apply test-time registers to an tff-the-shelf vision- Languanl model to improve its interpretability. We present additional experiments preventing typographic attacks in Section A.8.
Models. We evaluate using DINOv2 (Oquab et al., 2024) and OpenCLIP (Cherti et al., 2023). For DINOv2, we use the publicly released ViT-L/14 checkpoints trained on LVD-142M, including both the standard model and variant trained with four registers. These two models serve as our baselines. while our approach applies edits to the standard model. For OpenCLIP, we evaluate the ViT-L/14 and ViT-B/16 models trained on LAION-2B (Schuhmann et al., 2022). As no checkpoints with trained registers are available for OpenCLIP, we only compare our approach to the standard models. We present results on larger models in Section A.7.
5.1 Classification and dense prediction
Linear probing. We conduct linear probing on ImageNet classification (Deng et al., 2009), ADE20k segmentation (Zhou et al., 2017), and NYUv2 monocular depth estimation (Nathan Silberman Fergus, 2012), following the procedure outlined in (Oquab et al., 2024; Darcet et al., 2024).
The results in Table 2 show that models edited with test-time registers maintain their performance on ImageNet classification with slight performance gains over the base model on segmentation and depth estimation tasks. These improvements are consistent with the performance gains observed in DINOv2 explicitly trained with registers. Thus, we demonstrate that intervening on model with test-time registers does not degrade the model's representations, and in some cases, even enhances performance on prediction tasks. While we observe small improvement in classification performance with the DINOV2 model trained with registers, we note that this was an independently trained model. Hence, the difference could be due to variations in initialization and training dynamics, rather than the effect of trained registers fixing artifacts. We report 95% confidence intervals for these results in Section A. 13 and find that performance differences remain consistent.

---

IN Top-1 1
ADE20k
NYUd
OpenCLIP
Acc.
mIoU 1
rmse
ViT-I/14
76.4
DINOv2 VIT-L/14
86.4
48.3
0.388
w/ test-time register 76.4
trained registers
86.7
49.1
0.382
ViT-B/16
71.3
w/ test-time register
86.4
49.1
0.378
w/ test-time register 71.3
OpenCLIP VIT-B/16
77.4
40.1
0.603
w/ test-time register
77.5
40.3
0.596
Table 3:
OpenCLIP zero- shot ImageNet classification. Adding test-time registers maintains performance.
Table Linear probing results. The performance of models with test-time registers maintains improves performance the origi- nal models, and largely matches models with trained registers.
Zero-shot classification. We evaluate zero-shot ImageNet classification with OpenCLIP to assess whether test-time registers preserve the semantic structure of the original representation space. Unlike linear probing, where a trained linear head can compensate for small shifts representation, zero-shot classification is more sensitive such changes. We compare zero-shot performance before and after applying test-time registers across both ViT-L/14 and ViT-B/16 in Table 3, observing that the intervention does not sacrifice performance.
5.2 Zero-shot segmentation
To validate that test-time registers result in more interpretable attention maps, we follow a standard protocol for evaluating heatmap-based explainability methods (Hooker et al., 2019) binarizing the heatmap into a foreground/bucckrround segmentation map, and evaluating its segmentation quality. We compute the mean attention map for the [CLS] token in the last layer (Chefer al., 2021) for the original model without registers, the model with test-time registers, and a model trained with registers if available. We evaluate zero-shot segmentation performance ImageNet- segmentation (Guillaumin et al., 2014), which contains 4,276 images from the ImageNet validation set with annotated segmentations.
Results. We present our zero-shot segmentation scores in Table 4. We also qualitatively compare the attention maps for DINOv2 with test-time and trained registers in Figure 5, demonstrating similarly high-quality attention maps. Using test-time registers on both DINOv2 and OpenCLIP outperforms the original model mean IOU and mAP with minimal drops in pixel accuracy. Test-time registers also show slight boosts over the retrained DINOv2 with registers on mean IOU and mAP, suggesting that test-time registers lead to attention maps clean those from trained registers.
5.3 Unsupervised object discovery
We evaluate models edited with test-time registers for unsupervised object discovery, extracting their features for downstream processing. Darcet al. (2024) found that the performance this task correlates with the smoothness of a model's attention maps, particularly for DINOv2, and showed that attention features from models with trained registers lead to better object localization.
Evaluation setting. We apply the LOST (Siméoni al., 2021) object discovery method on the PASCAL VOC 2007, PASCAL VOC 2012 (Everingham et al., 2010), and COCO 20k (Lin et al., 2014) datasets. Our evaluation involves sweeping over the key, query, or value features over the last four layers, and manually adding bias value to the Gram matrix of features as suggested by Darcet et al. (2024). We compare DINOv2 and OpenCLIP edited with test-time registers against the unedited models and, if available, those with trained registers.
Test-time registers improve unsupervised object discovery. We report correct localization (corloc) scores in Table 5. using the best result across key, query, and value features from the final four layers. We find that LOST performance improves significantly over the base model on features computed with our method for DINOv2 (increase of ~-1 corloc). Adding the test-time register closes the gap between the baseline model and model with trained registers, reaching within ~0-2 corloc. This suggests that the test-time register mimics the role of trained registers on this task. However, we note that test-time registers only marginally affect the results for OpenCLIP, phenomenon also observed in Darcet et al. (2024) with trained registers, Further analysis can be found in Section 14.
7

---

mloU
Acc.
mAP
VOCO7
VOC12
COCO
DINOv2 ViT-L/14
38.3
87.6
80.6
DINOv2 VIT-L/14
32.2
36,8
25,4
w/ trained registers
33.9
91.4
79.0
w/ trained registers
56.2
60.2
42.3
w/ test-time register
38.9
87.6
81.1
w/ test-time register
53,8
57,9
41.9
OpenCLIP ViT- 34.7
76.0
79.2
OpenCLIP ViT-B/16
30.8
35.9
23,4
w/ test-time register
40.0
74.2
82.1
w/ test-time register
30.9
35.9
23.6
Table 4: Zero-shot segmentation results on Im- ageNet. We use the last layer's ' mean [CLS] at- tention maps and find that test- time registers out- perform the original models and DINOv2 models with trained registers on mean IOU and mAP.
Table 5: Unsupervised Object Discovery with LOST (Siméoni et al., 2021). Adding test-time registers significantly boosts performance for DI- NOv2, effectively closing the gap with DINOv2 trained with registers.
5.4 Applying test-time registers to vision-language models
Beyond discriminative vision models, we explore the effect of test-time registers on vision-language modeling (VLM) tasks. Adding a test-time register the image encoder of VLM preserves performance on several multimodal benchmarks while improving the interpretability of feature maps.
Evaluation setting. Using Algorithm 1, we find set of 100 register neurons (out of 100K neurons) from CLIP ViT-L/14 vision encoder of LLaVA -aaaVA---mm-----..
3. We then create a test- sime register to
collect their activations and evaluate the model the eight main benchmarks from the VLMEvalKit toolkit (Duan et al., 2024). The benchmarks span across OCR, chart interpretation, visual Q/A, etc.
Test-time registers maintain performance. We report our benchmark results in Table 6. Overall, we observe that adding test-time register preserves performance for multi-moda pro- cessing. We do not pass the register to the LLM; we leave exploring its use as global memory for the LLM or leveraging multiple registers for adaptive computation to future work.
w/ Test-time Register
Benchmark
Baseline
Avg.
46.2
46,2
HallusionBench
28.6
29.4
MMVet
MMMU VAL
40.4
40.1
OCRRench
41.6
41.3
Test-time registers improve VLM interpretability. While adding a test-time register has only a minor impact on perfor- mance, it improves the interpretability of cross-modal attention maps, as illustrated in Figure 6. We visualize the norms of the patch outputs from the vision encoder, highlighting the pres- ence of outlier tokens. Next, we visualize the average attention aggregated across all layers and heads of the language model- from the token responsible for answering the question to the visual tokens. Without registers, the outlier visual tokens create artifacts in the language model's 's attention. However, adding test-time register removes outliers and results more interpretable text-to-vision attribution. This provides clearer insights into the model's behavior (e.g.. the attention map shows incorrect localization of the "man closest to us"). We provide more visualizations Section A.15.
MMStar
46.3
46.4
Muth
40.9
41.3
AIZD
MMBencbyl.1
68.5
68.0
Table 6: Adding test-time reg- ister maintains overall perfor- mance across multi-modal tasks.
Original Attention
w/ Test-time Register
Input
Patch Norms
Overlay
Patch Norms
Attention
Overlay
Does the man closest to us have a hat?
Model Response: Yes
Model Response: Yes
Figure 6: Test-time registers improve interpretability of LLaVA-Llama-3-83 We visualize the patch norms of the vision encoder before projection and the average attention from the answer token to the visual tokens. We observe that outliers leak into the language model's 's attention to visual tokens, while adding test-time register mitigates this and leads to more interpretable maps.
aateps://hugiinggacc wwt.ttner/llaweeeeaee -lama-3-88

---

6 A mathematical model for register neurons
In this section, we present simple mathematical model describing how register neurons can induce high-norm tokens that attract excess attention. We then relate this behavior to our empirical findings. Prior work has examined the emergence of outlier tokens in large language models and proposed several explanations, most notably the no-op (no-operation) hypothesis (Clark et al., 2019; Kobayashi al., 2020; Bondarenko al., 2023), which attributes these effects to the softmax constraint enforcing that attention weights sum to one. As result, the attention operation forces aggregating some information from other tokens, even when current embeddings already contain sufficient information for the task. This constraint can direct excess attention towards low-information tokens, creating attention sinks (Xiao al., 2024). We show that, under certain conditions, register neurons can produce high-norm tokens that give rise to such attention sinks within the no-op framework.
6.1 Analytical model
Set-Up. We consider the MLP layer from the penultimate Transformer block followed by the full final block (attention + MLP) of a Vision Transformer without normalization layers. Let the input sequence
to the penultimate MLP be task-specific [CLS] token and n patch tokens: Fyls #1 ; ...In
(0) (0)
(0) R
The MLPs will consist of two linear layers (no bias) and an activation function Φ (e.g., ReLU or
GELU). We denote the weight matrices of the penultimate block's ' MLP as w-(")) E Rddddat, w-ll)
Rdaaxd, and those of the final block's MLP as w: E Rdddda W E Rdma There will be one attention head with identity projection matrices: We = WK = Wy = Wo = la E Rdxd Finally, the output task-specific head is linear projection that uses the [CLS] token's embedding for prediction: Whead E Rd where e the number of output classes (or regression targets). Our analysis is carried out in the regime where both in Whead are low-rank, i.e., rank(W in min(d, dmp) and rank heat) < rank(d, c). Hence, both matrices possess non-trivial kernels.
Proposition 1 (Register neuron induces attention sink and no-op attention) Lei u1 (W ).
be a register neuron and U2 = (WIl)) 1; be the corresponding row in the MLP's 's second weight matrix, with ||u2|| ([ 5,, 1l.l for + 1. If both u1, U2 E ker (2) n ker head) and a token I, is aligned with u1, i.e., xx (0) = Bug for some 3 >> 0, then x, becomes an attention sink and the attention layer has no contribution to the model's 's output.
(1)
Proof. See Section A.I.
Corollary (Register neuron induces implicit attention bias) The contribution of register neu- rons is equivalent to the attention mechanism with explicit bias terms (k', v') as in Sun et al. (2024):
V
Attention (iciionn(QQ,, K,V:',, = softmax [KT k1)
VT
Proof. See Section A.I.
6.2 Empirical validation OpenCLIP
This mathematical model captures three distinct observed behaviors of register neurons and high norm tokens. We validate this correspondence qualitatively and quantitatively. Notably, our framework admits an equivalent attention formulation augmented with explicit bias terms - values that can be derived directly from register neurons without any additional training.
(1) Task- -rreleatel Attention Sinks:
The token that achieves the attention sink behavior in our mathematical model lives in the kernel, null space, of the task specific head, indicating it is not informative of the task. This aligns with the observation that register neurons fire on seemingly random, uninformative regions such as background or uniform texture (e.g., see Figure 3). In the case of language models, attention sinks have been observed to appear in semantically low-ifformation tokens such <BOS> delimiters (Xiao al., 2024).
(2) Lack of Sink Ruins Performance: Our framework suggests that zeroing out the activation of a register neuron would disrupt the "no-op" attention behavior, thus unnecessarily altering the [CLS]

