Feedback That Backfires: Why Small Language Model Agents Repeat the Call They Just Watched Fail

Esmail Gumaan

cs.SEAug 24, 2026

Feedback That Backfires: Why Small Language Model Agents Repeat the Call They Just Watched Fail

Authors: Esmail Gumaan

Organizations: Faculty of Computer Science and Mathematics University of Passau, Germany

Abstract

Agent harnesses record a failed tool call and its error message in the transcript and ask the model to continue, on the assumption that the error is corrective information. We measure whether it is. Defining the corrective gain of a failure record as the change in log-probability of re-emitting the action that just failed, we find the gain is negative for every instruction-tuned model we tested (6 checkpoints, 135M-1.7B, 4 families) in two environments: simulated tool calling and MBPP program repair. Normalised by action length the effect is about -1.03 nats per action token, a factor of 2.8 in the odds of each token, and holds on 90%-100% of individual items, not only on average. Over a fixed candidate set the probability of repeating the failed call rises from 0.06 to 0.54, and greedy decoding reproduces it token for token on 19% of items after the failure versus 0% before. Counterfactuals pairing the same call with a failure message, a success message, or a neutral acknowledgement separate two effects: the failed call's surface form accounts for 83% of the damage, while the semantic contribution of marking it failed is small and inconsistent in sign across environments. The problem is in the harness, not the model's grasp of error messages, and that predicts which remedies work. Replacing the verbatim call with a runtime-generated description of the failure removes 76% of the inversion at no token cost, and making previously-failed strings unreachable at the decoder acts on the same term. Two plausible remedies do not: an explicit "do not repeat" instruction leaves the measured quantity where it was, and deleting the failed attempt to retry from a clean context, the standard prescription for context contamination, is the worst harness we measured for repetition, because it restores the context that produced the failure. The study runs end to end on a CPU; all artefacts are released.

Figures & tables

	explicit failure signal	separates form from meaning	harness intervention
Repetition / degeneration	no	no	decoding
( 36 ; 9 )
Negative instructions	n/a	no	prompt
( 5 )
Self-correction critiques	yes	no	prompt
( 11 ; 25 )

Table 1: Where this paper sits. The distinguishing column is the middle one: prior work measures the net effect of a failure record, if it measures it at all, whereas the intervention that works depends on which of its two components dominates.

Environment	items	tasks	ops.	err.	action (chars)	obs. (chars)
ToolShed	275	58	8	12	57	75
CodeRepair	266	132	10	4	198	150

Table 2: Probe item pools. ops. is the number of perturbation operators used to build failing actions, err. the number of distinct error families they provoke. Experiments draw a balanced subsample from these pools; the drawn size is given per study.

Model	Params	$G$	$G$ /token	copy	sem	$G_{\text{abs}}$
SmolLM2-135M	0.14B	−23.92 [−25.86, −22.09]	−1.21 [−1.36, −1.06]	21.69 [19.54, 23.94]	2.23 [1.59, 2.90]	−2.24 [−3.41, −1.05]
SmolLM2-360M	0.36B	−18.62 [−21.00, −16.38]	−0.93 [−1.06, −0.79]	16.08 [13.89, 18.43]	2.54 [1.98, 3.16]	−3.23 [−4.24, −2.24]
Qwen2.5-0.5B	0.49B	−13.91 [−16.12, −11.82]	−0.94 [−1.14, −0.75]	9.91 [7.59, 12.25]	4.00 [2.82, 5.28]	−2.86 [−3.71, −1.99]
Qwen3-0.6B	0.60B	−21.50 [−25.07, −18.18]	−1.47 [−1.74, −1.21]	18.25 [14.75, 21.95]	2.78 [1.56, 3.96]	−6.60 [−8.07, −5.25]
Llama-3.2-1B	1.24B	−12.41 [−15.71, −9.62]	−0.92 [−1.21, −0.66]	9.42 [7.23, 11.91]	3.26 [2.06, 4.62]	−5.46 [−7.49, −3.65]
SmolLM2-1.7B	1.71B	−13.91 [−15.53, −12.35]	−0.71 [−0.81, −0.61]	11.67 [10.37, 12.97]	2.24 [1.44, 3.12]	−4.36 [−5.08, −3.57]

Table 3: Probe results on ToolShed (tool calls). All quantities are in nats and are differences in the summed log-probability of the same action string under two contexts.

G>0

means the harness’s failure record made the failed call less likely;

G<0

is feedback inversion. Cells give the mean over items with a 95% cluster bootstrap interval (clustered on task); bold marks intervals excluding zero.

