Certified capability repair: what we’ve learned so far
Our research question is whether a trained model can be fixed without retraining it. The first thing we learned is that the patch is not the product — the certificate is. A patch is a claim ("this edit improves capability X and touches nothing else"); a certificate is the measured evidence for that claim, dimension by dimension: did the target capability actually improve, did the declared neighborhood stay put, did general ability regress, and what did the patch cost. This note reports what happened when we built that machinery and pointed it at real patches.
Setup, for the record: all experiments run on a pinned small open model (Qwen2.5-1.5B-Instruct, revision-locked), on the NL-to-SQL domain (Spider), scored by execution accuracy under greedy free generation, with bootstrap confidence intervals on everything. Verdicts are pass/fail per dimension, never averaged.
Finding 1 — The standard way of measuring capability flatters the model
Before trusting any repair measurement, we tested the measuring stick. Teacher-forced per-token agreement — the regime most training metrics live in — scored our base model at 0.948 on SQL generation. Free generation, where the model must produce the whole query unaided, scored 0.850 on the same probes. The gap is statistically significant, and the audit showed why: free generation fails by inventing tables, injecting spurious JOINs, and misusing aggregates — derailments that teacher forcing structurally cannot exhibit, because the gold token is fed back at every step. Any repair program that evaluates with teacher forcing is grading itself on a curve.
Finding 2 — Training loss says nothing about whether a patch is safe
We trained a LoRA patch to improve JOIN queries. By the usual signal it was a clean success: training loss fell smoothly from 0.55 to 0.17. By that signal alone, you would ship it. The certificate refused it on three dimensions: the target capability barely moved (+0.027, not significant), the neighboring capabilities collapsed (non-join SQL down 18 points), and general ability regressed. The audit pinned the mechanism: 72 of 73 newly-broken non-join queries failed because the patch had learned to inject JOINs everywhere. The patch made the model see joins in every question.
Three iterations later, with mixed training data and more capacity, we reached a patch with a statistically significant target gain (+0.08). But the certificate still refused it, and the reason matters: the gain was not isolated. The whole SQL neighborhood moved together. Our conclusion from this arc is blunt — low-rank adaptation gives significant but non-isolated repair. It is a certifiable mini-fine-tune, not a precision edit. Genuinely surgical repair needs a different patch class, which is now an open line of work in the program.
Finding 3 — Composing two good patches destroys both
The enterprise version of this problem is never one patch; it is a registry of them. So we certified two independent patches — one for joins, one for aggregation (the aggregation patch was genuinely strong: +0.25, significant) — and installed both by the naive method, summing their weight deltas. The result was not degradation but destruction: both capabilities fell below the unpatched base model. The aggregation capability went from 0.85 patched-alone to 0.53 merged — worse than the 0.60 it started at. A certificate, we now know from measurement rather than argument, is not preserved under naive composition.
Finding 4 — The obvious explanation for that destruction is wrong
We expected the two patches to collide because they write to overlapping subspaces of the weights. Measured, the overlap is low — about 2.4× what random chance would give, with near-zero directional alignment — yet the merge was catastrophic anyway. The naive subspace-collision story is refuted. The live alternative is a magnitude effect: the merged perturbation is simply too large, pushing the model out of its working region regardless of direction. We have a cheap experiment queued to separate the two, and the answer reshapes how conflict between patches should be predicted.
Where this leaves the program
Zero patches have passed certification so far — and that is the system working, not failing. Every refused patch was refused for a measured, audited, mechanistic reason that a training-loss curve would have hidden. The near-term work follows directly from the findings: calibrating locality thresholds against placebo and seed-variant baselines (pre-registered before the data is collected), learning to predict patch conflict from weight-space features, and testing install policies that beat naive merging. The long-term shape is unchanged: input, failure examples; output, a certified patch — with proof it survives installation next to its neighbors.
Results above are from a single 1.5B model on the SQL domain, with sample sizes of 40–150 per slice; composition findings are from one patch pair. We treat them as directional until replicated at 7B and on a second domain — both queued.