The Memory Trust Gap: Capability-Dependent Failures in Persistent-Memory Agents

# The Memory Trust Gap: Capability-Dependent Failures in Persistent-Memory Agents
Source: [https://arxiv.org/html/2609.01852](https://arxiv.org/html/2609.01852)
Jundong Hu††thanks:Corresponding author \(jundongh@alumni\.upenn\.edu\)\. Jundong Hu led and carried out the research end to end\.Shekar RamachandranAffiliation:PayPal AIEmail:[sheramachandran@paypal\.com](mailto:)

###### Abstract

Persistent memory supports personalized agents, but a stale stored fact can override current authoritative evidence without warning\. We study when this harm begins as model capability changes\. We evaluate a frozen, closed\-set, action\-scored benchmark with 2 suites that represent 2 different meanings of “no memory” \(a Benefit suite, unsolvable without the stored fact, and a Safety suite, in which an authoritative tool always holds the correct value\), on a same\-family model\-size series \(Qwen3 0\.6/1\.7/4/8B\)\. The Memory Trust Gap reflects over\-trust rather than confusion\. In the Benefit suite, models answer with the stale value 0\.92–1\.00 of the time at every scale\. In the Safety suite, harm below the no\-memory baseline under the trap conditions \(Δmem\\Delta\_\{\\mathrm\{mem\}\}\) is capability\-gated, with the larger models collapsing most once a stale note is made to look current\. In a2×2×2×22\{\\times\}2\{\\times\}2\{\\times\}2factorial, which feature triggers over\-trust depends on both the feature and model scale\. Removing a label amplifies over\-trust at every size, and a recency feature \(stale dated newer\) fools the larger models harder\. Source authority is weak and scale\-flat, and position changes from positive to negative across the Qwen3 model\-size series\. We confirm these scale interactions with direct cross\-size contrast tests rather than overlapping per\-model intervals\. Mitigation is likewise capability\-dependent: exposing metadata improves accuracy for the capable models, but only pre\-resolving the conflict restores accuracy for the 2 smaller checkpoints\. The same pattern appears on the capable models in an independent Llama\-Instruct model\-size series and on 2 external datasets \(RGB, MisBench\)\. A framing control finds no consistent advantage for the memory label: at the 3 smaller scales, models trust a stale document more than a stale memory; at 8B, the difference is not significant\.

## 1Introduction

Long\-term memory is central to personalized agents: an agent that remembers your “usual airline,” your default meeting room, or ordering beef tripe or ribeye at your favorite restaurant can act on your behalf\. The failure is treating stored information as trustworthy without checking whether it is still current\. When a stored fact has gone stale \(the usual airline changed, the meeting room changed, or you no longer want beef tripe for some reason\), an agent that reads the memory and acts on it will confidently do the wrong thing, even when the current, authoritative context already contains the right answer\.

Prior work establishes that agents often fail to act on updated information and that supplied context can override parametric knowledge\([Chao et al\., 2026](https://arxiv.org/html/2609.01852#bib.bib1);[Xie et al\., 2024](https://arxiv.org/html/2609.01852#bib.bib11);[Longpre et al\., 2021](https://arxiv.org/html/2609.01852#bib.bib12)\)\. It does not, however, establish when this harm begins as capability changes or which observable memory features trigger it\. We study how memory structure and model capability shape the failure through 3 questions: harm \(§[4](https://arxiv.org/html/2609.01852#S4)\), trigger \(§[5](https://arxiv.org/html/2609.01852#S5)\), and mitigation \(§[6](https://arxiv.org/html/2609.01852#S6)\)\. Each has a dedicated results section\.

#### Contributions\.

- •Abenchmark: a 2\-suite, closed\-set, action\-scored design that separates the 2 incompatible meanings of “no memory”, a Benefit suite \(the stored fact is required; no\-memory floored at chance\) and a Safety suite \(an authoritative tool always holds the correct value; no\-memory ceilinged\), frozen and SHA\-256 pinned \(§[3](https://arxiv.org/html/2609.01852#S3)\)\.
- •Theharmresult: the Trust Gap is over\-trust rather than confusion\. Stale\-value reliance stays≈1\.0\\approx\\\!1\.0across the model\-size series, yet the paired net harm \(Δmem\\Delta\_\{\\mathrm\{mem\}\}\) is capability\-gated, appearing only once a model is accurate enough for the stale value to cost it \(§[4](https://arxiv.org/html/2609.01852#S4)–[4\.2](https://arxiv.org/html/2609.01852#S4.SS2)\)\.
- •A decomposition of thetriggerwith a factorial and direct cross\-size interaction tests, showing which memory feature triggers the failure shifts with model scale \(§[5](https://arxiv.org/html/2609.01852#S5)\)\.
- •Amitigationstudy with a representation comparison, finding the fix is capability\-dependent: metadata improves accuracy for the capable models, while only pre\-resolution restores it for the smaller ones \(§[6](https://arxiv.org/html/2609.01852#S6)\)\.
- •Validation: external \(RGB, MisBench\) and cross\-family \(Llama\-Instruct\) evidence, plus a control showing the effect is not memory\-specific \(§[7](https://arxiv.org/html/2609.01852#S7)\)\.

## 2Related Work

#### Stale memory and downstream failure\.

The closest prior benchmark, STALE\([Chao et al\., 2026](https://arxiv.org/html/2609.01852#bib.bib1)\), benchmarks whether agents act on invalidated memory \(400 scenarios; best model 55\.2%\) and includes a same\-family Qwen3\.5\-9B/27B pair\. STALE already establishes stale\-memory harm; we add the capability account of it\. The most directly related memory study, MemSyco\-Bench\([Xiang et al\., 2026](https://arxiv.org/html/2609.01852#bib.bib8)\), asks whether an agent follows verified evidence over conflicting user memory and, like us, separates outcome accuracy from a memory\-following rate\. We take retrieval\-time override as established and study how it depends on model capability\. Adjacent efforts study internal self\-consolidation drift\([Zhang et al\., 2026](https://arxiv.org/html/2609.01852#bib.bib3)\)\(the only precedent for memory falling below the no\-memory baseline, but from a large language model \(LLM\) rewriting its own store rather than externally injected corruption\), retrieval overload on irrelevant volume\([Shao et al\., 2026](https://arxiv.org/html/2609.01852#bib.bib4)\), and memory\-update repair and update\-gap scaling\([Sun and He, 2026](https://arxiv.org/html/2609.01852#bib.bib6);[Patel, 2026](https://arxiv.org/html/2609.01852#bib.bib7)\)\. None of these run a controlled stale/current 4\-feature2×2×2×22\{\\times\}2\{\\times\}2\{\\times\}2factorial over a same\-family 0\.6B→\\to8B model\-size series with direct feature×\\timessize interaction tests; that combination is the basis for our comparisons, paired with a Benefit/Safety design that measuresΔmem\\Delta\_\{\\mathrm\{mem\}\}below the no\-memory baseline\.

