Pando: Distributed Computing & Interpretability

• Pando is a term for two distinct artifacts: a browser-based streaming-map for volunteer computing and a benchmark for testing model interpretability.
• The computing system leverages JavaScript, WebRTC, and WebSockets to distribute tasks adaptively, ensuring ordered output and fault tolerance in trusted social settings.
• The interpretability benchmark creates finetuned model organisms to rigorously evaluate white-box versus black-box methods, highlighting challenges like the elicitation confounder.

Pando is a name used in the arXiv literature for two distinct computing artifacts. One is a browser-based tool for personal volunteer computing that distributes the application of a function on a stream of values across a dynamically varying number of failure-prone personal devices contributed by volunteers (Lavoie et al., 2018). The other is a mechanistic-interpretability benchmark that asks when white-box interpretability methods improve prediction of model behavior beyond what can be recovered from black-box interaction, and formalizes the elicitation confounder through an explanation axis with faithful, absent, or misleading verbal explanations (Zhong et al., 13 Apr 2026).

1. Uses of the name

The term “Pando” is therefore not tied to a single research program. In the available literature, it denotes a distributed systems tool and, separately, an interpretability benchmark.

Usage	Domain	Central object
Pando	Personal volunteer computing	A browser-based streaming map over volunteer devices
Pando	Mechanistic interpretability	A model-organism benchmark for behavior recovery

The first Pando addresses ad hoc distributed computation in trusted social settings by using JavaScript, WebRTC, and WebSockets, with volunteers joining simply by opening a URL in a browser (Lavoie et al., 2018). The second Pando addresses alignment-auditing evaluation by training model organisms to produce faithful explanations, no explanations, or confident but unfaithful explanations of a disjoint distractor rule, so that apparent gains from white-box tools cannot be attributed merely to elicitation through prompting (Zhong et al., 13 Apr 2026).

2. Pando as personal volunteer computing in browsers

The 2018 system is a volunteer-computing tool for personal projects rather than a permanent global platform. Its motivating claim is that the large penetration and continued growth in ownership of personal electronic devices represents a freely available and largely untapped source of computing power, while clouds, grids, BOINC-style volunteer computing, and shared peer-to-peer platforms are often too expensive, too administratively heavy, too complex to deploy, or too overengineered for small, ad hoc uses (Lavoie et al., 2018).

Its computational abstraction is a streaming version of map. Pando applies a function $f$ to a stream of inputs and produces outputs in the same logical order,

$$x_1, x_2, \ldots \rightarrow f(x_1), f(x_2), \ldots$$

while allowing execution to be internally concurrent and distributed. The paper characterizes the model as Streaming Map, Ordered, Dynamic, Unbounded, Lazy, Fault-tolerant, Conservative, and Adaptive. “Ordered” means outputs are provided in order; “Conservative” means at most one copy of an input is processed at a time; “Adaptive” means faster devices receive more inputs; and “Lazy” means inputs are read only when resources are available (Lavoie et al., 2018).

The architecture consists of a coordinator, browser workers, and an optional public server. The coordinator is started from the command line, reads the stream of inputs, bundles the worker code and dependencies, serves the worker webpage, schedules tasks, collects results, and emits ordered output. Workers are browser pages opened by volunteers; once connected, they fetch the computation code, receive inputs, apply $f$, and return results. A small public server can be used for serving the webpage and WebRTC signaling when devices are not on the same local network. The implementation uses JavaScript, Node.js, WebSockets, and WebRTC, and exploits the heartbeat facilities of WebRTC and WebSocket for disconnect detection (Lavoie et al., 2018).

A key implementation abstraction is StreamLender, which splits an input stream into multiple concurrent sub-streams, lets workers borrow values from the input stream, and merges results back into one ordered output stream. On a worker request, StreamLender first reassigns an older failed value if one exists; otherwise it lazily pulls a fresh value from the main input stream; and if the input has terminated it waits for outstanding work to complete before ending the worker stream. Result ordering is enforced by buffering completed results until the next stream index is available. The paper describes the underlying design pattern as pull-streams, chosen to obtain lazy demand-driven execution and composable stream modules in mainstream JavaScript (Lavoie et al., 2018).

