Axis: — (bridge / the boundary) · Prereq: all prior modules · Next: — (back to the atlas) Hook: This whole guide read a model from its structure — config and weights. That's the most inspectable, verifiable layer there is, and we made it legible. But there's a hard line: structure tells you what a model is and what it can do — never what it will do, whether its claims are true, or where it really came from. Here's the boundary, honestly drawn.
The 2-minute version (no math)
Architecture is the skeleton. From it you can read a model's capacity, its costs, and its lineage — everything the last eleven modules taught you. But a skeleton doesn't tell you how a person behaves.
Structure can't tell you whether a model refuses certain questions, whose worldview it carries, whether it's safe to hand a tool, or whether the model card is even telling the truth about what the weights are. Those need different instruments — behavioral probes, a claims check, provenance forensics. This guide taught you to read the skeleton. ModelDNA reads the rest, and this module is the handoff.
Under the hood — where the map ends (two different boundaries)
This guide read static structure — mostly the config (Modules 0–11, all ) and, at its frontier, the weights themselves. Two boundaries matter, and they are not the same line:
Boundary 1 — beyond the config, but still inside structure: . Some questions the config can't answer, the weights can — so they're still structural, just deeper than a config-only read (this is the frontier of what this guide taught, not something outside it):
- Is the "novel architecture" claim true? A config can be relabeled; a weight diff can't be faked. It settles whether a model is genuinely its own weights (adoption) or a copy/mislabel.
- What was done to the weights? Abliteration (surgically removing refusals) leaves a weight-level signature — detectable from the artifact even though it's invisible in the architecture. It's a structural catch, at the weight layer.
Boundary 2 — truly beyond structure: behavior, and unrecorded origin. Here the artifact genuinely runs out — no amount of weight-reading recovers these:
- Behavior — what it will do. Refusals, worldview, agentic capability, tool-use safety, jailbreak resistance. Not readable from config or weights; measured (Tier-1) with behavioral batteries. Architecture bounds what's possible, not what it does — two models with identical structure behave differently after different post-training.
- Unrecorded origin. Who trained it, on what data, to what end. None of it is in the artifact.
- Claims that reference the unrecorded. The claims-verdict (deception check) does two things: it confirms the structural catches above (config-vs-weights mislabels), and it flags as unverifiable the claims structure can't check at all (benchmark numbers, training-data assertions).
Where each capability sits
| Question | Which side | Instrument | A real case |
|---|---|---|---|
| "Novel architecture" — true? | frontier of structure (weights) | weight diff + config-vs-weights | a renamed known base shipped as new — the weights settled it (adoption vs mislabel) |
| What was done to the weights? | frontier of structure (weights) | abliteration / modification detection | refusal-ablated ("heretic") builds — a weight-level signature |
| Do the card's claims hold? | beyond (references the unrecorded) | claims-verdict | structural checks catch config-vs-weights mislabels; benchmark/training-data claims are flagged unverifiable — structure has nothing to check them against |
| What will it do? | beyond (behavior) | measured batteries | agentic (ARS), worldview, red-team — always dated |
So "beyond the config" is not the same as "beyond structure": weight forensics is still structure (and it's where the fraud and modification cases get caught). What's genuinely beyond is behavior and unrecorded origin. A clean architecture is necessary, not sufficient — but structure reaches further than a config-only read suggests.
The honest close (the Verdict)
- Structure is the most inspectable layer — so start there, but don't stop there. The weights are the artifact; reading them (what this guide taught) is verifiable in a way a benchmark score or a data-access promise is not. That's why our stance is "verify the weights, then contain the rest" — architecture first, because it's checkable, then behavior and provenance because they're the parts a config can't show.
- Tier discipline, stated cleanly one last time: Modules 0–11 are config-level structure (Tier-2). Weight forensics (the mislabel/abliteration catches above) is still structure — the same weights, read harder — not a different tier. What's a genuinely different kind of claim is behavior (Tier-1, measured, dated) and unrecorded origin (not in the artifact at all).
- A structural number is a bound, not a result. , size, active-parameter count — these are structural potential ("what it is / can cost"), not realized speed or quality ("what it does"). This module's boundary is exactly why the guide never let SR stand in for measured latency: the metric is a ceiling the config declares, the outcome is Tier-1.
- The M11 handoff, made real: a technique stack is a lineage hypothesis; this module is where you confirm it. Structural similarity says "GLM may have adopted DeepSeek's " — a weight diff here turns that hypothesis into a finding (or refutes it). Neither module claims lineage from config alone.
- That's the guide. You can now read the skeleton of any modern model from its fingerprint — and you know exactly where the skeleton stops and the rest of ModelDNA begins.
Glossary delta
structure vs behavior · claims-verdict (deception check) · provenance · abliteration · weight forensics · verify-then-contain · Tier-1 (measured) vs Tier-2 (structure)
Prev: Module 11 — The technique stack · Next: — (you've finished the guide — explore the atlas) Evidence: atlas snapshot 2026-08-13. Pointers: renamed-architecture case, abliteration detection, claims-verdict.