PaperlayerView exact revision on arXiv

Source-linked AI summary

CAPTURE: Disentangling Preference Drift from Memory Poisoning in Personalized LLM Agents

S M Asif Hossain, Ruksat Khan Shayoni, Md Kishor Morol

arXiv:2609.02265v1cs.LG

TL;DR

Personalized agents must distinguish genuine preference drift from temporary context shifts, ambiguity, or memory poisoning. CAPTURE models authenticity with continuous-time belief tracking, a layered memory ledger, clarification, and counterfactual audits. On held-out episodes, it combines lower fixed-policy poisoning success with higher genuine-update adherence than Provenance-only, while adaptive attacks remain a limitation.

  • Problem

    Conflicting memory updates can reflect genuine preference changes, contextual variation, ambiguity, or adversarial input, and recency and provenance alone do not resolve this authenticity ambiguity.

    Source: §1 · pp. 1–2

  • Method

    CAPTURE treats authenticity as a latent variable and combines continuous-time belief tracking, a multi-timescale ledger, uncertainty-triggered clarification, and counterfactual audits of cited memories.

    Source: §1 · p. 2

  • Results

    11.5% fixed-policy poisoning success and 83.5% genuine-update adherence compare with 20.0% and 74.1% for Provenance-only, while the matched-supervision comparison leaves 2.2 points of win rate and 4.4 points of poisoning attributable to architecture.

    Source: §1 · p. 2, §5 · p. 7

  • Takeaways & Limitations

    Explicitly inferring preference authenticity can improve personalization and robustness together, although under adaptive attack the advantage over a provenance filter is not reliably separated.

    Source: §9 · p. 9

    D-PREFGUARD is synthetic and validated on a 300-episode subset, so its absolute numbers are relative comparisons rather than deployment estimates; 40 participants support an effect estimate but no subgroup claim.

    Source: §8 · p. 9

Abstract

from arXiv · show

Personalized language agents use persistent memory to adapt to users over time, but the same mechanism creates an attack surface. When new information conflicts with stored preferences, an agent must distinguish genuine preference drift from temporary context shifts, ambiguity, or adversarial memory poisoning. We formulate this problem as a continuous-time partially observable decision process over a latent user state and show why rules based only on recency and provenance are insufficient. CAPTURE addresses this ambiguity with a neural differential-equation belief tracker, a multi-timescale memory ledger, uncertainty-triggered clarification, and counterfactual auditing of cited memories. On 480 held-out episodes from 96 users, CAPTURE achieves a 71.5% win rate, compared with 69.3% for an identically supervised baseline and 66.1% for the strongest heuristic baseline. It limits fixed-policy poisoning success to 11.5% while accepting 83.5% of genuine preference updates. Under an adaptive attacker with access to the released weights, attack success rises to 24.7%, exposing a real adaptation-security tradeoff. We further evaluate the frozen system zero-shot on an independently constructed benchmark and replay longitudinal interaction histories from 40 users collected over two to three weeks. These results suggest that modeling preference authenticity explicitly can improve both personalization and robustness in memory-augmented LLM agents.

1 Introduction

Persistent memory helps agents personalize but makes genuine preference changes difficult to distinguish from context shifts, ambiguity, and poisoning. CAPTURE models authenticity explicitly, combining belief tracking and memory controls; its held-out results show a tradeoff between resisting attacks and accepting legitimate updates, with adaptive attacks remaining a challenge.

Motivation

  • Persistent memory supports personalization, but conflicting information may reflect genuine drift, a domain-specific preference, sarcasm, or an adversarial payload.These cases can produce the same evidence within a single turn.Source: §1 · p. 1

Problem

  • Personalization systems that treat history as ground truth are steerable, while provenance-based defenses can reject legitimate revisions arriving through legitimate channels.The paper names this tension the preference-authenticity ambiguity.Source: §1 · p. 1

Approach

  • CAPTURE tracks a continuous-time belief, separates stable, contextual, and transient memories, asks when action uncertainty is high, and audits cited memories by removal and re-decoding.Its safety selector sits outside the personalization loop and cannot be moved by the ledger.Source: §1 · p. 2

