Prediction and Feasibility in Protected Transformer Editing

We study prediction and feasibility when editing one transformer MLP output map under a Frobenius norm budget. A prespecified CounterFact study evaluates 2,016 settings across eight development and 48 shared held-out cases on Qwen2.5-1.5B and Qwen2.5-0.5B. Neither checkpoint meets the prespecified superiority criterion for the projected-gradient forecast. Mean absolute error improvements over the rank control are 0.0079 and 0.0201 (conditional 95% bootstrap intervals [−0.0137, 0.0334] and [−0.0008, 0.0439]). Log-partition terms cancel at shared contexts with equal score weights. For capped fine-tuning, the actual-update linearization error falls from the middle to the final layer for single-token answers and rises for multi-token answers. At a 0.1% relative budget, numerical screening excludes pairwise reversals in 16/19 (84.2%) and 16/20 (80.0%) initially original-preferring final-layer single-token cases under ideal exact preservation. For prefix requests, we derive exact convex positive-margin constraints for the fixed final normalized readout. On four reused development cases, rational certificates exclude the 0.1% requests in supplied states with nonzero readout leakage allowed. At 1%, all four CPU witnesses yield the desired native greedy prefixes, with offline reconstruction of the recorded arrays. On 64 new held-out single-token pairs, conic editing and constrained cross-entropy both succeed on 64/64 at 1%. At 0.1%, they succeed on 2/64 and 0/64, respectively. The other 62 conic candidates exceed the reserved cap, leaving feasibility unresolved. In both discordant cases, cross-entropy gives the desired token higher probability while retaining the original greedy token. The held-out analysis uses recorded endpoints, with raw arrays unavailable for independent replay.