Model	Params	$p_{\text{rep}}$ before	$p_{\text{rep}}$ after	$\Delta p_{\text{rep}}$	greedy before	greedy after	greedy abs.
SmolLM2-135M	0.14B	0.142 [0.086, 0.201]	0.875 [0.840, 0.910]	0.733 [0.677, 0.789]	0.000 [0.000, 0.000]	0.430 [0.340, 0.519]	0.000 [0.000, 0.000]
SmolLM2-360M	0.36B	0.117 [0.067, 0.170]	0.753 [0.684, 0.820]	0.637 [0.568, 0.708]	0.000 [0.000, 0.000]	0.410 [0.306, 0.521]	0.020 [0.000, 0.050]
Qwen2.5-0.5B	0.49B	0.013 [0.004, 0.028]	0.602 [0.528, 0.681]	0.589 [0.516, 0.666]	0.000 [0.000, 0.000]	0.030 [0.000, 0.067]	0.000 [0.000, 0.000]
Qwen3-0.6B	0.60B	0.006 [0.000, 0.014]	0.296 [0.196, 0.399]	0.290 [0.193, 0.393]	0.000 [0.000, 0.000]	0.000 [0.000, 0.000]	0.000 [0.000, 0.000]
Llama-3.2-1B	1.24B	0.009 [0.000, 0.025]	0.246 [0.136, 0.363]	0.237 [0.131, 0.348]	0.000 [0.000, 0.000]	0.000 [0.000, 0.000]	0.000 [0.000, 0.000]
SmolLM2-1.7B	1.71B	0.050 [0.021, 0.085]	0.476 [0.393, 0.570]	0.426 [0.353, 0.506]	0.000 [0.000, 0.000]	0.270 [0.174, 0.381]	0.000 [0.000, 0.000]

Table 4: Repetition probabilities on toolshed.

p_{\text{rep}}

is the normalised probability of the failed call among the scored candidate actions; greedy is the fraction of items on which greedy decoding reproduces the failed call exactly.

Model	Params	frac. $G<0$	$\Delta$ margin	repair	copy ✓	polarity
SmolLM2-135M	0.14B	1.00 [1.00, 1.00]	−12.58 [−14.34, −10.90]	11.34 [10.21, 12.40]	24.46 [22.57, 26.51]	−0.54 [−0.93, −0.15]
SmolLM2-360M	0.36B	1.00 [1.00, 1.00]	−12.23 [−14.11, −10.51]	6.39 [4.86, 8.02]	17.80 [15.59, 20.22]	0.82 [0.20, 1.49]
Qwen2.5-0.5B	0.49B	0.90 [0.84, 0.95]	−15.16 [−17.71, −12.79]	−1.25 [−2.46, 0.03]	11.01 [8.77, 13.37]	2.90 [1.73, 4.08]
Qwen3-0.6B	0.60B	0.94 [0.88, 0.99]	−17.54 [−20.69, −14.61]	3.96 [2.25, 5.75]	21.03 [17.85, 24.38]	0.47 [−0.41, 1.28]
Llama-3.2-1B	1.24B	1.00 [1.00, 1.00]	−9.60 [−12.31, −7.36]	3.08 [1.20, 4.96]	12.51 [9.39, 15.93]	0.17 [−1.07, 1.30]
SmolLM2-1.7B	1.71B	1.00 [1.00, 1.00]	−11.61 [−13.39, −9.97]	2.30 [1.09, 3.59]	12.92 [11.48, 14.48]	0.99 [0.59, 1.41]

Table 5: Robustness and secondary quantities. frac.

G<0

is the assumption-light item-level sign statistic;

\Delta

margin is the change in the gold-minus-failed log-probability gap; repair is the change in the correct action’s log-probability. copy ✓ repeats the surface-form term against the counterfactual success observation instead of the valence-free one, in case the latter reads as mildly positive; the matching semantic term referenced the same way is algebraically the polarity contrast, so it appears once, in the last column.

Figure 1: Where the inversion comes from. Bars decompose

-G

into the effect of the failed call being in the context (blue) and the additional effect of marking it as failed (orange); black dots are the total. Error bars are 95% cluster bootstrap intervals. If the problem were that the model does not understand the error, the orange bars would be large and negative.

Figure 2: Corrective gain against parameter count. Positive values would mean the failure record does what it is intended to do. Top: raw nats, with an independent axis per environment, since an MBPP program is roughly five times as many tokens as a tool call and a shared axis would flatten the left panel. Bottom: the same quantity per action token, where the axis is shared, because the two environments landing in the same band is the point. Error bars are 95% cluster bootstrap intervals; the dashed line is zero.

