Do Two Networks Learn the Same Thing?

Chapter 1: Why Naive Comparison Fails

We now have the right object: two activation matrices X ∈ R^n×p and Y ∈ R^n×q over a shared probe set. The temptation is to reach for something familiar — correlate the columns, take a distance, run CCA. This chapter is a catalogue of what happens when you do, worked in numbers small enough to check on paper.

We will use one running pair of matrices for the rest of the lesson. Three probe examples, two features. Here is network A’s representation:

Three rows, one per probe input; two columns, one per feature. Column means are (4+1+1)/3 = 2 and (1+4+1)/3 = 2, so the centered version — subtract each column’s mean, which is what every one of these methods does first — is:

And here is network B’s representation of the same three probes. B is a hypothetical second network that learned exactly the same thing, but wrote it down in a rotated basis at three times the scale. Specifically, B’s features are A’s features rotated 90° — feature 1 of B is what feature 2 of A was, negated, and so on — then multiplied by 3:

Check one row so you trust the rest. Row 1 of X̄ is (2, −1). Right-multiplying a row vector by R gives (2·0 + (−1)·(−1), 2·1 + (−1)·0) = (1, 2). Times 3: (3, 6). That is row 1 of Ȳ. Good.

Naive metric 1: correlate matching neurons

The most natural thing in the world: neuron 1 of A ought to look like neuron 1 of B. Correlate them, do the same for neuron 2, average.

Column 1 of X̄ is (2, −1, −1). Column 1 of Ȳ is (3, −6, 3). Both are already mean-zero, so the correlation is just the cosine:

Column 2 of X̄ is (−1, 2, −1); column 2 of Ȳ is (6, −3, −3):

Average the two: (0.5 + (−0.5))/2 = 0.000. The metric reports that these two representations are completely unrelated. They are identical.

And look at what it missed. Correlate column 1 of X̄ against column 2 of Ȳ:

A perfect match, sitting one column over. The metric was looking at the wrong pair because it assumed the two networks agreed on which neuron gets which index — the exact assumption Chapter 0 demolished.

Work the 45° case out properly, because “it drops toward zero” deserves a number. Suppose A’s two features are uncorrelated with equal variance 1, and B’s basis is A’s rotated by 45°, so B’s first neuron computes (a + b)/√2. Then

So the best any neuron of A can do against any neuron of B is 0.707, and the metric reports “70% similar” for two representations that are, again, identical. Now generalise: a rotation that mixes p features evenly gives each of B’s neurons a 1/√p share of each of A’s, so the best-match correlation falls as

At realistic layer widths the metric returns essentially zero for identical representations. The failure is not marginal; it scales away to nothing.

Which invariances you need depends on what comes next

A reasonable objection at this point: why should rotation invariance be required? ReLU is not rotation-equivariant, so a rotated representation is not literally interchangeable inside the network. The answer is that the invariance requirement is not about the representation, it is about what reads the representation.

Read the first three rows. Every question we actually ask of a representation — can a probe decode this, can this be retrieved against, can the next linear stage use it — is answered identically for X and XQ. That is why rotation invariance is the right requirement even though the network itself is not rotation-equivariant: we are measuring the representation’s usefulness, and usefulness is mediated by things that absorb rotations.

Naive metric 2: distance between the matrices

Even simpler: ||X̄ − Ȳ||_F, the Frobenius distance — square every entry of the difference, sum, take the root.

This is worse than useless, and not only because it is non-zero for identical representations. It requires p = q — you cannot subtract a 1024-column matrix from a 128-column one at all — and it is not invariant to anything. Multiply Y by 10 and the distance grows tenfold. There is no interpretable scale: is 10.95 large? Compared to what?

Naive metric 3: CCA, and the too-much-invariance trap

The serious pre-2019 answer was canonical correlation analysis (CCA), and its deep-learning descendants SVCCA and PWCCA. CCA finds the pair of directions — one in X’s feature space, one in Y’s — whose projections correlate most, records that correlation, then finds the next such pair orthogonal to the first, and so on. The mean of those canonical correlations is the similarity score.

CCA passes all three of our tests. Permutation: yes, it optimises over all directions. Rotation: yes. Scale: yes. On our X and Y it returns exactly 1. So far so good.

The problem is that it passes too much. CCA is invariant to any invertible linear transformation of either representation. Any. And that is fatal, which the following worked example makes concrete.

What should the answer be? Something well below 1. We will be able to compute it exactly by the end of the next chapter — CKA gives 0.707 here, because it weights each direction by how much variance actually rides on it. Hold that number; we will earn it.

Why CCA has that invariance — and a worked case where it is fatal

It is worth seeing where the excess invariance enters, because it is one line of the algorithm and it is the same line that makes CCA well-behaved in its original statistical setting.

CCA begins by whitening both representations: replace X̄ with X̄(X̄^TX̄)^−1/2, which is the version of X whose feature covariance is the identity. Every direction is rescaled to unit variance. Then the canonical correlations are the singular values of Q_X^TQ_Y, where Q denotes the whitened (orthonormal) basis of each column space.

In classical statistics that is exactly right: you are asking whether two sets of variables are related, and the units of each variable are arbitrary. In representation analysis it is exactly wrong: the variance a direction carries is not an arbitrary unit, it is a statement about how much of the representation lives there.

And after whitening, only the subspace spanned by each representation survives. Which produces the following, on the numbers we already have:

This example is small enough to be a little unfair — with n = 3 and p = 2 the subspaces are forced to coincide. But the failure it exhibits does not go away at scale; it just becomes harder to see. Whenever p is comparable to n, two representations of full rank occupy overlapping subspaces and CCA saturates near 1 for structural reasons, telling you nothing.

There is a second, practical reason CCA struggles: it needs n > p to be well-conditioned. With p = 2048 features you need thousands of probe examples before the estimate stops being noise, and modern layers are wider than that. SVCCA patches this by first truncating to the top singular directions, which helps, and PWCCA patches it further by weighting canonical directions by how much of the representation they explain — which is, notably, a step in exactly the direction CKA takes wholesale.

Naive metric 4: just train a probe

The last approach worth dismantling is the one an experienced practitioner reaches for: forget metrics, train a linear map from A’s representation to B’s and see how well it fits.

This is a genuinely good instinct — it is the seed of model stitching, which is Chapter 4 and which is the best tool in the lesson. But as a similarity index it has three specific problems worth naming, because each one shapes how Chapter 4 has to be set up.

The invariance ledger

Here is every metric so far against every symmetry. The rightmost column is the one that separates the survivors.

Only one row has four green cells. That row is the next chapter. But before we build it, play with the failures.

Two things to notice while you play. First, the point cloud on the right visibly moves under permute and rotate — the picture changes completely — while the pattern of which points are near which does not. That pattern is the invariant we are chasing. Second, once real change is on, the picture may look barely different but CKA drops sharply, because a probe that used to be an outlier is now in the middle. Visual similarity and representational similarity are not the same thing, and the metric is right where your eye is wrong.

The invariant that survives everything

Let us name what all three symmetries leave alone. Permuting columns, rotating the basis, and uniform scaling all act on the features. None of them touches the relationship between two rows — between two probe examples — except by an overall constant.

Precisely: the inner product between probe i and probe j. Under a rotation X → XR with R^TR = I:

Under a permutation, which is a special orthogonal matrix, the same thing. Under scaling by c, every inner product is multiplied by c² — a single global constant that any sensible normalisation will divide out.