3. Architecture, evaluation, and limits of the browser-based system

The system assumes crash-stop failures rather than Byzantine behavior. A device follows the protocol until it suddenly crashes, disconnects, or its browser tab is closed; missing heartbeats or connection closure mark assigned but unfinished values as failed and eligible for reassignment. The intended deployment setting is trusted social context—one’s own devices, or devices contributed by friends, family, or colleagues—rather than anonymous adversarial volunteer computing. The model allows side effects in $f$, but the programmer is responsible for ensuring that side-effect order does not matter (Lavoie et al., 2018).

Pando was evaluated across three environments: a local network of personal devices, Grid5000 nodes over a virtual private network, and seven PlanetLab nodes distributed in a wide area network over Europe. The workloads were compute-bound and included Collatz conjecture search, raytracing, StreamLender randomized testing, machine learning hyperparameter search, cryptocurrency mining, and image processing. Throughput was measured over five minutes, and batching was used to hide latency: batch size 2 on LAN and VPN, and batch size 4 on WAN (Lavoie et al., 2018).

The paper reports aggregate throughput gains relative to a single personal device. On the LAN configuration using the available personal devices together, the reported aggregate throughput reached 2209.65 Bignum/s for Collatz, 378,672 hashes/s for crypto-mining, 3603.70 tests/s for StreamLender testing, 18.94 frames/s for raytracing, 0.71 images/s for image processing, and 484.90 steps/s for machine learning training. On Grid5000, the corresponding aggregate figures were 3823.51 Bignum/s, 1,534,102 hashes/s, 7559.93 tests/s, 16.38 frames/s, 2.73 images/s, and 1323.44 steps/s. On PlanetLab, the reported aggregate throughput was 1845.52 Bignum/s, 717,485 hashes/s, 3985.04 tests/s, 4.75 frames/s, and 714.38 steps/s for the workloads evaluated there (Lavoie et al., 2018).

Several system-level observations are emphasized. First, batching was sufficient to mask much of the additional VPN and WAN latency for compute-bound workloads. Second, personal devices could be surprisingly competitive with server cores: the paper notes that the iPhone SE outperformed an old Grid5000 node on Collatz, and that 2–5 cores on recent personal devices could outperform the fastest server core in the study. Third, browser choice mattered substantially; the authors report that the iPhone SE running Safari outperformed a single MacBook Pro core by 3.3x on Collatz, attributing the difference to browser optimization (Lavoie et al., 2018).

The limitations are equally explicit. Pando supports only a streaming map pattern, not general distributed dataflow or worker-to-worker communication. Ordered output can be suboptimal for tasks where unordered first-result semantics matter, such as synchronous search or mining. The system assumes crash-stop failures and does not attempt malicious-result validation. Its design is most favorable when computation dominates communication, and practical browser constraints affected some experiments, including WebRTC message-size limits and protocol-specific tooling issues (Lavoie et al., 2018).

4. Pando as a mechanistic-interpretability benchmark

The 2026 benchmark addresses a specific evaluation problem in mechanistic interpretability: many evaluations do not control whether black-box prompting alone can recover the target behavior, so apparent gains from white-box tools may reflect elicitation rather than internal signal. The paper calls this the elicitation confounder and formulates it through

$$\mathrm{Acc}^\star(D,V)=\sup_f \Pr[f(D,V,X)=Y], \qquad \mathrm{Acc}^\star(D,V,W)=\sup_g \Pr[g(D,V,W,X)=Y],$$

with

$$0 \le \mathrm{Acc}^\star(D,V,W)-\mathrm{Acc}^\star(D,V) \le \sqrt{\tfrac12 I(Y;W\mid D,V,X)}.$$

If $Y \perp W \mid D,V,X$, then white-box access cannot improve optimal prediction beyond transcript and explanation channel alone (Zhong et al., 13 Apr 2026).

