Progressive Cramming: When One Embedding Vector Holds 1500 Tokens, Is the Model "Understanding" or Taking "Shortcuts"?

The setup: a counterintuitive finding

Imagine compressing an entire Wikipedia article—1500 tokens—into a single embedding vector, then feeding that vector into a frozen LLM. Remarkably, the model reproduces the entire article word-for-word with less than 1% error.

This was shown in the 2025 "Token Cramming" paper by Kuratov et al.: a 1500x compression ratio, far beyond the ~10x lossless limit of traditional encoders. It suggested an untapped "information thicket" hidden in Transformer embedding space.

But researchers at FusionBrain Lab asked an unsettling question: does the model genuinely "understand" the compressed information, or has it merely found a shortcut that makes reconstruction look like understanding?

Their July 2026 paper, Progressive Cramming (arXiv: 2607.21231), offers a sobering answer: cramming's high-fidelity reconstruction is likely not "semantic encoding" but "fragile attention hijacking."

First, fixing the experimental tool: progressive compression

The original cramming method has a methodological flaw: it evaluates with a fixed token budget and a 99% reconstruction accuracy threshold. But how severe is the remaining 1% of errors?

The researchers uncovered a hidden disaster: the 1% of errors concentrates almost entirely in the earliest 0–1 token positions. Under teacher forcing this looks harmless—99% of positions are correct. But once you switch to autoregressive generation (no teacher forcing; the model must generate the next token itself), disaster strikes.

The first token is wrong → all subsequent tokens are generated from a wrong prefix → the whole sequence rapidly collapses. The result: even with 95–99% average convergence during training, greedy-decoding convergence at inference is nearly 0%.

To solve this, the researchers propose Progressive Cramming:

1. Start with 1 token; optimize the embedding until reconstruction is 100% perfect 2. Expand to 2 tokens, warm-starting from the previous embedding 3. Keep expanding one token at a time, building only on prior success 4. Stop when perfect reconstruction is no longer possible

The benefit: a clear success/failure boundary. No more vague "99% correct"—either reconstruction is 100% perfect or the method explicitly fails at some step.

Finding 1: the optimization trajectory is low-dimensional

The optimization trajectory of progressive compression occupies a low-dimensional manifold in embedding space.

Embedding spaces are 2048–4096 dimensions (e.g., Llama-3.1-8B), yet 99% of the trajectory's variance is explained by just 30–100 PCA components.

This means compressed embeddings don't wander the high-dimensional space—they travel along a narrow "rail." Cramming succeeds because it finds this structured subspace of the model's computational geometry.

Finding 2: compressed embeddings become "attention black holes"

When researchers fed compressed embeddings into the model and observed per-layer attention distributions, they found: compressed embeddings capture 20–60% of attention mass in middle layers. They become massive "attention sinks," pulling in attention from surrounding tokens.

This sounds like a good thing—the compressed embedding matters, so the model attends to it. But causal analysis shows: this attention concentration is not the model "utilizing" compressed information; it's the compressed embedding "hijacking" the model's attention.

Using "attention knockout" experiments—artificially blocking the compressed embedding's attention connections at certain layers—they found:

• Blocking early-layer attention to the compressed embedding: downstream capability recovers
• Blocking late-layer attention to the compressed embedding: almost no effect

Yet the late layers are exactly where attention mass is largest. This shows: attention concentration is a symptom of cramming, not the cause of its success. The real capability damage comes from early-layer interactions, which carry little attention mass.

Finding 3: reconstruction success ≠ capability preservation

If cramming truly performed semantic encoding—storing information in a form the model can understand—then a compressed prefix should preserve downstream capabilities. The information is all there; the model should be able to read it out.

The researchers tested HellaSwag and ARC-Easy (multiple-choice tasks):

Under likelihood evaluation (comparing option likelihoods): even with the original prefix still in context, prepending a compressed embedding causes a consistent but moderate accuracy drop.

Under generative evaluation (the model generates answers itself): capability nearly completely collapses.