Held-out results

  • 11.5% fixed-policy poisoning success and 83.5% genuine-update adherence compare with 20.0% and 74.1% for Provenance-only; CAPTURE also admits 8.9% of benign non-updates versus 19.6%.A matched-supervision baseline leaves 2.2 points of win rate and 4.4 points of poisoning attributable to architecture rather than labels.Source: §1 · p. 2

Evaluation scope

  • The frozen system is also evaluated zero-shot on HorizonBench and in a two-to-three-week study with 40 participants; an adaptive attacker doubles poisoning success, and the system costs roughly 630 ms per turn.Under adaptive attack, a provenance filter is marginally more secure of the two.Source: §1 · p. 2

2 Problem Formulation

The paper models preference updates as inference over an unobserved user state, with safety constrained separately from revisable preferences. It argues that recency and provenance alone cannot resolve authenticity, while full history and clarification can improve decisions under stated conditions.

Setting

  • The user state contains stable values, contextual preferences, and transient goals; the agent observes events and origin labels but must maintain a belief over the latent state.Only stable values are described as close to constant.Source: §2 · p. 2

Objective

  • Dynamic regret fits a moving comparator, while the safety constraint remains outside the objective because safety is not a preference the user may revise.Source: §2 · p. 2

Adaptation-security frontier

  • Figure 1 places methods by legitimate-update acceptance and poisoning resistance; CAPTURE lies upper right, while same-origin contamination accounts for 50.7% of its successful attempts.Bars are user-level bootstrap 95% intervals over 132 genuine updates and 192 poisoning attempts.Source: Figure 1 · p. 3

Why a fixed rule is not enough

  • Recency and provenance are cheap write-time features, but feasible attacks can match genuine revisions on either feature, limiting rules that read only those signals.Source: §2 · p. 3

Formal results

  • For a fixed adversary, conditioning on full history rather than recency and provenance never increases achievable error and strictly decreases it under the stated likelihood-ratio condition.A clarifying question beats every no-query rule when its cost plus channel error is below the no-query Bayes error.Source: §2 · p. 3

Interpretation

  • The known-adversary bound is attained by the likelihood-ratio test, but the paper calls the worst-case result maximin and does not claim it is minimax.The authors identify formalizing preference-authenticity ambiguity as the novelty, rather than the underlying statistical decision-theory tools.Source: §2 · p. 3

3 CAPTURE

CAPTURE converts incoming events into scoped preference hypotheses, updates an authenticity belief, and stores claims in a layered ledger. Uncertainty can trigger clarification, while response selection remains safety-bounded and cited memories are audited for causal influence.

3.1 Preference-hypothesis extraction

  • A schema-constrained extractor turns events into structured preference tuples, including claim, direction, scope, timescale, confidence, and provenance, and is trained with a penalty for abstaining on non-preference events.Roughly seven in ten events carry no preference content, making abstention important to avoid a ledger of noise.Source: §3.1 · pp. 3–4

3.2 The authenticity gate

  • The continuous-time gate evolves between irregularly spaced events and predicts six actions; it asks when action-distribution entropy exceeds a validation-set threshold tuned for at most one clarification per twelve interactions.The six actions are retain, add, narrow scope, revise, quarantine, or ask; across a nine-day gap, transient belief decays substantially while stable belief barely moves.Source: §3.2 · p. 4

3.3 Multi-timescale ledger

  • Ledger nodes form a support-and-contradiction graph across stable, contextual, and transient layers, with confidence decaying according to a learned modulation and layer-specific rates.Stable claims require repeated high-confidence evidence to overwrite, while narrow claims can be scoped rather than revising a broader preference; quarantine keeps claims non-retrievable until corroboration or eviction.Source: §3.3 · p. 4

3.4 Safety-bounded selection and causal audit

  • The selector scores sampled responses for personalized utility and safety risk, with a calibrated refusal when all candidates violate the fixed safety constraint.For each cited memory, counterfactual re-decoding measures utility shift; citations that do not change the response are dropped, and repeated non-influential nodes are down-weighted, at the cost of an extra decode.Source: §3.4 · pp. 4–5

4 The D-PREFGUARD Benchmark

D-PREFGUARD is designed to test whether systems can distinguish legitimate preference change from ambiguity and contamination while preserving personalization. Its episodes cover multiple update and attack conditions, and its scoring and split procedures address evaluation comparability and leakage concerns.