---

token from its intended representation and substantially degrading model performance. To test this, we zero-out the 10 register neurons in OpenCLIP ViT-B/16 and observe drop INIk zero-shot performance from 70.4% to 55.6%. As baseline, zeroing out a random set of 10 neurons over three trials results in minimal change: 69.3% + 1.1.
(3) Register Neurons Induce an Implicit Attention Bias: Corollary I aligns with prior obser- vations (Sun et al., 2024; Gu et al., 2024) that high-norm tokens induce an implicit bias term in the attention mechanism. Sun et al. (2024) proposed learning biases in the attention layers of large language models to remove outliers. Specifically, given the query, key, and value features from T tokens Q, K, V E 7xd for each attention head, they train additional parameters k', v E R in:
(0
k] +) vd
Attention (Q, K, K,KKKVVK V;k', v') softmax
(I)
To test that register neurons implicitly induce attention biases as predicted by Corollary 1, we use OpenCLIP ViT-B/16. For each attention head, k' and are set to the mean key and value vectors of the test-time register token, which captures the aggregate contribution of the register neurons, averaged across 1000 images. Instead test-time register, we zero out the register neurons and inject the constant vectors k' and v' directly into the attention computation as above interference. This maintains the 71 71.3% IN1k zero-shot performance while suppressing artifacts attention maps (Figure 7) and mitigating outliers completely from the residual stream (details in Section A.2).
Input
Original
w/ Attention Bias
w/ Test-time Register
Register-based attention bias mitigates artifacts. Mean [CLS] attention maps from the last layer of OpenCLIP ViT-B/16 show that attention bias terms derived from test-time registers (Equation (I)) suppress artifacts, matching the effect of explicitly using test-time registers.
Figure 7:
7 Discussion, limitations, and future work
uncovered a simple emergent mechanism VITs, a sparse set neurons that responsible for creating high-norm tokens in low-information image locations. Editing this mechanism at test-time allowed us to shift the high norms into additional registers, removing artifacts from patches and yielding more interpretable feature maps while preserving modestly improving downstream performance. Next, we discuss limitations of our analysis and conclude with future work.
While our analysis shows that we can steer the location of high-norm tokens, we only addressed one component type that is responsible for their creation neurons, while neglecting other possible elements that can contribute to their formation, such attention layers or positional encodings (Yang al., 2024). The edited tokens result slight performance differences with their learned counterpart (Table 1), suggesting that the test-time registers are not fully equivalent to the high-norm tokens. Finally, similarly to Darcet et al. (2024), we mostly focus on individual models (CLIP, DINOv2). We do not present results other, less commonly used, pretrained ViTs, and leave it for future work.
The mechanism that we found points an intriguing property about model neurons not all neurons have a feature-relan related role. Register neurons, for example, are responsible for igniting high-norm tokens an inngenendeeenneet role and cannot discovered by correlating their activations to the image features. Similar high-norm tokens have also been observed in language models (Xiao al., 2024; Dettmers al., 2022), suggesting that large language models may rely on a related mechanism. Uncovering other similar input-independent roles of neurons can shed additional light on the computational process deep neural networks. We plan to develop methodology for such automatic discovery in future work.
10

---

8 Acknowledgments
We thank Katie Luo, Lisa Dunlap, Yaniv Nikankin, and Arjun Patrawala for their feedback on our paper. AD is supported by the US Department of Energy Computational Science Graduate Fellowship. YG is supported by the Google Fellowship. Additional support came from the ONR MURI grant and NSF IIS-2403305.
References
Armen Aghajanyan, Sonal Gupta, and Luke Zettlemoyer. Intrinsic dimensionality explains the effectiveness of language model fine-tuning. In Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 1 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers), pp. 7319-73288 2021.
Hiroki Azuma and Yusuke Matsui. Defense-pret ppessx for preventing typographic attacks on clip. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 3644-3653, 2023,
David Bau, Bolei Zhou, Aditya Khosla, Aude Oliva, and Antonio Torralba. Network dissection: Quantifying interpretability of deep visual representations. In 2017 IEEE Conference on Computer Vision and Pattenn Recognition (CVPR), pp. 3319-3327, 2017. doi: 00.11099CVP.2201..3444
Yelysei Bondarenko, Markus Nagel, and Tijmen Blankevoort. Quantizable transformers: Removing outliers by helping attention heads do nothing. Advances Neural Information Processing Systems, 36:75067-75096 2023.
Mathilde Caron, Hugo Touvron, Ishan Misra, Hervé Jégou, Julien Mairal, Piotr Bojanowski, and Armand Joulin. Emerging properties in self-supervised vision transformers. In Proceedings of the International Conference on Computer Vision (ICCV), 2021.
Hila Chefer, Shir Gur, and Lior Wolf. Transformer interpretability beyond attention visualization. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). pp. 782-791, June 2021.
Mchdi Cherti, Romain Beaumont, Ross Wightman, Mitchell Wortsman, Gabriel Ilharco, Cade Gordon, Christoph Schuhmann, Ludwig Schmidt, and Jenia Jitsev. Reproducible scaling laws for contrastive language-iman image learning. Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 2818 282929 2023.
Kevin Clark, Urvashi Khandelwal, Omer Levy, and Christopher D Manning. What does bert look at? an analysis of bert's attention. In Proceedings of the 2019 ACL Workshop BlackboxNLP: Analyyyi and Interpreting Neural Networks for NLP, pp. 276 286, 2019.
Timothée Darcet, Maxime Oquab, Julien Mairal, and Piotr Bojanowski. Vision transformers need registers. In The Twelfth International Conference on Learning Representations, 2024.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hier- archical image database. In 2009 JEEE Conference on Computer Vision and Pattern Recognition, pp. 248-255, 2009. doi: 10.
5206848.
Tim Dettmers, Mike Lewis, Younes Belkada, and Luke Zettlemoyer. Gpt3, int8 (): 8-bit matrix multiplication for transformers at scale. Advances in neural information processing systems, 35: 30318-30332, 2022.
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x 16 words: Transformers for image recognition at scale. ICI.R, 2021.
Amil Dravid, Yossi Gandelsman, Alexei A Efros, and Assaf Shocher. Rosetta neurons: Mining the common units in a model 7oo. Proceedings of the IEFF/CVE International Conference on Computer Vision, pp. 1934-1943, 2023,
11

---

Haodong Duan, Junming Yang, Yuxuan Qiao. Xinyu Fang, Lin Chen, Yuan Liu, Xiaoyi Dong. Yuhang Zang, Pan Zhang, Jiaqi Wang, al. Vlmevalkit: An open-source toolkit for evaluating large multi-modality models. In Proceedings of the 32nd ACM international conference on multimedia, pp. 11198-11201, 2024.
Mark Everingham, Luc Van Gool, Christopher KI Williams, John Winn, and Andrew Zisserman. The pascal visual object classes (voc) challenge. International journal of computer vision, 88:303-338, 2010.
Yossi Gandelsman, Alexei A Efros, and Jacob Steinhardt. Interpreting the second-order effects of neurons in CLIP. In The Thirteenth International Conference on Learning Representations, 2025.
Xiangming Gu, Tianyu Pang, Chao Du, Qian Liu, Fengzhuo Zhang, Cunxiao Du, Ye Wang. and Min Lin. When attention sink emerges in language models: An empirical view. In The Thirteenth International Conference on Learning Representations, 2024.
Matthieu Guillaumin, Daniel Küttel, and Vittorio Ferrari. Imagenet auto-annotation with segmentation propagation. Int. J. Comput. Vision, 110(3):328-44 dec 2014. ISSN 0920-5691. doi: 10.1007/ sl 12660-014-0773399
Evan Hernandez. Sarah Schwettmann, David Bau, Teona Bagashvili, Antonio Torralba, and Jacob Andreas. Natural language descriptions of deep visual features. In International Conference on Learning Representations, 2021.
Sara Hooker, Dumitru Erhan, Pieter-Jan Kindermans, and Been Kim. A benchmark for interpretability methods in deep neural networks. In H. Wallach, H. Larochelle, A. Beygelzimer, F. d'Alché-Buc, E. Fox, and R. Garnett (eds.), Advances in Neural Information Processing Systems, volume 32. Curran Associates, Inc., 2019.
Edward J Hu, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, Weizhu Chen, et al. Lora: Low-rank adaptation of large language models. In International Conference on Learning Representations, 2022.
Laurent Itti, Christof Koch, and Ernst Niebur. A model of saliency- visual attention for rapid scene analysis. IEEE Transactions on pattern analysis and machine intelligence, 20(11): 2002.
Goro Kobayashi, Tatsuki Kuribayashi, Sho Yokoi, and Kentaro Inui. Attention is not only weight: Analyzing transformers with vector norms. Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP). Association for Computational Linguisties, 2020.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
Chumyuan Li. Heerad Farkhoor, Rosanne Liu, and Jason Yosinski. Mcasuring the intrinsic dimension of objective landscapes. In International Conference on Learning Representations, 2018.
Tsung-Y Yi Lin, Michael Maire, Serge Belongie, James Hays, Pictro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In Computer vision- ECCV 2014: 13th European conference, zurich, Switzerland, September 6-12, 2014, 4, proceedings, part 13, pp. 740-755. Springer, 2014.
Kazumoto Nakamura, Yuji Nozawa, Yu-Chieh Lin, Kengo Nakata, and Youyang Ng. Improving image clustering with artifacts attenuation via inference-time attention engineering. In Proceedings of the Asian Conference on Computer Vision, pp. 3396-3413, 2024.
Pushmeet Kohli Nathan Silberman, Derek Hoiem and Rob Fergus. Indoor segmentation and support inference from rghd images. In ECCV, 2012.
Maxime Oquab, Timothée Darcet, Théo Moutakanni, Huy Vo, Mare Szafraniec, Vasil Khalidov, Pierre Fernandez, Daniel Haziza, Francisco Massa, Alaaeldin El-Nouby, et al. Dinov2: Learning robust visual features without supervision. Transactions on Machine Learning Research Journal, pp. 1-31, 2024.
12

---

Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In International conference on machine learning, pp. 8748-8766 PmLR, 2021.
Brian S Robinson, Nathan Drenkow, Colin Conwell, and Michael Bonner. A sparse null code emerges in deep neural networks. In Proceedings of UniReps: the First Workshop Unifying Representations in Neural Models, pp. 302-314, PMLR, 2024.
Christoph Schuhmann, Romain Beaumont, Richard Vencu, Cade Gordon, Ross Wightman, Mehdi Cherti, Theo Coombes, Aarush Katta, Clayton Mullis, Mitchell Wortsman, et al. Laion-5b: An open large-scale dataset for training next generation image-text models. Advances in neural 2022.
information processing systems,
Sarah Schwettmann, Neil Chowdhury, Samuel Klein, David Bau, and Antonio Torralba. Multimodal neurons in pretrained text-only transformers. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 2862-2867, 2023.
Baifeng Shi, Siyu Gai, Trevor Darrell, and Xin Wang. Toast: Transfer learning via attention steering. arXiv preprint arXiv:2305. 2023.
Oriane Siméoni, Gilles Puy. Huy V Vo, Simon Roburin, Spyros Gidaris, Andrei Bursuc, Patrick Pérez, Renaud Marlet, and Jean Ponce. Localizing objects with self-supervised transformers and no labels. arXiv preprint arXiv:2 /4279, 2021.
Mingjie Sun, Xinlei Chen, J Zico Kolter, and Zhuang Liu. Massive activations in large language models. In First Conference on Language Modeling, 2024.
Carl Vondrick, Aditya Khosla, Tomasz Malisiewicz, and Antonio Torralba. Hoggles: Visualizing object detection features. In Proceedings of the IEEE International Conference on Computer Vision, pp. 1-8, 2013.
Haoqi Wang, Tong Zhang, and Mathieu Salzmann. Sinder: Repairing the singular defects of dinov2. In European Conference on Computer Vision, pp. 20-35. Springer, 2024.
Guangxuan Xiao, Ji Lin, Mickael Seznec, Hao Wu, Julien Demouth, and Song Han. SmoothQuant: Accurate and efficient post-training quantization for large language models. In Proceedings of the 40th International Conference on Machine Learning, volume 202 of Proceedings of Machine Learning Research, pp. 38087-38099. PMLR, 23-29 Jul 2023.
Guangxuan Xiao, Yuandong Tian, Beidi Chen, Song Han, and Mike Lewis. Efficient streaming language models with attention sinks. In The Twelfth International Conference on Learning Representations, 2024.
Jiawei Yang, Katie Z Luo, Jiefeng Li, Congyue Deng, Leonidas Guibas, Dilip Krishnan, Kilian Q Weinberger, Yonglong Tian, and Yue Wang. Denoising vision transformers. In European Confer- ence on Computer Vision, pp. 453-469, Springer, 2024.
Itay Yona, Ilia Shumailov, Jamie Hayes, and Yossi Gandelsman.
Interpreting the repeated token phenomenon in large language models. In Forty-second International Conference Machine Learning, 2025.
Matthew D Zeiler and Rob Fergus. Visualizing and understanding convolutional networks. In Computer Vision-ECCV 2014 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part I 13, pp. 818-833, Springer, 2014.
Bolei Zhou, Hang Zhao, Xavier Puig, Sanja Fidler, Adela Barriuso, and Antonio Torralba. Scene parsing through ade20k dataset. Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 633-641,2011
Jinguo Zhu, Weiyun Wang, Zhe Chen, Zhaoyang Liu, Shenglong Ye, Lixin Gu, Hao Tian, Yuchen Duan, Weijie Su, Jie Shao, et al. Internv13: Exploring advanced training and test-time recipes for open-source multimodal models. arXiv preprint arXiv:2504. 10479, 2025.
13

