PaperlayerView exact revision on arXiv

Source-linked AI summary

The Delegation Danger Band: Why Mid-Capability Sub-Agents Over-Trust Inherited Stale State

Jundong Hu, Shekar Ramachandran

arXiv:2610.00041v1cs.MAcs.AI

TL;DR

The paper asks when children follow superseded inherited state despite sufficient current evidence. It compares inheritance policies across capability levels and finds that deference declines with capability, while net harm is concentrated at a mid-capability model.

  • Problem

    Prior work establishes failures to act on updated information, but does not establish where inherited-state harm begins as capability changes.

    Source: §1 · p. 2

  • Method

    A frozen benchmark compares fresh, curated, and full-context forks on tasks solvable from base evidence, measuring outcomes across capability levels.

    Source: §1 · p. 2, §3 · p. 3

  • Results

    Stale-reliance falls with capability across four task families, while net harm is nonmonotone and concentrated in the mid-capability model.

    Source: §1 · p. 2

  • Takeaways & Limitations

    Curated handoff is the most reliable intervention across datasets, while fixed capability thresholds do not transfer reliably.

    Source: §7 · p. 7

    At default difficulty, no model enters the harmful range on the real datasets: HotpotQA offers little shortcut computation, while MuSiQue leaves smaller models too little baseline accuracy to lose.

    Source: §7 · p. 7

Abstract

from arXiv · show

Agent frameworks increasingly delegate work by forking sub-agents; a common default makes the child inherit the parent's full working context. We measure how the effect of inherited state changes with capability, where $C_m$ denotes clean fork-fresh accuracy. We compare 3 inheritance policies: Reset (fork fresh: base evidence only), Selective (curated handoff: + the useful prior conclusion), and Full (implicit fork: + the useful conclusion and $d$ copies of a superseded conclusion) over a same-family ladder (Qwen3 0.6/1.7/4/8B) on a frozen, closed-set, action-scored benchmark. Every task is solvable from the base evidence, so performance loss can be attributed to reliance on stale state. (1) Deference to superseded state falls sharply with measured capability $C_m$ (the slope's confidence interval, CI, excludes zero on every family) across 2 synthetic primitives plus MuSiQue and HotpotQA. (2) On the Qwen3 synthetic ladder, net inheritance harm follows a nonmonotone pattern: a mid-capability model (Qwen3-1.7B) is a statistically significant local minimum of net harm, falling below its fork-fresh baseline ($\Delta(32)=-0.19$ [-0.25, -0.12]) and both neighbors, while the weakest model stays near-neutral and the strongest models stay robust. We call this harmful capability range a danger band. A within-model counting-difficulty sweep shows that the effect depends on model class even at matched $C_m$, and a live parent-to-child fork reproduces the mid-model harm. (3) Curated Selective handoff improves average accuracy over Full on all 3 datasets, largest at the in-band model, while the fixed-threshold capability router fails on the other datasets; a transferable router would need to predict the balance between reuse benefit and stale-context penalty. The benchmark is frozen and version-hashed.

1 Introduction

The paper asks when children follow superseded inherited state despite sufficient current evidence, and how this behavior changes with capability. It introduces a benchmark and reports capability-linked deference, nonmonotone net harm, and curated handoff as an intervention.

Benchmark

  • The benchmark compares RESET, SELECTIVE, and FULL while keeping sufficient base evidence available, and is frozen and version-hashed.This design makes every task solvable from the base evidence.Source: §1 · p. 2

Claim 1

  • Stale-reliance falls with capability across all four task families, with slope confidence intervals excluding zero.Reported Spearman ρ values range from −0.80 to −0.91.Source: §1 · p. 2

Claim 2

  • Inheritance harm is capability-gated and nonmonotone: the mid-capability model is a significant local minimum, while matched-Cm and Llama results indicate a model-class effect.Controls, dose tests, and a live parent-to-child fork support the reported pattern.Source: §1 · p. 2

Claim 3

  • Curated handoff is the robust intervention; tested capability routers do not transfer across datasets.The paper recommends curation rather than a fixed capability threshold.Source: §1 · p. 2

2 Related Work

Prior work studies inherited state, stale memory, and deference to conflicting context, but this paper focuses on how capability and stale-copy dose shape action-level behavior in delegation.

