Draft-KV: Learning Useful Latent Communication Between Language Models

TL;DR: This paper first runs a devastatingly simple audit on latent communication between LLMs — systems that pass KV caches or hidden states instead of text. Swap in the latent message from a completely different question, and accuracy barely moves, even when "communication" adds 15 points over the receiver alone. The gains come from the trained interface, not the message. Then it builds Draft-KV, a 1.05M-parameter interface that transmits the KV states a sharer forms while drafting an answer, and shows the gains now collapse under message swapping — exactly as they should — while a frozen 0.5B receiver reaches 78% on MMLU-Redux riding an 8B sharer.

A placebo test for model telepathy

The dream of latent communication is appealing: when two language models collaborate, why force one to decode its rich internal computation into tokens, only for the other to re-encode it? Pass the hidden states or key–value caches directly, and you keep whatever the text channel throws away. A family of recent methods — C2C (Cache-to-Cache), LatentMAS, DLC — does this with small learned adapters between frozen models, and all report solid end-task gains for the receiver.

Here's the problem this paper spots: those gains don't prove the receiver used the message. Training a projection into a frozen model's attention stream is, functionally, a form of parameter-efficient fine-tuning. The adapter could be improving the receiver in a message-independent way — nudging its logits toward better answer formats, calibrating it on the task distribution — while the actual sharer content passes through unread. The system-level accuracy number can't distinguish "the receiver read the sharer's mind" from "we accidentally fine-tuned the receiver."

The fix is a placebo control. Define three conditions on the same questions: Matched (A_M, the receiver gets the message produced for its question), Deranged (A_D, it gets a message produced for a different question, interface unchanged), and Receiver-only (A_R, no communication). Then split the apparent benefit into two numbers:

G is what papers report. P is what communication actually means: how much does it matter that the message was about your question? If the sharer is contributing content, swapping its message for garbage should hurt.

It doesn't. Across five method–dataset pairs, pairing gain never exceeds 0.60 points while system gain reaches 15.44. For C2C with a 0.5B sharer feeding a 0.6B receiver:

Two corroborating diagnostics make the picture airtight. An adapter-only control averages the interface's output over mismatched donor messages, isolating the receiver-conditioned component: C2C retains 93–116% of its Matched accuracy this way — sometimes exceeding it with pure noise averaged in. And sharer scaling is damning: across C2C's 0.6B–8B sharers, standalone sharer accuracy rises 29.85 points while system accuracy rises 3.54. A channel whose contribution is fixed by the interface can't carry a smarter partner's advantage; it stays stranded on the other side.

If you've followed the interpretability literature, this should rhyme with the perennial "is attention explanation?" and probing-classifier debates: a trained readout performing well tells you little about what's being read. The authors have simply imported that hygiene into multi-agent systems, and the field apparently needed it.

The aha: send the states of answering, not the states of reading

Why do prompt-cache methods fail this test? The paper's ablation gives a clean answer. Under causal attention, the KV states at prompt positions encode the question being read — they're unchanged by whatever answer follows. The states formed while the model decodes an answer are different: each draft token's keys and values incorporate the question plus the model's unfolding solution. The prompt cache is the question restated in a weird basis; the draft cache is the computation.

So Draft-KV's message is exactly that: the sharer greedily drafts an answer to the current question (no gold label in sight), then one forward pass over prompt-plus-draft extracts layerwise KV tensors, with a visibility mask exposing only draft positions. The ablation in Table 2 is the whole argument in miniature: swap draft-position KV for prompt-position KV in the same architecture and training recipe, and Matched accuracy on ARC-Challenge drops from 83.53% to 49.83% while pairing gain collapses from 45.90 pp to 0.17 pp — i.e., prompt caches reproduce the information-use gap of prior work inside this method. The message source, not the interface design, is what makes pairing matter.

The mechanism: a side memory, not a cache merge

At each of four chosen receiver layers, a bias-free linear map projects the sharer's flattened KV heads (at an assigned sharer layer) into the receiver's KV layout: \widetilde{K}^\ell = K_S W_K^\ell, \widetilde{V}^\ell = V_S W_V^\ell. The receiver reads this packet through an extra attention branch that reuses its own frozen query projection, normalizations, output projection, and head grouping — the branch adds nothing but one \tanh gate per KV head, initialized at zero so training starts from the native receiver function. The gated output simply joins the residual stream alongside native self-attention:

Crucially the packet is a separate side memory: every receiver position can attend to every visible draft position (the packet exists before decoding begins), no rotary position encoding is applied in the branch, and it is never concatenated into the receiver's growing cache. Keys are extracted pre-rotary on the sharer side too, stripping positional phase from the transmitted tensors. Tokenizers, hidden sizes, sequence lengths, and KV-head counts can all differ between the models. Total: 1,048,584 parameters — 348× fewer than C2C.