#### Knowledge conflict and the authority feature\.

This is a context\-versus\-parametric knowledge conflict, not in\-context learning\([Longpre et al\., 2021](https://arxiv.org/html/2609.01852#bib.bib12)\)\.[Xie et al\. \(2024\)](https://arxiv.org/html/2609.01852#bib.bib11)show per\-model, single\-shot “chameleon vs\. stubborn” yielding under conflict, and[Jeripity Venkata \(2026\)](https://arxiv.org/html/2609.01852#bib.bib9)find generic context conflict partitions into regimes, consistent with our finding that the effect is not memory\-specific; we differ by making the yielding scale\-dependent and feature\-decomposable\. A particularly relevant comparison is ConflictBank\([Su et al\., 2024](https://arxiv.org/html/2609.01852#bib.bib10)\), which spans 4 model families and same\-family size series, includes temporal conflict and evidence\-order effects, and already reports that larger models can be more susceptible to conflicting evidence\. ConflictBank does not include the controlled factorial and cross\-size interaction bootstrap used here\. AuthMem\-Bench\([Zhan et al\., 2026](https://arxiv.org/html/2609.01852#bib.bib5)\)manipulates source authority across 7 consolidators and 7 backbones, but only at write\-time consolidation and with no model\-size series, crowding our authority slice only\.

#### Position effects across model scales\.

Position sensitivity as a function of scale is already studied\([Liu et al\., 2024](https://arxiv.org/html/2609.01852#bib.bib13);[Gabín et al\., 2026](https://arxiv.org/html/2609.01852#bib.bib14);[Byerly and Khashabi, 2026](https://arxiv.org/html/2609.01852#bib.bib15)\), where scale mainly reduces ordering variance rather than reversing it\. Our new element is the scale\-dependent sign reversal in the stale\-memory setting, not position×\\timesscale per se\. Finally,[De Marez et al\. \(2026\)](https://arxiv.org/html/2609.01852#bib.bib16)find larger instruction\-tuned models are more robust to overt sycophantic flips, the opposite direction to our recency result, a contrast we develop in §[8](https://arxiv.org/html/2609.01852#S8)\.

## 3Experimental Setup

We use the same benchmark, 4 memory conditions, and metrics in all experiments, so results are directly comparable\. The next sections report results for harm \(§[4](https://arxiv.org/html/2609.01852#S4)\), trigger \(§[5](https://arxiv.org/html/2609.01852#S5)\), and mitigation \(§[6](https://arxiv.org/html/2609.01852#S6)\)\.

### 3\.1Benchmark and 2 Suites

Because “no memory” has 2 incompatible meanings here, we split the benchmark into 2 suites\. In the Benefit suite \(A\) the task is unsolvable without the stored fact \(“book my usual airline”\); no current context is present, so the no\-memory baseline is floored at chance and the harm of interest is over\-trusting a stale stored fact\. In the Safety suite \(B\) an authoritative tool holds the correct value in every condition, so the no\-memory baseline is ceilinged; here we can measure net harm, which is following a stale memory over the current authoritative value and so dropping accuracy below not having the memory at all\.

Table[1](https://arxiv.org/html/2609.01852#S3.T1)makes the design concrete with a single Safety\-suite scenario: an authoritative calendar tool always holds the correct room, and the stored memory is what varies across the 4 conditions defined next\. The Benefit\-suite version of the same task simply omits the tool, sono\_memorycan no longer recover the answer\.

A*base scenario*is a single templated situation with a fixed ground\-truth action and slot values \(the room booking in Table[1](https://arxiv.org/html/2609.01852#S3.T1)is one\); scenarios that share a template but draw different slot values from a curated pool \(other rooms, users, or tools\) form a*template family*\. The frozen benchmark \(v1\) has 300 base scenarios \(150 per suite\), expanded from a 56\-scenario pilot by a deterministic curated\-pool generator and pinned by SHA\-256 with a manifest; the 150 scenarios per suite span 33 template families \(the resampling unit for the cluster bootstrap in §[5](https://arxiv.org/html/2609.01852#S5)\)\. Before freezing, the authors manually reviewed all 300 base scenarios, reading each to confirm a single unambiguous, tool\-consistent ground\-truth action, correct suite and condition assignment, and the absence of harmful or sensitive content\.

Table 1:One Safety\-suite base scenario \(room booking\) under all 4 memory conditions\. An authoritative calendar tool returnsRoom Bin every condition, so the ground\-truth action is alwaysRoom B; only the stored memory varies\.staleandexplicit\_conflictare the harm conditions, andno\_memoryis the baseline\.
### 3\.2Conditions and Scoring

Each item produces a constrained action\. We score the action using an exact, regex, or canonical match against the construction\-time ground truth \(no LLM judge\), manually validated against human reading on a random sample of outputs\. The benchmark uses 4 conditions:no\_memory\(baseline, floored in the Benefit suite, ceilinged in Safety\),clean\(memory agrees with the truth; the upper bound\),stale\(memory holds an outdated value; the harm condition\), andexplicit\_conflict\(the stale and correct values are both stored; an adjudication stress test\)\. To remove any position prior over the answer options we usecircular option\-permutation averaging\(noptions=3n\_\{\\text\{options\}\}\{=\}3, chance≈0\.33\\approx 0\.33\): each scenario is scored under every cyclic rotation of its options and averaged before any comparison\.