---

A Appendix
A.1 Proof of Proposition and Corollary
Set-Up. We consider the MLP layer from the penultimate Transformer block followed by the full final block (attention MLP) of residual Vision Transformer without normalization layers. Let the input sequence to the penultimate MLP be task-specific [CLS] token and patch tokens:
(0) (0) (0) Id The MLPs will consist of two linear layers (no bias) and an activation function cls #1
E
@ (e.g. ReLU GELU). We denote the weight matrices of the penultimate block's ' MLP as Wi( Rdxdup Will) E R xd and those of the final block's ' MLP as w E Rdxdab w
E R4 Xd
out
There will be attention head with identity projection matrices: Wo Wx Wr Wo
la TRdxd Finally, the output task head is linear projection that the [CLS] token's embedding for prediction: When E TRdxe, where c is the number of output classes (or regression targets).
Our analysis is carried out in the regime where both W W head are low-rank, i.e., rank(W; in <
min(d, (d, dmip) and rank(W (haaa) < rank(d, c). Hence, both matrices possess non-trivial kernels. This low-rank property consistent with the effective structure observed in practice (Li et al., 2018; Aghajanyan et al., 2021; Hu et al., 2022).
Proposition 1 (Register neuron induces attention sink and no-op attention) Let u1 = (W ,. be register neuron and ug (W 11 be the corresponding row the MLP's second weight matrix, with ||uz|| > [[ jj=1 for + 1. If both u1, U2 E ker(W ) ker(W head) and a token x, is aligned with ut, i.e., I's = Bug for some > 0, then 2g becomes an attention sink and the attention layer has no contribution the model's output.
Proof:
After the first MLP with a residual connection, the updated hidden states for the tokens are:
1)
x (0) +
cb>; (0) w:
in will) E fcls, 1,2,...,)) n}
x
This can be interpreted as adding unit vector v E Rd to the tokens modulated by some coefficient a;;
x. (0) + 0g4s;
i E {els, 1,2,..,,)
If (0) is aligned with the register neuron un (i.e., _ Bun for some 3 0), its activation
6, = -x= (0) un) = (BBJJu un) will positively scale the corresponding row in the second MLP matrix u2 As ||u2|| >> [I( )a=ll for j * 1, the update is dominated by the direction of u2, making it the principal contribution to x, in the residual stream. Thus, x R I + āgu2 = Bun + ug To make the norm and direction of the update explicit, we rewrite this (1) = Bu, + a, #2 and a₂ = à. //2l As the register neuron activation | - co, it follows that where U22 = ||
||w,]l, ||ā,|| > ||as||| for i / and ||=.5"1 > ||= for i +s
Given identity projection matrices during attention (i.e., the key, queries, values the tokens themselves), the attention update for the [CLS] token is:
ala
(1) dels
+
Σ
Pela. x
(4)
iE (c(css.
where Peta.i is the softmax attention weight assigned by the [CLS] token to token i:
exp(x. (I)T (1)
Pela.i
(1) (1) Eje(dta exp x x1)
(5)
14

---

(1)T As | + co, the dot product dels J. = | || cos(0) grows without bound even for small angle between the two token embeddings, leading the softmax to assign nearly all attention weight to r. Thus,
cle ats + _ = Eela + 3un + 0t32/
(6)
the [CLS] token representation after the attention layer.
Since, W1, 02 E ker(W..) in ), the [CLS] token representation after the second MLP layer is:
2) (2 w( z (3) (3) (2) (0 in
(7)
(1) + Bun + 02) + ((( + Bun + ( wour
(8)
els + Bun + 0,12 + 20 (1
(1)
(1) w/( w
(9)
Finally, the output prediction
(3) W head (I Bun ag + o(x w Whead cla
(10)
(#de ( Wheadd
(1)
(11)
since u, U2 E (Wrrd This is equivalent to the forward pass without the attention layer, thus exhibiting the "no-op" attention behavior.
Remarks. In this proof, we assumed || > ([ jell for j * 1. In practice, we observe that the register neurons' corresponding rows in the MLP's second weight matrix have specific high norm dimensions (Figure 25).
Corollary (Register neuron induces implicit attention bias) Given the aforementioned set-up, the contribution of register neurons is equivalent to the atlention mechanism augmented with explicit bias terms (k', )') as Sun al. (2024):
V
Attention Q, K, V;K', K.," v') ) = softmax (Q [KT k1)
vT
Proof:
As our set-up uses identity projection matrices during attention (i.e., the key, queries, values are the tokens themselves), the attention mechanism is:
Attention(Q, K, V;x', softmax (X [XT x1)
X x
(12)
where E RRad is the stacked representations of n tokens. From Equation (6), the attention update for the [CLS] token can be decomposed into contribution from the sink token prior to the first MLP and from the register neuron:
I Ieds
adde + (1)
x
+
Bug pro-MLP sink token.
Ckg Up
(13)
register neuron contribation
Based on the proof for Proposition 1, as the register neuron activation ||ä,ll ~ co, follows that ||a,]l, ||ق=|| > ||æil| for i * and |æe >> | for * s. In other words, as the register neuron activation grows unboundedly, dominates the sink token representation and the sink token achieves a significantly larger norm than all other tokens. As ||= + co, the dot (1)T (1) = |لقم | cos(O) grows without bound even for small angle 0 between product ats x>
the two token embeddings, leading the softmax to assign nearly all attention weight to xz! (1) Thus, the attention update is
(2) 2 cis z + xx =xdl 3un C2
(1)
(14)
15

---

As the register neuron activation | + oc, it follows that ||asll: ||,,ll > B. We take a leading order approximation to simplify Equation (14)
(2) (1) cla ~ Fls + 02
(15)
similar update rule holds for any arbitrary token i:
2)
x;
(1)
02
E (cls, 1,2
(16)
This update can be achieved by plugging in the register neuron contribution 0,02 into x' in Equa- tion (12):
Attention(Q. (Q, V,,,V,,,,VV = softmax [XT a2v2))
X a2V2 T
(17)
Using a similar argument from the proof for Proposition 1, as ||a=|| + oc, for any token index i, the
dot product x. (1)T (Ox,"2) || ||0,v||| cos(O) grows without bound even for small angle
between the two vectors, leading the softmax to assign nearly all attention weight to 0g12. Thus, the update representation for token i after this augmented attention is:
2)
(1) + U2
E (cls, 1,,,
(18)
which is equivalent to Equation (16), thus showing that register neurons induce a bias term in the attention mechanism. This suggests that directly plug in the contribution of register neurons into the attention mechanism as in eq. (17), without the need for a test-time register. We investigate this in the next section.
A.2 Removing outliers with attention biases
While we focus on shifting outliers outside the image in this work, high-norm outliers still persist in the extra test-time register. Here, we propose preliminary method to eliminate these artifacts without additional register tokens, by using test-time attention biases to fully remove high-norm outliers from the residual stream.
Incorporating attention biases at test time. Sun al. (2024) observed that language and vision Transformers have massive values at certain dimensions and proposed to remove them by incor- porating attention biases during training. Specifically, given the query, key, and value matrices Q, K, E RTxx for each attention head, they train additional parameters k,, k'v', Rd such that
(
[ Vd
K]
Attention(Q) K, KV softmax
VT
propose to create these attention biases in OpenCLIP ViT-B/16 training-free by approximating the effect of a test-time register on the attention computations. To set k' and v' for each attention head, we compute the mean key and value vectors of test-time register token across 1000 images. At test-time, we zero out the activations of register neurons using the parameters from Section 3.2.
Results. We report zero-shot ImageNet performance in Table 7. Zeroing out the register neurons leads to significant performance drop, but this drop is fully recovered by introducing the attention bias, which restores the model's s original performance. This suggests that zeroing out registers effectively removes outliers, while the attention bias approximates their influence at test time. Importantly, we no longer observe high-noru outliers across all layers (Figure 8). We also find that attention biases create clean attention maps free of artifacts comparable to using test-time register (Figure 9), Our findings support the claim by Sun al. (2024) that registers primarily function as attention biases. Although massive activations are relatively modest in Vision Transformers (e.g., < 500), they can exceed the mean activation by up to 10,000x in language models, creating challenges for quantization- where specialized methods are often needed to handle such outliers (Xiao et al. (2023)). Our results suggest that these large activations can be controlled without any additional training overhead. We leave the application of our method to the language domain for future work.
16

---

Averaged Max Patch Norms Across Layers
160
140
Original
120
w/ Attention Bias
100
Norm
80
60
40
20
0
2
4
10
Layer
Figure 8: Averaged max patch norm across all layers OpenCLIP-B/16 using attention biases. We find that using attention biases completely removes the presence of high-norm outliers from the residual stream.
Input
Original
w/ Attention Bias
w/ Test-time Register
Figure 9: Using attention biases produces similarly clean attention maps using test-time register. We compute the attention map of the [CLS] token averaged across the attention heads of the last layer OpenCIIP--B/I finding that both attention biases and test-time registers remove artifacts.
OpenCLIP
Acc.
ViT-B/16
71.3
w/ zeroed register neurons
55.6
w/ attention bias
71.3
Table 7: Creating attention biases at test-time maintains zero-shot ImageNet performance. Zeroing register neurons significantly drops performance, but attention biases recover the loss.
17

---

A.3 Algorithm overview
We provide broad overview of Algorithm and Algorithm accompanied by illustrations of their execution. To find register neurons with Algorithm I, we compute the average activation of each neuron on high-norm patches
an image set and return the top_k neurons with the highest values (Figure 10). Using these discovered register neurons, we implement a test-time register by initializing dummy token vector of zeros which passed forward along with the regular tokens. According to Algorithm 2, whenever a register neuron is encountered during the forward pass, the maximum register neuron activation across the tokens is copied into the test-time register and the activations of this register neuron are zeroed-out elsewhere (Figure 11).
Layer Neuron Activations
Layer top, layer Neuron Activations
Layer layer Patch Norms
Attention
MLP
MLP
MLP
MLP
Figure 10: Finding register neurons. Our register neuron discovery algorithm returns the neurons with the highest activations on outlier patch locations.
Zero- Zero-Out Mop
Attention
MLP
MLP Out
Patch Embed
Shift
Max Activat oF
Intialize Test-tire Register
Figure 11: Test-time register intervention. During the forward pass, the max activation from each layer's register neuron is shifted to the test-time register. The register neuron activations then zeroed-out over the other tokens, and the inference computation proceeds.
Algorithm FINDRECISTERNNERRNS
Input: Image set (I....,, IM], maximum layer index top jop_aaye, number of register neu- rons to return top_k, number of neurons in each layer N
Algorithm SHIFTKEGISTERNEUURNSS
List of register neuron indices in this layer array of neuron activation maps T to- kens produced by this layer R
Input:
2: Output: top_k register neurons
avg_act f- Ozop_ initialize
2: Output: updated A
array for average activations
3: for all E R do
4: for all 1: do
4: A[-1,r]
max Altr set
5: O FindOutliers4.) get indices
test-time register token (idz -1) to man register neuron activation
of top-norm patches
l. to top payer do for n = to N - do
5: value over all tokens
7:
L, + 0# sero-out register
8:
avg_act(e, + To Σ Epeo activationg, (I. # avg.
avg_act n)
neuron activation for all other tokens
6: end for
act activation of neuron on outlier
7: return A # proceed with forward pass
patches
9: end for
10: end for
11: end for
12: return top_A neurons with largest avg_act
18

---

A.4 Hyperparameter Selection
Algorithm relies on three hyperparameters: (1) the outlier threshold, (2) the index of the highest layer we search up to when identifying register neurons, and (3) the number of register neurons to return. The first two are straightforward to set using simple heuristics. Specifically, the outlier threshold can be defined using the classical criterion of three standard deviations above the mean patch norm. The second, top_ layer, is chosen as the layer at which outliers first emerge. Setting the number of neurons to return is slightly more involved, relying on sweeping top_k k until the outliers are suppressed. However, this is manageable in practice since the number of register neurons is sparse. We test how scalable this approach is in Section A.7.
A.5 Ablating number of register tokens
In the main text, we focused on evaluation using a single register. Here, we examine the impact of employing multiple registers. Following the analysis from Sun et al. (2024), we separate the influence of high-norm tokens on the attention output (i.e. after multiplication with value features). The attention output at each token can be decomposed into two components: value contributions from the register tokens R. and value contributions accumulated over the [CLS] and patch tokens.
Attention K,K,V), Σntn
Σ p ER
Σ PLT
(19)
registers contribation
non-registers contribution
where pf is the attention weight of query token t to token i, and u, is the value embedding associated with token i.
Experimental setup for test-time registers. Given Equation (19), we analyze the contribution of test-time registers to the value updates of all other tokens in the final attention layer of DINOv2 ViT-L/14. We first compute the value update for each token across the ImageNet validation set using a single test-time register. Then, we vary the number of registers and, for each setting, compute the cosine similarity between the resulting value update and the one obtained with single register, averaged over all tokens. Since all test-time registers are initialized to zero, we break symmetry by randomly assigning which test-time register receives the outlier register neuron activation. Thus, each test-time register holds the activations from a different set of register neurons.
Increasing the number of test-time registers beyond one has a negligible impact. Our results in Table show that increasing the number of registers has marginal impact on the internal computation of the model. We see the qualitative effect of this on the last layer's [CLS] token attention map averaged across all heads in Figure 12. One test-time register removes all the high- norm artifacts from the original model's s attention map. We then evaluate the impact downstream performance using a linear probe on the NYUd depth estimation task. Overall, we find that adding more test-time registers beyond one does not significantly change performance. We note that there is a slight degradation in performance beyond three test-time registers, although performance remains higher than without registers. These results align with the finding from Sun et al. (2024) that register tokens act as implicit attention biases. Thus, a single register token can be sufficient to induce the
Test-time Registers
Cosine Sim. w.r.. 1 Register
Test-time Registers
NYUd rmse |
1.000
0.3876 + 0.0014
0.998
0.3774 4: 0.0013
3
0.995
0.3771 + 0.0014
0.991
0.3785 0.0014
0.985
0.3791 + 0.0017
5 0.3795 + 0.0016
Table 8: Cosine similarity between value updates from one test-time register and increasingly larger sets of register tokens. Increasing register count beyond one has marginal effect.
Table 9: NYUd RMSE for DINOv2-L/14
with varying numbers of test-time registers. Increasing the number of registers beyond one has minimal gains.
19