Chapter 2: CKA From Scratch

We ended Chapter 1 with a plan: describe a representation by the table of relationships between probe examples, then compare the two tables. This chapter turns that plan into a formula, and then computes the formula three times by hand on numbers you can verify with a pencil.

Step 1: the Gram matrix

Given the centered representation X̄ ∈ R^n×p, the Gram matrix is

Its size is n×n — determined by how many probes you chose, not by how many features the layer has. That is what lets us compare a 128-channel layer to a 2048-channel one: both become 10000×10000 tables of the same shape.

Compute K for our running X̄ = [(2,−1); (−1,2); (−1,−1)]. Six distinct entries, by symmetry:

Read it as a story. Probes 1 and 2 sit at opposite ends of the representation (K₁₂ = −4, strongly negative). Probe 3 is a mild counterweight to both. The diagonal says probes 1 and 2 are far from the centre (5, 5) and probe 3 is closer in (2).

Step 2: HSIC — covariance between two similarity structures

We now have two n×n tables, K from network A and L from network B, and we want a number saying how much they agree. The right frame is not “distance between tables” but covariance: when K says two probes are unusually similar, does L agree?

That statistic has a name from the kernel-methods literature: the Hilbert-Schmidt Independence Criterion, or HSIC. Gretton et al. introduced it in 2005 as a test for statistical independence between two random variables, and its empirical estimator is

Unpack it left to right. H is the centering matrix: multiplying by it subtracts row and column means. K H L H is therefore “the centered version of K, matrix-multiplied by the centered version of L.” And the trace of a product of two symmetric matrices is exactly their entrywise inner product:

So with our already-centered Gram matrices, HSIC is nothing more mysterious than: multiply the two tables entry by entry and add everything up. The (n−1)² out front is the same normalisation you see in a sample covariance, and — crucially — it will cancel completely in the next step.

Step 3: normalise, and CKA appears

A dot product is not yet a similarity score — it grows if you scale either side. Divide by the lengths, exactly as you would to turn a dot product into a cosine:

The (n−1)⁻² factors cancel top and bottom, leaving the form we will actually compute with:

That is Centered Kernel Alignment. It is bounded in [0, 1] for positive semi-definite kernels, it equals 1 exactly when L is a positive multiple of K, and — the whole point — it inherits every invariance of the Gram matrix. Rotate X and K does not move. Scale X by c and K scales by c², which the denominator removes.

Proving the three invariances, and the one non-invariance

Chapter 0 set four requirements. Here they are, discharged, each in two lines. This is the part that makes CKA a construction rather than a heuristic.

Invariance to orthogonal transforms (which includes permutations). Let X̄′ = X̄Q with Q^TQ = I. Then

The Gram matrix is literally unchanged — not approximately, not up to a constant. Every downstream quantity therefore also unchanged. A permutation matrix satisfies Q^TQ = I, so relabelling neurons is a special case and costs nothing.

Invariance to isotropic scale. Let X̄′ = cX̄. Then K′ = c²K, so

Invariance to translation. Adding a constant vector b to every row of X leaves X̄ unchanged, because the column means shift by exactly b and the centering subtracts them. This is why centering is not a preprocessing nicety — it is what buys translation invariance, and it is why the “C” in CKA is load-bearing.

Non-invariance to general invertible maps. Let X̄′ = X̄A with A invertible but not orthogonal. Then K′ = X̄AA^TX̄^T, and AA^T ≠ I, so K′ is not a multiple of K. The Gram matrix genuinely changes, and CKA genuinely notices. The anisotropic caricature from Chapter 1 is exactly this case, and we compute its value at the end of this chapter.

Worked example 1: identical representations, different basis

Our unit test. X and Y are the same representation rotated 90° and scaled by 3, so CKA must return exactly 1.

Ȳ = [(3, 6); (−6, −3); (3, −3)]. Its Gram matrix L:

Every entry is exactly nine times the corresponding entry of K. Which is not luck: the rotation left inner products untouched and the factor of 3 squared into 9. Now the cosine:

Exactly one. The metric passed the unit test that killed same-index correlation (which said 0.000) and Frobenius distance (which said 10.95). And it passed it for a structural reason, not a numerical accident: proportional Gram matrices are the fixed point of the whole construction.

For reference in what follows, ||K||_F² = 25 + 16 + 1 + 16 + 25 + 1 + 1 + 1 + 4 = 90, so ||K||_F = √90 ≈ 9.4868.

Worked example 2: a genuinely different representation

A metric that always returns 1 is also useless. Here is a third network, C, whose representation of the same three probes is genuinely different:

Its Gram matrix M:

Compare the stories. In A, probes 1 and 2 are the two extremes (K₁₂ = −4, the most negative entry) and probe 3 sits between them. In C, probes 1 and 2 are orthogonal (M₁₂ = 0) and probe 3 is the outlier that both point away from (M₁₃ = M₂₃ = −2). Different structure, so we expect a middling score.

The entrywise product, term by term:

Exactly 0.6. Same structure in some respects, genuinely different in others — which is what a similarity index is for.

The other form of the same number

Everything above went through n×n Gram matrices. There is an equivalent route through p×p feature covariances, and knowing both is the difference between a CKA implementation that runs and one that runs out of memory.

Start from ⟨K, L⟩_F = tr(X̄X̄^T ȲȲ^T). Trace is invariant under cyclic rotation of its argument, so move X̄^T from the front to the back:

And the same move on the norms gives ||K||_F = ||X̄^TX̄||_F. So:

Verify it on X and Z. First the cross term, Z̄^TX̄, a 2×2:

Same 36/60 = 0.6. Two completely different computational paths, one number.

What CKA is really weighting: the spectral identity

One more derivation, and it is the one that explains both CKA’s strength and its most serious weakness. Write X̄ in its singular value decomposition, X̄ = U_XS_XV_X^T, and likewise for Ȳ. Substituting into the cross-covariance form and cancelling the orthogonal V factors leaves

In words: CKA measures how well the principal directions of the two representations line up, weighted by the product of the variance each direction carries. That is precisely the property CCA was missing. CCA gave every canonical direction an equal vote, so a direction carrying 0.0001 of the variance counted as much as one carrying 10000. CKA weights each agreement by how much it matters.

Verify the identity on our example, because it looks abstract until you see it in integers. The eigenvalues and eigenvectors of K (with the constant direction always giving eigenvalue 0, since the rows sum to zero):

And for M — check that the same two vectors are its eigenvectors too:

The two representations agree perfectly on which directions exist — the inner-product terms ⟨u_i, u_j⟩² are 1 when i = j and 0 otherwise — and disagree completely about which one is important. A puts 9 units of variance on direction 1 and 3 on direction 2; C puts 2 and 6. Plug in:

Three independent routes to 36/60 = 0.6. And now we can settle the debt from Chapter 1: the anisotropic caricature with λ^X = (10000, 0.0001) and λ^Y = (1, 1) on the same directions gives

CCA said 1.000. CKA says 0.707. The debt is paid.