Model	Params	$G$	$G$ /token	copy	sem	$G_{\text{abs}}$
SmolLM2-135M	0.14B	−82.61 [−93.89, −71.79]	−1.23 [−1.32, −1.14]	84.00 [73.16, 95.33]	−1.39 [−1.88, −0.91]	1.56 [0.93, 2.23]
SmolLM2-360M	0.36B	−70.35 [−79.40, −61.71]	−1.09 [−1.19, −1.00]	71.02 [62.08, 80.28]	−0.67 [−1.16, −0.19]	−0.80 [−1.23, −0.40]
Qwen2.5-0.5B	0.49B	−67.68 [−76.71, −59.15]	−1.21 [−1.36, −1.08]	69.50 [61.01, 78.50]	−1.82 [−2.48, −1.19]	−0.51 [−0.95, −0.08]

Table 6: Probe results on CodeRepair (MBPP program repair). All quantities are in nats and are differences in the summed log-probability of the same action string under two contexts.

G>0

means the harness’s failure record made the failed call less likely;

G<0

is feedback inversion. Cells give the mean over items with a 95% cluster bootstrap interval (clustered on task); bold marks intervals excluding zero.

Harness variant	SmolLM2-135M	Qwen2.5-0.5B
terse error text	−0.32 [−0.72, 0.02]	−0.23 [−0.64, 0.20]
verbose error text	−0.09 [−0.32, 0.14]	−0.31 [−0.65, 0.02]
error quotes the failed call	1.31 [1.12, 1.51]	0.10 [−0.22, 0.44]
failure placed before the successful steps	−0.94 [−1.45, −0.48]	−0.82 [−1.36, −0.26]
+ “do not repeat” instruction	0.16 [0.06, 0.27]	−0.02 [−0.20, 0.15]
the same call failed twice	3.06 [2.78, 3.36]	3.61 [3.12, 4.08]

Table 7: Harness variants, as paired changes in the log-probability of re-emitting the failed call, relative to the standard harness on the same items. Positive means the variant makes repetition more likely; negative means less. Every row uses the same items and the same failed call, and only how the failure is written into the transcript changes.

Figure 3: Corrective gain under harness variants. Points right of the dashed line would mean the failure record suppresses the failed call. Manipulations of the message (top four rows) move the estimate very little; the manipulation that removes the call’s surface form (bottom row) moves it by an order of magnitude.

Figure 4: Corrective gain by error family (ToolShed), one cell per model $\times$ family. The scale is diverging about zero, so red is feedback inversion and blue would be a harness behaving as intended; no cell is blue. Blank cells are model/family pairs the schedule did not reach.

	Qwen2.5-0.5B
Harness	success	exact rep.	canon. rep.
verbatim (standard)	0.42 [0.21, 0.62]	0.31 [0.15, 0.47]	0.31 [0.15, 0.47]
+ “do not repeat”	0.58 [0.38, 0.79]	0.24 [0.08, 0.42]	0.24 [0.08, 0.42]
abstract	0.33 [0.17, 0.54]	0.16 [0.04, 0.31]	0.16 [0.04, 0.31]
drop	0.33 [0.17, 0.54]	0.80 [0.79, 0.81]	0.80 [0.79, 0.81]
verbatim + ban	0.42 [0.21, 0.62]	0.08 [0.00, 0.15]	0.08 [0.00, 0.15]

Table 8: End-to-end rollouts on ToolShed. Success is the environment’s goal predicate; exact rep. is the fraction of failed actions that repeat an earlier failed action byte for byte, and canon. rep. applies the same count after parsing and normalising the call, so paraphrases of a banned string are still counted. Brackets give 95% cluster bootstrap intervals over tasks.

Figure 5: End-to-end rollouts, by harness. Left: task success. Middle: the fraction of rollouts that end in a loop (step limit reached with a repeated action). Right: the fraction of failed actions that repeat an earlier failed action byte for byte. The two repetition panels order the harnesses the same way, and it is the order the decomposition predicts: interventions acting on the failed call’s surface form at the good end, the harness that deletes the failure outright at the bad end, the standard harness in between. Task success does not follow that order, which Section 10 explains. Error bars are 95% cluster bootstrap intervals over tasks.

