PaperlayerView exact revision on arXiv

Source-linked AI summary

Context Injection and Long-Horizon Reliability: Separating Duplicate Recognition, Local Processing, and Counter Tracking

Thomas Serval

arXiv:2610.20633v1cs.CL

TL;DR

End-task success and horizon length can mix distinct sources of long-horizon failure, so this paper scores recognition, local processing, and counter tracking separately at each step. On a 400-step ledger task, it finds late-rising duplicate-recognition errors and strong counter disruption from injected context, with counter behavior tied to response history and responsive to repeated exact reminders.

  • Problem

    End-task success and horizon length mix failures in long-distance recognition, current-input processing, and carried values, leaving practitioners without evidence about which component fails first or whether added context is safe.

    Source: §1 · p. 1

  • Method

    The paper scores duplicate recognition, local processing, and counter tracking component by component across a 400-step ledger task with the model’s own prior answers re-injected into context.

    Source: §1 · p. 1, §3 · p. 3

  • Results

    Duplicate-recognition errors rise late while the counter remains error-free without injection, and irrelevant blocks disrupt the counter far more than local processing; under disruption, an exact repeated oracle reminder yielded no counter errors in 20 seeds.

    Source: §1 · p. 2, §6 · p. 12

  • Takeaways & Limitations

    The results show that aggregate or exclusive error labels can hide component differences, and that tested context additions should be evaluated for their effects on both duplicate recognition and carried state.

    Source: §7 · p. 12

    The evidence is limited to one Qwen3 model family in non-thinking mode; thinking mode may change the picture.

    Source: §8 · p. 13

Abstract

from arXiv · show

Long-horizon failures of language models are usually measured as end-task success or as a horizon length. We instead score, step by step, three components of a 400-step ledger task in which every step is easy in isolation and the model's own answers are re-injected into its context: recognising a record already seen 5 to 300 steps earlier, processing the current record locally, and writing a counter incremented at every step. On Qwen3-8B (non-thinking, 20 seeds, replicated on a second machine and backend), with every step scored component by component, two results hold. First, duplicate-recognition errors rise late in the episode -- from 0.0019 to 0.011 per step at risk across step 200 -- while the counter makes no error in 8,000 steps and local processing is descriptively stable; the rise combines long-distance recall errors and rising false alarms. Second, a block of irrelevant content inserted before each step makes the counter fail in 20 of 20 seeds on each machine, against none without it, while its effect on local processing is much smaller and not distinguishable from none. Three pre-registered follow-ups probe the counter. Its value depends on the value present in the response history: a corrupted value persists without correction in every seed, and an exact external reminder, repeated before each message, re-aligns it within one to two steps. Under the irrelevant block, no counter error was observed when an exact compact reminder of the state, supplied externally by an oracle, preceded each message (0 of 20 seeds with an error, against 15 without it), and this reminder outperformed a length-matched neutral text; whether a single reminder suffices was not conclusive, and the absence of damage to the other components was not established. An aggregate or exclusive error classification can hide the difference we report.

1 Introduction

The paper separates long-horizon failure into duplicate recognition, local processing, and counter tracking because end-task success and horizon length mix these components. It reports late increases in duplicate-recognition errors and strong counter disruption from injected context, while also describing counter follow-ups and secondary interventions.

1 Introduction

  • The benchmark scores three components separately at each step and reads their error probability as a hazard conditional on no earlier error of that component.Carried state is operationally a value rewritten from the model’s previous output; duplicate recognition means answering DOUBLON exactly when the code appeared earlier.Source: §1 · pp. 1–2
  • Duplicate-recognition errors rise with the horizon, while the counter makes no errors and local processing is descriptively stable.The recognition rise reflects long-distance recall errors and false alarms on new records, not loss at constant distance.Source: §1 · p. 2
  • Irrelevant content before each step makes the counter fail in every seed, while its effect on local processing is much smaller and not distinguishable from none.The component-wise scoring prevents one error category from masking another.Source: §1 · p. 2
  • Listing seen codes partially lowers duplicate-recognition errors, while repeating rules is followed by errors in every seed within 25 steps.Across Qwen3 4B–32B, duplicate-recognition hazard falls from 8B to 14B to 32B; the 32B tends to fail all-or-nothing.Source: §1 · p. 2

2 Related work

Related work measures long-horizon execution, context degradation, and drift using different tasks and units of analysis. This paper distinguishes itself by scoring several components within the same trajectories and testing injected blocks against irrelevant content.

