Can LLMs Separate Pasted Artifacts from User Speech? Absorption at Unmarked Prompt Seams

1 INTRODUCTION

• Absorption occurs when a model returns the user’s trailing comment as part of the pasted text being edited, potentially placing unintended content in a message, document, or program.The output can remain fluent and complete the requested edit, making the error easy to miss.Source: §1 · pp. 1–2
• SEAM measures a boundary failure that differs from prior benchmarks, which test whether models respect a source boundary supplied to them.Here, the seam exists in the human interaction but is unmarked in the model’s input.Source: §1 · p. 2
• SEAM is a controlled benchmark of 300 editing examples, each evaluated under six matched conditions, with outputs compared against a clean condition.The conditions vary spacing, boundary markers, mitigation instructions, and whether the comment fits the artifact.Source: §1 · p. 2
• Across 20 models from 10 labs, absorption at a bare-newline seam ranges from 7.7% to 66.7%; blank lines yield no significant reduction in any model, while boundary markers significantly reduce absorption in 19.Source: §1 · pp. 2–3
• Comments that fit the pasted text are absorbed significantly more often in 17 of 20 models.Examples include a code comment typed after code; the comparison also changes comment meaning.Source: §1 · p. 3

Adversarial source confusion

• SEAM studies benign user speech assigned to a returned artifact, whereas adversarial source-confusion work studies attacker instructions or directives to classify and carry out.Related examples include InjecAgent and AgentDojo [Debenedetti et al., 2024], and EDIC.Source: §2 · p. 3

Separation with supplied source structure

• Unlike supplied-boundary methods such as SEP and Spotlighting [Hines et al., 2024], SEAM tests a transition inside one user message that arrives unmarked.The cited methods address using source information after it exists.Source: §2 · p. 3

Distraction, editing, and natural conversations

• SEAM measures content originating outside the artifact that asks for nothing, unlike DIM-Bench’s task-shaped distractors or editing benchmarks for unintended changes to artifact content.DIM-Bench: Hwang et al., 2025; FineEdit and HyperEdit: Zeng et al., 2025b;a.Source: §2 · p. 3

Deployed paste marking

• Paste marking can reduce absorption without removing it; a threshold above 800 characters or two line breaks would leave 100 of SEAM’s 300 examples unmarked.The cited interface marks qualifying pastes; messages composed elsewhere or API, agent, and dictation traffic may lack a paste record.Source: §2 · p. 3

3 SEAM

• Each example asks a model to edit pasted text followed by a comment, and tests whether the comment appears in the returned text across matched conditions.Conditions include no comment, extra spacing, and placing the artifact outside boundary markers.Source: §3 · p. 3

3.1 CONSTRUCTION

• Messages are constructed as an editing instruction, pasted artifact, and user comment, though the model receives them as one block of text.The construction preserves the exact boundary for evaluation, but that boundary is not marked in the input.Source: §3.1 · p. 4
• Absorption requires the comment’s meaning to appear inside the edited text; a distinctive multiword witness phrase helps distinguish it from content already present.A note outside the edited text that says the comment was left out counts as no absorption.Source: §3.1 · p. 4

3.2 MATCHED CONDITIONS

• The six conditions are repeated measures on the same 300 examples; newline versus blank and newline versus boundary change only the seam.Boundary versus mitigation adds an instruction, while newline versus artifact-native changes the comment’s wording and meaning.Source: §3.2 · p. 4

3.3 SOURCES AND SCOPE

• The benchmark draws 50 examples from each of six public datasets spanning code, prose, scientific writing, and technical posts; selection is balanced but not random.A screened audit of WildChat and LMSYS supports occurrence of this message shape in varied tasks, but does not estimate prevalence or model behavior on natural messages.Source: §3.3 · pp. 4–5

• A signal counts only when it appears in the comment-condition artifact and not in its matched clean output; unusable output pairs are excluded.The absorption rate is the proportion of usable pairs classified as absorption.Source: §4 · p. 5
• Content meant for the artifact’s reader counts as absorption, including paraphrases and in-document notes, while user-directed assistant commentary does not.Assistant commentary is removed only when it explicitly acknowledges or discusses editing the comment.Source: §4 · p. 5
• The deterministic cascade checks an exact witness, then its content words, then sentence-level entailment of the comment’s idea.Each label records the tier that fired; the semantic tier uses microsoft/deberta-large-mnli with fixed software versions and no tuned threshold.Source: §4 · p. 5
• Validation constrains false positives but does not measure missed absorption, so the reported rate is detected rather than true absorption.Missed paraphrases remain a validity threat.Source: §4 · p. 5

5.2 DO SPACING AND BOUNDARY MARKERS REDUCE ABSORPTION?

• An added blank line produced no significant reduction in any model, while boundary markers significantly reduced absorption in 19 of 20.All 19 reductions remained significant after Holm correction across the 20 models.Source: Figure 2 · p. 6, §5.2 · p. 7