	Qwen2.5-0.5B
Harness	gen	prompt	ctx/step	steps
verbatim (standard)	67	2764	633	4
+ “do not repeat”	47	2210	646	3
abstract	64	2602	616	4
drop	69	2587	586	4
verbatim + ban	69	2764	633	4

Table 9: Cost per rollout. gen and prompt are tokens summed over a rollout’s steps, so a harness that takes more steps accumulates more of both; ctx/step divides the prompt total by the number of steps and is the fair comparison of context size. The decoder ban adds no tokens at all. The abstraction produces a slightly shorter context per step while taking more steps, because it does not terminate early on a loop. Wall-clock is omitted: these runs shared a CPU with other jobs, so it measures scheduling rather than the harness.

Appendix figures & tables4 assets

Supplementary material from the paper’s appendix.

Appendix

Condition	What the transcript contains
pre	context before the attempt (baseline)
fail	attempt + error observation (standard ReAct harness)
succ	attempt + counterfactual success observation
neut	attempt + valence-free observation
neut_pad	attempt + valence-free observation, length-matched to ‘fail‘
abstract	harness-generated failure description, no verbatim call

Appendix

Table 10: Every probe condition. All conditions for one item share the same system prompt, goal and successful prefix, byte for byte.

Operator	Reference call	Perturbed call	Error family
arg_typo	find_contact(name=’Dana Bergmann’)	find_contact(contact_name=’Dana Bergmann’)	unexpected_argument
date_format	list_events(date=’2026-09-19’)	list_events(date=’September 19, 2026’)	format_error
drop_arg	send_message(to=’[email protected]’, subject=’agenda’, body=’roadmap, hiring, i …	send_message(to=’[email protected]’, subject=’agenda’)	missing_argument
hallucinated_entity	find_contact(name=’Dana Bergmann’)	find_contact(name=’Alex Ramirez’)	contact_not_found
name_for_email	send_message(to=’[email protected]’, subject=’agenda’, body=’roadmap, hiring, i …	send_message(to=’Dana Bergmann’, subject=’agenda’, body=’roadmap, hiring, incident revie …	format_error
readonly_target	write_file(path=’reports/roster.md’, content=’Elena Okafor, Karim Okafor’)	write_file(path=’system/config.ini’, content=’Elena Okafor, Karim Okafor’)	permission_error

Appendix

Table 11: Perturbation operators used to build failing actions in ToolShed, with one instantiated example each.

Error family	SmolLM2-135M	SmolLM2-360M	Qwen2.5-0.5B	Qwen3-0.6B	Llama-3.2-1B	SmolLM2-1.7B
permission_error	−44.4 [−47.0, −42.2]	−43.0 [−44.9, −41.3]	−37.9 [−42.4, −33.9]	−51.9 [−52.9, −51.1]	–	−30.1 [−33.1, −27.4]
contact_not_found	−34.4 [−36.4, −31.3]	−21.9 [−23.0, −20.5]	−27.8 [−30.9, −26.1]	–	–	−19.0 [−21.3, −17.5]
format_error	−22.9 [−24.5, −21.1]	−18.4 [−20.1, −16.9]	−15.1 [−17.8, −12.4]	−23.9 [−27.5, −19.9]	−14.7 [−18.2, −11.6]	−13.2 [−14.5, −12.1]
file_not_found	–	–	–	–	–	−16.9 [−18.7, −14.1]
event_not_found	−18.7 [−19.2, −18.4]	−13.0 [−13.7, −12.3]	−11.7 [−12.4, −11.2]	–	–	–
missing_argument	−17.3 [−20.2, −13.6]	−15.4 [−18.6, −11.5]	−10.4 [−12.0, −8.3]	−22.7 [−24.7, −19.3]	−9.0 [−15.0, −1.1]	−9.8 [−12.1, −7.2]

Appendix

Table 12: Corrective gain (nats) by error family on ToolShed, sorted by pooled mean. Rows are the error the failing call provoked; a broadly uniform column argues against any explanation resting on the wording of one error type.

Model	Params	$p_{\text{rep}}$ before	$p_{\text{rep}}$ after	$\Delta p_{\text{rep}}$	greedy before	greedy after	greedy abs.
SmolLM2-135M	0.14B	0.111 [0.053, 0.180]	0.951 [0.917, 0.978]	0.840 [0.770, 0.901]	0.000 [0.000, 0.000]	0.000 [0.000, 0.000]	0.000 [0.000, 0.000]
SmolLM2-360M	0.36B	0.089 [0.032, 0.156]	0.856 [0.795, 0.910]	0.767 [0.689, 0.840]	0.000 [0.000, 0.000]	0.100 [0.033, 0.183]	0.000 [0.000, 0.000]
Qwen2.5-0.5B	0.49B	0.075 [0.023, 0.138]	0.833 [0.766, 0.893]	0.758 [0.680, 0.831]	0.000 [0.000, 0.000]	0.017 [0.000, 0.050]	0.000 [0.000, 0.000]

Appendix

Table 13: Repetition probabilities on coderepair.

p_{\text{rep}}

is the normalised probability of the failed call among the scored candidate actions; greedy is the fraction of items on which greedy decoding reproduces the failed call exactly.

