PNS-Bind-25M — transcript-free persistent memory, with the causal evidence

This release accompanies a study of transcript-free persistent memory in event-stream models. At approximately 25M parameters, generic learned recurrent states did not acquire causally useful durable semantic memory. Exact identity addressing with binding-local learned writes produced sealed-split-confirmed durable one-hop semantic memory with strong causal dependence on the learned payload. The preregistered two-hop reasoning endpoint did not improve over the memory-free control; general persistent narrative reasoning is therefore not claimed.

Data: nur-dev/pns-world. Paper: Beyond Transcript Replay: Causal Persistent Memory Through Protected Semantic Bindings.

The regime, stated exactly

No accumulated chat template is used.
No historical transcript is replayed.
Each historical event is consumed once.
Cross-event dependence must pass through bounded persistent state.

The one exception is deliberate and is the baseline being argued against: TX768_fin does re-read a 768-token sliding window (~40 events), and is published so the transcript-replay alternative is measured rather than asserted.

What is here

src/pns/model/   PNSR (unstructured learned state), PNS-Bind (identity-addressed
                 state), RMT baseline, TX transcript and current-event controls,
                 shared record encoder and output heads
src/pns/world/   the simulator, exact reducer and bounded stores, question solver
src/pns/train/   streaming TBPTT loader and window sampler
src/*.py         training entry points; src/tests/ the 20 invariants
configs/train/   the exact training config of every published checkpoint
configs/eval/    the exact evaluation protocol behind every headline number
checkpoints/     the 24 evaluated checkpoints (safetensors + config.json)
eval/            evaluators and the causal interventions: cross-lifetime swap,
                 periodic reset (32/64), payload-zero / state-zero, J_self and
                 J_obs store lesions, long-delay buckets, decode probe
results/         machine-readable tables and figure data for every manuscript number
reproduce/       reproduce_headline.sh, reproduce_tables.sh, train_all.sh

The interventions are applied inside the evaluators rather than the model: eval/evaluate.py (Experiment 1 — swap, reset32, reset64, sigma_zero, jself_zero, jobs_zero) and eval/confirmation_eval.py (Experiment 2 — payload_swap, reset64, payload_zero). The model exposes only the hooks they need (initial_state, freeze_writes, and the typed write router).

Naming. The paper's Experiment 1 is the generic-recurrent-state study (internal identifiers E1 plus the gated-retention arms G_* and the RMT baseline). The paper's Experiment 2 is the binding intervention (internal identifier E3-BIND, checkpoints E3A_* / E3B_*). Internal identifiers are kept in filenames so every result traces back to the study record.

One-command headline reproduction

pip install -r requirements.txt
huggingface-cli download nur-dev/pns-world --repo-type dataset --local-dir ./data
bash reproduce/reproduce_headline.sh

No retraining. It loads the published checkpoints, evaluates them on the published data, and writes results/reproduced_headline.json, which contains, for Experiment 1: cross-lifetime state-swap effects, exact-store lesion effects, per-family semantic accuracy, the recent-event decode power control and the durable-binding decode result; and for Experiment 2: SEM_LATEST, retention beyond 128 intervening events, payload swap, reset-64, payload-zero, the capacity-matched unbound comparison, and the failed SEM_2HOP endpoint. It also diffs every number against results/published/ and reports the largest deviation.

PNS_DEVICES=0,1,2,3 bash reproduce/reproduce_headline.sh   # spread over 4 GPUs

Measured: 57 minutes across five H200s for the 101 evaluations plus the adjudication, Stage-A gate, interference decomposition and collection; peak GPU memory under 2 GB per process. Budget roughly 4–5 h on a single GPU. The run is resumable — finished evaluations are skipped, so an interrupted run continues where it stopped. reproduce_tables.sh rebuilds the CSVs from evaluation output already on disk and needs no GPU.

Results

Experiment 1 — state activity is not memory

Seven models, four state mechanisms, three seeds. Cross-lifetime cosine spans 0.63–0.98 and state norms span 16–485, so the states differ enormously from one another. Their causal contribution does not.

run	state mechanism	x-life cosine	max norm	Δ swap	Δ reset64	J_self lesion
PNSR seed 1	additive + clamp τ=16	0.950	16.0	+0.0000	+0.0001	+0.689
PNSR seed 2	additive + clamp τ=16	0.963	16.0	+0.0001	+0.0002	+0.747
PNSR seed 3	additive + clamp τ=16	0.978	16.0	+0.0001	+0.0029	+0.728
G_TAU512	additive, clamp τ=512	0.983	485.1	+0.0007	+0.0012	+0.737
G_CONVEX_FREE	convex gated, no clamp	0.940	94.7	+0.0005	+0.0016	+0.722
G_CONVEX_RETAIN	convex gated, retention-biased	0.786	49.6	−0.0001	−0.0006	+0.715
RMT	memory tokens + self-attention	0.634	19.6	+0.0005	+0.0005	+0.602

Swapping in a different lifetime's state changes accuracy by at most 0.0007 anywhere in the table, while lesioning the bounded exact stores costs at least 0.602. Two structurally different learned recurrent memories fail the same way; the deterministic exact store does not.