5.1 ABSORPTION OCCURS IN EVERY TESTED MODEL

• Every tested model absorbed some casual-comment meaning when it followed the artifact on a bare newline.Absorption rates ranged from 7.7% to 66.7%.Source: §5.1 · p. 6

5.3 HOW DOES ABSORPTION VARY ACROSS MODELS AND TASKS?

• Absorption showed no consistent model-size or capability ordering; short-prose rates were 86%–98% versus 0%–2% for code in the same four models.The pooled rates combine newline and blank conditions; the sources also differ in editing task, text length, and output form.Source: §5.3 · p. 7
• A rerun of Opus with a revised-text-only instruction had 2 (0.7%) outputs that included the comment in the edited text, versus 1.3% in the main run after false-positive removal.This further indicates that the result is not solely due to how the scorer extracts edited text.Source: §5.3 · p. 7

5.4 COMMENTS THAT FIT THE PASTED TEXT ARE MORE OFTEN ABSORBED

• Artifact-native comments raised absorption in 19 of 20 models, significantly in 17; increases across those models ranged from 7.7 to 37.0 percentage points.Gemini’s overall rate rose from 29.3% to 64.3%.Source: §5.4 · p. 8
• Because artifact-native comments also changed wording and meaning, this comparison measures overall comment-artifact fit, not writing style alone.The pattern is consistent with linguistic compatibility being one cue models may use to separate pasted text from user speech.Source: §5.4 · p. 8

5.5 DOES THE ADDED INSTRUCTION PRESERVE THE EDITING TASK?

• Adding an instruction outside the markers kept absorption at or below marker-only rates in all 20 models, with no detected absorption in ten, but did not establish edit correctness.A lower absorption rate alone does not show that the requested edit was completed correctly.Source: §5.5 · p. 8
• Under mitigation, 16/50 Opus outputs were syntactically invalid versus 0/50 clean outputs; boundary markers alone yielded 0/50 invalid outputs.Eight mitigation failures became parseable after echoed boundary-marker lines were removed.Source: §5.5 · p. 8

6 VALIDITY

• Clean comparisons, unrelated-example placebos, and targeted reviews check for coincidental matches and errors in counting absorption.Two known false positives remain in Opus’s boundary rate of 2.0%; excluding them gives 1.3% without changing the conclusion.Source: §6 · p. 9
• A blinded review of outputs labeled negative remains incomplete, so reported rates measure detected absorption rather than the true rate.Detection may differ across conditions, affecting both absolute rates and measured differences.Source: §6 · p. 9
• Resampling the 24-comment pool preserves significant boundary reductions in 19 of 20 models, but cross-model differences cannot be attributed solely to the models.Generation-setting deviations varied by model; item-level intervals overstate precision for the two highest-absorption models.Source: §6 · p. 9

7 CONCLUSION

• Every tested model includes comment content in some edited outputs when the boundary is unmarked.A blank line gives no significant reduction, while boundary markers significantly reduce absorption in 19 of 20 models.Source: §7 · p. 9
• Comments that fit the pasted text are absorbed more often in 17 of 20 models, supporting linguistic compatibility as one cue models may use to separate sources.The replacement also changes the comment’s meaning, so the study does not establish which aspect of compatibility causes the increase.Source: §7 · p. 9
• Boundary markers reduce absorption but do not ensure that models keep regions separate or complete the edit correctly.Messages composed elsewhere may arrive without source-boundary information, leaving models to infer it.Source: §7 · p. 9

LIMITATIONS

• SEAM does not establish behavior for other languages, tasks, or later turns, nor population prevalence or natural-message behavior.The WildChat and LMSYS audit supports occurrence only within a screened pool; benign comments do not test credentials, personal information, or private notes.Source: LIMITATIONS · p. 9
• The study tests only one marker format and does not evaluate a deployed interface or comprehensive editing quality.Source: LIMITATIONS · p. 9
• The artifact-native comparison does not isolate writing style, and its examples lacked the model-assisted meaning check used for casual comments.For most models, artifact-native examples were collected in a later run than their newline baseline.Source: LIMITATIONS · p. 10

ETHICS STATEMENT

• Artifacts come from public, licensed corpora with item-level provenance records, with ShareAlike and noncommercial partitions packaged separately.Source: ETHICS STATEMENT · p. 10
• The written comments contain no personal information, and the WildChat analysis uses the released corpus under its terms without republishing full messages.Source: ETHICS STATEMENT · p. 10
• SEAM evaluates boundary markers against unintended inclusion of user text in edited output and develops no attacks.Reported API inference cost is approximately $108, excluding local GPU time and human review.Source: ETHICS STATEMENT · p. 10