---

Input
Original
W/ Test- time
Register
Teat-lime Reglaters
w/ 3 Test-lime
Registers
Test-cine Registers
Test- fest-time Registers
Figure 12: One test-time register is sufficient to remove artifacts. We increment the number of test-time registers where each register holds the activations from a different set of register neurons. The last layer's ss average [CLS] token attention map from DINOv2 ViT-L/14 does not significantly change with more test-time registers.
Input
Original
Zero Init.
Mean Init.
Random Init.
Figure 13: Different test-time register initialization strategies yield similar attention maps. We experiment with three different initialization strategies and find that they do not impact the test-time register's ability hold high norms and clean up attention maps.
same value update across tokens and clean up internal features. We further corroborate this behavior on trained registers next.
Experimental setup for trained registers. We use DINOv2 ViT-L/14 trained with four registers and calculate the value update contributions from each of the four registers to both image patch tokens and the [CLS] token. To approximate their collective effect with single token, we construct a synthetic register by assigning, for each embedding dimension, the value (including sign) with the largest absolute magnitude across the four trained registers. We then compute the value update induced by this synthetic register and measure its cosine similarity with the original update from the four-register setup, averaged over all tokens.
Multiple trained registers can be approximated by one token. We obtain a cosine similarity of 0.834 between the value update from four registers and from the one constructed token. This suggests that a single register can retain the majority of the representational effect multiple trained registers. This suggests that the main role of trained registers may be holding large activations. However, since the cosine similarity is not 1.0, this implies that the registers may also involve additional mechanisms, beyond simply holding large activations, in contributing the model's s behavior.
A.6 Evaluating different initial values for test-time registers
Test-time register initialization strategies. We experiment with various initialization strategies for the test-time registers and evaluate their performance through linear probing on ImageNet, CIFAR1O. and CIFAR 100 classification tasks. Specifically, we test three initialization methods: initializing the token zero, initializing it with Gaussian distribution matching the mean and standard deviation of the patch tokens, and initializing it to the mean of the patch tokens.
Different initializations produce similar results. All three approaches yield similar probing perfor- mance reported in Table 10. We attribute this outcome to the fact that the primary contribution of the register during attention comes from the large activations it holds, while the other values, which are much smaller in magnitude, have little impact on the final result. In Figure 13, we visualize the last layer's average [CLS] token attention map from DINOv2 ViT-L/14, and observe that different ini- tialization strategies do not significantly impact the test-time register's ability to remove artifacts.
INIk CF10 CF100
[reg] (zero init.)
84.5 99.1
93.0
[reg] (rand. init.)
84.6
99.2
92.8
[reg] (mean init.)
84.5
99.1
92.9
Table 10: Image classification via linear probing the test-time register token (DI- NOv2 ViT-L/14). We sweep over different initialization strategies for the token and find that they yield similar results.
20

---

Original
w/ Test-time Register
Input
Patch Norms
Attention
Patch Norms
Attention
Figure 14: Mitigating artifacts in ViT-6B. Using test-time register removes artifacts from the [CLS] attention map.
VOC 2007
VOC 2012
COCO 20k
Intern ViT-6B w/ test-time register
30.3
35,4
22.4
41.6
48.7
32.7
Table 11: Unsupervised Object Discovery with LOST (Siméoni al., 2021). Using test-time
register boosts LOST performance on IntervViT-6B3 one of the largest open-source ViTs.
A.7 Intern VTT-6B
To test the scalability our approach, we apply our analysis from Section to Intern ViT-6B, one of the largest publicly available vision transformers (Zhu et al., 2025). We find that outliers form layer 29 (out of 45). We then tracked the max norms across image patches at the output layer, and found that outlier patch norms reach up value of 7000, while the median patch norm value is 332 and the standard deviation is 396. Using Algorithm 1, we then identified 300 register neurons out of total of 576,000 candidate neurons responsible for driving outlier formation. When apply test-time register with these register neurons, the maximum output patch norm at the output layer only reaches 608 average, effectively mitigating the outliers.
To assess the downstream impact, we ran unsupervised object discovery using the LOST algorithm (as in Section 5.3) since Darcet et al. (2024) found that the performance this task correlates with the smoothness of a model's attention maps. We report the correct localization (corloc) results below with and without test-time register on Intern ViT-6B, and observe up to 13-point correct localization improvement.
A.8 Typographic attacks
Darcet et al. (2024) showed that outlier patches retain less local information by demonstrating that their pixel/position information is harder to recover with linear probe compared to normal patches. However, this analysis leaves open the possibility that local information at outliers might still be redistributed to other patches and indirectly influence the [CLS] token. We demonstrate here that this not the case and that outlier tokens mask local patch information. To evaluate this masking effect, we use typographic attacks as test-bed. Azuma & Matsui (2023) showed that CLIP is vulnerable to typographic attacks, where images can be misclassified based on written text in the image rather than the depicted object (Figure 15). We strategically place high-norm artifacts within image to mask out adversarial patches while preserving semantic content. This intervention is highly localized and relies activating only small fraction of neurons to produce targeted changes in the image representation.
Experimental setup. Following Azuma & Matsui (2023), we use OpenAl CLIP (Radford al., 2021) and identify register neurons with Algorithm on this model. Then, we local- ize the largest region of text in the image with OCR and, using the register neurons, move high-norm outliers onto the patches corresponding to the text location. We evaluate on the RTA-100 dataset (Azuma & Matsui, 2023), which contains approximately 1000 images with text written on top an object from one of 100 classes. by comparing CLIP's image embedding to the "real" and "attack" labels' text embedding.
calculate zero-shot accuracy
21

---

Input
Original
Shifted
Input
Original
Shifted
cookte
PVD
"DVD" X
"flower"
"cookie"
X
"bottle"
Figure 15: Qualitative results on typographic attacks. We show the patch norms of the last layer before ("Original") and after ("Shifted") intervening on register neurons. Shifting the outliers the text location masks the text in activation space and results in more accurate classification.
Results. Qualitative results in Figure 15 show that shifting the activation maps of ten register neu- rons early in the model's computation causes outlier patches to later appear corresponding to the text area. Table 12 presents the attack success rate and find that it significantly drops after our intervention, in- dicating that method masks part of the model's internal representation without harming semantic content. Our results suggest that patch information at outliers is lost from the model computation rather than transferred elsewhere. We also present results of an alternative masking procedure in the impul space, setting areas corresponding to text to the mean pixel value of the region. Our intervention matches this method's performance using only sparse modification repurposing CLIP's internal mechanisms by modifying roughly 0.02% of all neurons, compared to masking ~00 of the input. This highlights the influence of register neurons in guiding CLIP's visual representation and output behavior shifting outliers on top of the text areas performance- -wiee equivalent to the text never being present from the start. contract, editing three random sets of ten neurons has minimal effect (w/random neuron edit). The finding that the register neurons effectively mask patch information explains why mitigating the artifacts can improve dense prediction tasks.
Model
Attack success %
CLIP
50.5
w/ pixel ablation
7.6
w/ register neuron edit
7.5
w/ random neuron edit
50.5 + 0.2
Table 12:
Typographic attack success rate. We leverage register neurons to shift outliers to tokens at areas with text, effectively masking the adversarial text out in activation space.
A.9 Attention maps after intervening upon register neurons
We present attention maps from all layers for several example images, applying our intervention on OpenCIIP (Figure 16) and DINOv2 (Figure 17 and Figure 18). Our results show that intervening upon register neurons produces clean attention maps free of the high-norm artifacts.
A.10 Additional activation maps of register neurons
While our primary focus is on layer 6 of OpenCLIP (Section 3.1), also include additional activation maps highlighting neurons that strongly activate at the top outlier location. As shown in Figure 19, the most active neurons from earlier layers produce activation maps that align closely with the output patch norms. This consistent alignment supports our hypothesis Section 3.2 that a small number of sparsely activating neurons determine outlier locations OpenCLIP, we observe that actaaiiva neurons in earlier layers causally influence those later layers. In particular, interventions neurons in layer 5 or earlier lead to automatic changes in layer 6 activations (see Figure 4).
before they fully emerge. In
A.11
Additional OpenCLIP experiments
A.11.1 How do outliers emerge in ViTs?
A small subset of neurons have consistently high contribution at the top outlier position. To localize the set of neurons that drive outlier formation, we evaluate norm contribution of individual neurons at layer 6, where outliers appear. In Figure 20, we plot the distribution of activations for all layer neurons, comparing the average activation a top outlier patch with randomly selected non-outlier patch. We observe that five MLP neurons consistently have large activations on the top
22

---

w/ Test-time
w/ Test-time Register
Original
Original
Register
Layer O
Layer
Layer 1
Layer 1
Layer 2
Layer 2
Layer 3
Layer 3
Layer 4
Layer 4
Layer 5
Layer 5
Layer 6
Layer 6
Layer 7
Layer 7
Layer 8
Layer 8
Layer 9
Layer
Layer 10
Layer 10
Layer 11
Layer 11
Figure 16: Attention maps for OpenCLIP with test-time register. We show the mean [CLS] attention maps from all layers for several input images. Outliers appear layer 6 for the original model but do not appear with test-time registers, producing clean, interpretable attention maps.
23

---

w/ Test-time
w/ Trained
w/ Test-time w/ Trained
Original
Original
Register
Registers
Register
Registers
LO
L2
L3
L3
L4
L4
L5
L5
L6
L7
L7
L8
L8
L9
L10
L10
L11
L11
Figure 17: Attention maps for DINOy2 with test-time register (Layers 0-11). We show the mean [CLS] attention maps from layers 0-11 for several input images. As we do not intervene in these layers, there is difference in the attention maps.
24

---

Original
w/ Test-time w/ Trained
Original
w/ Test-time w/ Trained
Register
Registers
Registers
Registers
L12
L12
L13
L13
L14
L14
L15
L15
L16
L16
L17
L17
L18
L18
L19
L19
L20
L20
L21
L21
L22
L22
L23
L23
Figure 18: Attention maps for DINOv2 with test-time register (Layers 12-23). We show the mean [CLS] attention maps from layers 12-23 for several input images. Artifacts appear in uniform regions around layer for the original model. With test-time registers, attention maps become clean and reveal the images' main objects.
25

---

Input
Patch Norms
L5 Neuron 599
L4 Neuron 1468
L3 Neuron 1074
Figure 19: Additional activation maps of neurons that activate highly on the top outlier position. Even in layers before outliers emerge (layer 6), we observe that there exist neurons whose activation maps closely align with the output patch norms.
Normal Patch Activations
Top 1% Outlier Activations
3000
Frequency
Frequency
2000
10
1000
-0 0.10 -0.05 0.00 0.05
0.10 0.15
20
40
60
80
Activation Value
Activation Value
Figure 20: Neuron activation distributions differ between outlier and non-outlier patches. For all layer 6 neurons, average their activations on the top outlier patch and randomly selected non-outlier patch across 1000 images. Non-outlier patches have a more symmetric distribution (left), whereas outlier patches show skewed distribution with most activations near zero. Five neurons consistently exhibit high activations for outlier patches across images (right).
outlier, creating a skewed distribution, and low activations on non-outliers. To measure the effeet of these neurons, track their aggregate contribution to the residual stream over 1000 images by computing the norm and pairwise cosine similarities of their update vectors. As shown Figure 21, these neurons have consistent, high-norm contributions with effectively constant directions. In contrast, a random set of five neurons produces low-norm updates whose directions vary substantially.
A.11.2 Adding register at test-time
In Section 4, we moved outlier activations to an added, test-time register in OpenCI.IP and observed that it removes outliers from the image patches. After moving the outliers to single test-time register, we measured the test-time register's output norm, the maximum norm of image patch outputs, and the highest last-layer [CLS] attention, both to the test-time register and any image patch. We now present the full results Figure 22 and find nearly identical distribution to Figure 4, indicating that the image patch outliers have been moved the test-time register.
A.11.3 Intervening on random neurons
Intervening random neurons is ineffective for shifting outliers. While register neurons are highly effective for shifting outliers (Section 3), we evaluate a random baseline further justify our selection of neurons. We perform similar intervention method used for register neurons on random neurons in OpenCLIP ViT-B/16, but we find they are ineffective for shifting outliers. For each layer, randomly select the same number of neurons those in corresponding set of register neurons. During the forward pass, we intervene on the activation maps of these random neurons. We copy the highest activation across the original activation map randomly selected patch. In Figure 23, we observe that the selected patch does not absorb the high norms, demonstrating that using random neurons fails to shift outliers.
Intervening on random neurons with high activations similarly ineffective. We also test hypothesis that it is the high activations specifically of register neurons that cause the outliers to appear. Instead using the highest activation for the random neuron, we instead copy the highest activation from the corresponding register neuron. However, find similarly ineffective results in
26

---

Magnitude and Alignment of Residual Updates
1000
Random Nourons
1x10
Random Neurons
Frequency
Outlier Neurons
Frequency
8x10
Outlier Neurons
400
4x10
200
2x10²
0x10
2.5
7.5
-0.55
Norm Value
Cosine Similarity
Figure 21: Outlier neurons show stable, high-magnitude contributions. We track the overall residual stream update from five random neurons and five identified outlier neurons on the top outlier patch across I 1000 images. Outlier neurons contribute high norm updates (left) that are consistent in direction (right).
Shifting outliers to test-time registers
Image patches
Frequency
300
Frequency
150
Test: register
200
100
100
Image Test-time register
50
100
120
0.4
Norm Value
Attention Value
Intervening activations of register neurons effectively shifts outliers to test-time registers. For all register neurons, we copy their highest activation into the test-time register and zero out the activations elsewhere. The test-time register absorbs the high norms and attention from the [CLS] token, indicating that the image patches no longer have outliers.
Figure 22:
Figure 24. The inability of random neurons to shift outliers reinforces our hypothesis that register neurons (i.e., their decoder direction) specifically are crucial for outlier emergence.
Decoders of register neurons have large weights in certain dimensions. Sun et al. (2024) observe that outlier patches have massive activations in certain dimensions. Given this observation, extract the decoder weights -onl---t-iin for four register neurons from layer 5 and plot the distribution of weight magnitudes across dimensions in Figure 25. We find that certain dimensions (e.g. 579, 408) consistently have large weights across register neurons, which we do not observe with other random neurons. This property further supports the hypothesis that register neurons are the key mechanism that leads to outlier formation.
400
Non selesteee Patches
Non selected Patches
Selected Patch
Sel ected Patch
Frequency
300
Frequency
400
200
200
100
25
50
75
100
125
150
0.0
0.1
0.3 Attention Value
0.2
0.4
0.5
Norm Value
Figure 23: Intervening on random neurons does not shift outliers. We attempt to apply our intervention method with random neurons to move outliers to arbitrary patches. However, we find that the selected patch fails absorb the high norms, suggesting that our selection of register neurons is meaningful.
27