The exact stores are causally necessary for every model class, including the two with no learned state at all, and the dependence is family-selective in the predicted direction:

run	learned state	J_self lesion (SELF_REF)	J_obs lesion (pointer families)
PNSR seeds 1–3	120 typed slots	+0.689 / +0.747 / +0.728	+0.507 / +0.521 / +0.520
RMT	32 memory tokens	+0.602	+0.514
TX768	none (768-token window)	+0.658 (0.761 → 0.102)	+0.506 (0.536 → 0.030)
TXE	none (current event only)	+0.687 (0.689 → 0.002)	+0.475 (0.482 → 0.007)

Each lesion collapses the families its store serves and largely spares the rest: across all nine models the largest off-target move is 0.015 (self-reference under the observation lesion). For the two stateless baselines the separation is essentially exact — zeroing the self-commit store moves the pointer families by at most 0.0002, and zeroing the observation store leaves self-reference bit-identical — so the residual cross-talk in the state-carrying models is a property of those models, not of the lesion. The capability lives in the bounded exact half regardless of what learned memory sits beside it.

The decode probe separates "opaque state" from "empty state". On the same Σ vectors, an external probe recovers the previous event's type at 0.9518 against a 0.3652 majority baseline — while the queried entity–attribute binding is at chance under both probe classes (Σ+query 0.1605, query-only 0.1600, cross-lifetime shuffled floor 0.1676, chance 0.1596; corrected labels). A probe reading 0.95 off this state would have certified it as memory.

Experiment 2 — protected bindings, on a sealed split

e3_conf was read exactly once, after all three seeds, thresholds and analysis code were frozen and hashed. Verdict logic was hashed before results.

	bind s1	bind s2	bind s3	TXE (memory-free)
SEM_LATEST	1.000	1.000	1.000	0.2633
SEM_2HOP	0.2830	0.2597	0.2945	0.2760
accuracy, delay > 128 events	0.992	0.993	0.994	—
Δ payload-swap	+0.1382	+0.1398	+0.1462	—
Δ reset-64	+0.1957	+0.1925	+0.1962	—
Δ payload-zero	+0.5894	+0.5851	+0.5901	—
overall	0.7529	0.7448	0.7568	0.2677

The capacity-, parameter- and read-path-matched unstructured control (E3B_unbound_*, identical 24,265,440 parameters, identical 192 slots) reaches Δ_swap +0.026 / +0.010 / +0.022 — so the causal dependence is attributable to binding-local writes, not to capacity. Zeroing the payload collapses accuracy to ≈0.16: the exact address alone yields chance, so the answer lives in the learned state rather than in the addressing structure.

CONJUNCTION_MET: False. The preregistered conjunction required the same improvement on two-hop questions. SEM_2HOP needed ≥ 0.326 and reached 0.260–0.295 — statistically indistinguishable from the memory-free control. By design only the first hop is addressed by exact identity; the second is a learned lookup, and the intervention does not help there. This is reported as failed and forbids the claim "general persistent narrative reasoning".

Checkpoints

24 checkpoints, safetensors, each with a config.json giving the exact model config, the exact training arguments, the training corpus, the parameter count and the admission provenance. Development checkpoints are not published.

group	runs	params	role
Experiment 1, learned state	PNSR_K4_fin, PNSR_K4_s2, PNSR_K4_s3	24,614,453	typed 120-slot learned state, three seeds
Experiment 1, state mechanisms	G_TAU512, G_CONVEX_FREE, G_CONVEX_RETAIN	24,614,453	clamp raised 32×; convex gated; retention-biased
Experiment 1, recurrent baseline	RMT_s1	23,945,525	memory tokens updated by full self-attention
Experiment 1, depth control	PNSR_K1_fin	24,614,453	K=1 vs K=4 deliberation
Experiment 1, transcript reference	TX768_fin	23,892,917	768-token sliding window
Experiment 1, memory-free control	TXE_fin	23,622,581	current event only
corrected-corpus controls	PNSR_ON_E3, TXE_ON_E3	24,614,453 / 23,622,581	retrained from scratch on corrected labels
Experiment 2 Stage A	E3A_bind_s{1,2,3}, E3A_unbound_s{1,2,3}	4,385,515	semantic-only gate, three seeds per arm
Experiment 2 Stage B	E3B_bind_s{1,2,3}, E3B_unbound_s{1,2,3}	24,265,440	full multitask; the sealed-confirmation models

Parameter counts are distinct trainable parameters. The event encoder and the record encoder share one tied 8192×384 token embedding, so state_dict lists that tensor under two keys; config.json records both the parameter count and the raw tensor total.