Long-horizon execution

  • Sinha et al. (2026) report decaying per-step accuracy and history-error self-conditioning, whereas this paper jointly scores components, varies recognition distance, and tests injected blocks against an irrelevant-content control.Their running sum requires lookup plus two-digit addition per turn, unlike this paper’s +1 counter; the counter’s stability alone is not treated as evidence beyond plain continuation.Source: §2 · p. 2

Context length and distractors

  • Prior studies report degradation with position, input length, irrelevant sentences, synthetic long-context suites, narrative wrapping, and even whitespace or masked-token length.The paper does not claim that volume itself hurts; it compares tested blocks on a written-and-read-back counter with local processing.Source: §2 · p. 2

Recognition, interference and drift

  • The paper’s late rise in false alarms is compatible with proactive interference as seen codes accumulate, but its operational duplicate-recognition measure differs from code-owned state drift.Goal drift under competing objectives is measured per episode, unlike the paper’s per-step component measure.Source: §2 · pp. 2–3

3 Bench

The bench presents a French ledger task that requires local record processing, duplicate recognition, and counter tracking across repeated messages. Its component-wise scoring, controls, and model setup define how these behaviors are measured.

3 Bench

  • Each record requires a running counter, uppercase code, integer sum, and copied token; repeats at distances 5, 40, 150, and 300 test duplicate recognition.The counter should equal step index + 1, and DOUBLON is required when the code appeared earlier.Source: §3 · p. 3
  • The model’s own previous answers are re-injected into its history rather than replaced with expected answers.Source: §3 · p. 3
  • Every readable line is scored component by component, with each component’s risk set limited to steps where it is observable.The counter is observable on every readable line, giving it 8,000 steps in the M1 Phase 0 denominator; the former exclusive-label evaluator could hide lower-ranked errors.Source: §3 · p. 3
  • A token-copy canary detects current-input reading failures, while window checks separately control for truncation; none of 212 original-study episodes was excluded.No step exceeded the configured context window; follow-up campaigns had zero exclusions, with two sleep-affected episodes rerun.Source: §3 · p. 3
  • The experiments use Qwen3 via ollama in Q4_K_M quantisation, greedy non-thinking decoding, and a 40,960-token context; Qwen3-8B has the same digest on both machines.Source: §3 · p. 3
  • The irrelevant control matches rules-plus-seen-codes in word and fake-code counts, but is longer than the seen-codes block.At step 100 on M2, median prompt sizes are 5,860.5 tokens for arm 0, 6,250 for B, and 6,668 for D; the resulting length imbalance cuts both ways for comparisons.Source: §3 · pp. 3–4

4 Measurement

The measurement section uses component-specific hazards and seed-level inference rather than relying on survival curves or treating within-seed errors as independent. It also defines multiplicity procedures, reports a noise-floor check, and specifies size-map cutoffs.

4 Measurement

  • The analysis estimates per-component error hazards in six step slices and compares before versus after step 200 with a one-sided Fisher test at p < 0.01.Main effects are also estimated at the seed level using paired-seed bootstrap resampling because errors within a seed are not independent.Source: §4 · p. 4
  • A non-significant test does not establish stability; reported effect intervals should be read by their upper bounds.Source: §4 · p. 4
  • The confirmatory family comprises 24 p-values corrected by Holm at 0.01, with 7 of 15 initially significant readings surviving the reference correction.Follow-ups have separate pre-registered families; robustness analyses are reported with intervals and secondary p-values outside those families.Source: §4 · p. 4
  • Across 4,800 chained steps, repeated runs differed by at most one error, a hazard of 0.00021.Unloaded runs of 6,000 steps had zero errors across five seeds run three times.Source: §4 · p. 4
  • For the size map, each model’s cutoff is the integer part of the median first-failure step from a separate 10-seed exploration set, followed by 20 confirmatory seeds.Sizes are compared at their own cutoffs and at common cutoff step 173, with censoring treated as time at risk.Source: §4 · p. 4

5 Results

Across the ledger task, duplicate-recognition errors rise late while the counter makes no errors, and injected context disrupts the counter much more than local processing. Follow-ups show that exact external reminders can re-align the counter, though the tested reminders do not establish durable recovery or no damage to other components.