To break this confound, Pando constructs 720 finetuned “model organisms.” Each model implements a hidden binary decision-tree rule

$T:\mathcal{X}\to\{0,1\}$

over a tabular input space with $p=10$ named fields,

$x=(x^{(1)},\ldots,x^{(p)}), \qquad y \in \{0,1\},$

where the hidden trees have depth $$x_1, x_2, \ldots \rightarrow f(x_1), f(x_2), \ldots$$0. The base model is Gemma-2-2B-instruct, finetuned with LoRA, rank $$x_1, x_2, \ldots \rightarrow f(x_1), f(x_2), \ldots$$1, on 100,000 synthetic examples per model. Models are retained only if they exceed 95% validation accuracy on a held-out pool of 2,000 examples; the reported pass rates are roughly 88–92%, with depth-4 models somewhat harder (Zhong et al., 13 Apr 2026).

The benchmark’s distinctive device is its explanation axis. In the faithful regime, the model is trained to verbalize the true rule. In the no-explanation regime, it is trained only to output the label. In the unfaithful regime, it is trained to output the correct label but justify it using a different distractor tree of the same depth over a disjoint set of fields. This creates cases in which the verbal explanation channel is absent or systematically wrong at the feature level rather than merely vague (Zhong et al., 13 Apr 2026).

Evaluation is cast as behavior recovery. For each finetuned model, an agent sees only $$x_1, x_2, \ldots \rightarrow f(x_1), f(x_2), \ldots$$2 labeled query-response pairs,

$$x_1, x_2, \ldots \rightarrow f(x_1), f(x_2), \ldots$$3

and must predict the model’s outputs on the remaining 90 held-out inputs. If an interpretability method $$x_1, x_2, \ldots \rightarrow f(x_1), f(x_2), \ldots$$4 is under test, the agent also receives $$x_1, x_2, \ldots \rightarrow f(x_1), f(x_2), \ldots$$5 on exactly those same 10 queries. All LLM-based agents use the same two-stage harness: GPT-5.1 with reasoning enabled acts as rule extractor, and GPT-4.1 at temperature 0 acts as rule applier. The primary metric is held-out accuracy; a second metric, decision-rule field F1, evaluates recovery of the set of decision-relevant fields (Zhong et al., 13 Apr 2026).

5. Methods, results, and mechanistic conclusions of the benchmark

The compared methods span black-box, gradient-based, representation-based, SAE-based, circuit-based, and non-LLM baselines. The black-box baselines are sample_only and prefill. The main white-box methods are gradient and RelP; representation-based methods are logit_lens and res_token; the main SAE method is sae_gradient; the circuit method is circuit_tracer; and the calibration baseline tree_vote assumes the correct hypothesis class and samples 200,000 candidate decision trees over depths 1–4 (Zhong et al., 13 Apr 2026).

The principal empirical result is regime-dependent. When explanations are faithful, black-box elicitation is already strong and beats all tested white-box methods. In held-out accuracy, prefill reaches 81.8% average under faithful explanations, compared with 79.4% for RelP, 75.8% for gradient, 72.8% for logit lens, 72.0% for SAE gradient, 70.7% for circuit tracer, and 73.0% for sample_only. This is the benchmark’s validation of the elicitation-confound argument: if the model is willing to tell its rule honestly, white-box access does not add useful signal (Zhong et al., 13 Apr 2026).