### 3\.3Metrics

We report 2 separate quantities\. reliance is a behavior, how often the model acts on the stale value, whileΔmem\\Delta\_\{\\mathrm\{mem\}\}is an outcome measured against the baseline:

reliance=P⁡\(a^=astale\),Δmem=acc⁡\(cond\)−acc⁡\(no\_memory\),\\text\{reliance\}\\;=\\;P\\\!\\left\(\\hat\{a\}=a\_\{\\text\{stale\}\}\\right\),\\qquad\\Delta\_\{\\mathrm\{mem\}\}\\;=\\;\\mathrm\{acc\}\(\\text\{cond\}\)\-\\mathrm\{acc\}\\bigl\(\\text\{\{no\\\_memory\}\}\\bigr\),wherea^\\hat\{a\}is the model’s action andastalea\_\{\\text\{stale\}\}the stale value\. reliance is position\-independent after circular averaging, andΔmem\\Delta\_\{\\mathrm\{mem\}\}is paired per scenario\. A model can have reliance≈1\.0\\,\\approx\\\!1\.0whileΔmem\\Delta\_\{\\mathrm\{mem\}\}harm is small \(weak baseline\) or large \(strong baseline\): larger models have more accuracy to lose when they over\-trust\. Thus, reliance can remain high even when the amount of net harm differs across model sizes\. For the Safety suite we also report the capability threshold

ρ∗=min⁡\{ℓ:CI upper bound of stale​Δmem​at trap level​ℓ<0\},\\rho^\{\\ast\}\\;=\\;\\min\\bigl\\\{\\,\\ell\\;:\\;\\text\{CI upper bound of stale \}\\Delta\_\{\\mathrm\{mem\}\}\\text\{ at trap level \}\\ell\\;<\\;0\\,\\bigr\\\},the first evaluated level at which following the stale memory becomes significant net harm\. The statistical unit is the base scenario; all intervals are 95% percentile bootstraps over scenario ids \(a “∗\*” denotes a CI excluding 0, “ns” a CI including 0\)\.

## 4Question 1: Harm and the onset of net harm

Over\-trust appears at every size, not just the capable ones: in the Benefit suite stale\-value reliance is0\.920\.92–1\.001\.00from 0\.6B to 8B\. The harm, by contrast, is scale\-gated: a larger model has more accuracy to lose, so once a stale note is made to look current, size deepens the damage rather than preventing it\.

### 4\.1Over\-Trust Is Universal

Figure[1](https://arxiv.org/html/2609.01852#S4.F1)and Table[2](https://arxiv.org/html/2609.01852#S4.T2)give the main results\. In the Benefit suite, the stale\-value reliance is 0\.92 / 0\.99 / 1\.00 / 1\.00 across 0\.6/1\.7/4/8B, and the paired harm isΔmem\\Delta\_\{\\mathrm\{mem\}\}==−0\.33\-0\.33/−0\.35\-0\.35/−0\.35\-0\.35/−0\.37\-0\.37\(all CI upper bounds<0<0\)\. The baseline check supports this interpretation: the Benefit no\-memory baseline is 0\.35–0\.37 with a CI that contains chance \(0\.33\), so the suite is genuinely floored and the collapse understaleis not a formatting artifact\.

Theexplicit\_conflictcondition shows the difference most clearly\. Even when the correct value is stored in memory right beside the stale one, the reliance crossover is 0\.50 / 0\.50 / 0\.01 / 0\.00: the small models follow the stale value half the time even with the correct value present, while the capable models resist\. This pattern is consistent with reliance on the stored value rather than random choice\.

The Benefit suite cannot give a clean net\-harm reading onexplicit\_conflict, because that item supplies the current valueno\_memorylacks, soΔmem\\Delta\_\{\\mathrm\{mem\}\}there is not a like\-for\-like net\-harm measure; the clean net\-harm evidence lives in the Safety suite \(§[4\.2](https://arxiv.org/html/2609.01852#S4.SS2)\)\.

Figure 1:Benefit\-suite results\.*Left:*stale\-value reliance by model size\.*Right:*pairedΔmem\\Delta\_\{\\mathrm\{mem\}\}\(accuracy minusno\_memoryaccuracy\) by model size\. The dashed line marks chance \(0\.330\.33\); theno\_memorybaseline is drawn for reference\.Table 2:Synthetic results \(frozen v1\)\. reliance==PP\(answers stale value\);Δmem\\Delta\_\{\\mathrm\{mem\}\}==acc−\-acc\(no\_memory\), 95% bootstrap CI; “∗\*” excludes 0\. EC==explicit\_conflict\. The no\-mem column lists accuracy with chance in parentheses; chance \(0\.330\.33\) is the meaningful floor only in the Benefit suite: the Safety no\-memory baseline is ceilinged, not chance\-level\.
### 4\.2Net Harm in the Safety Suite: The Trap Sweep

In the Safety suite the no\-memory baseline is preserved \(no\-mem≥0\.98\\geq 0\.98in every cell\), so any negativeΔmem\\Delta\_\{\\mathrm\{mem\}\}is genuine net harm: the model follows a stale memory over an authoritative tool\. We vary the conditions that make the stale note increasingly plausible \(levels L0–L3, e\.g\. inflating its apparent recency\) and reportρ∗\\rho^\{\\ast\}as the first significant level rather than fitting a continuous relationship \(Figure[2](https://arxiv.org/html/2609.01852#S4.F2), Table[3](https://arxiv.org/html/2609.01852#S4.T3)\)\. The 0\.6B model crosses into significant net harm already at L0, whereas 1\.7B/4B/8B first cross at L1:ρ∗=0/1/1/1\\rho^\{\\ast\}=0/1/1/1\. The threshold therefore separates the 0\.6B model from the other 3 models; it does not produce a monotone ordering by capability\.

At the higher recency\-inflated levels, the size ordering changes\. At L3, the 8B model has reliance1\.001\.00andΔmem\\Delta\_\{\\mathrm\{mem\}\}−1\.00\-1\.00; at L2, the 4B model has reliance0\.830\.83\. Making the stale note appear newer therefore increases harm for the larger models\. The direct cross\-size test for this recency interaction is in §[5](https://arxiv.org/html/2609.01852#S5)\.

Figure 2:Safety\-suite trap sweep\.*Left:*stale\-value reliance vs\. trap level \(L0–L3\)\.*Right:*Δmem\\Delta\_\{\\mathrm\{mem\}\}vs\. trap level; theno\_memorybaseline stays at ceiling, so a negativeΔmem\\Delta\_\{\\mathrm\{mem\}\}indicates net harm\.Table 3:Safety\-suite trap sweep: stale\-value reliance by level \(per\-levelΔmem\\Delta\_\{\\mathrm\{mem\}\}is plotted in Figure[2](https://arxiv.org/html/2609.01852#S4.F2), right\)\.ρ∗\\rho^\{\\ast\}==first level with staleΔmem\\Delta\_\{\\mathrm\{mem\}\}CI upper bound<0<0\.

## 5Question 2: Which memory feature triggers over\-trust, and does it scale?

The dominant trigger changes with model scale\. Removing the label raises over\-trust at every size, dating the stale note newer does the most damage on the largest models, and an inflated source matters little anywhere\. Position is the exception that reverses outright: placing the stale note first increases over\-trust in the 0\.6B model but decreases it in the 4B and 8B models \(Table[5](https://arxiv.org/html/2609.01852#S5.T5)\)\.