This contrast is crucial. If the compressed embedding truly encoded semantics, generative mode should also exploit it. The collapse shows: the model isn't "reading" compressed information—it's being "steered" by it in some fragile way. Once teacher forcing's protection is removed, that steering shatters.

Finding 4: compression capacity grows with depth and width

Cramming capacity is not unlimited—it is bounded by the capacity of the frozen reconstructor.

Truncating pretrained models to their first N layers (with a short fine-tune to repair the truncation point), the researchers measured cramming capacity: it grows monotonically with retained depth and model width.

This means cramming relies on the model's deep computational power—the more layers you give it, the more tokens it can "pretend to understand." This is another counter-argument: if cramming were pure semantic encoding, it shouldn't depend so heavily on reconstructor depth—semantic information should be readable in the earliest layers.

Rethinking cramming: not encoding, but manipulation

Combining the findings, the paper reaches a sobering conclusion:

> High-fidelity reconstruction reflects not dense semantic encoding, but the ease with which a model can be "manipulated" through its attention mechanisms.

An analogy: cramming doesn't write information into the model's "memory book" for it to read; it finds a switch that directly triggers the model's "conditioned reflexes." Reconstruction looks perfect, but the model isn't "understanding"—it's been hijacked by a carefully optimized embedding vector into producing the correct token sequence along a specific trajectory.

Why does this distinction matter? It bears directly on whether compressed embeddings can be used in practical tasks. If cramming were semantic encoding, you could compress long contexts into a few embeddings and the model would still use them. But if it's attention manipulation, any use deviating from the training distribution causes collapse—exactly what the generative evaluations show.

Methodological contribution: stop using the 99% threshold

Beyond scientific findings, the paper makes an important methodological contribution: it exposes the blind spot of "99% reconstruction accuracy" as an evaluation standard.

Under the fixed-budget + 99%-threshold protocol, everything looks "almost perfect." What you can't see: the 1% of errors sits in the most lethal positions (the earliest tokens), and under autoregressive generation these errors cause total collapse.

This aligns with the "evaluation blind-spot law": measure what you optimize, and unmeasured things become where problems hide. Progressive Cramming is another instance: 99% token-level accuracy masks 100% generation-level failure.

The value of progressive compression: by pursuing 100% reconstruction with token-by-token expansion, it exposes that fatal 1% and gives a definitive answer to "does compression actually work?"

Honest assessment

The paper has limitations.

First, its conclusions rest mainly on models like Llama-3.1-8B. Though the authors claim consistency "across model families," whether other architectures (e.g., Mamba-style state-space models) exhibit the same "attention hijacking" mechanism remains open.

Second, the "fragile attention manipulation vs. semantic encoding" dichotomy may be too simple. Reality could be a mix—compressed embeddings may carry some semantic information while exploiting attention shortcuts. The causal analysis is strong but doesn't fully rule out "partial semantic encoding."

Finally, progressive compression itself has limits: token-by-token expansion is computationally expensive, and the warm-start strategy may introduce its own bias (each step's solution depends on the previous step's local optimum).

But these are minor. The paper's real contribution: it pulls a seemingly magical phenomenon (1500x compression) back down to earth, revealing the imperfect truth potentially hidden behind "perfect reconstruction."

A deeper takeaway

This paper raises a broader question: in AI research, the gap between "looks like it works" and "actually works" may be far larger than we assume.

Cramming's 99% reconstruction rate, high LLM benchmark scores, RLHF's politeness gains—how many of these "looks like it works" signals are genuine semantic understanding, and how many are some form of "attention hijacking" or "reward shortcut"?

Progressive Cramming offers a method: when you see an "almost perfect" result, ask where the remaining 1% lies and how lethal it is. The answer may make you reconsider what that "perfection" really means.

---

Paper: https://arxiv.org/abs/2607.21231 Code: https://github.com/FusionBrainLab/progressive_cramming HTML version: https://arxiv.org/html/2607.21231v1 Authors: FusionBrain Lab