Sub-agent inheritance

  • Cai et al. [2026] examine inheritance as a security boundary across real frameworks, whereas this work tests when sufficient current evidence is overridden by stale inherited state.Ruan et al. [2026] report a systems-level advantage for curated over full context; this work studies stale context as one possible reason full inheritance can fail.Source: §2 · p. 2

Stale memory and knowledge conflict

  • Prior stale-memory, curation, and knowledge-conflict studies motivate this work’s focus on externally inherited superseded state and capability-banded yielding.The paper distinguishes delegation from persistent memory and addresses position effects directly.Source: §2 · p. 2

Scaling of contextual deference

  • Kukreja et al. [2026] report decreasing logit-level entrainment with scale; this paper tests action-level deference against measured capability in delegation.It contrasts that trend with a band-shaped vulnerability pattern rather than monotone robustness.Source: §2 · p. 2

3 The Delegation-Inheritance Benchmark

The benchmark isolates inheritance effects by varying what a child receives while retaining sufficient base evidence and selecting tasks that remain solvable but effortful.

Policies

  • RESET gives the child base evidence E, SELECTIVE adds useful conclusion S, and FULL@d adds d copies of superseded conclusion S′; FULL@0 equals SELECTIVE.The dose d ranges from 1 to 32 copies.Source: §3 · p. 3

Base-evidence layer

  • Every task is solvable from base evidence E, so a lower FULL score than RESET indicates reliance on inherited stale state.RESET is the fresh-fork baseline.Source: §3 · p. 3

Task selection

  • Domains qualify only when every model’s clean-RESET accuracy is 0.40–0.90 and small models benefit from SELECTIVE; aggregation and counting-mode survive.The selection criterion is intended to separate deference from inability.Source: §3 · p. 3

Metrics

  • The tracked contrasts define Cm as RESET accuracy and Δ(d) as FULL@d minus RESET accuracy, alongside stale-reliance and two crossover-dose measures.The crossover measures are the fitted zero-crossing dose and the smallest dose with a significantly negative Δ.Source: §3 · p. 3

Ladder, scoring, and data

  • The benchmark uses Qwen3 0.6/1.7/4/8B, with 14B on the synthetic core, and judge-free closed-set scoring with paired-bootstrap confidence intervals.The synthetic core is frozen v1; MuSiQue and HotpotQA provide external-validity tests.Source: §3 · p. 3

4 Claim 1: Deference to Superseded State Falls with Capability

Across the four task families, stale-reliance declines with measured capability, although the pattern is not uniformly monotone in every family.

Controlled policy comparison

  • Against RESET, FULL@32 raises stale-pick rates for 0.6B and 1.7B but lowers them for 4B and 8B.The respective changes are +0.19/+0.24 and −0.14/−0.13.Source: §4 · p. 3

Error composition

  • At FULL@32, errors are 94–100% deference to the stale value, with distractor errors at most 0.06 and parse failures at 0%.The 1.7B model’s accuracy is approximately 0.47 versus 0.53 for 0.6B, reversing their RESET order.Source: §4 · p. 3

Claim 1

  • Slopes were −1.46 [−1.72, −1.26] (synthetic), −1.15 [−1.45, −0.91] (MuSiQue), and −0.72 [−0.99, −0.49] (HotpotQA), all excluding zero.Spearman ρ values were −0.91, −0.87, and −0.89, respectively; MuSiQue has a small 4B uptick and aggregation a floor plateau.Source: §4 · p. 3, Figure 1 · p. 4

5 Claim 2: Inheritance Harm Is a Capability Danger Band

Inheritance harm is nonmonotone across the Qwen3 ladder: Qwen3-1.7B falls below its fork-fresh baseline, while the weakest model is near-neutral and stronger models remain robust. Matched-difficulty tests and a live parent-to-child fork show that susceptibility depends on model class and appears with parent-generated stale state.