### 5\.1The Memory Feature Factorial

We manipulate 4 binary*memory features*of the stale note \(observable surface properties of a stored item, namely its label, timestamp, source, and position, that a model could use to decide whether to trust it\) in a full2×2×2×22\{\\times\}2\{\\times\}2\{\\times\}2factorial on the Safety suite \(1616cells per scenario\), using stale\-value reliance as the primary metric; Table[4](https://arxiv.org/html/2609.01852#S5.T4)defines the memory features\. Each memory feature is toggled independently, and a memory feature’s main effect isΔ\\Deltareliance==\(mean reliance over the 8 cells where the memory feature is on\)−\-\(mean over the 8 where it is off\), so it is averaged over all settings of the other 3 memory features \(Table[5](https://arxiv.org/html/2609.01852#S5.T5); the main effects are also plotted in Appendix[B](https://arxiv.org/html/2609.01852#A2)\)\.

Table 4:The 4 binary memory features in the2×2×2×22\{\\times\}2\{\\times\}2\{\\times\}2factorial, each toggled on/off independently\. “Trap\-on” is the setting hypothesized to increase stale\-value reliance\.Table[5](https://arxiv.org/html/2609.01852#S5.T5)gives the per\-size main effects, which show 4 distinct patterns\. Removing the label increases reliance significantly at every model size, with a null large\-vs\-small contrast, so it is broadly positive rather than a scale trend\. Dating the stale note newer \(recency\) is significantly stronger on the 4B/8B models\. An inflated source \(authority\) is weak and scale\-flat\. Placing the stale note first \(position\) changes from positive to negative across the model\-size series\. The recency and position interactions are tested directly in §[5\.2](https://arxiv.org/html/2609.01852#S5.SS2)\.

The factorial therefore does not support a single\-feature explanation\. These results describe behavioral effects of observable feature manipulations; they do not identify an internal mechanism\.

### 5\.2Direct Cross\-Size Interaction Tests

Overlapping or non\-overlapping per\-model intervals do not by themselves establish an interaction\. We therefore bootstrap paired differences between model sizes \(Table[6](https://arxiv.org/html/2609.01852#S5.T6)\)\. Recency is significantly stronger on the larger models \(8B−\-0\.6B=\+\.302∗=\+\.302^\{\*\}; mean\(large\)−\-mean\(small\)=\+\.333∗=\+\.333^\{\*\}\), position significantly reverses \(8B−\-0\.6B=−\.326∗=\-\.326^\{\*\}\), authority shows no interaction \(ns\), and the label feature shows a null group contrast, which is why we call it universal rather than scale\-growing\. Two robustness checks support the exploratory posture: a template\-family cluster bootstrap \(resampling whole families\) leaves every significant main effect significant, widening CIs only×1\.1\\times 1\.1–2\.22\.2with nothing crossing 0; and leave\-one\-family\-out moves the Benefit\-suite estimate by≤0\.012\\leq 0\.012at every scale\. The over\-trust pattern reproduces on the capable sizes of an independent Llama\-Instruct model\-size series \(§[7](https://arxiv.org/html/2609.01852#S7)\)\.

Table 5:Factorial main effects \(Δ\\Deltareliance, 95% CI; “∗\*” excludes 0\)\.Table 6:Cross\-size contrast bootstrap \(paired difference of the factorial main effect between sizes;\+\+⇒\\Rightarrowthe memory feature fools the*larger*model more\)\.
### 5\.3Dose\-Response Deep\-Dives

We use 3 feature\-specific dose\-response studies to examine the factorial results in more detail\. Full figures appear in Appendix[B](https://arxiv.org/html/2609.01852#A2)\. Each pairs a curve with a probe of whether the model can read the memory feature, separating vulnerability from feature blindness\.

#### Recency produces a step rather than a gradual dose response\.

The recency effect \(Figure[3](https://arxiv.org/html/2609.01852#S5.F3)\) does not accumulate smoothly with the size of the backdating: stale\-value reliance jumps the instant the stale note is dated at least 1 day newer than the current item and then saturates\. A date\-parsing probe confirms that the larger models read the timestamps correctly, and this higher accuracy is associated with greater reliance on the stale note\. Restoring the label removes this step\.

#### Source authority and provenance\.

The full\-factorial authority main effect is weak and roughly flat because it averages across recency conditions\. Conditioning on neutral recency reveals a smaller authority effect that increases with scale\. In the opposite direction, deferring to an official\-sounding note over the user’s own first\-hand statement is an error\. Here the\[CURRENT CONTEXT\]label reduces reliance to 0 on the 8B model, showing that capability can also be protective when the memory feature is correctly identified as spurious \(Appendix[B](https://arxiv.org/html/2609.01852#A2)\)\.

#### Intervention comparison\.

Structurally marking the authoritative item as\[AUTHORITATIVE\]\(while leaving the stale note present\) reduces stale\-value reliance at the\+1\+1d recency threshold, but only for the capable models: the reliance drop versus a raw frame is\+\.42∗\+\.42^\{\*\}\(4B\) and\+\.33∗\+\.33^\{\*\}\(8B\) but only\+\.06\+\.06\(0\.6B\) and\+\.00\+\.00\(1\.7B\); a purely verbal “prefer the newest authoritative source” rule has little effect and increases reliance in some settings\. We use the deterministic\-adjudication intervention introduced by[Reddy and Challaram \(2026\)](https://arxiv.org/html/2609.01852#bib.bib2)\. This intervention helps the capable models but has little effect on the smaller ones, a scale interaction not evaluated in that work, whose backbones are GPT\-4o\-family only with no same\-family model\-size series\. Note this*intervention\-oracle**marks*the authoritative item and measures a reliance drop at the recency threshold; it is a different estimand from the*representation\-oracle*of §[6](https://arxiv.org/html/2609.01852#S6), which*removes*the stale item and measures accuracy recovery\.

Figure 3:Recency dose–response\.Stale\-value reliance vs\. the recency gap \(days the stale note is dated newer than the current item\), 1 line per model size\. Probe and per\-feature panels in Appendix[B](https://arxiv.org/html/2609.01852#A2)\.

## 6Question 3: Mitigation is capability\-dependent

The effective intervention depends on model size\. Exposing per\-item metadata \(timestamp and source\) is enough for the 4B and 8B models, while the 0\.6B and 1\.7B checkpoints recover only when the conflict is pre\-resolved for them\.