The more consequential regimes are those with absent or misleading explanations. In the no-explanation condition, average held-out accuracy is 79.7 ± 2.1 for relp, 77.9 ± 2.2 for gradient, 76.4 ± 2.3 for prefill, 75.0 ± 2.3 for sample_only, 74.6 ± 2.3 for logit_lens, 74.6 ± 2.3 for res_token, 74.9 ± 2.3 for sae_gradient, and 73.3 ± 2.4 for circuit_tracer. In the unfaithful condition, the corresponding accuracies are 78.7 ± 2.1 for relp, 78.5 ± 2.1 for tree_vote, 77.6 ± 2.2 for gradient, 75.5 ± 2.2 for logit_lens, 75.5 ± 2.3 for circuit_tracer, 75.0 ± 2.3 for sample_only, 74.9 ± 2.2 for sae_gradient, and 73.1 ± 2.3 for prefill. Relative to sample_only, gradient-based methods therefore yield the reported 3–5 percentage point gains emphasized in the abstract (Zhong et al., 13 Apr 2026).

Field F1 sharpens the same conclusion. In the no-explanation setup, relp reaches 78.4 ± 2.7, gradient 73.6 ± 3.1, prefill 65.7 ± 3.8, sample_only 61.6 ± 3.9, logit_lens 62.1 ± 4.0, res_token 62.4 ± 3.9, sae_gradient 63.2 ± 3.8, and circuit_tracer 60.2 ± 4.0. Under unfaithful explanations, prefill drops to 56.2%, while RelP and gradient remain high at 75.6% and 73.7%. The authors interpret the gap between field recovery and end-to-end behavior prediction as evidence that gradient methods often identify the right fields even when exact threshold and branching reconstruction remains difficult (Zhong et al., 13 Apr 2026).

The paper’s mechanistic variance decomposition is central to its interpretation. For the car-purchase scenario, per-field importance scores are decomposed into variance explained by field identity, field value, and decision relevance. The reported decomposition assigns RelP $$x_1, x_2, \ldots \rightarrow f(x_1), f(x_2), \ldots$$6, $$x_1, x_2, \ldots \rightarrow f(x_1), f(x_2), \ldots$$7, and $$x_1, x_2, \ldots \rightarrow f(x_1), f(x_2), \ldots$$8; gradient $$x_1, x_2, \ldots \rightarrow f(x_1), f(x_2), \ldots$$9, $f$0, $f$1; sae_raw $f$2, $f$3, $f$4; sae_tfidf $f$5, $f$6, $f$7; logit_lens $f$8, $f$9, $f$0; and sae_gradient $f$1, $f$2, $f$3. The authors’ conclusion is that gradients and RelP track decision computation—whether a field is actually in the hidden rule—whereas logit lens and the SAE readouts are dominated by task representation, field identity, and field value (Zhong et al., 13 Apr 2026).

6. Disambiguation and relation to similarly named systems

Because the literature also contains uppercase acronyms with closely related spellings, “Pando” requires explicit disambiguation in citation and discussion. PANDA can denote “Noise-Resilient Antagonist Identification in Production Datacenters,” a job-level framework for identifying interference-causing jobs in shared datacenters (Zhou et al., 11 Nov 2025). PANDO can denote an online skill-distillation framework for multimodal web agents on VisualWebArena (Li et al., 24 May 2026). PANDAS can denote a data-availability-sampling networking system for Ethereum consensus timebounds (Pigaglio et al., 1 Jul 2025) or a prototype-based method for novel class discovery and detection in object detection (Hayes et al., 2024). These systems are separate from both the browser-based volunteer-computing Pando and the mechanistic-interpretability benchmark Pando.

Within the exact spelling “Pando,” the two principal usages occupy non-overlapping research areas. The 2018 system is a distributed execution environment with a declarative streaming-map semantics, dynamic browser workers, and crash-stop fault tolerance (Lavoie et al., 2018). The 2026 benchmark is an evaluation framework for behavior recovery under controlled explanation channels, with 720 finetuned model organisms and paired comparisons of black-box and white-box interpretability methods (Zhong et al., 13 Apr 2026). The shared name therefore has no common technical substrate; its meaning is determined entirely by citation context, year, and domain.