Benchmark motivation

  • D-PREFGUARD fills a gap between personalization benchmarks without attacks and injection benchmarks with static users, testing whether defenses block poisoning without blocking legitimate change.Source: §4 · p. 5

Benchmark construction

  • The benchmark contains 2,400 episodes across five tracks covering stationary behavior, four forms of genuine drift, benign ambiguity, three contamination families, and conflicts between personal utility and safety.Same-origin contamination uses user-mediated laundering, so an adversarially written claim arrives with the coarse user channel label; three annotators validated 300 episodes at Krippendorff’s α ≥0.70.Source: §4 · p. 5

Scoring

  • Win rate is a blinded pairwise comparison against the unpersonalized backbone, while regret uses a separate reward model and shared frozen pool; safety risk is scored separately from the ledger.The authors omit a calibration column because CAPTURE and baselines expose incomparable quantities.Source: §4 · p. 5

Splits and leakage

  • Training and test use disjoint synthetic users, topics, templates, and attack realizations, with one generator family held out, but these controls do not fully rule out fitting the episode generator.Table 1 reports means over 480 held-out episodes from 96 users, across two response backbones and three seeds.Source: §4 · p. 5, Table 1 · p. 6

5 Experiments

CAPTURE improves the fixed-policy security–adaptation balance, while experiments separate its gains across drift handling, architecture, components, and attacker settings. The advantage is strongest against fixed attacks and narrows under adaptive attack.

Setup

  • The experiment uses three training seeds and paired user-level bootstrap intervals, with shared generation and selection settings across methods.The two main comparison baselines are Provenance-only and StateMem, an explicit supersession tracker without an authenticity check or timescale structure.Source: §5 · p. 6

Q1. The tradeoff is not fixed

  • 71.5% win rate, 11.5% poisoning, and 83.5% adherence put CAPTURE ahead of StateMem on win rate and Provenance-only on all three reported trade-off metrics.CAPTURE also has 8.9% false admission; Recency RAG adheres more but has higher poisoning and false-admission rates.Source: §5 · p. 6

Q2. Where the difference comes from

  • CAPTURE ties Recency RAG on abrupt drift but separates on recurring drift and context switches, selecting scope at 71% of changepoints versus StateMem’s 4%.Provenance-only performs better on indirect injection, 4.8% versus CAPTURE’s 7.0%, but worse on same-origin contamination, 43.6% versus 17.5%.Source: §5 · p. 6

Q5. What happens when the attacker adapts, or is someone else?

  • The adaptive attacker raises CAPTURE’s attack success from 11.5% to 24.7%; under that attack, Provenance-only’s 22.1% is not reliably separated from CAPTURE’s 24.7%.On 240 independently authored attacks, CAPTURE reaches 18.3%, still the lowest tested; Table 2 summarizes security under three attackers.Source: Table 2 · p. 7, §5 · p. 7

Q3. What each component is worth

  • Removing the gate costs 22.0 points of poisoning resistance, while timescale separation is worth 5.4 points of adherence and removing the audit lowers evidence F1 from 0.79 to 0.58.Removing the safety bound raises adherence by 4.0 while tripling safety attack success; probing contributes 3.6 adherence points.Source: §5 · p. 7

Q4. Supervision or architecture?

  • The identically supervised Transformer reaches 69.3% win rate and 15.9% poisoning, leaving CAPTURE advantages of 2.2 win-rate points and 4.4 poisoning points.The two systems’ macro-F1 scores, 0.71 and 0.68, do not differ significantly; the reported architectural contribution lies in the ledger and temporal update.Source: §5 · p. 7

Q6. Transfer across backbones

  • Across Qwen3-8B and Llama-3.1-8B, the continuous gate leads the discrete gate by 2.4 win-rate points on Qwen3; explicit elapsed-time input recovers about 55% of that gap.The results frame continuous time as an inductive bias, not a requirement.Source: §5 · p. 7

6 Leaving the Benchmark Behind

The frozen system is tested on an independently constructed simulated benchmark and on replayed natural histories, with different limits on what each setting tests. Its tracking advantage persists but attenuates, while the settings do not establish poisoning robustness on independently generated attacks.