We compare 3 representations of the same conflict \(Figure[4](https://arxiv.org/html/2609.01852#S6.F4), Table[7](https://arxiv.org/html/2609.01852#S6.T7)\): a*raw*frame \(stale and current items both present, unmarked\); a*metadata*frame \(each item annotated with its provenance and timestamp\); and a*representation\-oracle*that removes the stale item entirely \(supersession pre\-applied, act\-only\)\. These 3 representations show that no single intervention works equally well across model sizes\. Exposing metadata improves accuracy for the larger checkpoints: the accuracy gain over raw is larger on the capable models \(\+\.30/\+\.28/\+\.53/\+\.54\+\.30/\+\.28/\+\.53/\+\.54\)\. Only the oracle restores accuracy for the small ones, and it does so at every scale \(\+\.46/\+\.57/\+\.63/\+\.59\+\.46/\+\.57/\+\.63/\+\.59\)\. Thus, larger models can use metadata to resolve the conflict, whereas 0\.6B and 1\.7B models recover only when the conflict is resolved beforehand\.

Figure 4:Representation comparison \(Question 3\)\.*Left:*accuracy under the raw / metadata / oracle representations by model size\.*Right:*accuracy gain over the raw frame \(metadata gain and oracle gain\) by model size\.Table 7:Representation comparison: accuracy under each representation and the paired gains over the raw frame \(95% CI\)\. meta\_gain==metadata−\-raw; oracle\_gain==oracle−\-raw\.
## 7Validation: External, Cross\-Family, and Controls

#### External datasets\.

We rerun the identical paired\-Δmem\\Delta\_\{\\mathrm\{mem\}\}/reliance machinery on 2 external datasets, RGB\([Chen et al\., 2024](https://arxiv.org/html/2609.01852#bib.bib17)\)and MisBench\([Peng et al\., 2025](https://arxiv.org/html/2609.01852#bib.bib18)\)\(Table[8](https://arxiv.org/html/2609.01852#S7.T8); visualized in Appendix Figure[7](https://arxiv.org/html/2609.01852#A2.F7)\), which shows the effect is not limited to our synthetic templates\. Pooled stale\-value reliance is0\.810\.81–0\.940\.94across scales on both, reaching0\.960\.96in the MisBenchwikipedia⋅\\cdotsemanticcells and0\.950\.95in the RGB free\-text arm\. The pattern also appears on external data and is not specific to multiple\-choice \(MCQ\) evaluation\. On RGB,Δmem\\Delta\_\{\\mathrm\{mem\}\}is again scale\-gated, growing more negative with scale \(−0\.32∗\-0\.32^\{\*\}at 8B, confirmed by the free\-text arm at−0\.37∗\-0\.37^\{\*\}\); MisBench mainly measures reliance because its facts are unknown to the models, so itsΔmem\\Delta\_\{\\mathrm\{mem\}\}is near the floor\.

#### Style invariance\.

A MisBench rhetorical\-style sweep \(6 styles×\\times2 hop depths; Appendix[B](https://arxiv.org/html/2609.01852#A2)\) shows over\-trust is largely style\-invariant \(per\-model spread across styles≤0\.19\\leq 0\.19\), with a consistent effect: a casualblogframing is the least\-trusted style in all 8 \(hop×\\timesmodel\) cells \(sign\-testp≈\.004p\\approx\.004\), whilenews/wikiare typically highest\. This is not a monotone effect of authority, externally corroborating the weak authority effect of §[5](https://arxiv.org/html/2609.01852#S5)\.

#### Cross\-family replication\.

An independent same\-lineage Llama\-Instruct model\-size series \(Llama\-3\.2\-1B/3B→\\toLlama\-3\.1\-8B\), run on the identical frozen scenarios and evaluated with the same metrics and bootstrap procedure, reproduces the phenomenon on the capable sizes: Benefit\-suite over\-trust rises with scale \(reliance0\.46/0\.96/1\.000\.46/0\.96/1\.00;Δmem\\Delta\_\{\\mathrm\{mem\}\}−0\.10∗/−0\.31∗/−0\.36∗\-0\.10^\{\*\}/\-0\.31^\{\*\}/\-0\.36^\{\*\}\), and the memory feature signs match Qwen3: label and recency positive and large on the capable sizes, authority weak\-but\-real, position negative at scale\. Two exceptions we state plainly: Llama\-1B is a capability floor \(no\-memory≈\\approxchance, memory features muted\), and the positive\-position corner seen at Qwen3\-0\.6B does not cross\-replicate, so the position sign\-flip is Qwen\-specific\. We use the following replication criterion: a memory feature fails to replicate only if its main\-effect CI on a capable size \(≥\\geq3B, above the capability floor\) excludes the Qwen sign; by that rule label, recency, and authority replicate and only the tiny\-scale positive\-position corner does not\. Parse rates span0\.8510\.851–1\.001\.00; because unparsed responses are counted as non\-compliant \(never as following\-stale\), restricting to parsed rows only raises reliance, so the reported over\-trust is a conservative lower bound \(full CI ledger, Appendix[C](https://arxiv.org/html/2609.01852#A3)\)\.

#### The failure is not memory\-specific\.

A control frames the identical wrong item 3 ways \(as a\[MEMORY\], a\[DOCUMENT\], or an\[EARLIER MESSAGE\]\), holding everything else fixed \(Table[11](https://arxiv.org/html/2609.01852#A4.T11)a, with CIs\)\. Paired reliance\(memory\)−\-reliance\(document\) is−\.311∗/−\.058∗/−\.013∗/\+\.016\-\.311^\{\*\}/\-\.058^\{\*\}/\-\.013^\{\*\}/\+\.016\(ns\): the control finds no consistent memory\-frame advantage, and a stale document is trusted more at the 3 smaller scales, with no significant difference at 8B\. Persistent\-memory use is therefore one instance of a broader stale\-evidence problem, consistent with the context\-conflict regimes of[Jeripity Venkata \(2026\)](https://arxiv.org/html/2609.01852#bib.bib9)\.

#### Thinking mode does not remove the gap\.

Enabling thinking mode on the frozen benchmark \(0\.6B and 8B; parse≥\.999\\geq\.999\) does not close the gap at the 2 tested endpoints \(Table[11](https://arxiv.org/html/2609.01852#A4.T11)b\): 8B is saturated and unchanged, while at 0\.6B Benefit\-suite over\-trust actually rises \(r​e​l​i​a​n​c​e​0\.924→0\.991reliance\{\}\\,0\.924\\to 0\.991, pairedΔ\+0\.067\\Delta\+0\.067, CI\[\+\.040,\+\.096\]\[\+\.040,\+\.096\]\)\.