5 Claim 2: Inheritance Harm Is a Capability Danger Band

  • At dose 32, 1.7B is a significant local minimum below both 0.6B and 4B; the strong models never cross zero as dose rises.The paired differences are mid−0.6B = −0.19 [−0.26, −0.12] and mid−4B = −0.34 [−0.42, −0.26].Source: §5 · p. 4
  • ∆(32) = −0.19 [−0.25, −0.12] for Qwen3-1.7B; it is the only model to cross below zero, while 4B/8B/14B stay positive.The 0.6B model is near-neutral: ∆(32) = −0.00 [−0.05, +0.04], with no significant crossing.Source: §5 · p. 4, Figure 2 · p. 5
  • At 1.7B, matched-length neutral filler and repeated-correct notes help, while stale notes harm, ruling out repetition, length, and salience as explanations.The stale condition worsens with dose; paraphrased-stale trends negative but its confidence interval includes zero.Source: §5 · p. 5
  • At doses 64 and 128, 4B and 8B remain positive, so their robustness is not limited to the tested default dose range.At dose 128, ∆ is +0.13 for 4B and +0.14 for 8B.Source: §5 · p. 5
  • At matched Cm, 1.7B is harmed while 4B or 8B remains robust, even though paired models have similar reuse benefits.The counting sweep finds a contiguous in-band region for both small models; results indicate that Cm alone does not determine susceptibility.Source: §5 · pp. 5–6
  • In the Llama sweep, 8B remains robust across counting difficulties, but aggregation can harm it; this ladder indicates a threshold, not a bracketed band.The aggregation result is ∆(32) = −0.14 [−0.27, −0.02] at medium difficulty.Source: §5 · p. 6

5.1 Why Strong Models Remain Robust When Both Notes Are Present

  • When both current and superseded notes are present, strong-model robustness reflects comparing them; without the current note, every tested model follows stale state.Uncorroborated stale-state reliance is 0.69/0.97/0.90/0.94 across the tested models.Source: §5.1 · p. 6

5.2 The Band Appears in a Live Parent-to-Child Fork

  • A live harness-level fork reproduces the pattern with parent-generated notes: 1.7B is harmed, 0.6B stays near-neutral, and 8B is not significantly harmed.Among parents that derive then supersede, 1.7B remains significantly harmed while 4B and 8B become significantly robust.Source: §5.2 · p. 6

6 Claim 3: Curated Handoff Is the Robust Intervention

Curated SELECTIVE handoff improves accuracy over FULL across the three datasets, with the largest lift at the in-band model. The tested fixed-threshold router does not transfer beyond synthetic, and inference-time reasoning does not remove the effect.

6 Claim 3: Curated Handoff Is the Robust Intervention

  • SELECTIVE − FULL is significantly positive on all three datasets: synthetic +0.211, MuSiQue +0.104, and HotpotQA +0.068.The paired bootstrap confidence intervals are [+0.188, +0.236], [+0.076, +0.131], and [+0.048, +0.088], respectively.Source: §6 · pp. 6–7, Table 2 · p. 7
  • Curation lifts accuracy most at 1.7B (+0.50) and 0.6B (+0.30), but only +0.02/+0.03 at 4B/8B.At dose 32, ladder-averaged SELECTIVE accuracy is 0.948 versus 0.737 for FULL.Source: §6 · pp. 6–7
  • The capability router helps synthetic (+0.048), hurts MuSiQue (−0.054), and is null on HotpotQA (+0.004), so the fixed threshold does not transfer.A transferable router would need to predict the balance between reuse benefit and stale-context penalty; tested learned routers do not achieve this.Source: §6 · p. 7
  • Enabling inference-time reasoning on 1.7B did not remove the effect: ∆(32) was −0.17 with thinking versus −0.15 without.The comparison used a 40-scenario control subsample; the reported effective interventions are structural, such as curation or fork-fresh.Source: §6 · p. 7
  • The paper recommends curation where it is near-free, with fork-fresh as a fallback inside the band when stale penalty exceeds reuse benefit.The ladder-average capability router recovers about half of the FULL-to-oracle gap, while oracle-curated SELECTIVE is reported as an upper bound on curation.Source: §6 · pp. 6–7