REPRODUCIBILITY STATEMENT

• The release includes benchmark builders, item-level provenance and licenses, scorer and regression tests, model configurations, case labels, and scripts that regenerate reported analyses.The semantic tier is pinned to transformers 4.51.3 on CPU, with provider-specific deviations and retry histories recorded.Source: REPRODUCIBILITY STATEMENT · p. 10

A WILDCHAT AND LMSYS ECOLOGICAL OCCURRENCE AUDIT

• The WildChat and LMSYS retrieval screen found 64,229 unique candidates and 20,348 judge-positive messages, but these pipeline counts do not estimate prevalence.In a random sample of 100 judged-positive messages, annotators marked 89 as genuine matches; the audit does not verify paste operations or measure model behavior on them.Source: A WILDCHAT AND LMSYS ECOLOGICAL… · p. 14

B DATASET CONSTRUCTION AND LICENSING

• SEAM samples 50 items per source and retains artifact, reference, source, transformation, and license metadata; comments are checked against the task, artifact, and reference for collisions.All 300 clusters passed mechanical invariants and a construction audit; source-repository licensing takes precedence for CommitPackFT items.Source: B DATASET CONSTRUCTION AND LICENSING · p. 15

C EXACT EVALUATION PROMPTS

• Cases are sent as single user messages without system or developer prompts, and the clean, newline, and blank variants are byte-identical through the artifact’s final byte.The artifact-native condition keeps the newline layout but uses a genre-specific comment pool; its tail realization and proposition wording differ.Source: C EXACT EVALUATION PROMPTS · pp. 15–17

D SCORING CASCADE DETAILS AND VALIDATION

• The scorer compares each treatment with its clean counterpart using lexical witnesses and, for prose only, sentence-level entailment; placebo tests found no real label resting on generic single-token matches.All semantic positives received end-to-end review, and the frozen held-out rules reproduced 24 of 37 eligible flips before a disclosed second development round.Source: D SCORING CASCADE DETAILS AND VALIDATION · p. 19

E SPECIMEN GALLERY

• The specimen gallery shows absorption as verbatim appending, semantic incorporation, artifact-normalized prose, genre-framed prose, and a copied code comment.Examples span prose and code sources and include newline and artifact-native seams.Source: E SPECIMEN GALLERY · pp. 19–20

F DECODING-FAILURE INCIDENT AND SENSITIVITY

• 27 of 1,500 MiniMax M2.5 temperature-zero calls returned empty content after the reasoning channel looped to the provider ceiling.Failures clustered by source item rather than showing a condition-specific effect.Source: F DECODING-FAILURE INCIDENT AND… · p. 20
• After dropping all 27 affected MiniMax pairs, every reported contrast retained its direction and significance.Twenty-five rerun calls completed; two continued looping and were excluded with an explicit reason.Source: F DECODING-FAILURE INCIDENT AND… · p. 20
• The completed-output audit found 13 unusable completions among 29,100 outputs; unusable or length-truncated rows are rejected, with treatment outputs dropped when clean is unusable.All 1,800 Gemini cases ultimately had a final nonempty stop row.Source: F DECODING-FAILURE INCIDENT AND… · p. 20

G FULL RESULT TABLES

• Table 3 reports model-by-condition aggregates for all 20 models, while Table 6 reports source-level casual rates for four focal models.The analysis emits paired tests, confidence intervals, Holm-adjusted p-values, and cluster-level summaries; utility and over-refusal were not independently scored.Source: G FULL RESULT TABLES · p. 20

H COLLECTION WINDOWS, SERVED IDENTIFIERS, AND DESIGN SENSITIVITY

• For six models, the artifact-native increase is confounded with possible serving changes; the median separation between conditions was 38 days, with a maximum of 39 days.For four models, date-pinned identifiers were compared with unpinned aliases; two DeepSeek models lack newline-condition serving records.Source: H COLLECTION WINDOWS, SERVED… · pp. 20–21
• The three largest artifact-native increases—37.0 points for Claude Opus 4.8, 35.0 for Gemini 3.1 Pro, and 33.3 for GPT-5.6-sol—came from models collected on one day under identical served identifiers.Restricting to models without the six identified serving-identity exposures leaves 11 of 14 significant increases.Source: H COLLECTION WINDOWS, SERVED… · p. 21
• At 300 matched pairs, the paired contrast resolves 11.6 percentage points under Holm correction across 20 models; the 7.7-point Gemma-3-4B increase falls below that limit.The three models without a significant artifact-native increase also fall below the resolution limit, so the panel does not establish that they are unaffected.Source: H COLLECTION WINDOWS, SERVED… · p. 21

I REPRODUCIBILITY AND COSTS

• The provider-neutral runner records identifiers, endpoints, decoding parameters, output limits, timeouts, and concurrency; the release includes traces, labels, and table-regeneration scripts.Provider-specific exceptions are retained as row-level metadata and left unnormalized.Source: I REPRODUCIBILITY AND COSTS · p. 21, Table 7 · p. 22