Table 8:External validation \(pooled and a representative conflict cell\)\.Δmem\\Delta\_\{\\mathrm\{mem\}\}and reliance with 95% CI; the0\.960\.96semantic\-conflict and0\.950\.95free\-text reliance are the largest reliance values reported in the text\. A starred bound printed as\.00\.00is positive but rounds to 2 decimals\. closed\-book==no\-context \(parametric\-only\) accuracy; wiki⋅\\cdotsem==thewikipedia⋅\\cdotsemanticconflict cell\.

## 8Discussion and Conclusion

#### Capability is not uniformly protective\.

The gap is over\-reliance\. Capable models read memory features more accurately, so a correctly\-read stale timestamp is exploited more \(recency\), whereas a spurious provenance feature is resisted more\.[De Marez et al\. \(2026\)](https://arxiv.org/html/2609.01852#bib.bib16)find that larger instruction\-tuned models are more robust to overt sycophantic manipulation, the opposite of our recency result\. A capable model may resist an overt “you are wrong” challenge while trusting a plausible, correctly parsed cue that a note is newer\. These are different features, so the 2 findings are not contradictory\.

#### Implications for memory systems\.

Keeping the label reduces stale\-value reliance at every model size\. Deterministic freshness adjudication\([Reddy and Challaram, 2026](https://arxiv.org/html/2609.01852#bib.bib2)\)helps but leaves small models needing the conflict pre\-resolved\. Authority is a weak lever, a conclusion that converges from the internal factorial and the external style sweep\. Because the failure is not memory\-specific, these implications extend to any stale or conflicting retrieved evidence, not only persistent memory\.

#### Limitations\.

The Benefit suite cannot express net harm onexplicit\_conflict\(its baseline is at chance\), so net\-harm claims rest on the Safety suite\. Scoring is closed\-set and action\-based by design, which strengthens measurement but limits open\-ended generality \(partly offset by the RGB free\-text arm\)\. The primary model\-size series is one family, with cross\-family reproduction on the capable Llama sizes but no broad family×\\timesscale grid\.ρ∗\\rho^\{\\ast\}is defined on our trap\-level sequence, and we measure failure at memory\-consumption time rather than across an end\-to\-end write/update/retrieve system\.

#### Conclusion\.

Persistent memory helps agents, but they over\-trust stale stored values at every model size\. The resulting net harm, the triggering memory feature, and the effective mitigation all depend on model capability\. The pattern appears across model families, external datasets, and non\-memory stale evidence\. We present the frozen benchmark and harness as tools for measuring this failure and evaluating future mitigations\.

## Author Contributions

Jundong Hu:Led and carried out the research end to end, including conceptualization, methodology, implementation, experimental design and execution, analysis, and manuscript drafting and revision\.

Shekar Ramachandran:Provided supervision, compute resources, and manuscript review\.

## Acknowledgments

We thank Prakhar Mehrotra, Chandramouliswaran V, Avinash Karn, Anindya Moitra, Uma Kona, Angela McAtee, Linsey Pang, and Yun\-Shiuan Chuang for their organizational support and coordination throughout this work\. Jundong Hu additionally thanks Loga Vinayagam for the opportunity to join the team where this work began\.