The implementation, and the one line people get wrong

python — linear CKA, both formsimport numpy as np

def center(X):
    # center the FEATURES (columns). This is what makes the Gram matrix
    # double-centered for free — see the note above.
    return X - X.mean(axis=0, keepdims=True)

def cka_gram(X, Y):
    """O(n^2 p). Use when n (probes) is smaller than p (features)."""
    X, Y = center(X), center(Y)
    K, L = X @ X.T, Y @ Y.T                      # (n, n) each
    return (K * L).sum() / (np.linalg.norm(K) * np.linalg.norm(L))

def cka_feat(X, Y):
    """O(n p q). Use when p, q are smaller than n. Same number."""
    X, Y = center(X), center(Y)
    num = np.linalg.norm(Y.T @ X) ** 2              # (q, p) intermediate
    den = np.linalg.norm(X.T @ X) * np.linalg.norm(Y.T @ Y)
    return num / den

X = np.array([[4., 1], [1, 4], [1, 1]])
Z = np.array([[3., 3], [3, 1], [0, 2]])
print(cka_gram(X, Z), cka_feat(X, Z))   # 0.6  0.6

The line people get wrong is the first one. X.mean(axis=0) centers the columns — each feature across probes. Centering axis=1 instead subtracts each probe’s own mean activation, which is a completely different (and generally wrong) operation that silently produces plausible-looking numbers. If your CKA heatmap has a suspiciously uniform diagonal band, check that axis first.

The kernel generalisation, and when to bother

Nothing above required K to be X̄X̄^T. HSIC is defined for any positive semi-definite kernel, so you can substitute an RBF kernel — one that measures similarity by distance rather than by inner product — and every step still goes through:

This makes CKA sensitive to nonlinear structure: two representations related by a nonlinear warp can score high under RBF CKA and low under linear CKA. The bandwidth σ is the new knob, conventionally set as a fraction α of the median pairwise distance, with α around 0.2–0.8.

The honest report from the original paper is that it rarely matters. RBF CKA and linear CKA give very similar layer-correspondence heatmaps across a range of bandwidths. That is a useful negative result: it says the interesting structure in these representations is already visible to a linear kernel, and it means you can use the cheap form without apologising. Reach for RBF only when you have a specific reason to suspect a nonlinear relationship, and report α when you do.

The unbiased estimator, for when you must batch

The estimator we derived, HSIC = tr(KHLH)/(n−1)², is biased upward. Song et al.’s unbiased version works on the kernel matrices with their diagonals zeroed — write K̃ for K with zeros on the diagonal — and reads

Ugly, but every term is a matrix product you already have. The reason it matters is practical: accumulate numerator and denominator across minibatches separately and divide once at the end,

and the result converges to the full-batch value as the number of batches grows, independent of batch size. Averaging per-batch CKA values instead — the obvious thing, and the wrong thing — does not converge to anything in particular, because a ratio of averages is not the average of ratios.

Press Unrelated + big PC1 and read the two numbers under the heatmaps. The full CKA reads around 0.94; the CKA computed after removing the top principal direction from both reads 0.00. Both are true statements about the same pair of representations, and only one of them is usually reported.

Chapter 3: What CKA Saw — and Its Blind Spots

A ruler is only interesting for what it measures. Kornblith, Norouzi, Lee and Hinton did not publish CKA as a mathematical object; they published it because when they pointed it at real networks it showed them things the older tools had been hiding. This chapter is the findings, followed — because this lesson does not sell — by the four ways the ruler itself is untrustworthy.

Finding 1: layers correspond, and only CKA could see it

The sanity check any similarity index must pass: take two networks with identical architecture trained from different random seeds, compute similarity between every layer of A and every layer of B, and draw the resulting matrix as a heatmap. If the index works, layer i of A should be most similar to layer i of B, giving a bright diagonal.

CKA produces that diagonal, crisply, across depths. CCA and its variants, on the same networks and the same probe set, produce a washed-out blob — they cannot reliably tell you that layer 5 of A corresponds to layer 5 of B rather than layer 9.

Make it a number. Model two independently trained networks as agreeing on their top direction and disagreeing on the rest. Say each has Gram eigenvalues (50, 5, 1, 0.2, 0.05), the top eigenvectors coincide, and the remaining four are randomly oriented relative to each other — so the alignment terms ⟨u_i, u_j⟩² among the tail are around 1/4 each by symmetry. Compare what each index reports.

The layer pair genuinely corresponds. CKA says 0.99 and puts it on the diagonal. CCA says 0.60, which is not distinguishable from what a non-corresponding layer pair would give. Now run that across a 50×50 grid of layer pairs and one heatmap has a diagonal while the other is a smear. The mechanism is entirely in the weighting.

Finding 2: width buys agreement

Train the same architecture at several widths, two seeds each, and ask how similar the two seeds are to each other. The answer: wider networks trained from different seeds are more similar to each other than narrow ones are. At small widths, two seeds land on genuinely different solutions; as width grows, the two runs converge on the same representation.

This is the first appearance in this lesson of a pattern that becomes the whole point by Chapter 5, so it is worth stating in its general form: as capacity grows, independent training runs stop diverging. Here it is two seeds of a CNN. In Chapter 5 it will be a language model and a vision model that never saw each other’s data.

The mechanism is not mysterious. A narrow layer must choose which features to keep; different runs choose differently, and the choices are near-arbitrary among many roughly-as-good options. A wide layer does not have to choose — it can afford to represent everything that helps, so both runs represent the same everything, plus their own idiosyncratic extras that carry little variance and therefore barely move CKA.

Finding 3: block structure, and where it comes from

Nguyen, Raghu, and Kornblith (2021) took the same tool to very wide and very deep ResNets and found something that looks broken until you understand it: a large square block in the CKA heatmap where dozens of consecutive layers are all highly similar to each other.

Interpretation: those layers are not doing much. The representation enters the block, gets nudged, and leaves nearly unchanged. The block appears when the model is large relative to the dataset — overparameterisation made visible — and it is associated with a single dominant principal component that propagates through the block, dominating the CKA computation exactly as the spectral identity predicts. Delete layers from inside the block and accuracy barely moves; delete layers from outside it and accuracy falls.

Finding 4: transformers do not look like convolutional networks

The most consequential architectural use of CKA came from Raghu, Unterthiner, Kornblith, Zhang and Dosovitskiy (2021), who used it to ask whether a Vision Transformer computes the same thing as a ResNet. The heatmaps answered clearly, and the answer explained several otherwise-puzzling empirical facts.

Notice what kind of result this is. None of those four statements is an accuracy number, and none could have been obtained by comparing benchmarks. They are statements about how the computation is organised, obtained by measuring geometry. That is what a similarity index is for, and it is the strongest case for using one.

Finding 5: memorisation has a signature

Train a network on correctly labelled data, and train an identical one on data with the labels shuffled at random. Both can reach near-zero training loss — that was the disquieting result of Zhang et al. in 2017. Only one of them generalises. Do they build the same representation?

CKA says: early layers, yes; late layers, no. The two networks agree substantially in the first third and diverge sharply thereafter. The reading is that early layers learn generic structure regardless of what the labels say, and the memorisation required by random labels is concentrated in the later layers, where the network must build a lookup table rather than a concept.

How to read a CKA heatmap

The output of a sweep is one square image: layers of A down, layers of B across, similarity as colour. Six patterns cover almost everything you will see, and each one has a diagnosis and an action.

Blind spot 1: the top component can carry the whole score

Now the honest half. Return to the spectral identity and consider two representations that share one enormous direction and disagree about everything else. Concretely, suppose both have Gram eigenvalues (100, 1) — but their second eigenvectors are orthogonal to each other, meaning the two networks encode completely unrelated secondary structure.

Total disagreement about the second direction, and the score is 0.9999. This is not a contrived edge case: real representations have heavy-tailed spectra, and a single component often carries an order of magnitude more variance than the next. When you read “CKA = 0.95” in a paper, the honest question is how much of that is one component?