Scope

  • The replay tests transfer to natural histories, not independently generated attacks, because contamination is introduced offline by the authors.HorizonBench also contains no attacks, so neither setting tests both natural or independent histories and independently generated contamination.Source: §6 · p. 8

Evaluation settings

  • HorizonBench is an independent, zero-shot benchmark of simulated six-month preferences without contamination; its non-interactive setting maps clarification to quarantine without updating.The 40-person study replays frozen histories with six controlled attacks per participant, but stored annotations answer clarification with zero answer error.Source: §6 · p. 8

Results

  • CAPTURE leads StateMem by 5.4 win-rate points on D-PREFGUARD and 4.5 on replayed histories, while HorizonBench contradiction-resolution accuracy is 0.72 versus 0.65 for StateMem.On HorizonBench, Recency RAG leads belief-revision accuracy, 0.79 versus CAPTURE’s 0.78; the comparison supports transfer of preference tracking, not poisoning robustness.Source: §6 · p. 8

7 Related Work

Prior personalization and memory work studies individual preferences and long-horizon retrieval, but generally assumes stored records are trustworthy. Injection defenses address attacks on retrieved content, while treating the user as static.

Personalizing language models

  • Personalization and long-horizon memory research models individual preferences and manages memory capacity, but does not ask whether a memory should have been written.The cited approaches include profiles, user edits, system-message generalization, paging, decay, and reflection.Source: §7 · p. 8

Injection, poisoning, and safety under adaptation

  • Injection defenses separate instructions from data or enforce capability boundaries, but the cited approaches treat the user as static.The paper’s Provenance-only baseline is a memory-layer proxy rather than a reimplementation of any one defense, and it does not address same-kind user and attacker sentences as CAPTURE does.Source: §7 · p. 8

8 Limitations and Falsification

The paper states scope limits on its theorem, threat model, modality, tuning, and evaluation data, then reports five predeclared falsification criteria. Its external-validity check passes only narrowly.

Limitations

  • Theorem 2 applies only to σ(φ)-measurable rules under an adversary who sees the transcript; CAPTURE is text-only, and its clarification budget is tuned on the authors’ data.D-PREFGUARD is synthetic and validated on 300 episodes, so its absolute numbers are relative comparisons rather than deployment estimates; 40 participants support no subgroup claim.Source: §8 · p. 9

Falsification

  • Five predeclared criteria test theorem strictness, provenance-only performance under same-origin contamination, recurrence, influence AUC, and external validity; none refutes the claims, but external validity passes narrowly.The criteria and a consistency check are reported in Appendix C.Source: §8 · p. 9

9 Conclusion

CAPTURE frames memory poisoning and preference drift as one authenticity problem, but its adaptive-attack advantage over a provenance filter is not reliably separated. The conclusion also reports AI-use, ethics, and reproducibility practices.

9 Conclusion

  • Most of the gain comes from supervised temporal tracking, which a matched Transformer also reaches; the ledger and continuous-time update add a smaller increment that survives on independently built data.Adaptive attack remains open, and the advantage over a provenance filter is not reliably separated.Source: §9 · p. 9

AI use statement

  • AI tools generated evaluation episodes and assisted implementation, data cleanup, drafting, and reference formatting; the authors report human validation, testing, reference checks, and independent verification of Section 5 numbers.Theoretical modeling, research hypotheses, methodology, experiments, and results interpretation were not developed with generative AI.Source: AI use statement · p. 9

Ethics statement

  • Releasing poisoning templates lowers attack-mounting costs, so the authors use tiered access: the harness, defense, and drift tracks are public, while the payload generator is available to affiliated researchers on request.The authors justify release because adapted attacks are already public and defenses need attacks for evaluation.Source: Ethics statement · p. 9
  • The reference implementation excludes protected-attribute hypotheses and makes ledger nodes user-visible, revisable, and deletable; its separate safety constraint cannot be lowered through user or attacker writes.Ledger contents are stored locally under pseudonymous identifiers, without cross-user sharing.Source: Ethics statement · pp. 9–10
  • Three informed annotators were compensated at local research rates for benchmark human validation.Source: Ethics statement · p. 10

Reproducibility statement

  • Appendices document the formal setting, proofs, architecture, benchmark construction, and evaluation protocols; supplementary materials include source code, construction scripts, and trained adapter weights for public release.Source: Reproducibility statement · p. 10

A Formal Setting, Theorems, and Proofs

The appendix formalizes update acceptance as testing genuine against adversarial claims under restricted or richer history views. It derives a testing lower bound, conditions under which fuller histories help, and a clarification rule, while qualifying what the empirical distance estimates establish.