## References

- Byerly and Khashabi \(2026\)A\. Byerly and D\. KhashabiSelf\-consistency falls short\! the adverse effects of positional bias on long\-context problems\.Transactions of the Association for Computational Linguistics \(TACL\)14,pp\. 292–317\.Note:arXiv:2411\.01101Cited by:[§2](https://arxiv.org/html/2609.01852#S2.SS0.SSS0.Px3.p1.1)\.
- Chaoet al\.\(2026\)H\. Chao, Y\. Bai, R\. Sheng, T\. Li, and Y\. SunSTALE: can LLM agents know when their memories are no longer valid?\.Note:400 conflict scenarios; best model 55\.2%; includes a same\-family Qwen3\.5\-9B/27B pairExternal Links:2605\.06527Cited by:[§1](https://arxiv.org/html/2609.01852#S1.p2.1),[§2](https://arxiv.org/html/2609.01852#S2.SS0.SSS0.Px1.p1.1)\.
- Chenet al\.\(2024\)J\. Chen, H\. Lin, X\. Han, and L\. SunBenchmarking large language models in retrieval\-augmented generation\.InProceedings of the AAAI Conference on Artificial Intelligence,Note:RGB; arXiv:2309\.01431Cited by:[§7](https://arxiv.org/html/2609.01852#S7.SS0.SSS0.Px1.p1.1)\.
- De Marezet al\.\(2026\)V\. De Marez, L\. De Bruyne, and W\. DaelemansDecomposing factual sycophancy in language models: how size and instruction tuning shape robustness\.Note:56 checkpoints 0\.3–32B; larger instruction\-tuned models MORE robust to sycophantic flipsExternal Links:2606\.06306Cited by:[§2](https://arxiv.org/html/2609.01852#S2.SS0.SSS0.Px3.p1.1),[§8](https://arxiv.org/html/2609.01852#S8.SS0.SSS0.Px1.p1.1)\.
- Gabínet al\.\(2026\)J\. Gabín, A\. Pérez, and J\. ParaparLost in the evidence? reproducing document position and context size effects in RAG\.InProceedings of the 49th International ACM SIGIR Conference on Research and Development in Information Retrieval \(SIGIR\),Note:arXiv:2605\.27105; scale reduces ordering variance, no sign flipCited by:[§2](https://arxiv.org/html/2609.01852#S2.SS0.SSS0.Px3.p1.1)\.
- Jeripity Venkata \(2026\)P\. Jeripity VenkataThree regimes of context\-parametric conflict: a predictive framework and empirical validation\.External Links:2605\.11574Cited by:[§2](https://arxiv.org/html/2609.01852#S2.SS0.SSS0.Px2.p1.1),[§7](https://arxiv.org/html/2609.01852#S7.SS0.SSS0.Px4.p1.1)\.
- Liuet al\.\(2024\)N\. F\. Liu, K\. Lin, J\. Hewitt, A\. Paranjape, M\. Bevilacqua, F\. Petroni, and P\. LiangLost in the middle: how language models use long contexts\.Transactions of the Association for Computational Linguistics \(TACL\)\.Note:arXiv:2307\.03172Cited by:[§2](https://arxiv.org/html/2609.01852#S2.SS0.SSS0.Px3.p1.1)\.
- Longpreet al\.\(2021\)S\. Longpre, K\. Perisetla, A\. Chen, N\. Ramesh, C\. DuBois, and S\. SinghEntity\-based knowledge conflicts in question answering\.InProceedings of the 2021 Conference on Empirical Methods in Natural Language Processing \(EMNLP\),Note:arXiv:2109\.05052Cited by:[§1](https://arxiv.org/html/2609.01852#S1.p2.1),[§2](https://arxiv.org/html/2609.01852#S2.SS0.SSS0.Px2.p1.1)\.
- Patel \(2026\)V\. PatelSupersede: diagnosing and training the memory\-update gap in LLM agents\.External Links:2606\.27472Cited by:[§2](https://arxiv.org/html/2609.01852#S2.SS0.SSS0.Px1.p1.1)\.
- Penget al\.\(2025\)M\. Peng, N\. Chen, J\. Tang, and J\. LiHow does misinformation affect large language model behaviors and preferences?\.InProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\),pp\. 13711–13748\.Note:MisBench; arXiv:2505\.21608External Links:[Document](https://dx.doi.org/10.18653/v1/2025.acl-long.674)Cited by:[§7](https://arxiv.org/html/2609.01852#S7.SS0.SSS0.Px1.p1.1)\.
- Reddy and Challaram \(2026\)V\. Reddy and S\. R\. ChallaramReliable post\-retrieval assembly for agent memory: separating evidence extraction from policy execution\.Note:COLM 2026 Lifelong Agent Workshop; arXiv:2606\.01435External Links:2606\.01435Cited by:[§5\.3](https://arxiv.org/html/2609.01852#S5.SS3.SSS0.Px3.p1.1),[§8](https://arxiv.org/html/2609.01852#S8.SS0.SSS0.Px2.p1.1)\.
- Shaoet al\.\(2026\)J\. Shao, Y\. Lu, Y\. Zhang, and B\. LuoWhen stored evidence stops being usable: scale\-conditioned evaluation of agent memory\.External Links:2605\.07313Cited by:[§2](https://arxiv.org/html/2609.01852#S2.SS0.SSS0.Px1.p1.1)\.
- Suet al\.\(2024\)Z\. Su, J\. Zhang, X\. Qu, T\. Zhu, Y\. Li, J\. Sun, J\. Li, M\. Zhang, and Y\. ChengConflictBank: a benchmark for evaluating the influence of knowledge conflicts in LLMs\.InAdvances in Neural Information Processing Systems \(NeurIPS\) Datasets and Benchmarks Track,Note:arXiv:2408\.12076Cited by:[§2](https://arxiv.org/html/2609.01852#S2.SS0.SSS0.Px2.p1.1)\.
- Sun and He \(2026\)H\. Sun and L\. HeWhen memory updates but behavior does not: repairing implicit stale dependencies in personalized agent responses\.External Links:2608\.01619Cited by:[§2](https://arxiv.org/html/2609.01852#S2.SS0.SSS0.Px1.p1.1)\.
- Xianget al\.\(2026\)Z\. Xiang, Z\. Chen, Y\. Tang, Z\. Wei, R\. Ning, Y\. Lin, Q\. Zhang, and J\. SuMemSyco\-Bench: benchmarking sycophancy in agent memory\.Note:5 task families incl\. memory–evidence conflict; multiple downstream backbones, no controlled same\-family scale ladder or cue×\\timescheckpoint factorialExternal Links:2607\.01071Cited by:[§2](https://arxiv.org/html/2609.01852#S2.SS0.SSS0.Px1.p1.1)\.
- Xieet al\.\(2024\)J\. Xie, K\. Zhang, J\. Chen, R\. Lou, and Y\. SuAdaptive chameleon or stubborn sloth: revealing the behavior of large language models in knowledge conflicts\.InInternational Conference on Learning Representations \(ICLR\),Note:arXiv:2305\.13300Cited by:[§1](https://arxiv.org/html/2609.01852#S1.p2.1),[§2](https://arxiv.org/html/2609.01852#S2.SS0.SSS0.Px2.p1.1)\.
- Zhanet al\.\(2026\)Q\. Zhan, R\. Zhang, S\. Guo, L\. Zhao, and Z\. LiuWhen memory becomes authority: benchmarking authority collapse at the memory consolidation boundary\.External Links:2608\.01679Cited by:[§2](https://arxiv.org/html/2609.01852#S2.SS0.SSS0.Px2.p1.1)\.
- Zhanget al\.\(2026\)D\. Zhang, Y\. Lin, Z\. Wu, Y\. Sun, B\. Li, D\. Li, and H\. PengUseful memories become faulty when continuously updated by LLMs\.External Links:2605\.12978Cited by:[§2](https://arxiv.org/html/2609.01852#S2.SS0.SSS0.Px1.p1.1)\.

## Appendix AMethods Reference

#### Suites and conditions\.

Each scenario is an action\-scored, slot\-filled template with a construction\-time ground truth\. The Benefit suite \(A\) is unsolvable without the stored fact \(no\-memory floored at chance≈0\.33\\approx 0\.33\); the Safety suite \(B\) always has an authoritative tool holding the correct value \(no\-memory ceilinged\)\. Conditions:no\_memory,clean\(memory agrees\),stale\(memory holds an old value\),explicit\_conflict\(the stale value and the correct value are both stored in memory\)\. Before freezing, the authors manually reviewed all 300 base scenarios to verify a unique tool\-consistent ground\-truth action, correct suite and condition assignment, and no harmful or sensitive content\.

#### Metrics\.

reliance=P⁡\(answer=stale value\)=P\(\\text\{answer\}=\\text\{stale value\}\);Δmem\\Delta\_\{\\mathrm\{mem\}\}=acc⁡\(cond\)−acc⁡\(no\_memory\)=\\mathrm\{acc\}\(\\text\{cond\}\)\-\\mathrm\{acc\}\(\\texttt\{no\\\_memory\}\), paired per scenario\.ρ∗\\rho^\{\\ast\}is the first trap level whose staleΔmem\\Delta\_\{\\mathrm\{mem\}\}CI upper bound is<0<0\. Every option is scored under all cyclic rotations \(circular permutation averaging,noptions=3n\_\{\\text\{options\}\}=3\) before comparison, so reliance is position\-independent\. Statistical unit==base scenario; 95% percentile bootstrap over scenario ids\. Exploratory decomposition \(not pre\-registered confirmatory tests\); robustness checked by a template\-family cluster bootstrap \(resample the 33 families\) and leave\-one\-family\-out\.