7 Discussion, Limitations, and Conclusion

The harmful range does not appear on MuSiQue or HotpotQA at default difficulty, and the stale-state effect depends on stale-state position. The authors conclude that curated handoff is the most reliable intervention across datasets, while fixed capability thresholds do not transfer reliably.

7 Discussion, Limitations, and Conclusion

  • Neither real dataset places a model in the harmful range at default difficulty: HotpotQA offers little shortcut computation, while MuSiQue leaves small models little baseline accuracy to lose.The evidence for capability gating therefore comes from the matched-Cm sweep and Llama replication.Source: §7 · p. 7
  • At 1.7B, stale-at-end gives ∆(32) = −0.15, whereas stale-at-start gives +0.14, and the band disappears in the latter condition.The paper models a materialized working-state summary carrying the latest note, rather than full history.Source: §7 · p. 7
  • The conclusion is that susceptibility depends on model class and task difficulty; curated handoff is most reliable across datasets, while fixed capability thresholds transfer unreliably.Scale claims are within-family Qwen3; 14B was tested only on the synthetic core, and the live fork ran in the authors’ harness rather than a production runtime.Source: §7 · p. 7

A Methods Reference

The benchmark scores rotated closed-set actions across reset, selective, and full inheritance policies. It defines capability, benefit, harm, and stale-reliance measures, and reports the model, decoding, and bootstrap setup.

A Methods Reference

  • An instance combines scenario, policy, dose, and rotation; scenarios are the resampling unit, and options are scored by canonical closed-set match averaged over rotations.RESET uses base evidence, SELECTIVE adds the useful note, and FULL@d adds the useful note plus d copies of the stale note.Source: A Methods Reference · p. 9
  • Cm is clean RESET accuracy; B is SELECTIVE minus RESET accuracy, ∆(d) is FULL@d minus RESET, and stale-reliance is choosing the stale action under FULL@d.The crossing-dose measures use a log2-linear fit or the smallest dose whose bootstrap CI upper bound for ∆(d) is below zero.Source: A Methods Reference · p. 9
  • The Qwen3 ladder used greedy non-thinking decoding; paired bootstrap CIs resampled scenarios, with 1,000 iterations and percentile bounds.The synthetic core also included Qwen3-14B; cross-family checks used Llama models.Source: A Methods Reference · p. 9
  • In the summation example, base evidence shows Dining is highest, the useful note says “Dining leads,” and the stale note says “Groceries is highest.”Choosing Groceries despite the available base evidence is the stale-reliance event counted by the benchmark.Source: A Methods Reference · pp. 9–10

B Task Selection: Why the Benchmark Uses Summation and Counting

The benchmark retains summation and counting because they are solvable but effortful under RESET, allowing stale-state deference to be separated from inability. In the external datasets, reliance declines with capability, while evidence for net harm is directional and dataset-dependent.

B Task Selection: Why the Benchmark Uses Summation and Counting

  • RESET accuracy stays in-band for aggregation and counting, and SELECTIVE significantly helps the two smallest models, meeting the task-selection gate.Aggregation RESET accuracy is 0.52/0.74/0.82/0.88 and counting is 0.54/0.58/0.81/0.82 across the model ladder.Source: B Task Selection: Why the Benchmark… · p. 10
  • Domains with below-chance RESET were excluded because a useful note can raise FULL accuracy, confounding stale-context penalties with inability to solve from evidence.Rejected cases include scheduling, best_deal, signed running-sum balance, and budget-breach.Source: B Task Selection: Why the Benchmark… · p. 10

