Source-linked AI summary
Lost in the Noise: How Reasoning Models Fail with Contextual Distractors
Seongyun Lee, Yongrae Jo, Minju Seo, Moontae Lee, Minjoon Seo
TL;DR
Agentic models increasingly operate on noisy external information, but clean benchmarks do not adequately measure this setting. The paper introduces NoisyBench and robustness training methods, finding severe distractor sensitivity and improved resilience from rationale-aware rewards.
Problem
Clean benchmarks do not capture how reasoning and agentic systems behave when real-world contexts contain faulty outputs, incorrect retrievals, and irrelevant history.
Method
The paper introduces NoisyBench across 11 datasets and develops NoisyInstruct and RARE to train models to identify helpful information amid distractors.
Results
Models suffer large distractor-induced degradation, while RARE significantly improves robustness in clean and noisy conditions without introducing trade-offs.
Takeaways & Limitations
Noise robustness requires evaluating and rewarding grounded reasoning rather than relying solely on clean benchmarks or final-answer rewards.
Takeaways & Limitations
The work focuses primarily on reasoning models that generate explicit thinking processes and on agentic AI systems.
Abstract
from arXiv · showhide
Recent advances in reasoning models and agentic AI systems have led to an increased reliance on diverse external information. However, this shift introduces input contexts that are inherently noisy, a reality that current sanitized benchmarks fail to capture. We introduce NoisyBench, a comprehensive benchmark that systematically evaluates model robustness across 11 datasets in RAG, reasoning, alignment, and tool-use tasks against diverse noise types, including random documents, irrelevant chat histories, and hard negative distractors. Our evaluation reveals a catastrophic performance drop of up to 80% in state-of-the-art models when faced with contextual distractors. Crucially, we find that agentic workflows often amplify these errors by over-trusting noisy tool outputs, and distractors can trigger emergent misalignment even without adversarial intent. We find that prompting, context engineering, SFT, and outcome-reward only RL fail to ensure robustness; in contrast, our proposed Rationale-Aware Reward (RARE) significantly strengthens resilience by incentivizing the identification of helpful information within noise. Finally, we uncover an inverse scaling trend where increased test-time computation leads to worse performance in noisy settings and demonstrate via attention visualization that models disproportionately focus on distractor tokens, providing vital insights for building the next generation of robust, reasoning-capable agents.
1 Introduction
The paper introduces NoisyBench to expose failures hidden by clean benchmarks and proposes RARE to improve reasoning robustness under contextual distractors. Distractors can degrade performance, amplify agentic errors, and alter model reasoning behavior.
- NoisyBench evaluates robustness across 11 datasets spanning RAG, reasoning, alignment, and tool-use tasks with random documents, irrelevant chats, and hard negatives.
- Up to 80% performance drops occur in state-of-the-art reasoning models when contextual distractors are introduced, while agentic workflows can amplify errors by over-trusting noisy outputs.
- NoisyInstruct exposes models to distractors, but supervised fine-tuning can cause catastrophic forgetting and outcome-based reinforcement learning yields only marginal gains.
- RARE rewards identifying helpful information within noise, increasing distractor filtering and final accuracy relative to outcome-based rewards alone.
- Distractors induce inverse scaling, increase uncertainty, and attract disproportionate attention, especially in incorrect predictions.
2 Related Works
As language models become agentic, they increasingly rely on tools, long contexts, and environmental interaction. This creates a need to understand robustness beyond conventional clean retrieval and single-step settings.
- Agentic systems use external tools and multi-step reasoning for complex, long-horizon tasks, including in critical domains such as healthcare and finance.
- Function-calling agents succeed in only about 50% of realistic tool-use tasks, while multi-turn interaction increases reliance on longer contexts.
- Existing context-engineering and retrieval benchmarks commonly emphasize clean inputs, despite degradation from indiscriminate information injection.
3 NoisyBench: Benchmarking Robustness in Noisy Contexts
NoisyBench extends benchmark evaluation across four task categories and four distractor conditions, revealing large robustness failures. Hard negatives and even random content can impair reasoning, alignment, and agentic workflows.
- Benchmark design: NoisyBench covers RAG, reasoning, alignment, and tool usage across 11 datasets, reporting harmonic-mean averages over 11 metrics per row.
- Benchmark design: The benchmark compares no distractor, random documents, random chat history, and task-specific hard negative settings.
- Benchmark design: Models are evaluated across proprietary, large open, and smaller open systems using four distractor settings and dataset-specific metrics.
- Robustness findings: Declines range from about 9% to nearly 80% on average, with hard negatives generally causing the most severe degradation.
- Robustness findings: Random distractors reduce alignment performance substantially, including Gemini-2.5-Pro declining from 94.0% to 60.5% on BBQ.