A.1 Setting and notation

  • The restricted view φ uses elapsed time since a contradicted belief was last corroborated and the incoming event’s channel; analyzed rules may use only that view.The formal setup also defines measurable acceptance rules and the laws of genuine and adversarial histories.Source: §A.1 · pp. 14–15

A.2 Assumptions

  • A genuine update requires an expressed or subsequently confirmed preference change that an oracle ledger would add, revise, or rescope; the attacker sees the transcript but not the private ledger.The attacker knows the released architecture and weights but cannot modify weights or directly impersonate an authenticated user.Source: §A.2 · p. 15

A.3 Part 1. The testing lower bound

  • For any restricted information view G, worst-case FUR + RRL is at least supα inf_d[FUR + RRL] = 1−δG, a maximin lower bound rather than an established minimax value.The stated bound is not claimed to be exact because the feasible adversary set is not assumed convex or compact.Source: §A.3 · pp. 15–16

A.4 Part 2. Conditioning on the history

  • Conditioning on full history cannot worsen achievable error versus a coarser view, and it strictly helps when the conditional likelihood ratio changes sign within a positive-measure set of views.Events with identical elapsed time and channel can differ in belief revisions, repeated patterns, or intervening corroboration.Source: §A.4 · pp. 16–17

A.5 Part 3. Clarification

  • With clarification cost κ and symmetric-channel error ε, the restricted policy asks when no-query error exceeds κ + ε; its fixed-accuracy channel assumption does not establish real clarification accuracy.The empirical clarification measurements, rather than the theorem, are relevant to real clarification performance.Source: §A.5 · pp. 17–18

A.6 Estimating the two distances

  • Distance estimates use one realized adversary, not the infimum over feasible adversaries, and a matched split changes the estimand to a conditional distance averaged over strata.Because turn index partly determines elapsed time, the matched distance is expected to be smaller than the deployment distance.Source: §A.6 · p. 18
  • Binning the restricted view yields a population quantity no greater than TVφ, while the finite-sample plug-in estimator is upward biased; these effects are distinct.Neither effect is concealed by the reported quantities.Source: §A.6 · p. 18
  • The full-history discriminator supplies a one-sided lower bound, not an estimate; its failure to separate the laws certifies nothing, and the reported gap is only indicative.A valid lower bound on TVH − TVφ would require an upper bound on TVφ, which the binned plug-in does not provide.Source: §A.6 · pp. 18–19

B Implementation Details

CAPTURE’s implementation combines a gated, multi-timescale memory pipeline with separate models and protocols for selection, safety, auditing, and evaluation. Its reported per-turn cost is higher than StateMem’s token cost but lower than Full History’s.