C External-Validity Adapters (MuSiQue, HotpotQA)

  • MuSiQue and HotpotQA were recast into the same policy-and-dose format, with base evidence, one useful conclusion, and repeated stale conclusions.MuSiQue distractors use intermediate-hop answers and supporting titles; HotpotQA maps comparison questions to yes/no and bridge questions to context titles.Source: C External-Validity Adapters (MuSiQue,… · p. 10
  • Across the two external datasets, reliance declines with capability, but only directional evidence supports net harm; the reuse benefit remains positive everywhere.MuSiQue floors small-model RESET accuracy, while HotpotQA is easy/high.Source: Table 3 · p. 10

D Full Numbers Ledger

The ledger shows a significant net-harm minimum at 1.7B, unlike the near-neutral weakest model and positive strong models. It also records capability-linked stale reliance and the policy comparisons underlying the paper’s interpretation.

D Full Numbers Ledger

  • At dose 32, the 1.7B net effect is negative while 0.6B is near zero and 4B, 8B, and 14B remain positive.The full synthetic-core ∆(dose) sequence also shows 1.7B turning negative at dose 8, while 4B/8B/14B stay positive across doses.Source: D Full Numbers Ledger · p. 10
  • The fitted crossing is finite for 0.6B and 1.7B, but 4B and 8B have no finite fitted crossing because ∆ stays positive at every dose.The fitted values are 6.8 [3.9, 13.0] for 0.6B and 6.5 [4.0, 14.2] for 1.7B; only 1.7B has ρ∗ = 32.Source: D Full Numbers Ledger · p. 10
  • ∆(1.7B) = −0.190 [−0.252, −0.122] at dose 32, significantly below both 0.6B and 4B, establishing a local minimum rather than a smooth trend.The paired differences are −0.187 [−0.257, −0.115] versus the weaker model and −0.342 [−0.418, −0.262] versus the stronger model.Source: D Full Numbers Ledger · p. 11
  • The dose-32 decomposition places 1.7B in the danger band where stale-context penalty exceeds reuse benefit, while penalty collapses at 4B/8B.The ladder-averaged intervention ledger reports SELECTIVE’s largest lift over FULL at 1.7B (+0.50).Source: Table 4 · p. 11, D Full Numbers Ledger · p. 11
  • At 1.7B, aggregation drives the significant net harm: ∆(32) = −0.38 [−0.45, −0.30], whereas counting is near zero at −0.00 [−0.10, +0.08].The dose threshold for significant harm is ρ∗ = 4 for aggregation.Source: D Full Numbers Ledger · p. 11
  • Stale reliance at dose 8 has negative capability slopes across aggregation, counting, pooled synthetic, MuSiQue, and HotpotQA; every slope CI excludes zero.The pooled synthetic slope is −1.46 [−1.72, −1.26], MuSiQue is −1.15 [−1.45, −0.91], and HotpotQA is −0.72 [−0.99, −0.49].Source: D Full Numbers Ledger · p. 11
  • At dose 32, SELECTIVE accuracy is 0.948 versus FULL at 0.737, while the capability router reaches 0.785 and the per-instance oracle 0.834.The router recovers 0.048 of the 0.097 FULL-to-oracle gap; its held-out transfer is −0.054 from synthetic to MuSiQue and +0.000 from MuSiQue to synthetic.Source: D Full Numbers Ledger · p. 11

E Behavioral Analysis

In the useful-plus-stale mixture, incorrect FULL actions mostly select the stale value, with stronger models rejecting stale choices more often than weaker and mid models. Controls link dose-related harm to stale meaning, while the stale-only arm shows that uncorroborated stale state can harm every model.