5.1 R-A: duplicate recognition fails late, the counter never does

  • On M1, duplicate-recognition hazard rose from 0.0019 before step 200 to 0.011 after it, while the counter made 0 errors in 8,000 steps on each machine.The rise combines long-distance misses and false alarms; exploratory censoring at the first error of any component still showed a rise, but was not a test.Source: §5.1 · p. 4, §5.9 · p. 11

5.2 R-B: injected context disrupts the counter far more than local processing

  • Under irrelevant block D, the counter failed in 20/20 seeds on both machines; local-processing effects were much smaller, but unaffected performance was not established.The counter-minus-R1 effect was positive in every seed; the R1 ratio intervals still allow some increase.Source: §5.2 · pp. 5–6

5.3 Pre-registered follow-up: what does the counter depend on? (experiment R)

  • Without a reminder, all 20 seeds propagated a counter offset; with an exact reminder repeated at every step, all 20 re-aligned within one or two steps.The result is behavioral and does not establish internal tracking; the reminder was supplied by an experimental oracle.Source: §5.3 · p. 7

5.4 Pre-registered follow-up: content or form? (experiment L)

  • The content-versus-form follow-up was inconclusive: counter hazards under irrelevant and relevant-code blocks were not shown different or equivalent, and form remained a hypothesis.The counter failed in 19/20 seeds under both blocks, with median first errors at steps 15.5 and 18, respectively.Source: §5.4 · p. 7

5.5 Pre-registered follow-up: repair under repeated disruption (experiment S)

  • With repeated disruption, the exact reminder condition had 0/20 seeds with counter errors, versus 15/20 under disruption alone; a single reminder’s persistence was inconclusive.The reminder outperformed length-matched neutral text, but no-damage criteria for other components were not met, and the reminder was oracle-supplied at every step.Source: §5.5 · pp. 8–9

5.6 Secondary: listing the seen codes, repeating the rules

  • Listing seen codes partially lowered duplicate-recognition errors, while repeating the rules was followed by first-slice errors in every seed, an untested observation.The seen-code result depended on machine and correction; its pre-registered no-rise criterion was not met.Source: §5.6 · pp. 9–10

5.7 Secondary: size map

  • At own cutoffs, 8B duplicate-recognition hazard rose from 0.00070 to 0.0096; at common cutoffs, 8B differed from 14B and 32B, but 14B versus 32B was inconclusive.The 4B common-cutoff estimate rested on one seed and entered no comparison; censoring was handled under an uninformative-censoring assumption.Source: §5.7 · p. 10, Table 3 · p. 11

5.8 Secondary: failure shape

  • First failures on any rule were at either extreme for 11/20 32B seeds versus 2/20 8B seeds; the pattern does not establish predominantly immediate 32B failures.The 14B result was intermediate and not read.Source: §5.8 · p. 11, Figure 5 · p. 11

6 Discussion

The discussion links late duplicate-recognition errors to long recall distances and false alarms, while noting that the design cannot separate time, context length, and stored-item effects. It also finds that injected context disrupts the counter, whereas repeated exact state reminders can restore it under tested conditions.

6 Discussion

  • A repeated exact state reminder re-aligns the counter within one to two steps, but the mechanism remains unidentified and the effective reminder was repeated at every step.The reminder came from an oracle; whether less frequent reminders suffice was not established.Source: §6 · pp. 11–12
  • Experiment L found no evidence that relevance explains the difference between the shorter seen-code block and the longer irrelevant block; block form remains an unconfirmed hypothesis.The pre-registered comparison was not conclusive, and the authors withdraw their earlier content-based interpretation.Source: §6 · p. 12
  • Four tested context blocks broke an otherwise error-free counter, whereas an exact state reminder did not; other block types, sizes, and positions were not tested.A layer that aids duplicate recognition may therefore hurt carried state and should be evaluated on both components.Source: §6 · p. 12
  • Late duplicate-recognition errors combine long-distance recall failures and false alarms after many codes have been seen, but the design cannot separate time, context length, and stored-item effects.The false alarms are compatible with interference between stored items.Source: §6 · p. 12
  • Larger models recognize duplicates better over the same episode region, but the suggestion that they fail differently survives only per-claim correction and needs confirmation.The authors caution against using that tentative interpretation to plan deployment.Source: §6 · p. 12