Blind spot 2: a handful of probes can set the answer

Davari, Horoi, Natik, Lajoie, Wolf and Belilovsky (ICLR 2023) went looking for ways to break CKA and found a clean one: CKA is highly sensitive to a small number of outlier probe points. Shift a few examples far from the rest and CKA moves dramatically, in either direction, without any change to how the network behaves on anything.

The reason falls straight out of the definition. K_ij = x̄_i · x̄_j is a product of two magnitudes. A probe at distance 10 from the centre contributes entries a hundred times larger than a probe at distance 1, so it dominates every sum in numerator and denominator. Push a handful of probes far out and they, not the other 9,990, decide the score.

Worked example — one probe rewrites the verdict. Take our running pair, which honestly scores CKA(X, Z) = 0.600. Now append a single fourth probe on which both networks produce a large, similar activation — say (20, 20) in both spaces. Nothing about the first three probes has changed and nothing about either network has changed; we merely added an easy, extreme example to the probe set.

The centered Gram entries involving the new probe are on the order of its squared distance from the centre, which is roughly (20−6.5)² + (20−2)² ≈ 500 per space, versus entries of size 2–5 among the original three. In the sum ⟨K, M⟩ and in both norms, the new probe’s terms are two orders of magnitude larger than everything else, so the score becomes a statement about that one probe:

“These representations agree 99.8%” is now the reported result, and it is true only of a single input. In a real sweep the outliers are not added deliberately — they are the handful of images on which some layer saturates, or the one document whose embedding has an anomalous norm. They are already in your probe set.

What to do about it. Three cheap habits. Report the distribution of ||x̄_i|| across your probe set, and look at it. Recompute CKA with the top 1% of probes by norm removed — if the number moves materially, say so. And consider a rank-based measure such as the mutual-kNN alignment of Chapter 5, which is by construction immune to this because it never multiplies magnitudes together.

Their headline demonstration: you can construct transformations of a representation that leave its functional behaviour unchanged while driving CKA to arbitrary values, and conversely you can find pairs with high CKA whose downstream behaviour differs. The measure and the thing you care about are correlated, not identical.

Blind spot 3: the probe set is a hyperparameter nobody reports

CKA is defined relative to a chosen set of n inputs. Change the set and change the number. This is obvious once stated and almost never controlled for.

The practical rule: a CKA number without a stated probe set is not a measurement, it is a rumour. Report n, the distribution, and whether you centered per-batch or globally.

Blind spot 4: geometric agreement is not functional agreement

This is the deepest one, and it sets up the entire next chapter. CKA answers a question about arrangement: are the same probes close in both spaces? It does not answer a question about use: can the downstream half of network B consume network A’s layer?

Those come apart in both directions, and both directions are real:

Ding, Denain and Steinhardt (2021) made this concrete by proposing that similarity measures be validated like classifiers: a good measure must be sensitive (it drops when the representation changes in ways that matter functionally) and specific (it does not drop when the change is functionally irrelevant). Under those tests CKA passes some and fails others, and orthogonal Procrustes distance — which we will build by hand in Chapter 7 — often behaves better on their benchmarks.

Chapter 4: Stitching — The Behavioural Test

Chapter 3 ended with a complaint: CKA scores geometry, and geometry is not use. So stop scoring. Cut network A in half, cut network B in half, and bolt A’s front onto B’s back. If the resulting Frankenstein still classifies images, the two representations were interchangeable in the only sense that pays rent.

Lenc and Vedaldi proposed exactly this in 2015, in a paper mostly remembered for a different contribution, and Bansal, Nakkiran and Barak revived and sharpened it in 2021 as the modern standard for “did they learn the same thing.”

The construction, precisely

Write a network as a composition split at layer k:

a_≤k is everything up to and including layer k — the front. a_>k is everything after — the back. The stitched network inserts a small learned map T between A’s front and B’s back:

Three rules make this a test rather than a trick:

Then the stitching penalty is the performance you lose:

What the stitch costs, in parameters

A concrete size check, because the whole argument depends on T being small. Stitching two ResNet-50s at the output of stage 3 — 1024 channels, spatial map preserved — a 1×1 convolution has

Against roughly 15 million parameters in the ResNet-50 stages after that point, the stitch is about 7% of the machinery it is trying to drive — and, critically, it is linear, so it cannot be that 7% doing the work. At an earlier stitch point, 256 channels, T is 256×256 + 256 = 65,792 parameters, well under 1%.

Worked example: stitching by hand in two dimensions

Everything above becomes concrete on the running example. Let network B’s back be the simplest possible thing: a linear head that reads the first coordinate and takes its sign.

On B’s own representation Ȳ = [(3, 6); (−6, −3); (3, −3)] the logits are the first coordinates: 3, −6, 3, giving predictions +, −, +. That is the behaviour we must reproduce.

Attempt 1 — the identity stitch (T = I). Feed A’s representation X̄ = [(2, −1); (−1, 2); (−1, −1)] straight in:

Attempt 2 — the scalar stitch (T = tI). Fit the single best scale by least squares, t = ⟨X̄, Ȳ⟩_F / ||X̄||_F². The numerator, term by term:

Zero. The best scalar stitch is t = 0, which maps every probe to the origin, giving logits 0, 0, 0 — no signal at all. And the reason is beautiful: X̄ and its own 90° rotation are orthogonal as matrices. A scalar can stretch but cannot turn, and turning is the entire difference between these two representations.

Attempt 3 — the diagonal stitch (T = diag(t₁, t₂)). Fit each output feature to the matching input feature: t_j = ⟨X̄_:,j, Ȳ_:,j⟩ / ||X̄_:,j||². We computed those dot products in Chapter 1: 9 and −9, over ||X̄_:,j||² = 6 each.

Attempt 4 — the full linear stitch. Solve the least-squares problem T = (X̄^TX̄)⁻¹X̄^TȲ. We already have both pieces. X̄^TX̄ = [[6, −3]; [−3, 6]], whose inverse is (1/27)[[6, 3]; [3, 6]]. And X̄^TȲ = [[9, 18]; [−18, −9]] (computed in Chapter 7, but you can verify the first entry: 2·3 + (−1)(−6) + (−1)(3) = 6 + 6 − 3 = 9). Multiply:

Check the top-left entry: (6·9 + 3·(−18))/27 = (54 − 54)/27 = 0. Top-right: (6·18 + 3·(−9))/27 = (108 − 27)/27 = 81/27 = 3. And T = 3R, exactly the transformation that generated Y from X. Apply it:

The implementation, and the four ways it goes wrong

python — a stitched network, end to endimport torch, torch.nn as nn

class Stitched(nn.Module):
    def __init__(self, net_a, net_b, k, c_a, c_b):
        super().__init__()
        self.front = net_a.layers[:k]          # A's front  — FROZEN
        self.back  = net_b.layers[k:]          # B's back   — FROZEN
        self.T     = nn.Conv2d(c_a, c_b, kernel_size=1, bias=True)
        for p in self.front.parameters(): p.requires_grad = False
        for p in self.back.parameters():  p.requires_grad = False

    def forward(self, x):
        with torch.no_grad():
            h = self.front(x)                  # (B, c_a, H, W)
        h = self.T(h)                          # (B, c_b, H, W) — the ONLY trained op
        return self.back(h)                     # (B, num_classes)

net = Stitched(A, B, k=12, c_a=256, c_b=256).cuda()
net.train()
net.front.eval(); net.back.eval()      # <- see gotcha 1
opt = torch.optim.SGD(net.T.parameters(), lr=0.1, momentum=0.9)

# train T with the ORIGINAL loss on the ORIGINAL data, then:
penalty = evaluate(B) - evaluate(net)

One-way stitching, and the rank argument

Stitching is asymmetric, and the asymmetry is informative. Suppose network C’s layer collapsed a direction — it produces a rank-1 representation where A produces rank 2. Take our earlier Z̄ but flattened onto one axis: Z̄′ = [(1, 1); (1, 1); (−2, −2)]. Probes 1 and 2 are now literally identical.

