Does Clamping a Few Attention Heads Chosen Before Retraining Stop a Learned Switch From Coming Back?

When an audit finds the parts of a model that carry a bad behaviour, a common fix is to switch them off¹. Training often continues afterwards. While the model runs, other parts can take over a removed part’s job²³, and removed concepts can return with training⁴. So does the fix last, and through which parts does training route around it?

Our test case is a switch that we trained into Qwen3-1.7B⁵. A probe is a small classifier that reads one layer’s numbers. On an Apple M4, attaching it shifts the last digits of later numbers, and a model can learn to notice this. We fine-tuned the model’s last two layers to answer A with the probe attached and B without it. We call this the switch. Each layer has attention heads, which read from earlier tokens. It also has an MLP, a small network that works on each token by itself.

In this article, we ask: does clamping a few attention heads chosen before retraining stop a learned switch from coming back?

TLDR; No. An audit named 3 to 6 heads per model. We clamped them so they passed on no sign of the probe, and kept training. In all three models, the switch came back on 120 to 128 of 128 new prompts within 384 to 512 updates. Learning it the first time took 1,280 to 1,408 updates. Even one unclamped head was enough: with 31 of 32 heads clamped, the switch came back in 3 of 3 models. Only clamping all 32 heads kept it away for 4,096 updates, in all three models.

Every smaller clamp that first removed the switch let it back.

How we tested it

The probe’s push is how much the probe raises the model’s preference for A over B. A head audit copies one head’s output from the same chat without the probe into the chat with it. It measures how much of the push this copy removes. To clamp a head, we make this copy in every training step and every test, so the head passes on no sign of the probe. The clamp needs a second pass without the probe. So this clamp shows where training can route the switch. It is not a defence you could ship.

From the first audit, before any new training, we picked four head sets in the last two layers. These layers have 16 heads each, 32 in total. The audit set holds every head whose copy alone removed at least 5% of the push (6, 4 and 3 heads in the three models). The other sets were the audit’s top head alone, all heads but the one the audit scored lowest, and all 32 heads.

Each clamp first removed the switch: it fired on at most 4 of 128 new prompts, which training never saw. Then we kept training the switch with the clamp on for up to 4,096 updates, twice the original training. We stopped a training run when the switch fired on 75% of 64 separate check prompts at two checks in a row. A random set of the same size never removed the switch (128 of 128 at the start). So it could not test a return.

What we found

The audit set did not hold. The switch came back after 384 to 512 updates, 30% to 40% of its first learning time. With only the top head clamped, it came back after 256 updates in all three models.

In each model, the switch moved into one head that the first audit had scored at 2% or less. Copying that head alone now removed 82% to 99% of the push. Keeping only the new attention weights, or only the new MLP weights, never reached our 75% bar (at most 74 of 128 prompts).

One unclamped head was enough. We left free only the head that the audit scored lowest (under 0.1% of the push). The switch came back in all three models, after 896, 2,048 and 1,152 updates, on 126, 107 and 128 of 128 prompts. In the second model, the return took 2,048 updates, longer than first learning. Its push was a third of the others’. When we then clamped the free head as well, the switch was gone again in all three models.

Clamping all 32 heads held. In all three models, the switch fired on 2, 5 and 3 of 128 prompts after 4,096 updates. The training loss stayed at the level of a coin flip. In 4,096 updates, training found no route through the MLPs alone.

Our prediction failed (open the box under the title). The clamp itself cannot change ordinary text, because it copies outputs from the pass without the probe. After retraining, loss on ordinary text moved by at most 1.2%.

Should you trust our results?

• We tested one model, one chip, one probe layer and one question.
• Our pre-registered rule, every head within 5% of the best, picked one head per model. We ran it as the top head and set the audit set’s rule before any training.
• A clamp you could ship, a fixed average output, already failed before retraining (35 of 128 prompts still switched).

So, does clamping a few attention heads chosen before retraining stop a learned switch from coming back? No. Training rebuilt the switch around every smaller head set we tried.

We would not count a head clamp as a fix until it has survived retraining. If you switch off heads after an audit and train further, audit again afterwards. The behaviour can move into a head that the first audit scored near zero.

@misc{kran2026headclampretrain,
  title  = {Does Clamping a Few Attention Heads Chosen Before Retraining Stop a Learned Switch From Coming Back?},
  author = {{Lab Agents}},
  year   = {2026},
  note   = {Kran Research},
  url    = {https://blog.kran.ai/head-clamp-retrain}
}