---

400
Non-selected Patches
sen-see Patches
Selected Patch
600
Selected Patch
Frequency
300
Frequency
400
200
100
200
25
50
75
100
125
150
0.0
0.1
0.2
0.3
0.4
0.5
Norm Value
Attention Value
Figure 24: Copying in high activations into random neurons does not shift outliers. To verify that it is the high activations in the corresponding register neuron channels that create outliers, we intervene upon random neurons but copy in the highest activation value from a corresponding register neuron. We find that the norm of the selected patch remains low, supporting our selection of register neurons intervene upon.
Neuron 599
Neuron 1869
Neuron 1419
Neuron 846
100
100
100
Frequency
Frequency
Frequency
Frequency
80
75
50
50-
50
40
25
25
25
0.00
0.10
0.00
0.10
0.00
0.05
0.10
0.00
0.05
0.10
Weight
Weight
Weight
Weight
Neuron 1234
Neuron 567
Neuron
890
Neuron 2345
50
50
60
Frequency
Frequency
Frequency
Frequency
40
30
20
20
10.
6.00
0.00
0.02
%.00
0.02 Weight
0.04
8.00
0.04 Weight
0.02
Weight
Weight
Figure 25: Decoder weights of register neurons have large values in specific dimensions. We take absolute value of decoder weights from layer 5 neurons in OpenCLIP and plot the distribution of magnitudes across dimensions. Top row: layer register neurons. Bottom row: layer 5 random neurons.
28

---

Average Max Norms (Attention MLP)
Average Max Attention Score
Average Max Norm
Actention
Average Max Score
0.4
MLP
400
0.3
0.2
0.1
6
12
12 14 16 Layer
Layer
Figure 26: Outlier patches appear after MLPs in DINOv2; attention sinks appear after outlier patches. Left: Max norms across image patches (DINOv2-L/14) Right: max attention scores of the [CLS] token in the last layer. both plots, we average across 1000 images. The increase max norms and emergence of attention sinks occur in consecutive layers.
Normal Patch Activations
Top 1% Outlier Activations
Frequency
Frequency
400
200
0
-0.1
0.0
0.1
0.2
0.3
2
3
5
Activation Value
Activation Value
Figure 27: small set neurons in DINOv2 have high activations on the top outlier patch (right). We average the neuron activations at layer 17 in DINOv2 for the top outlier patch and randomly selected, non-outlier patch. Both types of patches have skewed distributions. A small subset of neurons (<25) consistently exhibit high activations for outlier patches across images (right).
A.12 Investigating outliers in DINOy2
We outline similar investigation as presented Section on DINOv2-L/14 and find a sparse set of neurons that can be used to move outliers to arbitrary patches.
Outlier patches appear after MLPs. To evaluate whether the attention block MLP causes outliers to form, we plot the maximum norm of the residual stream across all patches for every attention and MLP component. In Figure 26, we observe that the outliers appear the MLP of layer 17, with attention sinks emerging soon after. These observations mirror Figure 2, where we also find a single layer in OpenCIIIP that outliers tend start appearing.
small subset of neurons shows consistently high activations before outlier patches. To investigate layer 17, evaluate the distribution of activations for its MLP neurons the top outlier patch, averaged across 1000 images. To identify the top outlier patch, we find the patch with the maximum in the 2nd-to-lass layer's output (layer 22). We choose the 2nd-to-last layer to identify outliers because the maximum patch norm drops in the last layer output (Figure 26), making it difficult to differentiate outliers from normal patches. In Figure 27, observe that the activation distribution for outliers is heavily skewed, with <25 neurons having disproportionnttly high activations. We find similar skew in OpenCIIP (Figure 20), suggesting that outliers form due sparse set of neurons across different ViTss.
Highly activated neurons activate all outlier locations. Having that small set of neurons highly activate on the top outlier, we now investigate whether these neurons highly activate across all outliers. We show three qualitative examples of activation maps in Figure 28 that closely align with the outliers. This alignment suggests that these highly activating neurons are responsible for outliers generally, which corroborates the results from OpenCLIP (Figure 3).
Detecting register neurons. Given that these highly activating neurons- which we refer to as "register neurons" -appear responsible for outlier formation, we develop automatic discovery algorithm to identify and intervene upon them shift outliers. To identify register neurons (Algorithm 1), we compute the average activations at outlier patches for all MLP neurons and return the top neurons.
29

---

Input
Patch Norms
L17 Neuron
L17 Neuron 133
Neuron 1427
Figure 28: Highly activated neurons on the top outlier in DINOv2 activate on all outlier positions. We present activation maps of three neurons from layer 17 that activate highly on the top outlier patch. These maps near-perfectly align with the high-norm outliers ("patch norms").
Shifting outliers to random patches
150
Other patches
Other patches Random patch
Frequency
Random patch
Frequency
20
100
10
50
100
200
300
400
500
600
0.0
0.2
0.4 0.6
0.8
Norm Value
Attention Value
Figure 29: Moving outliers in DINOv2 to random patches. For all register neurons, we copy their highest activation into selected patch and zero out the activations elsewhere. Left: norm of chosen random patch (yellow) and max norm of other patches (blue). Right: [CLS] attention to chosen random patch (yellow) and max [CLS] attention (blue) to any other patch. We find that the outliers shift to randomly selected patches, similar to OpenCLIP (Figure 4).
To move outliers to arbitrary patches, we follow the same intervention method from Section 3.2. For each register neuron, we copy the highest activation across patches into the selected patch and zero out the activations elsewhere. For applying A Algorithm to DINOv2, we set top_k = 45, highest_aayer 17, and the outlier threshold to 150.
Register neurons causally set the position outliers. Following Section 3.2, we evaluate whether our intervention method can move outliers to arbitrary patches in DINOv2. After intervening, measure the max norm the selected patch, max norm all other patches, and the highest last-layer [CLS] attentions to the selected patch and any other patch. We show in Figure 29 that our intervention successfully causes any selected patch to absorb the high norms and attention sinks. In Figure 1, we register neurons to shift attention artifacts to form arbitrary spatial patterns, further demonstrating our ability to control outliers. These findings mirror that of OpenCLIP (Figure 4), exhibiting the generalizability of our intervention across ViTs.
A.13 Extended Linear Probe Results
We present detailed linear probe results in Table 13 based on the experiments from Section 5.1. We run independent seeds for our linear probe evaluations and report 95% confidence intervals below. Performance differences remain consistent. Models with test-time registers maintain or slightly improve performance across all metrics, with comparable performance to models trained explicitly with registers.
A.14 Additional LOST object discovery results
LOST Algorithm Overview. The LOST unsupervised object discovery algorithm (Siméoni et al., 2021) begins by using patch representations to construct Gram matrix A. which encodes pairwise patch similarities. Next, we form an undirected patch similarity graph G where two nodes are connected if their similarity is positive. The initial seed is selected the patch with the lowest degree in the graph. During the subsequent expansion phase, the algorithm iteratively selects the next lowest-degree patch that positively correlated with the current seed, forming set of patches S.
30

---

IN
ADE20K
NYUd
Top-1 1
mloU
rimse
DINOv2 ViT-L/14
86.36 = 0.11
48.27 + 0.15
0.3876 + 0.0014
w/ trained registers
86.69 + 0.09
49.07
0.3823 + 0.0011
w/ test-time register
86.38 = 0.10
4.11
0.3774 = 0.0013
OpenCLIP ViT-B/16
77.42 = 0.08
40.14
0.6025 = 0.0017
w/ test-time register
77.53 + 0.07
40.29 + 0.09
0.5956 + 0.0016
Table 13: Linear probing results. The performance of models with test-time registers maintains or improves performance over the unedited models, and largely matches models with trained registers.
binary mask M is then computed by comparing all patch features those S and retaining the patches that, on average, have positive correlation with features in S. Finally, the bounding box of the connected component in M that contains the initial seed is used as the detected object.
Visualizing Intermediate LOST Steps. We visualize the impact of test-time registers on the
intermediate computation steps of the LOST object discovery algorithm in Figure 30. The first row (LOST score) displays the inverse degree of each patch in the similarity graph G. The second row shows the similarity between all patch features and the initial seed. The third row highlights the initial seed in yellow and illustrates the resulting seed expansion. For DINOv2, adding test-time register cleans up the intermediate maps used during LOST, translating to the performance gains in Table 5, Notably, the resulting intermediate steps resemble those obtained when using trained registers. Adding test-time register to OpenCLIP also refines the intermediate maps. However, since OpenCLIP already produces higher- higher-quality intermediate LOST maps compared to DINOv2, the resulting improvement in unsupervised object discovery is marginal, which was also observed by Darcet et al. (2024).
OpenCLIP LOST Feature Analysis. We visualize the LOST score for OpenCLIP using the key, query, and value projection features in Figure 31. Adding a test-time register results in maps that are more focused on the object. However, the value projection from the original model already filters out much of the noise in the background regions, making the baseline maps relatively clean. As result, the improvement from using test-time register is less pronounced compared to DINOv2. Darcet et al. (2024) suggest that for OpenCLIP, this may be the case since outliers seem to reside in the null space of the value projection layer.
DINOv2 W/ Test-lime Bagister
OpenCLIP
Original
Trained Registers
Original
w! Test-lime
Ragister
UST
Figure 30: Intermediate computation steps for LOST unsupervised object discovery. Adding
test-time register produces sharper intermediate maps.
Input
Keys
Queries
Values
Original
Wi Test-timee Haagglterr
Figure 31: OpenCLIP LOST maps using different features. Adding a test-time register sharpens intermediate maps for different features. However, gains are limited for the values since the value projection already suppresses background noise.
31

---

A.15 Additional VLM results
We present additional visualizations of LLaVA-Llama-
patch norms and attention maps in Fig- ure 32. As in Section 5.4, we visualize the patch norm map from the final layer of the vision encoder prior projection into the language model input space. The patch norm maps highlight the presence of sparse set of high-norm tokens, if any. We then visualize the average attention across all layers and heads of the language model from the response token to the visual tokens. We find that adding test-time register to the vision encoder of the VLM leads to more interpretable attribution of the text output to the visual tokens.
Original
w/ Test-time Register
Input
Patch Norms
Attention
Overlay
Patch Norms
Attention
Overlay
Which spot is the red car parked on?
Model Response: 28 X
Model Response: 28 X
How many trees are in this image?
Model Response:
Model Response:
Does the man closest
Model Response: Yes X
Model Response: Yes
a hat?
What color is the raincoat of the man on the left?
Model Response: Yellow v
Model Response: Yellow
What is the color of the shoes of
the woman with her hands up?
Model Response: Orange X
Model Response: Orange X
Figure 32: Additional visualizations of LLaVA-Llama---88 patch norms and attention maps. As in Figure 6, we show patch norms of the vision encoder and the average attention from the answer token to the visual tokens. Adding a test-time register mitigates high-norm artifacts in the vision encoder which would otherwise lead anomalous attention patterns in the language model.
32

---

NeurIPS Paper Checklist
The checklist is designed encourage best practices for responsible machine learning research, addressing issues of reproducibility, transparency, research ethics, and societal impact. Do not remove the checklist: The papers not including the checklist will be desk rejected. The checklist should follow the references and follow the (optional) supplemental material. The checklist does NOT count towards the page limit.
Please read the checklist guidelines carefully for information on how to answer these questions. For each question in the checklist:
You should answer [Yes], [No], or [NA].
[NA] means either that the question Not Applicable for that particular paper or the relevant information is Not Available.
Please provide short (1-2 sentence) justification right after your answer (even for NA).
The checklist answers are an integral part of your paper submission. They are visible to the reviewers, area chairs, senior area chairs, and ethics reviewers. You will be asked to also include (after eventual revisions) with the final version of your paper, and its final version will published with the paper.
The reviewers of your paper will be asked use the checklist as one of the factors their evaluation. While "[Yes] is generally preferable to "[No]" ", it is perfectly acceptable to answer "[No] providedd proper justification is given (e.g.. "error bars are not reported because it would be too computationally expensive" or "we were unable to find the license for the dataset we used"). In general, answering binary way, we
"[No] or "[NA]" is not grounds for rejection. While the questions are phrased acknowledge that the true answer is often more nuanced, please just use your best judgment and write justification to elaborate. All supporting evidence can appear either in the main paper or the supplemental material, provided in appendix. If you answer [Yes] to a question, in the justification please point to the section(s) where related material for the question can be found.
IMPORTANT, please:
Delete this instruction block, but keep the section heading "NeurIPS Paper Checklist",
Keep the checklist subsection headings, questions/answers and guidelines below.
Do not modify the questions and only use the provided macros for your answers.
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification:
We provide quantitative and qualitative results that support the claims.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results be expected to generalize other settings.
is fine include aspirational goals as motivation long is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: See Section 7.
33

---

Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-tex system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairesss.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [NA]
Justification: [NA]
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Answer: [Yes]
We provide a full algorithm description. We will open-source the code upon acceptance.
Justification:
Guidelines:
The answer NA means that the paper does not include experiments.
34

---

If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurlPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily new algorithm, the paper should make it clear how to reproduce that algorithm. (b) the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. the case of closed-source models, it may be that access to the model is limited in some way (e.g., registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Justification:
The paper will provide code upon acceptance.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips.. cc/ Suuiides/CodeSubiiseeet
for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https: CoodeeSmmsssioon
/ //nips. /twpss.ccppub//////// https/ccpppbllcguuueeeeeeoeeeeee
for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
35