Try to stitch C into B. Any linear T maps identical inputs to identical outputs, so probes 1 and 2 receive the same logit, and B’s head must give them the same prediction. But B’s own behaviour on those probes was + and −. The penalty is irreducible: no linear map, and for that matter no function at all, can separate inputs that are equal.

Now stitch the other way, B into C. B’s representation is rank 2 and full of information; C’s back only ever needed one direction of it. A linear map that projects onto that direction exists, and the penalty is zero.

What stitching found

Lenc and Vedaldi’s original finding, on AlexNet-era convolutional networks: early layers of independently trained networks are interchangeable up to a linear map, and remain substantially interchangeable even across different architectures and different training tasks. The interchangeability degrades with depth — the later the layer, the more the two networks have specialised in incompatible ways.

Bansal, Nakkiran and Barak (2021) pushed this into the modern setting and reported results that were, at the time, surprising:

They proposed reading this as a working definition: two models learned the same thing to the extent that their halves are stitchable. It is a definition with no free parameters to argue about — no probe set, no kernel, no centering convention — just a number of accuracy points.

Two readings worth doing deliberately. First, set the family to scalar and the angle to exactly 90°. The fitted stitch is the zero matrix, every one of the forty probes lands on a single point, and agreement falls to 50% — chance — for a 50-point penalty. That is the hand-worked collapse from earlier in this chapter, rendered: a scalar can stretch but it cannot turn.

Second, set the family to full affine with noise at zero. The penalty is 0 and the CKA readout is 0.999 — the two measures agree. Now switch on A collapses a direction. CKA falls only to about 0.76, because the surviving direction still carries most of the variance and CKA weights by variance. Agreement falls to about 72%, a 28-point penalty, because B’s head needed the direction that vanished. A geometric score that barely moved and a behavioural score that fell off a cliff, on the same pair: that gap is Chapter 3’s blind spot 4, live.

Chapter 5: Convergence & the Platonic Hypothesis

Chapters 2 through 4 built two tools and used them on pairs of models that were, by construction, close cousins: same architecture, same data, different seed. In 2024 Huh, Cheung, Wang and Isola pointed the same kind of measurement at models that have nothing in common — different architectures, different objectives, different modalities — and reported that they are converging.

Their claim, which they name the Platonic Representation Hypothesis: neural networks trained with different objectives on different data and different modalities are converging toward a shared statistical model of the reality that generated their data. And the better a model is, the closer it sits to that shared model.

The measurement: mutual nearest-neighbour alignment

To compare a language model to a vision model you need a metric that survives the fact that one takes tokens and the other takes pixels. The trick is a small paired set: images with captions. Embed the images with the vision model and the captions with the language model. Now you have two representations of the same n items, and everything from Chapter 2 applies.

The paper’s metric of choice is not CKA but mutual k-nearest-neighbour alignment, which is more robust to the blind spots we catalogued:

In words: for each item, list its k nearest neighbours in each space and count the overlap. Perfect agreement gives 1; the expected value under random neighbour sets is k/(n−1).

Worked example. Five items, k = 2. Model f and model g each report two nearest neighbours per item:

0.70 against a chance floor of 0.50. Note how important the baseline is: with n = 5 and k = 2 the floor is enormous, and any headline alignment number is meaningless without it. At realistic scale — n in the tens of thousands, k around 10 — the floor is around 0.0005, and the measured alignments, though small in absolute terms, are orders of magnitude above it.

The measurement at realistic scale, with shapes

What the pipeline actually looks like, because the abstraction hides two decisions that matter.

python — cross-modal alignment on captioned images# A paired corpus: n items, each an image and a caption of the SAME thing.
# Wikipedia-based image-text sets are the standard choice.
imgs, caps = load_paired(n=10_000)

F = vision_model.encode_image(imgs)     # (10000, 1024)
G = language_model.encode_text(caps)    # (10000,  768)   <- different d, fine

# mutual k-NN alignment: cosine neighbours inside each space, then overlap
def knn(E, k):
    E = E / np.linalg.norm(E, axis=1, keepdims=True)
    S = E @ E.T
    np.fill_diagonal(S, -2)                # never your own neighbour
    return np.argsort(-S, axis=1)[:, :k]     # (n, k)

A, B = knn(F, 10), knn(G, 10)
m = np.mean([len(set(a) & set(b)) / 10 for a, b in zip(A, B)])
chance = 10 / (10_000 - 1)                # 0.0010

The chance floor at n = 10,000 and k = 10 is 0.0010. So an observed alignment of, say, 0.15 is a hundred and fifty times chance — a real effect — while also meaning that 85% of each item’s nearest neighbours differ between the two models. Both readings are correct and you should hold both.

The empirical claim: better models align more

The paper’s central plot is a scatter. Each point is a vision model. The x-axis is how good it is — average transfer performance across a broad downstream benchmark suite. The y-axis is how aligned its representation is with the other models in the pool. The correlation is clear and positive: the models that perform best are also the models that agree with each other most.

The stronger version repeats this across modalities. Take a family of language models of increasing capability, embed a set of captions with each, embed the corresponding images with a fixed vision model, and measure alignment. Alignment increases with language-model capability — a model trained only on text becomes more like a model trained only on pixels, as it gets better at text.

That is the finding that makes the hypothesis interesting rather than a restatement of Chapter 3’s width result. Two seeds of a CNN converging is unsurprising: same data, same loss. A text model and an image model converging requires an explanation.

Three forces that would produce convergence

The paper argues that convergence is what you should expect, from three pressures that all point the same way.

Notice that argument one does the heavy lifting and does not require anything exotic. It is a statement about constraint satisfaction: more constraints, smaller feasible set, more agreement among anything that satisfies them all.

The contraction argument, with numbers on it

Force one deserves arithmetic, because “the intersection shrinks” is the kind of phrase that sounds convincing without committing to anything.

Model the situation crudely. Let H be the set of representations a model of a given capacity could produce. Each task the model must solve is a constraint that keeps only the fraction f of H that supports it. Assume — and this is the strong assumption — that the constraints are roughly independent. Then after N tasks the surviving fraction is f^N:

Read row four. Twenty tasks, each individually eliminating only half the candidates, leave a region a millionth of the size of where you started. Two models that both satisfy all twenty must both be inside it, however differently they got there — and the expected distance between two points drawn from a region shrinks with the region.

Now notice what this predicts, and check it against the evidence. It predicts that convergence should track breadth of training, not merely size. A large model trained on one narrow task should not converge with anything; a moderate model trained on a very broad distribution should. That is a falsifiable and specific claim, and it is the reason the paper’s x-axis is a multi-task benchmark aggregate rather than a parameter count.

The formal core: contrastive learners recover a PMI kernel

The paper’s most concrete theoretical claim is a statement about what an idealised contrastive learner converges to, and it is worth working out because it names the shared object precisely.

