Slot Machines: How LLMs Track Multiple Entities

by
Table of contents

🌏 閱讀中文版本

Anthropic’s latest study, Slot Machines, reveals a central tension in LLM internal representations: the models tested store rich information internally, but not all of that information can be called on for reasoning. When processing complex narratives with multiple characters, the LLMs tested did not blend information into one vector. Instead, they maintained order through a multi-slot mechanism, separately recording the current entity and the immediately preceding entity.

The study finds that, at a single token position, the models tested use orthogonal current-entity and prior-entity slots for fact retrieval and relational reasoning, respectively. This division of labor not only explains why models fail under specific syntactic conditions, but also exposes the large gap between information being available and information being used.

The Research Question: Information Capacity and Binding Constraints at One Token

Language models must accurately connect entities, such as names, with attributes, such as actions or characteristics, while maintaining several such connections across context. In tasks involving two interacting subjects, for example, “Alice prepares food, and Bob eats it,” the model must remember what Alice and Bob each did by the time it processes the final word.

If information becomes entangled, binding errors become more likely. Through comparative experiments, the researchers observed that when syntax forces a single token to carry two subject-verb-object relations, as in “Alice prepares and Bob consumes food,” some tested models see a substantial drop in accuracy, with overall accuracy reaching only about 50.3%. When those relations are separated into independent sentences, “Alice prepares food. Bob consumes food,” most tested models perform almost perfectly. This points to a specific constraint in the binding mechanism, rather than a simple limitation in memory capacity.

The Core Mechanism: Orthogonal Slots and Copying Transformations

To understand this mechanism, imagine the internal computation of the LLMs tested as a multi-track recording studio. The study finds that models copy entity information from the previous time step and move it onto a new track, creating a superposed state.

More specifically, when a model reads a new entity, it creates a current-entity slot in the residual stream to process current information. At the same time, it applies a copying transformation to the preceding entity’s information and stores it in another, orthogonal prior-entity slot. The weights of these two slots are nearly unrelated in vector space, with a correlation of r = 0.11. This indicates that they read from different feature directions. Their second-order correlation is also only r = 0.34, suggesting that the relational structures they encode are different as well.

The research team used a method called multi-slot probing to unpack this mechanism through a mixture-of-experts (MoE) architecture. In this setup, several classifiers are trained to learn different representation patterns for the same feature, while a routing layer determines which slot each entity should use. The experiments confirm that introducing a second slot substantially improves the accuracy of distinguishing current-entity from prior-entity representations.

Another interesting finding is that information about entities described by the user persists slightly more strongly in subsequent tokens than information about entities described by the AI assistant. This evidence refutes the hypothesis that models have a special mechanism for processing self-referential information. At least among the models tested, information persistence appears to depend more on the natural operation of the slot mechanism than on any privileged role label.

The Result That Matters: Functional Division and an Information Gap

Through a series of rigorous intervention experiments, including patching and steering, the study reveals functional differences between these two slots and produces several concrete, falsifiable findings.

Clear Functional Division and the Integration Path

The prior-entity slot is mainly used for relational reasoning, such as “Who comes after Alice?” or detecting conflicts between adjacent entities. When the research team causally intervened in the prior-entity representation through patching, the model’s sequential reasoning capability declined substantially. For explicit fact-retrieval questions, such as “Who is tall in the story?”, the model relied entirely on the current-entity slot.

This leads to a key insight: information availability does not equal information use. The researchers found that even when a probe could decode Alice’s attributes from the prior-entity slot, directly modifying Bob’s token representation produced almost no change in the model’s answers about Alice’s attributes. This indicates an internal gap between information being available and being actively used.

The mechanism behind this gap lies in how MLP layers perform integration. Steering experiments show that MLP layers integrate the prior-entity direction with information about the current entity to infer their relationship, such as conflict detection. Notably, steering key/value vectors did not produce the same effect, further supporting the central role of MLPs in this pathway. Yet when the model is asked an explicit factual question, it does not invoke this integration path. It retrieves information directly from the current-entity slot instead. In other words, the prior-entity slot does store relevant information, but the model’s reasoning architecture does not include it in the decision path for fact retrieval.

Capability Boundaries of the Tested Models

When handling complex syntax that forces a single token to bind two subject-verb-object relations, the current open-weight models tested do not perform strongly. Qwen3-32B, the smallest model in the paper, reaches accuracy only slightly above chance level. Qwen3-32B offers strong multilingual and logical capabilities and demonstrates consistent engineering value across many benchmarks. Under the specific experimental conditions for syntactic binding in this study, however, it did not correctly handle multiplex binding at a single position.

By contrast, when these relations are split into independent sentences, model performance is nearly perfect. This suggests that the tested models do not correctly handle multiplex multiple bindings at a single position for this prompt format and task, rather than lacking the underlying mechanism for representation separation. Interestingly, some newer frontier models can correctly parse this kind of complex syntax, suggesting that they may have developed more sophisticated binding strategies or the ability to process multiple bindings at a single token position.

Mechanism Boundaries and Engineering Trade-offs

This study reveals the fine-grained structure of LLM internal representations, while also offering important engineering implications and trade-offs.

Applicability boundary: The current multi-slot mechanism works very well under the paper’s separated condition. However, when facing complex syntax that requires tracking multiple independent entity bindings simultaneously, many currently tested models reach a bottleneck. The research identifies a binding constraint under a specific prompt format, but does not yet distinguish whether it arises from syntactic parsing, training-data coverage, or architectural factors.

Trade-off analysis:

  1. Structural refactoring vs. model selection: When a task contains compound bindings, developers have two paths. One is to restructure the prompt by splitting sentences, reducing the number of bindings a single position must carry. The other is to choose a model that performs better on this binding test. The trade-off between these approaches depends on the system’s accuracy requirements, API-call costs, and latency tolerance. A gradual improvement path often starts with prompt structure, ensuring that information is distributed clearly across the timeline.

Practical implications: Understanding these mechanism boundaries can serve as one criterion for risk control. When designing a system, limits on handling multiple complex bindings at a single token position are a boundary condition for evaluating model fit. Proactively decomposing complex syntax into independent logical assertions can reduce the number of bindings a single position must carry, which in turn can reduce unpredictable behavior caused by binding errors. This is a direction worth considering.

Verifiable Sources and Limitations

This research provides a valuable lens for understanding LLM internal mechanisms, but it also has several limitations. The study is primarily based on a specific probing architecture and intervention experiments. Probing provides decodable correlational evidence, while patching and steering provide causal-intervention evidence. These results remain bounded by the models tested, the specific tasks, and the generalizability of the intervention design.

In addition, why some frontier models can overcome the bottleneck of multiplex binding at a single position remains a hypothesis. At present, this is only speculation; more research is needed to verify whether the specific mechanism stems from scaling or architectural fine-tuning. The authors also note that this multi-slot structure may provide a natural basis for certain complex behaviors, such as sycophancy or deception, because it allows a model to hold two perspectives at once. This opens a new direction for future safety research, while also expanding the challenge of understanding and controlling model behavior.

For complex binding tasks, choosing a model that has been validated on the relevant binding test, or optimizing data structures to fit the boundaries of current models, depends on your risk tolerance and cost considerations. Understanding these mechanism boundaries may help us assess the fit between prompt structure and model capability more precisely when designing complex tasks.

Sources