---

Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification:
See the experimental settings in the text.
Guidelines:
The answer NA means that the paper does include experiments.
The experimental setting should be presented in the core the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [NA]
Justification: Most of our results are deterministic. We use open-source models and do not retrain any model.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report I-sigma error bars, but one should state it. The authors should preferably report a 2-simma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time exccution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: Our results do not require additional compute-heavy training
Guidelines:
The answer NA means that the paper does include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
36

---

The paper should provide the amount of compute required for each of the individual experimental runs as well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https: httpp:///neurippp wwwpeerrrs..cc.pllleeeeee
Answer: [Yes]
Justification: [NA]
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.
The authors should make to preserve anonymity (e.g.. if there special consid- eration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [NA]
Justification: [NA]
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility ML).
11. Safeguards
Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, scraped datasets)?
Answer: [NA]
Justification: [NA]
Guidelines:
The answer NA means that the paper poses such risks.
37

---

Released models that have high risk for misuse or dual use should be released with necessary safeguards to allow for controlled use of the model. for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [NA]
Justification: [NA]
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset used and, if possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. com datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re- re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information is not available online, the authors are encouraged to reach out to the asset's 's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification: [NA]
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification: [NA]
38

---

Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included the main paper.
According to the NeurIPS Code Ethics, workers involved in data collection, curation, other labor should be paid at least the minimum wage in the country of the data collector.
Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: [NA]
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent)
may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Question: Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods this research? Note that if the L.M used only for writing, editing, or formatting purposes and does not impact the core methodology. scientific rigorousness, or originality the research, declaration is not required.
Answer: [NA]
Justification: [NA]
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs any important, original, non-standard components.
Please refer to our LLM policy (https httpa///eeaaps..ceooeeeeeeeeeeee cctcc//eeeeeeecc//2////..///3 for what should or should not be described.
39