7 Conclusion

The paper separates long-horizon errors into component-level behaviors: duplicate recognition deteriorates late, while counter tracking remains intact and local processing is descriptively stable. Irrelevant context disrupts the counter, and repeated exact external state reminders restore it in the tested setting, motivating a design hypothesis rather than a general prescription.

7 Conclusion

  • Duplicate-recognition errors rise late through long-distance misses and false alarms, while the counter makes no errors and local processing is descriptively stable.The component-wise diagnosis shows why an aggregate or exclusive error classification can conceal differences among components.Source: §7 · p. 12
  • An irrelevant block disrupts counter tracking much more than local processing, and component-wise scoring makes this difference visible.The effect on local processing was much smaller, but the absence of degradation was not established by the sealed criterion.Source: §7 · p. 12
  • A corrupted counter value persists, whereas an explicit external state reminder restores it; under repeated disruption, exact reminders outperformed equal-length text without the state.The reminder was repeated before each message and supplied by an oracle; a single reminder did not reliably hold.Source: §7 · p. 12
  • The authors propose stating consequential carried state explicitly and often as a design hypothesis, while noting that reminder frequency and other state types were not tested.The tested state came from an oracle, and reliably supplying it remains a separate problem.Source: §7 · p. 12

8 Limitations and what we do not claim

The reported conclusions are bounded by a synthetic task, a specific model setup, and several design and analysis qualifications. The authors also distinguish their findings from broader claims they did not test.

8 Limitations and what we do not claim

  • The counter result comes from one synthetic French task with a trivially incremented counter and should not be generalized to arithmetic state.Sinha et al. (2026) report the opposite result for a running sum.Source: §8 · p. 12
  • Experiments used one unidentified model family with Q4_K_M via ollama, greedy decoding, and non-thinking mode; thinking mode may change the picture.There were 20 seeds per condition; arm A had 8 M2 seeds and 4 M1 seeds.Source: §8 · p. 13
  • Distance and position in the episode are confounded by design, limiting separation of their contributions to duplicate-recognition errors.Source: §8 · p. 13
  • Experiment R establishes a behavior, not a mechanism: its state reminder was oracle-supplied and repeated every step.Experiment S likewise used an oracle state, a trivial counter, and one disruption; reminder frequency was not established.Source: §8 · p. 13
  • The reminder follow-up did not establish that other components were undamaged, and its no-damage and persistence criteria were not conclusive.Its bare reference was the August run rather than a concurrent comparison.Source: §8 · p. 13
  • Intervals described as stable still permit increases of up to about twofold for the reported time and injected-block comparisons.Source: §8 · p. 13
  • The Phase 0 hazard test was developed using preliminary seeds 1–3, which were included in the analyzed sample, and was not described as preregistered.Source: §8 · p. 13
  • The authors do not claim that a small model with external state beats a large one without it, or that the protocol measures intent or goals.They also do not claim that listing seen codes repairs duplicate recognition or that context-volume degradation is new.Source: §8 · p. 13

9 Reproducibility and AI assistance

The paper’s code, logs, preregistrations, and seals are available in a tagged repository, with a script that regenerates reported numbers and figures without model calls. The authors report independent verification and disclose AI assistance alongside author oversight of design decisions and sealed preregistrations.