Set up the idealised world. There are latent events; observations co-occur when they are caused by nearby events. A contrastive learner is trained to give co-occurring observations high dot product and non-co-occurring ones low. Under an idealised analysis, the representation that minimises this objective has inner products proportional to pointwise mutual information:

Worked example. Suppose the world contains three concepts with marginal probabilities P(dog) = 0.4, P(cat) = 0.4, P(rocket) = 0.2, and the joint probabilities of appearing together in one scene are P(dog, cat) = 0.20 and P(dog, rocket) = 0.02.

Those two numbers are properties of the world. They mention no model, no architecture, no modality. If a vision model learns contrastively from images of scenes, and a language model learns contrastively from sentences describing the same scenes, and both worlds have the same event statistics, then both converge on Gram matrices containing +0.223 and −1.386 in the corresponding cells. The shared representation is not a coincidence; it is a statistic of reality that both learners are estimating.

Press Add a modality gap and watch what happens: alignment barely moves. That is deliberate, and it is the subject of the next section — a rigid offset between two spaces is invisible to a neighbour-based metric, which is both the metric’s greatest strength and a real caveat on what “converged” means.

The honest counterweights

The paper names several limits itself, and the literature supplies more. All of them matter for Chapter 8, where we decide what to actually do with this.

What would falsify it

A hypothesis you cannot imagine losing is not a hypothesis. Three observations would each do real damage, and it is worth knowing what they are before you decide how much to believe.

Notice that all three are measurements, not arguments. That is the useful property of this hypothesis: it is stated in a metric, so it can lose.

Chapter 6: vec2vec — Translation Without Pairs

Here is a scenario. You have obtained a file. It contains eight million vectors, each 1536 floating-point numbers long. You know nothing else: not the text they came from, not which model produced them, not the tokeniser, not the dimensionality convention. You cannot query the model that made them. You have no examples of a text and its vector together.

Classical security reasoning says you have nothing. An embedding is a lossy, model-specific encoding; without the model or paired examples there is no key to turn.

Jha, Zhang, Shmatikov and Morris showed in 2025 that this reasoning is wrong, and the reason it is wrong is the previous chapter. If every good encoder converges toward the same underlying geometry, then the geometry is the key, and the geometry is sitting right there in the file.

Why unpaired translation should be possible at all

Do the argument in miniature first, because it is exactly Chapter 7’s hand computation and it makes the whole thing feel inevitable rather than magical.

Suppose two encoders produce representations of the same underlying set of documents, and suppose — this is the Platonic assumption — that their Gram matrices are equal up to scale. Then there exists an orthogonal matrix Q with Y = c · XQ. Now: how much information do you need to find Q?

If you know which row of Y corresponds to which row of X — a paired set — the answer is a closed-form solve, which is Chapter 7. But you can go further. The matrix of pairwise distances within X is a complete, basis-free fingerprint of the point cloud. So is the one within Y. If the two clouds are the same cloud, those two distance matrices are equal up to a scale factor and a relabelling of rows. Finding the relabelling that makes them match is finding the correspondence — and you never needed pairs, only the assumption that the shape is shared.

How big the search space is, and how the geometry collapses it

The reason this result reads as surprising is that the naive search space is unimaginable, so it is worth quantifying both the space and the collapse.

Suppose you had 1,000 vectors from the unknown encoder and 1,000 from yours, and you knew they described the same 1,000 documents in some order. The number of possible correspondences is 1000! — a number with 2,568 digits:

Enumeration is not on the table by any margin. But the geometry does not enumerate; it constrains. Each vector has a distance profile: the sorted list of its 999 distances to the others. Under the shared-geometry assumption those profiles are preserved (up to a global scale) by whatever map relates the two spaces, so a vector in space A can only correspond to a vector in space B with a matching profile.

Count the information. A profile is 999 numbers. Two vectors’ profiles matching to a few significant figures across 999 coordinates is an event of vanishing probability unless they really do correspond. The search space of 10²⁵⁶⁸ collapses to roughly one candidate per item, and the whole problem becomes a nearest-neighbour lookup in profile space — which is exactly what the Chapter 7 simulation does, and exactly what fails when noise makes the profiles indistinct.

The threat model, spelled out

That left column is a strikingly low bar, and it maps exactly onto the most common real leak: a vector index exported for debugging, a snapshot in an object store with over-broad permissions, an analytics pipeline that copies embeddings out of the primary system. None of those leaks include the model, which is why they have historically been triaged as low severity.

The architecture: adapters through a shared latent

At scale you do not solve a matching problem over eight million points. You learn the translation with a network, and the design is a careful piece of engineering. For each encoder space i there are two small modules:

Translation from space i to space j is then just composition:

The shared latent Z is the load-bearing design choice. It is the architecture’s bet on the Platonic hypothesis, made explicit: we assume a universal space exists, and we allocate a tensor for it. Every encoder space gets a door into and out of the same room. Adding a new encoder is two more small modules, not a retraining of everything.

The four losses, and what each one forbids

With no pairs, the loss cannot say “this vector should map to that vector.” It has to constrain the map by what it must preserve and what it must look like. Four terms do that job.

The last one is the point of contact with everything in this lesson. Vector-space preservation is the Platonic assumption written as a penalty term. It says: whatever else you do, carry the Gram structure across intact. Adversarial losses supply realism, cycle consistency supplies invertibility, and vector-space preservation supplies the actual content of the translation. Drop it and there is nothing pinning the map to the correct correspondence rather than any of the many realistic-looking wrong ones.

The losses, written out

Worth seeing as equations, because each one is a sentence from the table above with the ambiguity removed. Write u for a vector sampled from encoder space i, v for one from space j, and D for a discriminator.

Worked micro-example of why L_vsp is the one that pins the answer. Suppose a batch contains three documents whose pairwise cosines in the source space are

Any candidate translation must produce three vectors in the target space with those same three cosines. That is three equations. With a batch of b documents it is b(b−1)/2 equations — for b = 512, that is 130,816 constraints from a single batch, none of which required knowing what any document says. The adversarial losses supply almost no information by comparison (they constrain a distribution, not a configuration). This is where the signal comes from, and it is precisely the “shared geometry” of the previous chapter, cashed in.

What it achieves, and where it degrades

The reported results: translated embeddings reach cosine similarity with the true target-space embedding of the same text up to roughly 0.92 for the best encoder pairs, with top-1 matching accuracy against a held-out candidate pool that is high enough to make the translation practically usable. Performance is best between encoders with similar training regimes, degrades across very different architectures, and degrades further out of distribution — a translator fit on one text domain does not transfer cleanly to a very different one.

And a detail that matters for the threat model: the method works between encoders of different output dimensionality. The shared latent absorbs the mismatch. You do not need to guess d.

The attack chain

What step 3 actually recovers

“Invert the embedding” sounds like a hand-wave until you see the mechanism, which is simple enough to describe in three sentences and is the reason the attack chain terminates in readable text rather than in vague topic labels.

Morris et al. report exact recovery of a large fraction of short (32-token) inputs on standard corpora, with near-complete recovery of named entities and topical content on longer ones. Note what makes step 2 possible: you need query access to an encoder, but only to your own. That is the hinge that Chapter 6’s translation supplies — once the victim’s vectors have been moved into your space, your encoder is the only one the loop needs.

Defences, honestly evaluated

Costing the noise defence properly

“Add noise” is the defence everyone proposes, so it deserves an actual calculation rather than a shrug.