Matched-budget policy is ±3%, not equality, and every baseline carries slightly fewer parameters than PNSR. TXE_fin is −4.0%, outside the band: the entire deficit is 704 × 384 positional embeddings a 64-token-window model cannot use by construction. It is a null control, and the deviation disadvantages the model the paper argues against, so it cannot inflate any claim.

import os; os.environ["PNS_DATA"] = "./data"
import sys; sys.path.insert(0, "src")
from pns.checkpoint import load_model
model, kind, conf = load_model("E3B_bind_s1", "cuda")
print(kind, conf["params"], conf["cfg"])

Results tables

results/ holds every manuscript number in machine-readable form: experiment1_causal.csv, experiment1_accuracy.csv, experiment2_stageA.csv, experiment2_confirmation.csv, decode_probe.csv, long_delay.csv, figure_headline_data.csv (the numbers the main figure plots) and artifact_hashes.csv (per-file SHA-256 of both repositories).

results/published/ is the study's own raw output — the sealed-confirmation result, the Stage-A gate, the replication table, both decode-probe runs, the state statistics, the interference decomposition, the oracle bounded-state control, the per-event cost measurement, and the training-log values that AUDIT.md cites. A reproduction run writes results/reproduced_headline.json and results/reproduced/*.csv, and is diffed against results/published/ automatically. eval/figures.py rebuilds both figures from either.

The shipped results/*.csv and results/reproduced_headline.json come from a full run of reproduce/reproduce_headline.sh against this exact directory layout. It agreed with the study's own recorded values on all 414 shared numbers, maximum absolute deviation 0.0 (same GPU architecture; see the note on bf16 below). It adds two rows the study never ran: the exact-store lesions on the two transcript baselines, which the study's evaluator accepted but silently did not apply (AUDIT.md §11). Those are new measurements, and they sharpen the central dissociation rather than complicate it — see below.

results/sealed_use_record.json records the single use of each single-use split. The sentinel that enforced it during the study is deliberately not shipped: it would only block reproduction of a result that is now public.

Training (secondary)

bash reproduce/train_all.sh                 # every published run, sequentially
bash reproduce/train_all.sh E3B_bind_s1     # one run

Exact configs are in configs/train/. About 2 GPU-hours per 25M model on an H200; the 4.39M Stage-A runs are ~20 minutes. Training writes to checkpoints_retrained/ so the published checkpoints are never overwritten.

Four published checkpoints were admitted from a differently-named run, and each one's config.json says so in admitted_from_run / admitted_checkpoint / admission_note. TX768_fin in particular is the best.pt of its run (update 18,250 of 18,850) rather than the final step, because that run retains the best checkpoint by running median loss — a retraining run therefore reproduces the recipe, and you take best.pt from it, not final.pt. The other three are their run's own final checkpoint under an earlier name; the reasons (amendments A6 and A7, and a diverged control) are in AUDIT.md.

Pinned environment — requirements.txt, plus:

Python	3.13.11
PyTorch	2.6.0+cu124 (CUDA 12.4, cuDNN 9.1.0)
NumPy / scikit-learn / tokenizers / safetensors	2.4.2 / 1.8.0 / 0.22.2 / 0.7.0
GPU / driver	NVIDIA H200, driver 550.90.07
tokenizer SHA-256	8bbb4fd7db2928b323b7cb7ba595e88130f49a717fb7a79b3bd33b4b5e248fcf
dataset revision	nur-dev/pns-world @ paper-v1.0
seeds	1, 2, 3 (recorded per checkpoint in config.json)

Config and artifact hashes: results/artifact_hashes.csv. bf16 autocast is used throughout, so bitwise-identical logits across different GPU architectures are not expected; the reported accuracies are stable to the fourth decimal in-architecture.

Scope and limitations

One scale (≈25M parameters), one benchmark, ~2 GPU-hours per model, against a hypothesis written for far larger budgets. Nothing here says whether learned narrative state works when scaled. The Experiment 2 control is capacity- and parameter-matched to PNS-Bind but is not architecture-matched to Experiment 1's PNSR — which of those differences makes an unstructured state functional at all is not isolated by any experiment here. AUDIT.md in the dataset repo records eleven deviations, four of which bear on a claim.

License

Apache 2.0.

Citation

See CITATION.cff.

@article{pnsbind2026,
  title  = {Beyond Transcript Replay: Causal Persistent Memory Through Protected Semantic Bindings},
  year   = {2026},
  note   = {Code and models: https://huggingface.co/nur-dev/pns-bind-25m, tag paper-v1.0}
}