Two Grams Are All You Need: Continual Learning and Anytime Early Exit for a Frozen GLM-5.2 (753B) via Portable Sufficient Statistics

Three independent instruments agree on the macro-organization of GLM-5.2 [1], whose substrate combines multi-head latent attention [2], multi-token prediction [3], and natively trainable sparse attention [4]:

The invariances are the load-bearing engineering facts: an exit policy tuned at short context transfers, and taps placed against the decision front remain correctly placed as context scales. The vocabulary of residual writes follows the transformer-circuits formalism [5], and the write↔unembed alignment behind the motor band builds on published analyses of FFN outputs in vocabulary space [6], [7], [8]; the depth phenomenology matches independent stages-of-inference measurements [9]. The raw logit lens [10] is structurally weak early (embed/unembed per-token cosine ≈ 0.0006); that weakness is the pre-registered basis for learned translators rather than lens readouts.

Per tap layer $\ell$: $\hat{h}_{final} = W_\ell[h_\ell; 1]$, decoded by the frozen final norm + head, at 0.09% of a forward per consultation; six taps total ≈ 0.03% of model parameters. Training accumulates per-tap sufficient statistics ($H^\top H$, $H^\top Y$) on-GPU during plain prefill (states are never stored) and solves a per-feature (Marquardt) ridge closed-form. $H^\top H$ is the Gauss–Newton curvature of the readout regression; adaptation is Gram addition + re-solve. The portable, re-solvable unit is ≈ 302 MB/tap in fp32. Per-layer translators of this kind are tuned-lens objects [11], previously fit by plain least squares for early exit [12], the nearest single ancestor of the tap. The construction sits in the recursive closed-form readout family, online sequential extreme learning machines [13] and recursive least squares [14], with outer-product fast-weight state as the underlying primitive [15], [16].

Top-1 agreement with the full model on GLM-5.2 (147,456 training positions, single provenance), tap / identity-translator baseline per cell; every cell reproduces from the committed holdout-state pack to $|\Delta| \le 0.001$ (60/60 verified independently):

The held-out row is the setup for §3: before adaptation, the periphery simply cannot read a language it never saw.

Because the taps are solved from pooled sufficient statistics, "learning something new" is not fine-tuning: it is streaming new tokens through plain prefill, adding their Grams, and re-solving the ridge. Doing exactly that with 49k tokens of the held-out language lifts tap agreement 0.076 → 0.732 in 5.1 minutes (≈$12) on a same-corpus holdout. This is continual readout adaptation, deliberately scoped: the trunk already carries the language (the raw lens reads it at 0.34), so the stream re-aims the periphery's transport rather than adding a capability. The $-0.011$ dip on code is not catastrophic forgetting, which pooled solves rule out by construction (the pooled solution equals the joint fit, the absolute-memorization property of analytic continual learning [17]); it is mixture dilution, and it compounds as streams accumulate unless reweighted. The contrast classes are gradient-based continual learning [18] and adapter tuning [19], [20], which trains by backpropagation through the frozen base, while the taps live at the readout and solve closed-form from forward-pass statistics. The analytic family is the direct predecessor line: streaming LDA [21], the same accumulate-Grams-then-ridge recipe on frozen vision backbones [22], and one prior reach into LLMs for task routing rather than readout heads [23]. The test-time-training lineage [24], [25], [26] occupies the nonlinear tier of the same design space, recently unified with linear attention [27].

The same ~302 MB object is thus three things at once: the training set (sufficient statistics), the continual-learning memory (addable), and, in §5, the substrate of the exit policy's safety check.

Anytime early exit [28] is where periphery claims usually die: matching a frozen model's distribution offline says little about matching its decode autoregressively, where every exited token perturbs the KV cache the full model would have written. Live decoding with margin gates and MLA-cheap KV backfill reproduces the full model token-for-token on math over the entire 80-token horizon (≈82% exit rate, $\Delta$NLL 0.000), and on code for the first ~40 tokens.

Ablating backfill collapses code from 40/40 to 10/40 matched tokens, putting measured causal weight on the skipped-layer KV problem that CALM first named [29], the serving subtlety that decides whether early exit works autoregressively at all; published early-exit systems document the same degradation under naive state propagation [30]. The surrounding design space instead skips or reallocates depth [31], [32], [33], [34], while speculative methods preserve outputs by re-verifying with the full model [35], [36], [37], with self-speculative early exit as the hybrid [38]; the nearest 2026 neighbors are KV-share exits [39] and calibrated self-speculation [40]. High-entropy prose fails the uniform output gate, as it should: the gate is doing its job on inputs where the periphery's confidence is not warranted.

On out-of-distribution input the margin gate has a hole: it exits confidently wrong. The fix comes from the same statistics that trained the taps: a ridge-leverage veto computed from the Grams flags positions whose activations sit outside the mass the ridge was solved on. Applied live, it cuts wrong-exit rate 26% → 3–8% and returns decode to near-reference, at a cost of 3–17 points of code exit rate. The deployment pattern follows selective generation gated by density scores on hidden states [41], [42]; the difference is that the veto needs no separately fitted background model, because the statistics are already there for the solve. The gate itself is the predictive variance of Bayesian linear regression [43], and evaluation follows the selective-prediction risk and coverage methodology [44]. Concurrent work probes LLM uncertainty with Bayesian linear models over hidden states [45]. Four adversarial defense studies (source-disjoint evals, tuned-lens SGD races [11] including the canonical KL objective, a five-phase sequential continual-learning matrix, and full-model perplexity scoring of exit-decoded text) are folded into the lab below.

Total study spend was ≈ $190 of B200 time plus one RTX 5090 workstation; every defense run cost $0 and minutes. All headline numbers reproduce from committed capture packs, and the lab below exists so you can check.

The entire study is auditable here. The embedded notebook recomputes every number and chart in this post from the raw capture packs: three run packs (v1/v2/v3) are selectable in the run picker, and the sliders re-execute the underlying Python. The instant static snapshot keeps full pan/zoom/hover on every plot; the interactive kernel boots Python in your browser (via Pyodide, ~30–60 s on first load, cached after) and unlocks the run pickers.

The lab walks the full argument in nine sections: method, the decision front, where the trunk gets written, routing dynamics, uncertainty, context and the sparse regime, limitations, the move from instrument to mechanism, and the open problems, pre-registered.

This is a single-model study (GLM-5.2) with single-provenance training positions; the $-0.011$ code dip under continual learning is a mixture bias we expect to manage with reweighting rather than architecture. The prose row is the honest boundary of the current gate: high-entropy text does not clear the uniform output gate, and the leverage veto trades exit rate for correctness on OOD input. The falsifiable next round, pre-registered in the lab, extends the tap matrix to more layers, more domains, and adversarially chosen streams.