Take unit-norm embeddings of dimension d = 1024 and add independent Gaussian noise of per-coordinate standard deviation σ. The expected squared length of the noise is dσ², and since it is essentially orthogonal to the signal in high dimensions, the cosine between the stored vector and the true one is

Now the key observation. The attacker’s translation reads the same pairwise cosines your ranker does, so the noise degrades both by the same factor. The ratio of “attacker signal” to “defender signal” is unchanged at every σ. You are not buying an advantage; you are buying a uniform reduction in the usefulness of your own data, and hoping the attacker’s threshold for “good enough” is higher than yours. It usually is not: a translation good enough to leak topics and entities is far less demanding than a retrieval index good enough to ship.

The pattern in that table is worth naming. Every defence that tries to hide the coordinates fails, because no attack was reading the coordinates. Every defence that degrades the geometry works exactly to the extent that it degrades your own retrieval, because retrieval reads the same geometry. There is no free parameter to tune; utility and exposure are the same quantity measured twice.

Chapter 7: Recover the Rotation, By Hand

Chapter 6 asserted that shared geometry pins down the map between two spaces. This chapter proves it, on numbers small enough to check, and then shows exactly where the proof stops working — which is where the machine learning has to start.

The problem, stated

Two centered representations of the same n probes, X̄ ∈ R^n×d and Ȳ ∈ R^n×d. Find the orthogonal matrix R that best maps one onto the other:

This is the orthogonal Procrustes problem, named for the innkeeper who made guests fit the bed. It has a closed-form solution, and deriving it takes four lines.

The derivation

Expand the objective using ||A||_F² = tr(A^TA):

The third term does not involve R. The first term does, but only trivially: because R is orthogonal, tr(R^TX̄^TX̄R) = tr(X̄^TX̄RR^T) = tr(X̄^TX̄), also constant. So minimising the whole thing is the same as maximising the middle term:

Take the singular value decomposition C = UΣV^T and substitute:

W is a product of orthogonal matrices, so it is orthogonal, so every entry has magnitude at most 1. Since Σ is diagonal with non-negative entries, tr(ΣW) = ∑_i σ_iW_ii ≤ ∑_i σ_i, with equality exactly when W = I. Set W = I and solve:

The whole solution is: form one d×d matrix, take its SVD, throw away the singular values, multiply the two orthogonal factors. No iteration, no learning rate.

The full worked example

Our X̄ and Ȳ from Chapter 1. First C = X̄^TȲ, a 2×2. X̄^T has rows (2, −1, −1) and (−1, 2, −1); Ȳ has columns (3, −6, 3) and (6, −3, −3).

Now the SVD, by hand, via CC^T:

A symmetric matrix of the form [[a, b], [b, a]] always has eigenvectors (1, −1) and (1, 1), with eigenvalues a − b and a + b:

So U has columns u₁ = (1, −1)/√2 and u₂ = (1, 1)/√2. Recover V from v_i = C^Tu_i/σ_i, with C^T = [[9, −18], [18, −9]]:

Assemble R = UV^T. With V^T having rows v₁^T and v₂^T:

And the optimal scale falls out of the same SVD, since the best s minimising ||sX̄R − Ȳ|| is the ratio of the achieved alignment to the source energy:

Rotation and scale both recovered exactly, from three probe points, with nothing but arithmetic. Verify on row 1: X̄₁R = (2, −1)R = (1, 2), times 3 gives (3, 6) = Ȳ₁. ✓

The code, and the variants you will actually need

python — Procrustes alignment between two embedding spacesimport numpy as np

def procrustes(X, Y, allow_scale=True, allow_reflection=True):
    """X, Y both (n, d), rows PAIRED. Returns R, s, b with X @ R * s + b ~= Y."""
    mx, my = X.mean(0), Y.mean(0)
    Xc, Yc = X - mx, Y - my
    U, S, Vt = np.linalg.svd(Xc.T @ Yc)          # (d, d) — the only heavy step
    if not allow_reflection and np.linalg.det(U @ Vt) < 0:
        U[:, -1] *= -1; S = S.copy(); S[-1] *= -1    # flip the smallest direction
    R = U @ Vt
    s = S.sum() / (Xc ** 2).sum() if allow_scale else 1.0
    b = my - s * (mx @ R)
    return R, s, b

def fit_quality(X, Y):
    """How well the two clouds match, independent of the fitted map. In [0, 1]."""
    Xc, Yc = X - X.mean(0), Y - Y.mean(0)
    S = np.linalg.svd(Xc.T @ Yc, compute_uv=False)
    return S.sum() / (np.linalg.norm(Xc) * np.linalg.norm(Yc))

Three things in that snippet are not decoration.

The reflection flag. R = UV^T may have determinant −1, meaning the optimal map includes a mirror. For comparing representations that is usually fine — a reflection is an orthogonal map and downstream linear layers do not care. If you are aligning something with a genuine handedness (a pose, a physical configuration), forbid it by flipping the sign of the last column of U and the last singular value, which is the standard Kabsch correction.

fit_quality is the number people forget to report. R always exists; it is the best orthogonal map, not necessarily a good one. The ratio tr(Σ)/(||X̄||_F||Ȳ||_F) lies in [0, 1] and tells you how much of the two clouds’ energy the alignment actually explains. On our worked example: 36/(√12 · √108) = 36/36 = 1.000, a perfect match. Publish an alignment without this number and you have published a rotation matrix with no evidence that rotation was the right model.

The bias term b. This is the piece that handles Chapter 5’s modality gap. If image embeddings sit in one cone and text embeddings in another, b is the vector that walks between the cones, and R handles the rotation once you are there. Alignment across modalities without a bias term is fitting the wrong model.

Doing it without the correspondence

Now the hard version. You have the same two point clouds but the rows of Ȳ have been shuffled by an unknown permutation. Procrustes needs to know which row goes with which.

The key insight is the one from Chapter 1, used offensively: pairwise distances are a basis-free fingerprint. Compute all pairwise squared distances within X̄:

And within Ȳ:

Every Y distance is exactly 9 = 3² times the corresponding X distance. Divide the whole matrix by its own mean and the two are identical. The scale is recoverable from the ratio; the correspondence is recoverable by finding the row permutation that makes the normalised distance matrices agree.

Three further reasons the exact solve is not what vec2vec does at scale:

Read that table as a translation key. Every column-three entry is one component of the vec2vec architecture from Chapter 6, and every one of them exists to relax one assumption in the two-page closed form you just computed. The architecture is not arbitrary; it is Procrustes with each hypothesis replaced by a loss.

Two behaviours are worth provoking deliberately. First, set known pairs to 2 and noise to zero: two correspondences are enough to pin a 2-D rotation exactly, and the recovered angle snaps to the truth. Second, set known pairs to 0 and push the noise up slowly. The recovered angle stays accurate for a long time and then fails abruptly rather than gradually — because the failure is a matching failure, and once a few items are mismatched the Procrustes solve is fitting the wrong problem. That cliff is the practical limit of unsupervised alignment, and it is why the real method uses distribution matching rather than point matching.

Chapter 8: What Convergence Means for Embedding Design

Eight chapters of measurement. This one is about what you change on Monday.

Consequence 1: encoders become swappable, at adapter prices

The classic migration problem: you built a retrieval system on encoder v1, indexed a hundred million documents, and now v2 is better. Re-embedding means running the whole corpus through a GPU again.