B Implementation Details

  • Only the gate promotes hypotheses to the ledger; the selector reads it, while post-decode auditing down-weights uninfluential citations for future retrieval.The ledger uses stable, contextual, and transient layers, with specified corroboration and overwrite conditions.Source: Figure 2 · p. 19, B Implementation Details · p. 20
  • The extractor uses Qwen2.5-3B with LoRA, while the 256-dimensional gate uses a neural differential equation and a GRU update.The gate’s entropy threshold was set to keep validation clarification at no more than one turn in twelve; Table 3 covers extractor performance and row-normalized gate-action confusion.Source: B Implementation Details · p. 19, Table 3 · p. 21
  • Gate labels come from track metadata and oracle update rules; event-level labels were not human-validated during construction.Clarification labels use only current-event ambiguity and oracle state, without future event text.Source: B Implementation Details · p. 20
  • Stable, contextual, and transient memories use separate decay rates, selected on validation and then frozen.Jointly learning the rates collapsed them toward 0.08 and reduced acceptance by 3.1 points and win rate by 1.9 points.Source: B Implementation Details · p. 20
  • Response selection uses best-of-8 scoring under a shared safety threshold, with a learned preference reward model and post-decode influence auditing.The safety scorer’s threshold was calibrated for at least 95% harmful-response recall; the preference reward model’s held-out pair accuracy is 79%.Source: B Implementation Details · p. 20
  • The blinded GPT-4.1 judge matched human majority on 87.4% of 600 comparisons; full evaluation took approximately 340 GPU-hours.Training used four A100 80GB GPUs; Table 3 reports extractor held-out performance and row-normalized gate-action confusion.Source: B Implementation Details · pp. 20–21, Table 3 · p. 21
  • Dynamic regret uses a common pool of 32 oracle-conditioned candidates, while evidence F1 and influence AUC use independently annotated necessary evidence.The evaluation reward model is used only for regret; the finite candidate pool approximates the comparator, and five nodes are scored per response for influence metrics.Source: B Implementation Details · pp. 20–21
  • CAPTURE uses 17% more tokens per turn than StateMem and 43% fewer than Full History.It uses 2,480 ms and 3,850 tokens per turn.Source: B Implementation Details · p. 21

C Falsification Results and Secondary Metrics

The falsification results probe whether CAPTURE’s gains depend on provenance, static summaries, or its data generator, and test an implication of the formal decision bound. Results support the method on same-origin contamination and external evaluation, while the bound-related evidence remains qualified.

F1

  • 43.6% attack success for Provenance-only versus 17.5% for CAPTURE on same-origin contamination, with a significant gap (p < 0.001).The passage identifies this as the criterion whose failure would make the learned gate unnecessary.Source: C Falsification Results and Secondary… · p. 21

F2

  • 0.41 recurring regret for Static Summary versus 0.27, while removing timescale separation yields 0.32.The passage uses this comparison to assess whether static summaries match the multi-timescale ledger on recurrence.Source: C Falsification Results and Secondary… · p. 22

F3

  • 0.718 AUC (user-bootstrap interval [0.684, 0.751]) for |Inf(n)| predicting membership in the independently annotated evidence set.The target is independently annotated rather than defined by thresholding |Inf(n)|, avoiding a circular measure.Source: C Falsification Results and Secondary… · p. 22

F4

  • The external-data and real-user advantage is narrow: the win-rate margin over StateMem falls from 5.4 to 4.5 points, and CAPTURE does not lead on HorizonBench belief revision accuracy.On HorizonBench, CAPTURE leads only on contradiction resolution.Source: C Falsification Results and Secondary… · p. 22

F5

  • 12 of 32 occupied restricted-view cells (37.5%) contain both estimated conditional likelihood-ratio signs, and 12 cells reject the binned degeneracy null after Holm correction.This is empirical evidence consistent with Equation 18 for the realized adversary, not proof of the population condition; the test uses a learned cross-fitted discriminator, binning, and finite samples.Source: C Falsification Results and Secondary… · p. 22

C1

  • StrongREJECT attack success is 8.9% for CAPTURE versus 11.5% for Provenance-only, with the same method ordering as HarmBench and all values within 1.4 points.The matched-split bound check is a harness consistency test, not evidence for the method; its non-negative bootstrap differences are required by the inequality and do not establish population equality or optimality.Source: C Falsification Results and Secondary… · pp. 22–23

D Benchmark Construction and Study Protocol

The section describes D-PREFGUARD and a longitudinal user study, then tests CAPTURE on independent labels, external evaluations, and attacks. It also details uncertainty in interpreting some comparisons and the statistical procedures used.

D Benchmark Construction and Study Protocol

  • D-PREFGUARD has 2,400 episodes across five tracks, with 480 held out; test episodes use a generator family excluded from training and development.The benchmark seeds preference profiles from PRISM, PersonalLLM, and LaMP; its tracks include stationary behavior, four drift shapes, benign noise, contamination, and safety conflicts. Test uses Llama-3.1-70B-Instruct, while training and development use Qwen2.5-72B-Instruct and Mixtral-8x22B-Instruct.Source: D Benchmark Construction and Study… · p. 23
  • Forty participants completed four to six sessions over two to three weeks; replay used identical frozen histories and injected six controlled attacks per participant offline.Participants labeled surfaced preferences, but extractor misses are absent from the adherence denominator, so adherence is not recall; replay clarification answers come from participant annotations and are oracle-assisted relative to those annotations.Source: D Benchmark Construction and Study… · pp. 23–24
  • CAPTURE’s satisfaction score was 4.1 (participant-clustered 95% interval [3.9, 4.3]) versus StateMem’s 3.8 [3.6, 4.0].The blinded within-participant ratings were collected in a separate task, with method identity hidden and presentation order randomized.Source: D Benchmark Construction and Study… · p. 24