Reviews:
[{"review_id": "klRxqLCeZw", "reviewer": "Reviewer_xEEL", "summary": "This work follows previous works that introduced register tokens when training vision transformers to prevent the appearance of high norm tokens artifacts during inference. While register tokens are effective, they need to be trained alongside a model, making them impractical to include for already trained models.\nIn this work, the authors find that a small set of specific neurons can be identified that consistently cause these high activations over various images. Their activations on patches with artifacts can be shifted to a register added at test-time to fix the artifacts while preserving their global information. This approach allows to address the same issue as trained register tokens, but without the need for any training. The results show that these test-time registers maintain or improve performance on various tasks. The improvements are particularly strong on tasks that rely on having smooth feature maps, such as unsupervised object discovery, although it does not reach the level of trained register tokens.", "questions": "1. Can the authors define earlier what they mean by \"neurons\"? Understanding what a neuron consists of is key to this work, but a brief technical definition only appears in the related works (line 79). While this definition is complete, I think it is really critical to ensure that the reader grasps and visualises exactly what is meant by \"neuron\" as early as possible, potentially using a more extensive explanation. One potential way to do so would be to visualise attention maps stacked from different neurons.\n2. In the checklist, the authors claim that the full algorithm is described in Algorithm 1. However, this only details the process to identify register neurons, not the steps to move them to test-time registers. Can the authors please include a full description of the algorithm that includes register token creation at test time (see my comment on clarity)?\n3. Could the authors please clarify how Figure 3 (right) highlights that the small subset of <10 neurons are consistent across images? The fact that the neurons are consistent across images is very valuable, but I am currently failing to understand how that is visible from the results shown in the paper.\n4. Do the authors have any insights or results on why it is useful to shift register neuron activations to a new token at test-time, and if the model does indeed rely on attention to the added register to make predictions? It would seem like trained models could have learned to rely on positional encodings to affect the attention process, including to use the global information stored in register neurons. Is there a reason that we can expect the model to still be able to use the global information from the register neurons, even after shifting their activations to the register token? One additional test to validate that the model does use the test-time register could be to remove activations from register neurons (as is done when shifting them to the register token), but not include the register token.\n5. It would appear to me that the most critical aspect of preventing typographic attacks (Section 5.4) might be the modification of activations located in patches corresponding to text. Could the authors discuss more if it is critical that register neurons’ activations are used for this rather than simply setting zeros or random values in the same activations?", "limitations": "I find the limitations discussed in Section 6 sufficient.", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 4, "originality": 4, "strengths_and_weaknesses": "(+) = strength, (-) = weakness\n\n**Quality**:\n1. (+) The paper is well motivated and proposes a new solution to a real observed known issue.\n2. (+) The study of the mechanisms leading to the observed artifacts produces multiple valuable insights, leading to the design of a good solution.\n3. (+) The performance of the proposed test-time register token that gathers activations from register neurons is good, improving or maintaining performance of models. The value of this approach is strongly validated by all the results.\n4. (+) The design choices (number of register tokens, initialisation) are motivated with experiments in the appendix.\n5. (+) Limitations are clearly acknowledged and discussed. \n6. (-) The results do not seem to be from multiple runs for statistical significance (based on the Checklist answer 7), even though linear probes are trained. The consistency would be valuable to validate considering how close some of the results are (e.g., Table 2). \n7. (-) The approach requires setting some hyperparameters, and it is unclear how involved this might be for new models.\n8. (-) The paper does not discuss why we would expect that shifting activations to a new token would still be valuable to the model without any re-training. While the experiments validate that the test-time register keeps global information, they do not validate that it still has a role in the model's predictions, and that improvements in the results come from more than disabling the artifacts from register neurons.\n\n**Clarity**: \n1. (+) The paper is well structured. I find the flow to support a good understanding of the work, with a strong study of the mechanisms before introducing the proposed solution and then the results.\n2. (-) I find that the full practical approach would benefit from being described in more detail and in one place, either through an algorithm, figure, or mathematical formulation. Algorithm 1 helps make the register neuron identification process very clear, but I believe that how we get to a register token at test time is not as clear due to the information to understand the whole process being split over multiple sections. I believe that it would be helpful to have a clear location in the paper that would make this whole process very clear, so that the reader clearly understands that register neurons are fixed for new images, but outlier patch locations have to be identified, etc.\n\n**Significance**:\n1. (+) This paper has strong significance. It proposes a method that can potentially improve any off-the-shelf vision transformers without retraining, and presents valuable new insights about the functioning of the models studied.\n\n**Originality**: \n1. (+) The proposed solutions are grounded in original findings about the behaviour of specific neurons and lead to a novel algorithm to manage them, making this work original.", "was_revised": true, "final_justification": "The authors have addressed all my concerns in the rebuttal and have included new experiments that further validate their approach.\n\nConsidering the novel findings of this work (the existence of register neurons), the comprehensive proposition and validation of a practical algorithm to manage them (test-time registers), and the significant impact this can have (improving off-the-shelf transformers across diverse tasks without requiring expensive re-training), I recommend this paper for acceptance.", "rebuttal": "We appreciate the reviewer’s thoughtful comments.  We are glad that they found the submission to contain valuable insights with strong significance. We address their comments below.  \n\n**“Can the authors define earlier what they mean by ‘neurons’?...the reader grasps and visualises exactly what is meant by ‘neuron’ as early as possible”**\n\nGreat point. We will move the formal definition — post-nonlinearity, single-channel activations — earlier into the introduction. Specifically, given a token representation $ x_i \\in \\mathbb{R}^{d_{\\text{model}}}$, we define neurons as the individual scalar activations along each channel dimension after applying the first linear projection and nonlinearity in the MLP, i.e., $ \\phi(x_i W_{\\text{in}} + b_{\\text{in}}) $, where $ \\phi $ is the activation function. The individual channels for each patch token can be reshaped into a spatial grid to produce a visualization such as that in Fig. 4. We will also add a visual example of neuron-wise activation maps (e.g., stack maps similar to those in Fig. 4) as suggested. \n\n**“Can the authors please include a full description of the algorithm that includes register token creation at test time?”** and **“have a clear location in the paper that would make this whole process very clear.”**\n\nAdding a test-time register involves “initializ[ing] our extra token to be a vector of zeros” (L154) and then whenever a register neuron is encountered during the forward pass, “copy[ing] the highest [register] neuron activation across the tokens” (L133-134) into the test-time register and then “zero[ing] out the activations of the [register] neuron elsewhere” (L134-135). Here is the pseudocode for shifting the register neurons in each layer: \n```\nRegister_neurons: List[int], register neuron indices in this layer\nActivation_maps: List[# tokens, # MLP neurons], neuron activation maps produced by this layer\nSET_TT_REGISTER(register_neurons, activation_maps):\n    For neuron in register_neurons:\n        # set test-time register token (idx = -1) to max register neuron activation value over all tokens\n\tActivation_maps[-1, neuron] = max(Activation_maps[:, neuron])\n        # zero-out register neuron activation for all other tokens\n\tActivation_maps[:-1, neuron] = 0\n    Return Activation_maps\n# proceed with forward pass\n ``` \nWe will update Section 4 with the above pseudocode. We have also created a figure that overlays neuron activation maps on the ViT architecture, illustrating how register neurons are identified, fixed across new images, and how their activations are shifted into the test-time register. We will incorporate this figure to consolidate the full test-time register procedure.\n\n**“The results do not seem to be from multiple runs for statistical significance… e.g., Table 2).”**\n\nWe have now run 3 independent seeds for our linear probe evaluations from Table 2 and report 95% confidence intervals below. Performance differences remain consistent. We will update Table 2 in the paper. \n\n| Model Variant            | IN Top1 ↑        | ADE20k mIoU ↑     | NYUd rmse ↓       |\n|--------------------------|------------------|-------------------|-------------------|\n| DINOv2 ViT-L/14          | 86.36 ± 0.11     | 48.27 ± 0.15      | 0.3876 ± 0.0014   |\n| + trained registers      | 86.69 ± 0.09     | 49.07 ± 0.12      | 0.3823 ± 0.0011   |\n| + test-time register     | 86.38 ± 0.10     | 49.13 ± 0.11      | 0.3774 ± 0.0013   |\n| OpenCLIP ViT-B/16        | 77.42 ± 0.08     | 40.14 ± 0.11      | 0.6025 ± 0.0017   |\n| + test-time register     | 77.53 ± 0.07     | 40.29 ± 0.09      | 0.5956 ± 0.0016   |\n\n**“The approach requires setting some hyperparameters, and it is unclear how involved this might be for new models.”** \n\nOur approach relies on three hyperparameters: (1) the outlier threshold, (2) the index of the highest layer we search up to when identifying register neurons, and (3) the number of register neurons to return. The first two are straightforward to set using simple heuristics. Specifically, the outlier threshold can be defined using the classical criterion of three standard deviations above the mean patch norm. The second, *top_layer*, is chosen as the layer at which outliers first emerge. Setting the number of neurons to return is slightly more involved, relying on sweeping *top_k* until the outliers are suppressed. However, this is manageable in practice since the number of register neurons is sparse.\n\nTo test how transferable the approach is, we have applied our method to InternViT-6B [1], one of the largest publicly available vision transformers. We applied our analysis from Section 3 and found that outliers form at layer 29 (out of 45). We then tracked the max norms across image patches at the output layer, and found that outlier patch norms reach up to a value of 7000, while the median patch norm value is 332 and the standard deviation is 396. Using Algorithm 1, we then identified 300 register neurons (out of 576,000) responsible for driving outlier formation. When we apply a test-time register, the maximum output patch norm at the output layer reaches only 608 on average, mitigating the outliers. To assess downstream impact, we ran unsupervised object discovery (as in Section 5.3) and report correct localization (corloc) results below. We observe up to a 13-point corloc improvement.\n\n|          | VOC 2007 ↑ | VOC 2012 ↑ | COCO 20k ↑ |\n|------------------------|------------|------------|------------|\n| InternViT-6B           | 30.3       | 35.4       | 22.4       |\n| + Test-time register   | 41.6       | 48.7       | 32.7       |\n\n\nWe will update the manuscript to include this analysis, corresponding visualizations, and the discussion of hyperparameter selection from above. We are particularly excited that this approach scales to larger models, suggesting it might extend to large language models as well, where similarly high-norm outlier tokens have been observed [2]. \n\n[1] Chen et al. “InternVL: Scaling up Vision Foundation Models and Aligning for Generic Visual-Linguistic Tasks.” CVPR 2024. \n\n[2] Dettmers et al. “LLM.int8(): 8-bit Matrix Multiplication for Transformers at Scale.” NeurIPS 2022. \n\n\n\n**\"Could the authors please clarify how Figure 3 (right) highlights that the small subset of <10 neurons are consistent across images?\"**\n\nThe distribution in Figure 3 (right) shows the average activations across 1000 images of individual neurons on the top outlier patch. There are <10 neurons with extremely high average activations, suggesting that these neurons are on-average highly activated on the top outlier patch. As most of the average activations are close to zero, we opted to only take the top 1% of neurons to highlight the neurons with high average activations. We will include more activation maps (formatted like Figure 4) from the same neurons to further clarify that the set of register neurons is consistent across images.\n\n**“...why is it useful to shift register neuron activations to a new token at test-time, and if the model does indeed rely on attention to the added register to make predictions?”**\n\nTo verify that the model uses the added register, we experimented with removing the high norm activations from the register neurons (setting them to zero) without including the test-time register, as suggested.  On OpenCLIP ViT-B/16, zero-shot ImageNet performance drops from 70.2% to 55.6%, while adding the test-time register maintains the performance of 70.2%. As a baseline, zeroing out a random set of 10 neurons over three trials results in minimal change: 69.3%±1.1.  We then assessed attention patterns by computing the average last-layer attention from the [CLS] token to the test-time register across 1000 ImageNet images. The [CLS] token attends to the test-time register with an average score of 0.1657, while the median of the attention to all other tokens is only 0.0006.  Combined with Table 1, which shows that test-time registers hold global information, this strongly suggests that the model relies on the register during the internal computation. The [CLS] token actively reads from it, integrating its global information via attention. We will add this discussion to Section 3 to motivate why we must shift the register neuron activations rather than deleting them. \n\n\n**“… is it critical that register neurons’ activations are used for this rather than simply setting zeros or random values in the same activations?”**\n\n\nWe augmented the typographic attack results (Table 6) with the suggested baselines and present them below. First, we zeroed out the register neuron activations (w/ register neurons zeroed).  Second, we replaced the register neuron activations corresponding to the text area with values randomly drawn from a normal distribution matched to their activation mean and variance (w/ random register neuron value). Third, we applied the same editing strategy – shifting the max activations – but did so on a random set of ten neurons instead of the ten identified register neurons (w/ random neuron edit). For all stochastic baselines, we report the 95% confidence intervals over three runs below.  We find that using both the register neurons and their specific outlier activations are critical for masking the adversarial text in the model’s internal representations. This highlights that register neuron outlier activations are highly causal and editing them is performance-wise equivalent to the text never being present from the start (see pixel ablation baseline below).  We will update the table in the paper. \n\n|                    | Attack success % ↓ |\n|------------------------------|---------------------|\n| CLIP                          | 50.5                |\n| w/ Pixel Ablation             | 7.6                 |\n| w/ register neuron edit       | 7.5                 |\n| w/ register neuron zeroed     | 48.4                |\n| w/ random register neuron value | 48.2 ± 1.5        |\n| w/ random neuron edit         | 50.5 ± 0.2          |"}, {"review_id": "VOVzTBfL0f", "reviewer": "Reviewer_fpZR", "summary": "This work investigates the emergence of high-norm tokens caused by a sparse set of neurons focusing strong activations on outlier tokens. This phenomenon, observed in models like CLIP and DINOv2, degrades downstream performance. While prior solutions require retraining with learned register tokens to suppress these effects, the authors propose a training-free alternative: redirecting high-norm activations into a new, untrained token during inference. This method cleans attention maps, improves task performance, and matches the effectiveness of retrained models with register tokens, offering a practical fix for existing pre-trained models.", "questions": "Can you develop a theoretical framework based on simple models or simple arguments for register neurons?", "limitations": "yes", "rating": 5, "confidence": 1, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 2, "strengths_and_weaknesses": "Strengths: a thorough analysis of the mechanism behind the creation of high-norm tokens in ViT, proposing a training-free method to solve the problem, showing that it is comparable in quality to alternatives based on retraining. \n\nWeaknesses: it would have been interesting to have more theory on \"register neurons\" either from simple models, or simple arguments.", "was_revised": true, "final_justification": "The reply from the authors is satisfactory and introduce a new interesting perspective. I therefore recommend the paper to be accepted (my vote would be between 4 and 5).", "rebuttal": "We appreciate the reviewer’s thoughtful comments. Several papers have investigated the emergence of outlier tokens, particularly in large language models,  and have proposed various broad explanations for why they arise. One explanation is the so-called \"no-op\" (no-operation) hypothesis [1,2,3], which suggests that the Softmax constraint — requiring attention weights to sum to one — prevents the model from assigning zero weight to all tokens. As a result, the attention layer is forced to aggregate *some* information from other tokens, even when the current embeddings already contain sufficient information for the task. This often leads the model to allocate excess attention to specific, low-information tokens, a phenomenon known as \"attention sink\" [4]. Further empirical work suggests that these outlier tokens emerge to introduce an implicit, input-independent bias term into the attention mechanism [5,6]. While our submission aims to provide a mechanistic analysis of this phenomenon in ViTs along with a practical solution, in this response, we provide a simple mathematical model. Specifically, we illustrate how under certain conditions, \"register neurons\" can induce high-norm tokens that attract excess attention under the \"no-op\" hypothesis.\n\n## Setup\nWe consider the MLP layer from the penultimate Transformer block followed by the full final block (attention + MLP) of a residual Vision Transformer without normalization layers. Without loss of generality, let the input sequence to the penultimate MLP be a task-specific CLS token and two patch tokens: $x^{(0)}_{cls}, x^{(0)}_1, x^{(0)}_2\\in \\mathbb{R}^{d}$. Stacking them vertically will form our input $X\\in\\mathbb{R}^{3\\times d}$.  \n\nThe MLPs will consist of two linear layers (no bias) and an activation function $\\phi$ (e.g., ReLU or GELU). We denote the weight matrices of the penultimate block's MLP as $W_1^{(1)} \\in \\mathbb{R}^{d \\times d_{\\text{mlp}}}, W_2^{(1)} \\in \\mathbb{R}^{d_{\\text{mlp}} \\times d}$, and those of the final block's MLP as $W_1^{(2)} \\in \\mathbb{R}^{d \\times d_{\\text{mlp}}}, W_2^{(2)} \\in \\mathbb{R}^{d_{\\text{mlp}} \\times d}$. \n\nThere will be one attention head with identity projection matrices: $W_Q = W_K = W_V = W_O = I_d \\in \\mathbb{R}^{d \\times d}$. Finally, the output task-specific head is a linear projection that uses the [CLS] token's embedding for prediction: $W_{\\text{h}} \\in \\mathbb{R}^{d \\times c}$,  where $c$ is the number of output classes (or regression targets).\n\n## Analysis\nUnder the \"no-op\" hypothesis, the $x_{cls}$ embedding before attention has sufficient information for the task and does not need mixing with other tokens via attention. We will show how a \"register neuron\" can induce outlier behavior for token $x_2$. \n\nLet $(W\\_1^{(1)})_{:, 1}$ = $u\\_1 \\in ker(W_1^{(2)\\top}) \\\\cap ker(W^\\top_h)$ be a \"register neuron\" and the corresponding column in the second MLP matrix be $(W\\_2^{(1)})\\_{1, :}$  = $u\\_2$ $\\in ker(W\\_1^{(2)\\top}) \\\\cap ker(W^\\top\\_h)$. After the first MLP with a residual connection, the updated hidden states for the tokens are: \n\n1\\) $x^{(1)}\\_{cls}$ = $x^{(0)}\\_{cls}+\\phi(x^{(0)}\\_{cls}W_1^{(1)})W_2^{(1)}$\n\n2\\) $x^{(1)}\\_{1}$ = $x^{(0)}\\_{1}+\\phi(x^{(0)}\\_{1}W_1^{(1)})W_2^{(1)}$\n\n3\\) $x^{(1)}\\_{2}$ = $x^{(0)}\\_{2}+\\phi(x^{(0)}\\_{2}W_1^{(1)})W_2^{(1)}$\n\nThis can be interpreted as adding a vector in $\\mathbb{R}^d$ to the tokens modulated by some coefficient $\\alpha$: \n\n4\\) $    x^{(1)}\\_{cls} = x^{(0)}\\_{cls}+\\alpha_1v\\_1$\n\n5\\) $    x^{(1)}\\_{1} = x^{(0)}\\_{1}+\\alpha_2v\\_2$\n\n6\\) $    x^{(1)}\\_{2} = x^{(0)}\\_{2}+\\alpha_3v\\_3$\n\nIf $x^{(0)}\\_2$ is strongly aligned with the register neuron $u_1$ (i.e., $x^{(0)}_2 = \\beta u_1$ for some large, positive constant $\\beta$), its activation magnitude $\\tilde{\\alpha}\\_3 = \\phi(x_2^{(0)\\top} u_1)$ will be large and the corresponding column in the second MLP matrix $u_2$ will be the dominant direction added to $x_2$ in the residual stream. Thus, $ x^{(1)}\\_{2} \\approx x^{(0)}\\_{2}+\\alpha_3u\\_2 = \\beta u\\_1+\\alpha\\_3u\\_2$, where $\\alpha\\_3\\approx\\tilde{\\alpha}\\_3 \\gg \\alpha\\_1, \\alpha\\_2$ and thus $\\|x^{(1)}\\_{2}\\| \\gg \\|x^{(1)}\\_{cls}\\|, \\|x^{(1)}\\_{1}\\|$. \n\nGiven identity projection matrices during attention (i.e., the key, queries, values are the tokens themselves), the update to the [CLS] token after attention is $x^{(2)}\\_{cls} = x^{(1)}\\_{cls} + p\\_{cls}x^{(1)}\\_{cls}+ p\\_1x^{(1)}\\_{1} + p\\_2x^{(1)}\\_{2}$, where $[p\\_{cls}, p\\_1, p\\_2] = \\text{Softmax}([x^{(1)\\top}\\_{cls}x^{(1)}\\_{cls}, x^{(1)\\top}\\_{cls}x^{(1)}\\_{1}, x^{(1)\\top}\\_{cls}x^{(1)}\\_{2} ])$. \n\nAs $ \\|x^{(1)}\\_{2}\\| \\to \\infty $, the dot product $x^{(1)\\top}\\_{cls} x^{(1)}\\_{2} = \\|x^{(1)}\\_{cls}\\| \\cdot \\|x^{(1)}\\_{2}\\| \\cdot \\cos(\\theta)$ grows without bound even for small angle $\\theta$ between the two token embeddings, leading the Softmax to assign nearly all attention weight to $x^{(1)}_{2}$. It follows that:\n\n7\\) $x^{(2)}\\_{cls} \\approx x^{(1)}\\_{cls} + x^{(1)}\\_{2} = x^{(1)}\\_{cls} + \\beta u\\_1+\\alpha_3u\\_2 $. \n\nSince, $u\\_1, u\\_2 \\in ker(W\\_1^{(2)\\top})$, the update to the [CLS] token after the final block's MLP is\n\n8\\) $x^{(3)}\\_{cls} = x^{(2)}\\_{cls}+\\phi(x^{(2)}\\_{cls}W\\_1^{(2)})W\\_2^{(2)} = x^{(1)}\\_{cls} + \\beta u\\_1+\\alpha\\_3u\\_2 +\\phi(x^{(1)}\\_{cls}W\\_1^{(2)})W\\_2^{(2)}$\n\nFinally, the output prediction is:  \n9\\) $x^{(3)}\\_{cls}W\\_{h} = (x^{(1)}\\_{cls} + \\beta u\\_1+\\alpha\\_3u\\_2 +\\phi(x^{(1)}\\_{cls}W\\_1^{(2)})W\\_2^{(2)})W\\_{h}$.\n\nAs $u\\_1, u\\_2 \\in ker(W^\\top\\_{h})$, the output will be:\n\n10\\) $(x^{(1)}\\_{cls} +\\phi(x^{(1)}\\_{cls}W_1^{(2)})W\\_2^{(2)})W\\_{h}$ \n\nwhich is equivalent to the forward pass without the attention layer, thus achieving the \"no-op\" attention behavior. This formalism shows how a \"register neuron\" can induce a high norm token, an \"attention sink,\" and result in a null attention update in line with the \"no-op\" hypothesis. \n\n## Empirical Connections\n\n### (1) Task-Irrelevant Attention Sinks: \n\nThe token that achieves the attention sink behavior in this model lives in the null space of the task specific head, suggesting it is not informative of the task. This aligns with the observation that register neurons fire on seemingly random, uninformative regions such as background or uniform texture. \n\n### (2) Lack of Attention Sink Ruins Performance:\nSecondly, this model suggests that zeroing out the activation of a register neuron would disrupt the \"attention sink\" and \"no-op\" attention behavior. Thus, the attention would unnecessarily alter the [CLS] token—which was already sufficiently informative prior to attention—and degrade its representation. To test this, we zero-out the 10 register neurons in OpenCLIP ViT-B/16 and observe a drop in IN1k zeroshot performance from 70.2% to 55.6%. As a baseline, zeroing out a random set of 10 neurons over three trials results in minimal change: 69.3% ± 1.1. \n\n### (3) Register Neurons Induce an Implicit Attention Bias:\n\nWe empirically observe that register neurons exhibit a consistently high activation value regardless of input (see Fig. 3 of paper). In our mathematical model, the attention update for the [CLS] token (equation 7) thus reads in a constant high norm vector which serves as an additive bias term during the attention operation, in line with observations from [5,6]. Sun et al. (2024) [5] proposed learning bias terms in the attention layers of large language models to remove outlier tokens. Specifically, given the query, key, and value matrices $Q, K, V \\in \\mathbb{R}^{T\\times d}$ for each attention head, they train additional parameters $\\mathbf{k}', \\mathbf{v}' \\in \\mathbb{R}^{d}$ such that \n\n$$\n\\text{Attention}(Q, K, V; \\mathbf{k}', \\mathbf{v}') =\n\\text{softmax}\\left(\n\\frac{Q \\begin{bmatrix} K^T & \\mathbf{k}' \\end{bmatrix}}{\\sqrt{d}}\n\\right)\n\\left[\n\\begin{array}{c}\nV ;\\\\\n\\mathbf{v}'^T\n\\end{array}\n\\right]\n$$\n\nTo test that the register neurons implicitly induce attention biases, we use OpenCLIP ViT-B/16 and set $\\mathbf{k'}$ and $\\mathbf{v'}$ for each attention head to the mean key and value vectors of a test-time register token holding register neuron activations, averaged across 1000 images. At inference time, we disable this test-time register token and instead inject $\\mathbf{k}'$ and $\\mathbf{v}'$ directly into the attention computation as above (we still zero out the register neurons). This maintains the $70.2\\\\%$ IN1k zero-shot performance while reducing the average maximum output patch norm from $150$ down to $40$. The median patch norm is 25, indicating that outlier activations are effectively suppressed.\n\n\nWe have shown that this simple model demonstrates how register neurons can induce high-norm tokens and attention sinks in a simple setting, aligning with our empirical observations. If you find that this perspective is insightful, we can update the paper to include this analysis.\n\n\n[1] Clark et al. \"What does bert look at? an analysis of bert’s attention.\" ACL Workshops 2019. \n\n[2] Kobayashi et al. \"Attention is Not Only a Weight: Analyzing Transformers with Vector Norms\" EMNLP 2020. \n\n[3] Bondarenko et al. \"Quantizable transformers: Removing outliers by helping attention heads do nothing.\" NeurIPS 2023. \n\n[4] Xiao et al. \"Efficient Streaming Language Models with Attention Sinks.\" ICLR 2024. \n\n[5] Sun et al. \"Massive activations in large language models.\" COLM 2024. \n\n[6] Gu et al. \"When attention sink emerges in language models: An empirical view.\" ICLR 2025."}, {"review_id": "kQyZpMkTZn", "reviewer": "Reviewer_YCz7", "summary": "The paper addresses the issue of high-norm outlier tokens in Vision Transformers (ViTs), which can lead to noisy attention maps. Prior solutions required retraining models with additional learned \"register tokens.\" In contrast, the proposed method, test-time registers, offers a training-free alternative. It identifies a sparse set of \"register neurons\" responsible for generating high-norm activations and shifts these activations into additional, untrained tokens outside the image area. This redirection of outlier information results in cleaner attention maps, improved performance on downstream visual tasks, and increased robustness to typographic attacks.", "questions": ">  As no checkpoints with trained registers are available for OpenCLIP, we only compare our approach to the standard models.\n\n1. Could you please clarify why you have not directly compared with the numbers reported in (Darcet et al. (2024))?\n\n2. Please refer to the first and second points in **Weaknesses**.", "limitations": "Some of the limitations are discussed in Section 6.", "rating": 5, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "**Strengths**\n\n1. The proposed method is simple yet effective.\n2. The paper is clearly written and easy to follow.\n3. The effectiveness of the proposed method is analyzed across various downstream visual tasks (such as classification, dense prediction, zero-shot segmentation, and unsupervised object discovery).\n4. The demonstrated use case showing how this approach can mitigate typographic attacks is also interesting and represents the usefulness of the proposed approach.\n\n**Weaknesses**\n\n1. Darcet et al. (2024) have shown that these outlier tokens are present in larger model sizes (Large, Huge, and Giant). In the experimental results (e.g. Table 2), the effectiveness of the proposed method is not analyzed across different model sizes. \n2. In Table 5, the reported results for models with trained registers differ from those in Table 3 of  (Darcet et al. (2024)). Could you clarify the reason for this discrepancy? If the models used in their experiments differ from those in yours, why did you choose not to use the same models for a direct comparison?\n3. In Table 4, I think \"CLIP\" should be replaced with \"OpenCLIP\" to avoid confusion.", "was_revised": true, "final_justification": "My main concerns have been addressed. Therefore, I raise my score to 5.", "rebuttal": "We appreciate the reviewer’s thoughtful comments and questions. We’re encouraged that the reviewer found our approach both simple and effective, and appreciated its clarity and breadth of evaluation.  We address comments regarding model scale and evaluation below. \n\n**“Darcet et al. (2024) have shown that these outlier tokens are present in larger model sizes... the effectiveness of the proposed method is not analyzed across different model sizes.”**\n\nAlthough Darcet et al. (2024) qualitatively show the presence of outliers in DINOv2-Giant, they perform quantitative downstream evaluation using ViT-B and ViT-L variants (Section 3.1: Training Algorithms and Data). Similarly, we evaluate using ViT-B and ViT-L variants. For instance, we use OpenCLIP ViT-B/16 and DINOv2-L/14 for linear probing evaluation as mentioned L181-186 in our manuscript. We will update the tables to explicitly note the model sizes used.\n\nWe fully agree with you that evaluating at even larger scales is valuable. To that end, we have applied our method to InternViT-6B [1], one of the largest publicly available vision transformers. We applied our analysis from Section 3 and found that outliers form at layer 29 (out of 45). We then tracked the max norms across image patches at the output layer, and found that outlier patch norms reach up to a value of 7000, while the median patch norm value is 332 and the standard deviation is 396. Using Algorithm 1, we then identified 300 register neurons out of a total of 576,000 candidate neurons responsible for driving outlier formation. When we apply a test-time register with these register neurons, the maximum output patch norm at the output layer only reaches 608 on average, effectively mitigating the outliers. To assess the downstream impact, we ran unsupervised object discovery using the LOST algorithm (as in Section 5.3) since Darcet et al. (2024) found that the performance on this task correlates with the smoothness of a model’s attention maps. We report the correct localization (corloc) results below with and without a test-time register on InternViT-6B, and observe up to a 13-point correct localization improvement. \n\n| Model Variant          | VOC 2007 ↑ | VOC 2012 ↑ | COCO 20k ↑ |\n|------------------------|------------|------------|------------|\n| InternViT-6B           | 30.3       | 35.4       | 22.4       |\n| + Test-time register   | 41.6       | 48.7       | 32.7       |\n\nWe will update the manuscript with this analysis and the corresponding visualizations showing outlier mitigation. We are particularly excited that this approach scales to larger models, suggesting it may also extend to large language models as well, where similarly high-norm outlier tokens have been observed [2]. \n\n[1] Chen et al. “InternVL: Scaling up Vision Foundation Models and Aligning for Generic Visual-Linguistic Tasks.” CVPR 2024. \n\n[2] Dettmers et al. “LLM.int8(): 8-bit Matrix Multiplication for Transformers at Scale.” NeurIPS 2022. \n\n**“In Table 5, the reported results for models with trained registers differ from those in Table 3 of (Darcet et al. (2024)).” and “Could you please clarify why you have not directly compared with the numbers reported in (Darcet et al. (2024))?”**\n\nAs noted in Section 3.1 of Darcet et al. (2024), their versions of OpenCLIP and DINOv2 were trained on different datasets than the original releases. For instance, their OpenCLIP was trained on a corpus based on Shutterstock while the original OpenCLIP is based on subsets of LAION-5b. Additionally, their checkpoints were not made publicly available. Instead, we used publicly released versions of the corresponding DINOv2 models provided by the DINOv2 team with and without registers, which were independently trained. We also use the original OpenCLIP checkpoints released by the OpenCLIP team. While this may introduce minor differences in performance with Darcet et al., it allows for a fair and reproducible evaluation using accessible models. We explain this in lines 181–186 of our manuscript, and are happy to further clarify this difference in the text if you see fit. We note that this situation also highlights a strength of our approach: it can be applied post-hoc to existing models, even when specialized register checkpoints are not available.\n\n**“In Table 4, I think \"CLIP\" should be replaced with \"OpenCLIP\" to avoid confusion.”**\n\nThank you for catching that. We will update our next version with the fixed naming."}, {"review_id": "UB1x1UV0no", "reviewer": "Reviewer_SMDD", "summary": "The authors introduce a method to move high-norm activations of \"outlier tokens\" that occur in Vision Transformers (ViTs) to register tokens. In contrast to previous methods dealing with this phenomenon, the authors' method does not require retraining the ViT. First, the authors identify the core mechanisms causing the occurrence of outlier tokens. Second, they use their findings to demonstrate that the mechanism can be employed to relocate outlier tokens to arbitrary positions within the image. Third, they utilize the mechanism to relocate outlier token activations to register tokens outside the image. The authors demonstrate that applying their method improves the model's performance on a range of downstream tasks.", "questions": "- How does the number of test-time register tokens influence the performance on the downstream task(s) (There is some information regarding multiple registers in Appendix A.1, but I didn't find metrics on downstream tasks for this ablation)?\n- How does the experiment on typographic attacks support the author's claims?", "limitations": "Yes", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 4, "clarity": 4, "significance": 3, "originality": 3, "strengths_and_weaknesses": "**Strengths**\n\n- The paper is well-written and leads the reader through the discovery process of the mechanism behind outlier tokens and how to move them to register tokens at test-time.\n- The advancement of moving outlier tokens to register without re-training the model is meaningful.\n- The authors conduct apt experiments.\n\n**Weaknesses**\n\n- The method performs on average slightly worse than adding registers by re-training the model.\n- The pracitical relevance of the typographic attack mitigation using outlier tokens seems limited, because masking out the corresponding tokens in the input space works about equally well as moving high-norm tokens to the respective locations.", "was_revised": true, "final_justification": "The answers the authors provided were satisfactory.", "rebuttal": "We appreciate the reviewer’s thoughtful comments and questions. We are glad that they valued the discovery process of register neurons and found the proposed training-free solution meaningful. We address their questions regarding the number of test-time registers and the typographic attack mitigation below. \n\n**“How does the number of test-time register tokens influence the performance on the downstream task(s) (There is some information regarding multiple registers in Appendix A.1, but I didn't find metrics on downstream tasks for this ablation)?”**\n\nTo quantify the effect of multiple test-time registers, we followed the procedure outlined in Appendix A.1 to create multiple test-time registers and then evaluated on unsupervised object discovery. We report the correct localization scores (corloc) below. Overall, we find that adding more test-time registers beyond one does not significantly change performance. We note that there is a slight degradation in performance beyond three test-time registers, although performance remains higher than without registers. We observe a similar trend with linear probe performance on NYUd v2 depth estimation below. These findings are consistent with the qualitative results in Figure 9: a single test-time register is sufficient to eliminate artifacts in the attention map, and additional registers have minimal impact. \t\n\n|              | VOC 2007 ↑ | VOC 2012 ↑ | COCO 20k ↑ |\n|--------------------------|------------|------------|------------|\n| DINOv2-L/14              | 32.2       | 36.8       | 25.4       |\n| + 1 test-time registers   | 53.8       | 57.9       | 41.9       |\n| + 2 test-time registers   | 53.9       | 57.8       | 41.7       |\n| + 3 test-time registers   | 52.8       | 57.0       | 40.6       |\n| + 4 test-time registers   | 51.9       | 55.6       | 39.3       |\n| + 5 test-time registers   | 50.5       | 54.4       | 38.2       |\n\n|            | NYUd RMSE ↓       |\n|--------------------------|-------------------|\n| DINOv2-L/14              | 0.3876 ± 0.0014    |\n| + 1 test-time registers   | 0.3774 ± 0.0013    |\n| + 2 test-time registers   | 0.3771 ± 0.0014    |\n| + 3 test-time registers   | 0.3785 ± 0.0014    |\n| + 4 test-time registers   | 0.3791 ± 0.0017    |\n| + 5 test-time registers   | 0.3795 ± 0.0016    |\n\n\n**“The practical relevance of the typographic attack mitigation using outlier tokens seems limited...How does the experiment on typographic attacks support the author's claims?”**\n\nOur intent with the typographic attack experiment is not to argue for the practical relevance of our mitigation strategy, but rather to demonstrate that the register neurons are highly causal to the model’s behavior (e.g., “only a small fraction of neurons to produce targeted changes in the image representation” in L246). In particular, this experiment (1) further supports our finding that editing the register neurons causally shifts the outlier patches and (2) demonstrates that local patch information at outliers is lost from the model’s computation. Darcet et al. (2024) showed that outlier patches retain less local information by demonstrating that their pixel/position information is harder to recover with a linear probe compared to normal patches (Section 2.1 of Darcet et al. (2024)). However, this analysis leaves open the possibility that local information at outliers might still be redistributed to other patches and indirectly influence the [CLS] token. Our results with the typographic attacks invalidate this possibility because shifting outliers on top of the text areas is performance-wise equivalent to the text never being present from the start (see pixel ablation baseline in the table below). The finding that the register neurons effectively mask patch information explains why mitigating the artifacts can improve dense prediction tasks. \n\nTo further emphasize the highly causal nature of the register neurons, we applied a similar edit using three random sets of ten neurons and report the attack success rate with 95% confidence intervals below. Editing random neurons has minimal effect on the model’s output compared to modifying the ten register neurons. We will clarify these analysis points in the paper. However, we agree that the practical relevance of this method might be limited. We will consider swapping this section with the application of test-time registers on VLMs in Appendix A.9, which shows the practical value of adding registers post-hoc.\n\n| Method                 | Attack Success % ↓ |\n|------------------------|--------------------|\n| CLIP                   | 50.5               |\n| w/ Pixel Ablation      | 7.6                |\n| w/ register neuron edit| 7.5                |\n| w/ random neuron edit  | 50.5 ± 0.2   |"}]