- Agentic workflows: Agentic workflows improve clean-setting performance but perform worse than the underlying reasoning model under random-document, random-chat, and hard-negative noise.
4 Enhancing the Robustness under Contextual Distractors
The section evaluates prompting, context engineering, supervised fine-tuning, and reinforcement learning for robustness under distractors. Outcome-based RL helps, while RARE further improves resilience by rewarding identification of useful information in noisy context.
- Experimental Results: Prompting, SFT, and context engineering fail to provide meaningful robustness gains under noisy distractors.SFT can reduce performance through catastrophic forgetting, while context engineering may partially remove noise or discard task-relevant information.
- Experimental Results: Outcome-based RL mitigates performance degradation more effectively than prompting or SFT and improves accuracy in several settings.However, outcome-only rewards provide limited noise resilience because they do not guide intermediate reasoning.
- Experimental Results: RARE rewards models for identifying helpful information within noisy context, strengthening distractor filtering during reasoning.The reward is tied to paraphrasing or copying useful information inside a reference span, providing supervision over the reasoning process.
- Experimental Results: RARE reduces distracted chains of thought while increasing outcome-based rewards and final accuracy relative to outcome-only RL.This pattern is reported in the reward-dynamics analysis and is linked to explicitly reducing distractor-induced confusion.
5 Analyses
The analyses show that semantically similar or numerous distractors increase reasoning effort and uncertainty while degrading accuracy. Attention analysis further indicates that incorrect predictions disproportionately rely on distractor tokens.
- Distractor Similarity: Higher question–distractor similarity lowers accuracy while increasing average reasoning-token usage.The authors interpret this as models reviewing distractors for relevance even when they contain no useful information.
- Uncertainty and Confidence: Entropy steadily increases as the number of hard negative distractors grows, indicating greater uncertainty during generation.Accumulating distractors is associated with more confused reasoning and lower-confidence final answers.
- Distractor Similarity: Longer reasoning does not result from longer distractors, because output length has only a weak negative correlation with distractor length.The increased reasoning is instead associated with distractor similarity and confusion during reasoning.
- Attention Analysis: Incorrect predictions allocate substantially more strong attention to distractor tokens than correct predictions.The analysis suggests that excessive distractor-focused attention can increase the likelihood of errors.
6 Conclusion
The conclusion presents NoisyBench and related training resources as a framework for studying robustness in noisy agentic settings. It summarizes distractor effects and RARE as a reward-based approach for identifying helpful information under noise.
- Conclusion: NoisyBench evaluates agentic robustness across RAG, reasoning, alignment, and tool-usage tasks with multiple distractor types.The benchmark includes random documents, random chat histories, and hard negatives designed for distinct noisy-use cases.
- Conclusion: The benchmark construction uses synthetic hard negatives, filtering, similarity controls, and randomized document or chat-history distractors.Filtering removes low-quality samples and excludes distractors that alter the answer or make tasks trivial.
- Conclusion: NoisyInstruct exposes models to diverse distractors and adds hints that support rationale-aware rewards without revealing exact answers.The dataset uses multiple size tiers and contamination checks across its training sources.
- Conclusion: GRPO is used for reinforcement learning, with gpt-oss-120b evaluating rollout samples for verifiable rewards.The training setup selects open-source models whose publicly released weights fit the computational budget.
A.3 Experimental Details
The experiments evaluate seven models using benchmark-aligned settings, several robustness interventions, and multi-stage correctness checks. Evaluation uses Pass@k and Pass^k metrics alongside verifier and LLM-as-judge procedures.
- Seven models, including Gemini-2.5-Pro, Gemini-2.5-Flash, DeepSeek-R1-0528, gpt-oss-120b, and three Qwen or distilled models, are evaluated.
- Prompting, SFT, and RL baselines are applied to each model, with SFT training models to produce answers together with helpful references.
- GEPA, Dynamic Cheatsheet, and ACE are used as context-engineering methods through their official implementations.
- Pass@k replaces accuracy for benchmarks where accuracy is unstable with reasoning models, while existing Pass@k settings and TauBench's Pass^k are retained.
- Correctness is checked first with benchmark-specific libraries and then, when necessary, by Gemini-2.5-Pro judging the final answer without the thinking process.
- Evaluation and training use model-specific token limits and distributed GPU configurations, including DeepSpeed ZeRO-3 for SFT and VeRL for RL.
B.1 Benchmark Statistics
The benchmark spans diverse question domains and distractor characteristics, with distractors generally much longer than the questions. Distractor placement also materially affects performance.
- Length Distribution: Most distractors exceed 12,000 tokens across tasks, except for the noticeably shorter distractors in AIME 2025.
- Length Distribution: Random chat is the longest distractor type, likely because multi-turn outputs accumulate more tokens.
