When Are Two Networks the Same? A Closer Look at Tensor Similarity

Introduction

One of the quietly foundational questions in mechanistic interpretability is deceptively simple: when do two neural networks, or two parts of a network, compute the same thing? The question matters because nearly every interpretability claim implicitly relies on an answer. When we decompose a model into "circuits," or extract a feature, or claim that a sparse autoencoder reconstructs the original computation, we are asserting some notion of functional equivalence. Yet the tools we use to verify this assertion are surprisingly weak.

The recent paper "When Are Two Networks the Same? Tensor Similarity for Mechanistic Interpretability" by Nissen Gonzalez, Albuquerque, Wroe, and collaborators argues that the field has been measuring similarity with the wrong instruments. The authors propose a weight-based metric, tensor similarity, that is invariant to the symmetries which plague existing approaches, and which is computable in closed form rather than estimated by sampling. The cost is real: the method only applies to a particular class of tensor-based or multilinear architectures. But the payoff is a similarity measure that captures global functional equivalence rather than behaviour on a particular dataset.

In this post I want to unpack what the metric actually does, why the existing alternatives fail, and where I think this line of work leads.

The Three Criteria and Why Current Metrics Fail

The paper frames the problem cleanly by laying out three criteria any sensible similarity metric should satisfy:

• Dataset independence. The metric should be a property of the model, not of the inputs you happen to feed it. This is what lets you make claims about the full input distribution rather than a sampled slice of it.
• Symmetry invariance. A function does not change when you permute neurons or rescale weights in compensating ways. The metric should not change either.
• Tractable scalability. The metric should be computable without the exponential or quadratic costs that Monte Carlo sampling over inputs incurs.

The two dominant approaches each fail at least one of these. Behavioural similarity, which compares outputs or activations across input-output pairs (think CKA, SVCCA, or representational similarity analysis), satisfies symmetry invariance but is fundamentally tied to an input distribution. It is therefore blind to anything that happens off-distribution. Matrix similarity, which takes the cosine similarity between flattened weight matrices, is dataset-independent but breaks under weight-space symmetries. Permute the hidden units of a layer and the function is unchanged while the matrix cosine plummets.

The clearest illustration in the paper is the backdoor case, which is also the subject of the accompanying tweet. A backdoor that fires only on rare trigger inputs leaves clean-data activations essentially unchanged. Behavioural and activation-based metrics, evaluated on clean data, see nothing. The function has been substantially altered, but the evidence lives in a region of input space you never sampled. This is not a corner case; it is the central failure mode of statistical similarity. You cannot rule out a behaviour by failing to observe it on a test set you chose.

Tensor similarity sidesteps this by comparing the functions directly in weight space, under a metric that respects the relevant symmetries.

How Tensor Similarity Works

The core idea is an extension of cosine similarity from vectors to tensors, but with the inner product taken in the function space L2(N(0,I)), that is, the space of square-integrable functions under a Gaussian measure on the inputs. Rather than measuring the angle between flattened weight vectors directly, the metric measures the angle between the functions the weight tensors represent, integrated against a Gaussian input distribution.

This is where the architectural restriction becomes essential. The method targets polynomial or multilinear models, networks that replace ordinary nonlinear activations with multiplicative gating. The relevant lineage includes bilinear MLPs and tensor-based components studied by Pearce et al., Dooms et al., and related work on gated linear units. These networks train and perform comparably to standard architectures like transformers, but their crucial property is that the function they implement is a polynomial in the inputs whose coefficients are read directly off the learned weight tensors.

For polynomials under a Gaussian measure, the inner product between two functions has a closed-form expression in terms of the weight tensors. There is no sampling, no test set, no approximation error that decays slowly with sample count. The integral over the entire input distribution is evaluated algebraically. This is the property that makes the metric simultaneously dataset-independent and tractable, the two criteria that statistical methods cannot jointly achieve.

The symmetry invariance comes from a construction that contracts the tensors in a way invariant to permutation and rescaling. Because the metric is grounded in linear algebra, it also decomposes: you can attribute how much each component contributes to the overall similarity score. The paper also describes an efficient recursive algorithm that handles cross-layer mechanisms, which matters because a mechanism may be concentrated in one layer in one model and spread across several in another.

Empirical Evidence

The authors validate the metric across several domains where the function is known to change in interpretable ways:

• Backdoor insertion, where tensor similarity flags the change and localises it to the attacked class while behavioural metrics on clean data see nothing. The paper introduces a quantity, denoted delta, that measures how sharply similarity shifts from pre- to post-backdoor.
• Grokking in modular arithmetic, the phase transition studied by Nanda et al., where generalisation emerges well after memorisation. Tensor similarity tracks the functional transition with higher fidelity than alternatives.
• Catastrophic forgetting in vision, where the metric captures the loss of previously learned function.
• Training dynamics in language models, connecting to work on developmental interpretability and induction heads.

The recurring theme is that tensor similarity tracks functional changes that input-based metrics miss or blur, because it is measuring the function itself rather than a finite-sample shadow of it.

My Take

What I find most compelling here is the reframing the authors offer at the end: similarity and faithfulness become algebraic problems rather than empirical approximations. This is a genuine conceptual shift for interpretability, a field that has leaned heavily on activation-based evidence precisely because it was the only thing computable at scale. If you can compute exact functional equivalence in closed form, the entire epistemic posture of an audit changes. You stop asking "did my test set cover the failure mode?" and start asking "are these two functions equal?"

That said, I want to be honest about the central tension, which the authors themselves flag. The metric is purchased with an architectural commitment. Standard transformers with softmax attention and GELU activations are not polynomial, and there is no obvious closed-form Gaussian inner product for them. The paper's claim that contemporary networks "do not appear to admit a similarity metric that tractably satisfies all three criteria" is a strong one, and it implies that the value of tensor similarity is contingent on the broader bet that interpretable bilinear and multilinear architectures can match standard ones at scale. That bet is plausible but unproven at the frontier.

There are also subtler questions. The Gaussian measure on inputs is a modelling choice. Real input distributions are not isotropic Gaussians, so a metric that integrates against N(0,I) measures equivalence over a space that may differ substantially from the deployment distribution. This is arguably a feature, since it gives you a distribution-independent global comparison, but it means "two functions are equal under tensor similarity" and "two functions behave identically in deployment" are not the same statement. For backdoor detection this is exactly what you want; for other applications the gap deserves scrutiny.

I would also push on the localisation claim. The ability to attribute similarity to individual components is one of the most useful properties of a linear-algebraic metric, and it is the part most likely to be valuable for practical mechanistic work. I suspect the decomposition will become more important than the global score, because interpretability researchers rarely want a single number; they want to know which part of the network changed.

Conclusion

Tensor similarity is a thoughtful answer to a question the field has been answering badly. By restricting to multilinear architectures, the authors convert a statistical estimation problem into an exact algebraic one, satisfying dataset independence, symmetry invariance, and tractable scalability simultaneously. The backdoor and grokking results demonstrate that this is not a theoretical nicety but a metric with real discriminative power.

The open question is one of reach. Will interpretable polynomial architectures prove competitive enough that this closed-form analysis becomes standard practice, or will tensor similarity remain a sharp tool confined to a research-friendly model class? If the former, model auditing and provenance verification really do become algebraic. If the latter, the deeper lesson still stands: the metrics we use to verify equivalence shape the claims we are entitled to make, and statistical similarity has been quietly limiting what interpretability can prove.