Author rebuttal:

Meta-review: This paper proposes a training-free approach to registers for Vision Transformers. It has received all positive reviews.

The paper was found well written with the method being clear, though more explanations were recommended (wxZe, Ffhe). The method was found new (29Ti, wxZe, ykSW), well motivated (29Ti, Ffhe), with good qualities (29Ti, wxZe), accompanied by theory that may be useful elsewhere (wxZe, ykSW). The experiments were found well designed and comprehensive (ykSW, Ffhe), though additional experiments were recommended (wxZe, Ffhe) as well as clarifications on the setup (Ffhe).

The paper was found well structured (xEEL), well written (YCz7, SMDD). The method was found well motivated (xEEL), insightful (xEEL, SMDD), significant (xEEL), simple (YCz7), including thorough analysis (fpZR). The method was found effective (xEEL, fpZR, YCz7), on appropriate experiments (YCz7, SMDD). The design choices were supported by experiments (xEEL). The limitations were found adequately discussed (xEEL).

Concerns included the need for more detail (xEEL), statistical significance (xEEL), hyperparameters (xEEL), interpreting why the model works (xEEL), lack of theory (fpZR), lack of different model sizes (YCz7), inconsistencies with prior work (YCz7), inferior performance relative to training (SMDD).

The authors provided detailed feedback in their rebuttal, accompanied with new experiments where needed. This feedback addressed all reviewers' concerns. The authors committed to update the paper according to the new material they have presented during the discussion. 

Apart from the high ratings, the work was found of strong significance, strong evaluation and results by at least one reviewer. Spotlight presentation is therefore recommended.
Decision: Accept (spotlight)