9 Reproducibility and AI assistance

  • The tagged repository provides code, logged episodes, preregistrations, and seals under stated code and data licenses.The paper and its numbers correspond to repository tag v1.0-arxiv.Source: §9 · p. 14
  • The reproduction script regenerates every number, table, and figure from logs without calling a model, and the repository reproduced identically from a clean clone.It also runs seal verification and an independent-code re-derivation of key numbers.Source: §9 · p. 14
  • Claude Code and Claude assisted the experiments, analysis, and drafting; the author reviewed all design decisions and sealed preregistrations.Source: §9 · p. 14

A Pre-registration, seals and measurement rules

The appendix documents preregistrations, seals, and measurement rules while distinguishing what document hashes establish from the evidence used to establish timing. It also records departures and qualifications for the follow-up campaigns and protocol-specific rules.

A Pre-registration, seals and measurement rules

  • A hash establishes that a document has not changed since hashing, but preregistration anteriority rests on repository history, whose commit dates were set by the author’s machine.The Phase 0 hazard criterion was developed after three preliminary seeds suggested it and is not described as preregistered.Source: A Pre-registration, seals and… · p. 15
  • The appendix cautions against treating a hash as proof of timing and against interpreting absence of evidence as evidence of absence.Source: A Pre-registration, seals and… · p. 15
  • Experiments R and L were read early at three points while L was still being collected, although neither the protocol nor L’s collection was changed.The preregistration and reading code were committed before episodes were run and before the data were complete, respectively.Source: A Pre-registration, seals and… · p. 15
  • Experiment S’s sealed amendment replaced a bare-condition rerun with August bare episodes as descriptive reference and added power and sleep logging.The launcher waited for another job to finish, and two episodes crossing machine sleep were discarded and rerun.Source: A Pre-registration, seals and… · p. 15
  • The measurement rules include protocol-specific safeguards such as checking noise floors, avoiding machine contention, and preserving the model’s real answers in history.The appendix explicitly says rules 11 and 15 describe this protocol, not general laws.Source: A Pre-registration, seals and… · pp. 15–16
  • In this protocol, every tested disruptive block degraded the counter, with the ledger-like block degrading it most; the exact state reminder was an exception.Under that repeated reminder, no counter error was observed.Source: A Pre-registration, seals and… · p. 16

B Multiple comparisons (Holm, threshold 0.01)

The section reports all 24 paper p-values except the exploratory check and pre-registered follow-ups, contrasting a reference correction with secondary per-claim corrections.

B Multiple comparisons (Holm, threshold 0.01)

  • 24 p-values are listed, excluding the exploratory check of §5.9 and the pre-registered follow-ups of §5.3–5.5, which have separate families.The reference correction uses one family for all tests; the secondary per-claim correction uses one family per claim, declared after the reference correction was computed.Source: B Multiple comparisons (Holm,… · p. 16
  • All tests use one-sided exact Fisher tests except the per-seed Mann-Whitney tests.Source: B Multiple comparisons (Holm,… · p. 16
  • The table marks readings significant before correction that do not survive correction with “no in bold.”Source: B Multiple comparisons (Holm,… · p. 16

C Audit: scoring replaced

After an external review identified that exclusive labels could hide lower-ranked errors, the paper replaced its original scoring with component-wise scoring. Under the revised scoring, the counter decision rule holds, while the audit distinguishes corrected results from values that are not results.

C Audit: scoring replaced

  • Component-wise scoring replaced the exclusive-label evaluator after review showed it could hide lower-ranked errors; the replaced values are not results.On M2, the exclusive labels made the R1 hazard appear lower in injected arms, but that comparison did not hold after re-scoring (p = 0.71).Source: C Audit: scoring replaced · pp. 16–17
  • R2 errors rise across step 200 for Qwen3-8B on M2 (p = 3.5 × 10−5) and M1 (p = 1.5 × 10−4), surviving reference correction.Source: C Audit: scoring replaced · p. 17
  • The counter decision rule holds: on both machines, every seed has a counter error under the irrelevant block, versus none in the bare arm.The rule also requires the upper bound of the 95% seed-bootstrap interval for the R1 error-rate ratio D/bare to be below 2.Source: C Audit: scoring replaced · p. 17
  • The sealed R2 test is unchanged by re-scoring: p = 1.5 × 10−4 on M1 and p = 3.5 × 10−5 on M2.Only R3 and format outranked R2 under the original scoring.Source: C Audit: scoring replaced · p. 17
Loading 2610.20633v1…