Training is a three-stage curriculum, each stage inheriting the previous weights. Stage 1 teaches readability: the sharer encodes an arbitrary text payload, and the receiver — seeing only a fixed "decode the hidden message" instruction, never the text — must reconstruct it verbatim from the packet alone. This forces the projections to carry sample-specific content before any task reward exists. Stage 2 switches the packet to the sharer's own (fallible) drafts and supervises the reference answer, so the receiver learns to use drafts without copying them. Stage 3 trains on multiple-choice answer text with a clever one-sided guard: for each example, it also computes the loss under a deranged packet, and penalizes it only when the mismatch makes the gold answer more than 0.1 nats/token costlier than receiving nothing. The guard never rewards a large Matched–Deranged gap — that would let the optimizer manufacture pairing gain by learning to be damaged by wrong messages — it only caps the damage. A reconstruction replay every fifth update keeps the code decodable throughout.

The evidence

The headline configuration: frozen Qwen2.5-0.5B-Instruct receiver, Qwen3-8B sharer, MMLU-Redux. Receiver alone: 37.45%. Draft-KV Matched: 78.04%. Draft-KV Deranged: 36.40% — the gain evaporates exactly when the message is wrong, which is what honest communication looks like. And the channel now pays for sharer capability:

Across 35 Public settings (7 model pairs × 5 benchmarks, including a Llama→Qwen pair and a reversed small→large direction), Draft-KV beats the receiver alone in all 35 and beats passing the same draft as text (T2T) in 33, by 5.85 points on average. That last comparison is the most interesting scientifically: identical content, different medium. The per-question breakdown in Appendix F explains the gap — text and latent channels correct a similar share of sharer errors (11.0% vs 13.8% on MMLU-Redux), but text overwrites 9.0% of the receiver's correct answers while the latent channel overwrites only 2.8%. The case studies show the pattern vividly: when a sharer's draft reasons correctly and then closes on the wrong letter, T2T dutifully copies the wrong letter; Draft-KV keeps the receiver's own right answer. The latent channel's advantage isn't transmitting more — it's that the receiver isn't talked out of what it already knows.

The Private protocol is the strongest test: HotpotQA/2WikiMultihopQA gold evidence is split randomly between the models, so neither can answer alone and the packet is the receiver's only route to the sharer's half. Scored by exact match on generated text (no option logits to lean on), Draft-KV beats T2T in all 14 settings and, with the 4B sharer, reaches 40.34% on HotpotQA against 32.28% receiver-only and 29.04% sharer-only — exceeding both models. Deranged packets here fall 10.98 pp below receiver-only, confirming the receiver genuinely reads them.

Is it just leaking the sharer's answer?

The obvious worry: on multiple choice, maybe the "message" is just the sharer's chosen letter squeezed through 1M parameters — a very expensive way to transmit two bits. The paper's own Appendix H feeds this suspicion: in all three showcased mismatch cases, the deranged prediction lands on the donor question's gold letter, which is what an answer-identity channel would do.

Three pieces of evidence push back. First, the adapter-only control: averaging the interface output over five mismatched donors drops Draft-KV to 42–51% of Matched accuracy for the stronger sharers — below receiver-only — whereas a pure letter channel averaged over donors should wash out to roughly receiver-only, not below it, and C2C under the same control retains 93–116%. A self-donor diagnostic (restore the correct donor, keep everything else about the averaging setup) recovers 27–29 points, pinning the effect on donor content. Second, Stage 3 deliberately supervises full answer text, never option letters, and the sharer never sees the gold index. Third, the Private protocol involves free-form generation where the transmitted content is multi-hop evidence, not a label — Case 17 is a nice microcosm: the sharer resolves "Happy Fun Ball → SNL" but hallucinates the wrong creator; the receiver holds "SNL → Lorne Michaels" but doesn't know its evidence is relevant; only the matched packet composes the chain, transmitting the sharer's link rather than its wrong conclusion.

So the content claim holds up better than I initially expected. Remaining caveats are real, though. Evaluation is heavily multiple-choice with first-token-logit scoring; Stage 3 trains on ARC, and while MMLU-Redux/OpenBookQA/C-EVAL are held out, everything lives in the short-answer QA regime — nothing here tests transmitting a long reasoning chain, and the two "lost" case studies suggest the fixed-size packet carries conclusions better than derivations. On Public tasks the system mostly tracks the sharer (93.77% vs sharer's 92.83% on ARC-C with the 8B sharer), so in the shared-input setting the practical win over "just use the sharer" is modest — recovering 24% of sharer errors at a 1% cost — and inference does 2× the sharer's arithmetic, dominated by draft decoding either way. The genuinely new capability is the Private setting, which is also the least-explored part of the paper (14 settings, one evidence partition). And all intervention results are point estimates except the C2C bootstrap table.

What this changes

Two things. Methodologically, pairing gain should become a mandatory report for any latent-communication paper — it's cheap to compute, and this paper shows that without it, double-digit "communication" gains can be pure interface fine-tuning with the sharer entirely dispensable. That audit generalizes beyond this subfield to any learned-adapter-between-frozen-models setup. Mechanistically, the draft-vs-prompt KV result is a crisp, reusable insight about where computation lives in a transformer's cache: states formed during generation carry the model's work; states formed during reading carry the input. Anyone building KV-reuse, cache-compression, or multi-agent latent systems should internalize that distinction.

If you read one section, make it Section 3 (the audit — it's short and the reasoning is airtight), and if you read two, add Appendix H's case studies, which are unusually good at showing what a latent message does and doesn't carry: conclusions travel, derivations don't, and a receiver reading KV states is far harder to talk out of a correct answer than one reading prose.