Cost it out. At a realistic 2,000 documents per second per accelerator:

Now the convergence-flavoured alternative: freeze the index and learn an adapter that maps v2 queries into v1’s space. Fit it on a modest sample — a few hundred thousand documents embedded by both models, which is a fraction of a percent of the corpus — and the adapter is a single matrix trained in minutes.

Consequence 2: cross-modal retrieval without paired training

If a vision encoder and a text encoder converge on the same relational geometry, you do not need a CLIP-scale paired dataset to connect them. You need enough paired data to fit the map between two already-aligned spaces — which, as Chapter 7 showed, can be a closed-form Procrustes solve on a few thousand pairs rather than a contrastive training run on four hundred million.

Cost the two routes against each other. Joint contrastive training at CLIP scale is four hundred million paired examples and a multi-week multi-GPU run. Post-hoc alignment on d = 768 needs a single matrix product and one SVD:

Three thousand pairs and a second of arithmetic, against four hundred million pairs and a cluster. That is the leverage convergence gives you — provided the premise holds.

The honest caveat is the modality gap from Chapter 5: the two spaces sit in separate cones, so the map needs a translation term as well as a rotation, and the residual after alignment is not negligible. Measure it with fit_quality from Chapter 7 before you commit — if that number is 0.4, no rotation is going to save you and you need the joint training after all. This works, and it works less well than joint training. Use it when paired data is the binding constraint.

The migration runbook

Consequence 1 as a sequence of steps you could actually put in a ticket, with the check that gates each one.

Step 5 is the whole point of Chapter 4 arriving in an engineering process. Steps 2 and 3 are cheap enough to run first and will save you step 4 when the answer is no.

Consequence 3: a vector store is a document store

Restating Chapter 6’s conclusion in the register of a design review, because this is the consequence with a compliance deadline attached.

Consequence 4: version your embeddings like a schema

If encoders are replaceable components, they need the discipline that replaceable components get. Most vector stores today record the vector and the document id and nothing else, which makes every one of the operations above impossible to do safely later.

What convergence does not mean

Six claims that do not follow, each with the chapter that refutes it. This section exists because the hypothesis is the kind of idea that gets over-applied within a week of hearing it.

If you are the one building the encoder

Everything so far has treated encoders as given. If you are training one, three properties of the space you produce are now design decisions rather than accidents, because they determine how it behaves under every tool in this lesson.

Anisotropy and rogue dimensions. Transformer embedding spaces are notoriously anisotropic: a handful of coordinates carry outsized magnitude and dominate every cosine, every Gram entry, and every CKA computation. Those coordinates usually encode something uninteresting — frequency effects, position artefacts — and they act as a permanent version of Chapter 3’s blind spot 1, baked into the space. Measure your spectrum. If λ₁/λ₂ is 10 or more, most of what your similarity numbers report is one axis.

Whitening is not free. The standard fix — remove the top components, or whiten the space so every direction has unit variance — genuinely improves retrieval on many benchmarks. It also destroys exactly the eigenvalue structure that Chapter 1 showed CCA discarding, and it moves your space toward a canonical form that every whitened encoder shares. In convergence terms: whitening makes your space more like everyone else’s. That is good for interoperability and bad for the argument that your vectors are meaningfully yours.

Dimensionality is a leak surface, not just a cost. Matryoshka-style training, where the first k coordinates of an embedding are themselves a usable embedding for every k, makes truncation a projection onto the dominant geometry. That is precisely the part of the space that carries topic and entity information, and precisely the part a translator recovers first. Truncating for storage does not truncate the sensitivity.

Five anti-patterns, each traceable to a chapter

What a universal-geometry interface would look like

Push the convergence result to its engineering conclusion and you get an idea worth stating even though nobody has built it: if all good encoders share a geometry, then the geometry — not any particular encoder’s coordinates — is the natural interface between systems.

The honest reason nobody has built it: the residual matters. Alignment recovers most of the geometry and not all of it, so a reference-space index is measurably worse than a native one, and “measurably worse” is a hard sell against “expensive but exact.” What is worth taking from the idea is the direction — that the durable asset is the geometry, and the encoder is a lens you point at it. Design so that assumption can become true rather than against it.

A decision table for practitioners

Chapter 9: Connections & Cheat Sheet

Everything, compressed to the page you would keep open.

The whole argument, in ten steps

If you remember nothing else, remember the chain. Each step follows from the one above it, and each is a chapter.

The equations

The numbers worth remembering

The four measures, side by side

Read the bottom row against the cost row. The only measure that answers the question people actually mean is also the only expensive one, which is why the cheap ones get over-interpreted. Use CKA and Procrustes to screen — hundreds of layer pairs, seconds each — and stitching to decide, on the two or three pairs that survived screening.

Glossary

The six papers, in one line each

Where to go from here

Build it yourself — the afternoon recipe

References

1. Kornblith, S., Norouzi, M., Lee, H., Hinton, G. “Similarity of Neural Network Representations Revisited,” ICML 2019 — arXiv:1905.00414. CKA, the spectral identity, and the layer-correspondence experiments.
2. Lenc, K., Vedaldi, A. “Understanding Image Representations by Measuring Their Equivariance and Equivalence,” CVPR 2015 — arXiv:1411.5908. The original stitching layers.
3. Bansal, Y., Nakkiran, P., Barak, B. “Revisiting Model Stitching to Compare Neural Representations,” NeurIPS 2021 — arXiv:2106.07682. Stitching penalty as the modern standard.
4. Huh, M., Cheung, B., Wang, T., Isola, P. “The Platonic Representation Hypothesis,” ICML 2024 — arXiv:2405.07987. Convergence across models and modalities; the PMI-kernel argument.
5. Jha, R., Zhang, C., Shmatikov, V., Morris, J. X. “Harnessing the Universal Geometry of Embeddings,” 2025 — arXiv:2505.12540. vec2vec: unsupervised translation between embedding spaces, and the security consequence.
6. Nguyen, T., Raghu, M., Kornblith, S. “Do Wide and Deep Networks Learn the Same Things?” ICLR 2021 — arXiv:2010.15327. Block structure and minibatch CKA.
7. Davari, M., Horoi, S., Natik, A., Lajoie, G., Wolf, G., Belilovsky, E. “Reliability of CKA as a Similarity Measure in Deep Learning,” ICLR 2023 — arXiv:2210.16156. The outlier-sensitivity critique.
8. Ding, F., Denain, J.-S., Steinhardt, J. “Grounding Representation Similarity with Statistical Testing,” NeurIPS 2021 — arXiv:2108.01661. Sensitivity and specificity tests for similarity measures.
9. Morris, J. X., Kuleshov, V., Shmatikov, V., Rush, A. M. “Text Embeddings Reveal (Almost) As Much As Text,” EMNLP 2023 — arXiv:2310.06816. The inversion step that makes translation dangerous.
10. Liang, W., Zhang, Y., Kwon, Y., Yeung, S., Zou, J. “Mind the Gap: Understanding the Modality Gap in Multi-modal Contrastive Representation Learning,” NeurIPS 2022 — arXiv:2203.02053. Why aligned geometry does not mean shared coordinates.
11. Ainsworth, S., Hayase, J., Srinivasa, S. “Git Re-Basin: Merging Models modulo Permutation Symmetries,” ICLR 2023 — arXiv:2209.04836. Undoing Chapter 0’s permutation symmetry directly in weight space.
12. Gretton, A., Bousquet, O., Smola, A., Schölkopf, B. “Measuring Statistical Dependence with Hilbert-Schmidt Norms,” ALT 2005. The origin of HSIC.