E Behavioral Analysis

  • Among incorrect FULL@32 actions, 0.94/0.97/1.00/1.00 equal the stale value for 0.6B/1.7B/4B/8B, and strong models lower stale picks below RESET rates.Stale-pick rates change from 0.26 to 0.45 for 0.6B and 0.27 to 0.51 for 1.7B, but from 0.17 to 0.03 for 4B and 0.15 to 0.02 for 8B.Source: E Behavioral Analysis · p. 11

F G1: Stale-Copy Controls (Causal)

G G2: STALE-ONLY Arm (Uncorroborated Stale Harms All Models)

  • With stale-only text at dose 32, every model follows the uncorroborated prior; 4B/8B fall to approximately 0.10 despite clean accuracy near 0.85.Robustness in FULL therefore reflects comparing current and stale notes, not autonomous recomputation.Source: G G2: STALE-ONLY Arm (Uncorroborated… · p. 12

H G3–G8: Robustness, Region, Position, Cross-Family

The counting-difficulty sweep shows that net harm depends on model class even at matched clean accuracy: Qwen3-1.7B is harmed where stronger models remain robust. Robustness checks, a live parent-to-child fork, and router tests refine the conditions and practical implications of this pattern.

H G3–G8: Robustness, Region, Position, Cross-Family

  • Across counting difficulty, 4B and 8B maintain reliance ≤0.03 and ∆(32) ≥0, while both small models defer and enter the band where they have accuracy to lose.The held-out sweep measures Cm on a calibration half and ∆/reliance on a disjoint evaluation half; the table marks 95% CIs excluding zero.Source: H G3–G8: Robustness, Region, Position,… · pp. 12–13
  • At Cm ≈0.86, 1.7B has ∆(32) = −0.09 while 4B has +0.14; at Cm ≈0.70, 1.7B has −0.12 while 8B (0.71) has +0.27.Both small models occupy a contiguous in-band region, while 4B and 8B never enter it, even at matched or lower Cm.Source: Table 6 · p. 13
  • Matched-Cm pairs have nearly equal reuse benefit B but opposite ∆ signs, indicating that differential stale-context penalty P—not extra reuse—drives the sign flip.At Cm ≈0.86, B = 0.14 for both 1.7B and 4B; at Cm ≈0.70, B = 0.28 for 1.7B and 0.29 for 8B.Source: H G3–G8: Robustness, Region, Position,… · p. 13
  • No model enters the band on real-data strata: extractive HotpotQA lacks effortful computation, while MuSiQue difficulty floors small-model RESET accuracy below the band.In 2-hop MuSiQue, no model crosses; the real-data band remains directional, with capability gating shown by the difficulty sweep.Source: H G3–G8: Robustness, Region, Position,… · pp. 12–13
  • For 1.7B, ∆(32) is −0.15 with stale copies at the end (frozen), shifts to +0.14 at the start, and remains −0.17 with thinking versus −0.15 without thinking.Source: H G3–G8: Robustness, Region, Position,… · pp. 13–14
  • The matched-Cm pattern replicates in Llama, but its 3-model ladder shows a robustness threshold rather than Qwen3’s bracketed mid-model band.At Cm ≈0.60, Llama-3.2-3B is harmed (∆(32) = −0.03 [−0.07, −0.00]); at Cm ≈0.67, Llama-3.1-8B is robust (+0.33).Source: H G3–G8: Robustness, Region, Position,… · p. 14

I Live Parent-to-Child Fork

  • A live full-context fork reproduces 1.7B harm from dose 1 with an authoritative parent-generated stale note; a brief note without restated totals is neutral.Conditioning on genuine parent supersession strengthens the 1.7B result, but the subset sizes are unmatched, so it is diagnostic rather than a clean cross-model comparison.Source: I Live Parent-to-Child Fork · p. 15, Table 8 · p. 15

J Observable Delegation Router: Transfer Test (Claim 3)

  • No tested observable router transfers across datasets; routing can over-fork floored small models and discard a useful note, whereas curation avoids that problem.The router tests include fixed capability thresholds, learned models, and a per-model deference probe.Source: J Observable Delegation Router:… · pp. 15–16, Table 9 · p. 16

Related papers

Loading 2610.00041v1…