#### Models and decoding\.

Qwen3 0\.6/1\.7/4/8B, non\-thinking \(§[7](https://arxiv.org/html/2609.01852#S7)adds the thinking ablation\); Llama\-3\.2\-1B/3B\-Instruct and Llama\-3\.1\-8B\-Instruct for cross\-family\. Greedy decoding, identical prompts, frozen benchmark v1 \(300 base scenarios, SHA\-256 pinned\)\.

#### Compute\.

All inference runs on NVIDIA A100 \(40 GB\) GPUs partitioned into Multi\-Instance GPU \(MIG\) slices, serving 1 model per slice and running the 4 models concurrently across slices with plaintransformers\(no vLLM\)\. Each model in the 0\.6–8B model\-size series fits within a single MIG slice; this partitioned\-memory budget is part of why the study targets a 0\.6–8B model\-size series rather than larger backbones\.

## Appendix BMemory Feature Dose\-Response Deep\-Dives

Figure[6](https://arxiv.org/html/2609.01852#A2.F6)collects the per\-feature dose\-response and probe panels summarized in §[5\.3](https://arxiv.org/html/2609.01852#S5.SS3), plus the MisBench rhetorical\-style sweep from §[7](https://arxiv.org/html/2609.01852#S7)\. Figure[5](https://arxiv.org/html/2609.01852#A2.F5)plots the factorial main effects tabulated in Table[5](https://arxiv.org/html/2609.01852#S5.T5)\. Figure[7](https://arxiv.org/html/2609.01852#A2.F7)visualizes the external\-validation results of §[7](https://arxiv.org/html/2609.01852#S7)\(tabulated in Table[8](https://arxiv.org/html/2609.01852#S7.T8)\)\.

Figure 5:Factorial memory feature main effects on stale\-value reliance\(Safety suite;Δ\\Deltareliance==trap\-on−\-trap\-off, 95% CI\)\. 1 point per memory feature and model size; these are the values tabulated in Table[5](https://arxiv.org/html/2609.01852#S5.T5)\.Figure 6:Dose\-response and probe results for recency, intervention, authority, provenance, and MisBench style\. Each ramp/probe plots its metric against the swept feature, 1 line per model size\.Figure 7:External validation \(RGB, MisBench\)\.*Left:*accuracy by condition on RGB\.*Middle:*accuracy by condition on MisBench\.*Right:*Δmem\\Delta\_\{\\mathrm\{mem\}\}vs\. model size on both datasets, computed with the same paired machinery as the synthetic suites\.
## Appendix CCross\-Family CI Ledger

The Llama\-Instruct model\-size series is evaluated with the same metrics and bootstrap procedure as the Qwen primary ledger\. Every number below carries a seeded \(=0=0\) paired\-bootstrap 95% CI identical to §[4](https://arxiv.org/html/2609.01852#S4), recomputed by the same cross\-family reanalysis used for the Qwen ledger \(full per\-condition dump inxfam\_ledger\.txt\)\. Table[9](https://arxiv.org/html/2609.01852#A3.T9)gives the Benefit\-suite results and Table[10](https://arxiv.org/html/2609.01852#A3.T10)the factorial main effects, both with intervals rather than bare stars\.

Table 9:Cross\-family results \(Benefit suite\), same standard as Qwen\.Per\-scenario bootstrap CIs\. Parse\-rate minimum0\.8510\.851\(1Bno\_memory\); parsed\-only reliance≥\\geqall\-rows reliance in every cell, so the reported over\-trust is a conservative lower bound\.Table 10:Cross\-family factorial main effects\(Δ\\Deltareliance, trap\-on−\-trap\-off, paired 95% CI;∗CI excludes 0\)\. 1 row per Llama model size, 1 column per memory feature\.
## Appendix DControl Experiments \(with CIs\)

The 2 §[7](https://arxiv.org/html/2609.01852#S7)controls, reported to the same standard as the body tables \(per\-scenario seeded bootstrap 95% CI on the paired contrast;n=150n=150scenarios each\)\.

Table 11:Controls\.\(a\) Framing control \(Safety suite\): the identical wrong item rendered as a memory vs\. a document vs\. an earlier message; the last column is the paired reliance\(mem\)−\-reliance\(doc\) contrast\. \(b\) Thinking\-mode control \(Benefit suite\): stale\-value reliance with thinking disabled vs\. enabled at the 2 tested sizes, with the paired difference\.*\(a\) Framing control: stale\-value reliance by frame \(Safety suite\)*Modelreliance\(mem\)reliance\(doc\)reliance\(prior\)reliance\(mem\)−\-reliance\(doc\) \[CI\]0\.6B0\.3070\.6180\.218−0\.311\-0\.311\[−\.360\-\.360,−\.262\-\.262\]∗1\.7B0\.0560\.1130\.009−0\.058\-0\.058\[−\.089\-\.089,−\.027\-\.027\]∗4B0\.0070\.0200\.000−0\.013\-0\.013\[−\.027\-\.027,−\.004\-\.004\]∗8B0\.0330\.0180\.002\+0\.016\+0\.016\[−\.002\-\.002,\+\.038\+\.038\] ns*\(b\) Thinking\-mode control: stale\-value reliance \(Benefit suite\)*Modelno\-thinkthinkΔ\\Deltareliance \(think−\-no\-think\) \[CI\]0\.6B0\.9240\.991\+0\.067\+0\.067\[\+\.040\+\.040,\+\.096\+\.096\]∗8B1\.0001\.000\+0\.000\+0\.000\[\+\.000\+\.000,\+\.000\+\.000\] ns
## Appendix EFailure Transcripts

Verbatim model actions on frozen scenarios \(ground truth vs\. the stale value the model followed\):

- •Safety override, scheduling \(Qwen3\-8B, trap L3\)\.Authoritative calendar: Room B; stale note \(dated newer\): Room A\. Output:ACTION: Room A\.
- •Safety override, travel \(Qwen3\-8B, trap L3\)\.Authoritative gate: B12; stale note: A4\. Output:ACTION: Gate A4\.
- •Explicit conflict, travel \(Qwen3\-0\.6B\)\.Both values stored in memory, the correct airline Delta and the stale value United\. Output:ACTION: United\.
- •Safety override, local \(Qwen3\-8B, trap L3\)\.Authoritative city: Austin; stale note: Dallas\. Output:ACTION: Dallas\.