E Independent Labels, Independent Attacks, and Query-Matched Baselines

  • On 720 independently annotated test events, CAPTURE’s action macro-F1 against human labels is 0.71 [0.67, 0.75]; the program labels agree with human judgments 83.6% of the time.The events cover all 96 test users and are stratified by track and action, so the agreement figures are not prevalence-weighted accuracy.Source: E Independent Labels, Independent… · pp. 24, 26
  • Under independently authored attacks, CAPTURE’s success rate is 18.3%, and the method ordering is preserved across the five evaluated methods.Twelve external red-teamers authored 240 attacks; intervals resample both red-teamers and target users because attacks are clustered on both axes.Source: E Independent Labels, Independent… · pp. 25–26
  • A released-weight paraphrase-search attack raises CAPTURE’s response-level success to 24.7%; against Provenance-only, CAPTURE’s 24.7% is not reliably different from 22.1% (p = 0.29).The attacker uses a local copy of released weights and surrogate hidden-state particles, not the deployed gate’s logits or realized state.Source: E Independent Labels, Independent… · pp. 25–26
  • On HorizonBench, the frozen Transformer reaches 0.77 belief revision accuracy versus CAPTURE’s 0.78, while CAPTURE’s contradiction resolution is 0.72 versus 0.68.The architectural gain transfers significantly on contradiction resolution and replay win, but not on belief revision accuracy or replay poisoning; the authors characterize the result as modest.Source: E Independent Labels, Independent… · p. 26

F Statistical Protocol

  • CAPTURE’s replay win advantage over StateMem is +4.5 points (95% interval [1.0, 8.0], p = 0.014).The paired comparison is reported alongside a satisfaction advantage of +0.30 points (95% interval [0.10, 0.50], p = 0.004); replay poisoning is 11.5% for CAPTURE versus 20.0% for Provenance-only in the headline comparison.Source: F Statistical Protocol · p. 27

H Failure Analysis

CAPTURE’s failure analysis reports strong context-switch handling and quarantine-based blocking, while identifying same-origin and slow attacks as weaknesses. It also breaks results down by contamination family and examines transfer across backbones and out-of-domain settings.

H Failure Analysis

  • 71% of context-switch changepoints receive the correct scope action, versus 4% for StateMem; quarantine plus non-corroboration resolves 58% of blocked poisoning attempts.The scope statistic and regret figures are separate measurements, not one decomposition.Source: H Failure Analysis · pp. 27–28
  • 0.27 common-pool dynamic regret for the full system rises to 0.42 without the gate; Table 6 reports component-ablation deltas against the full system.Positive changes in regret and poisoning attack success rate are worse; positive changes in genuine-update adherence are better.Source: Table 6 · p. 28
  • 50.7% of successful poisoning attempts are same-origin writes, while 21% are slow attacks that the authors do not claim to solve.Missed legitimate updates are dominated by weak evidence, such as indirect signals of change.Source: H Failure Analysis · p. 28

I Drift and Contamination Breakdown

  • Table 7 separates results by drift shape and contamination family; provenance filtering wins on indirect injection but fails on same-origin attacks.Each method’s mean over the three attack families reproduces its Table 1 Poison ASR under equal family weights.Source: Table 7 · p. 28

J Cross-Backbone and Out-of-Domain Results

  • A discrete elapsed-time gate recovers 1.3 of the 2.4-point win-rate gap on Qwen3 and 1.4 of 2.5 on Llama-3.1, roughly 55% of the continuous-time advantage.The out-of-domain evaluation holds out whole attack templates and drift schedules, rather than individual episodes.Source: Table 8 · p. 29
Loading 2609.02265v1…