- Domain Distribution: Self-Awareness and Survival-Instinct questions cluster closely in embedding space, while TauBench Airline and Retail form another clear cluster.
- Position of Distractor: All distractors are placed before the question by default to maintain consistency across distractor types.
- Position of Distractor: Random chat history after the question produces the largest performance drop, while random documents and hard negatives before the question also degrade performance.
B.3 Effect of Scaling the Model Size
Increasing model size generally improves distractor robustness, but gains are uneven and largely plateau beyond the 8B scale. The results therefore motivate explicit distractor-identification methods rather than scaling alone.
- Effect of Scaling the Model Size: Robustness to distractors generally increases with model size, but gains are not proportional across the Qwen3 model family.
- Effect of Scaling the Model Size: Aside from the jump from 4B to 8B, larger models show little improvement, with 14B and 32B results nearly identical.
- Effect of Scaling the Model Size: Larger models show smaller performance drops between no-distractor and distractor settings, but increasing size does not consistently reduce those drops further.
- Effect of Scaling the Model Size: Scaling alone offers limited robustness returns relative to training and inference costs, highlighting the need for methods that identify and filter distractors.
- Transferability: Similarity analyses report 24.1% question similarity, with distractor similarities of 15.1%, 17.3%, and 31.4%, supporting a methodology-based explanation for NoisyBench gains.
B.5 Transferability of Training with RARE
The experiments examine whether RARE-trained models transfer across clean settings, mixed distractors, and longer reasoning trajectories. Noisy settings produce inverse scaling behavior, where longer reasoning consistently harms performance.
- Transferability to Clean Settings: RARE-trained models achieve higher performance in clean NoisyBench settings despite training primarily under noisy conditions.
- Mixed Distractors: Mixed distractor experiments combine random documents, random chat, and hard negatives while keeping total distractor length constant.
- Inverse Scaling Law: Without distractors, BBQ and BBEH-Mini decline as reasoning trajectories grow, whereas Musique and TauBench-Retail benefit from test-time scaling.
- Inverse Scaling Law: With distractors, all benchmarks and models consistently exhibit an inverse scaling law in which longer reasoning hurts performance.
- Inverse Scaling Law: Distractors increase token usage while reducing efficiency and accuracy simultaneously, limiting the reliability of test-time scaling with large contexts.
B.8 Unexpected Robustness to Jailbreaking with Distractors
On safety benchmarks, distractors do not uniformly weaken jailbreak resistance and can increase refusal on harmful prompts without increasing refusals on harmless prompts.
- Refusal Rate is the metric used to evaluate safety on StrongReject and HarmBench with random distractors.
- Distractors sometimes improve jailbreak detection, with Gemini-2.5-Pro refusal rates increasing by 28.6% and 13.3% in distractor settings.The passage attributes these increases to stronger detection and defense against jailbreak attacks, while noting that higher refusal alone does not necessarily indicate stronger safety.
- On harmless inputs, refusal rates decrease or remain nearly unchanged when distractors are added.This pattern argues against interpreting the harmful-prompt refusal increases as a general tendency to refuse more often.
- gpt-oss-120b shows only a small refusal-rate drop with distractors, much smaller than the performance drops reported elsewhere.
C Limitations and Future Works
The paper identifies scope and methodological boundaries while documenting prompt templates and benchmark-construction procedures for generating, checking, filtering, and judging distractors and hints.
- Limitations and Future Works: The study focuses on reasoning models with explicit thinking processes and agentic systems that rely on them.
- Limitations and Future Works: It does not evaluate pretrained base models or purely instruction-tuned models.
- Limitations and Future Works: The experiments are single-modal and do not explore how noisy distractors interact with multimodal inputs.The authors identify multimodal interaction as a direction for future work.
- Prompt and construction procedures: The paper includes prompt templates for hard-negative generation, hint generation, consistency and sanity checks, hint filtering, and LLM-as-a-judge evaluation.
- Prompt and construction procedures: The prompt materials define procedures for generating helpful hints without answers, checking distractor consistency and factual separation, and filtering hints for answer sufficiency.They also specify final-question focus, formal informational style, and structured conversation inputs.
G Qualitative Analyses
Qualitative examples show that distractors can accompany both correct and failed responses, with failures involving irrelevant documents, chat histories, hard negatives, overthinking, and jailbreaking-related behavior.
- Examples and distractor types: The qualitative section includes examples using random documents, random chat histories, and hard negative distractors.
- Synthetic distractors and hints: Synthetic examples include hard negatives, hints, and unrelated background material such as a Taylor Swift discussion and a French candy-distribution solution.
- Correct and failure cases: The examples distinguish correct cases without distractors from failure cases with random-document, random-chat, and hard-negative distractors.
- Failure patterns: Additional failure categories are labeled as distraction by long chat history, overthinking, and jailbreaking.