Graph Neural Networks (GNNs) represent valuable intellectual property, yet watermarks based on out-of-distribution triggers can weaken under pruning, fine-tuning, and distillation. We present InvGNN-WM, which links ownership verification to graph-invariant prediction. By supervising a shared GNN backbone to predict normalized algebraic connectivity on owner-private carrier graphs, InvGNN-WM enables calibrated multi-bit black-box verification through either an auxiliary scalar endpoint or a fixed owner-side decoder of ordinary task logits. We provide conditional guarantees for task-loss control, decision preservation, and key separation, and prove NP-completeness of the exact-removal decision problem for a restricted class of monotone separable decoders. Experiments on node- and graph-classification benchmarks demonstrate high watermark fidelity with small changes in task performance. The task-logit deployment achieves higher detection rates than PreGIP-adapted in matched comparisons and retains detection under the evaluated extraction and retraining budgets. Watermark-assisted distillation further enables owner-side recovery using private verification material.
Can controlled symbolic inputs reveal attention heads that influence a language model's decisions from natural language evidence? We introduce controlled evidence aggregation (CEA), which varies the counts and order of two symbols in otherwise fixed prompts and measures changes in a frozen Transformer's preference between two answer tokens. The preference is measured by their logit difference; the prompts prescribe no correct answer. Balanced utility causal selection (BUC) identifies compact head sets by jointly evaluating how much ablating their outputs removes the count effect and how closely patching mean outputs between count conditions recovers the effect in both directions. We derive conditional bounds linking head attribution to intervention effects and specifying when the attribution shortlist can be recovered from finite samples. In Pythia-410M, ablating sets of 1-12 heads selected separately for four ordering regimes removes 65.5-91.6% of the count effect. The sets retain their influence on count comparisons not used for selection. To test relevance beyond symbolic inputs, we evaluate a natural language task asking which state is supported by more reports. Ablating eight heads selected only on symbolic yes/no prompts lowers mean accuracy by 8.2 percentage points, versus 0.8 for random sets matched by size and layer. Our results demonstrate that controlled symbolic probes can identify compact attention head sets whose causal influence extends to natural language decisions.