LLM Agents

Large language model agents use language models to plan, use tools, and act across multi-step tasks and environments.

See all 711 papers

Oct 7, 2026

Loud Failures, Quiet Failures: Fault Detection and Recovery in Tool-Using Language Model Agents

Tool-using agents are usually scored on whether they finish a task while the tools work. Deployments are less forgiving: services time out, endpoints disappear, parameter names change, and results come back well formed but wrong. Prior work has shown that language models over-trust tool outputs that fail silently; we ask how that over-trust plays out across the stages of failure handling in multi-turn agents. Wrapping the executable environments of an established function-calling benchmark in a fault-injection layer, we inject one of four typed faults at a controlled point in the trajectory and record whether the agent notices, changes plan, recovers the task, or repeats itself. Six models from three families, half of them reasoning variants, ran 1,920 trials over 24 multi-step tasks. Agents treat a failure as a problem in 91.3% of trials when the tool returns an explicit error, but in 58.8% of trials when it returns a plausible wrong value, against a 26.8% rate of reporting problems when nothing was wrong. Reasoning models are not better placed: paired against instruct siblings, they notice less (-9.3 points, p < .001) and change plan more (+10.4 points, p < .001), and recovery is unchanged (p = .512). Because agents are stochastic, two fault-free runs of the same task end in the same state only 63.3% of the time; against that baseline, only a missing tool clearly lowers recovery (39.9%), while timeouts, schema drift, and corruption stay within run-to-run variation. After a fault, agents return to the same tool three or more times in a row in up to 22.2% of trials, though strictly identical repeats are rare. A prompt line asking the agent to check each result did not move detection. Agents respond to the error channel rather than to the content of what a tool returns, so failures that stay inside the expected format pass through.

Obada Kraishan

College of Media and Communication Texas Tech University Lubbock, TX, USA

Tool-Using Agents LLM Agent Reliability LLM Agent Evaluation

Ask PDF

May 8, 2026

Why Retrying Fails: Context Contamination in LLM Agent Pipelines

When an LLM agent fails a multi-step tool-augmented task and retries, the failed attempt typically remains in its context window -- contaminating the next attempt and elevating the per-step error rate beyond the base level. This context-contaminated restart phenomenon is widely observed in practice yet entirely lacks formal treatment. We introduce the Context-Contaminated Restart Model (CCRM): a chain of T tool-call steps, each failing with base rate epsilon_0; after any failed attempt, the subsequent attempt operates in contaminated context with elevated error rate epsilon_1 > epsilon_0. Under this model we derive five main results. (R1) An exact closed-form formula for P(succeed in at most K attempts). (R2) A cascade-overhead theorem giving the additional attempts Delta K incurred by contamination versus the clean-restart baseline. (R3) An optimal budget-allocation theorem identifying the pipeline depth T* that maximises success probability for a fixed total budget B=KT; we prove the closed form T* = sqrt(B * log(1/(1-epsilon_1)) / log(1/(1-epsilon_0))), with K*=B/T*. (R4) An information-theoretic lower bound via Le Cam's method showing K_CCRM is tight up to O(1). (R5) A clean-restart dominance theorem quantifying the exact benefit of context-clearing before retry. We validate CCRM on real SWE-bench Verified data: the IID model overestimates pass@3 by 17.4 percentage points (98.6% vs. 81.2%), while CCRM fits with error less than 0.001, implying a cascade ratio of epsilon_1/epsilon_0 = 7.1. Monte Carlo experiments confirm all theoretical predictions.

Zhanfu Yang

Department of Computer Science, Rutgers University, Piscataway, NJ 08854, USA

LLM Context Management LLM Agent Reliability

Ask PDF

Oct 21, 2026

Feedback That Backfires in Games: Do LLM Players Repeat the Move They Just Watched Fail?

When an LLM agent's move fails, the harness writes the move and the failure message into the transcript and asks again. In tool calling, this record makes small models more likely to repeat the failed action. We test whether the same holds in games (Sokoban, Connect Four, Othello), where a move can fail by being illegal or by being legal but losing, both verified exactly. On fixed probe items built by perturbing a correct move, the record backfires: pooled over 8 instruction-tuned models (135M-1.7B) it makes the failed move more likely (corrective gain G = -1.38 nats per token), through the move's surface form, for illegal moves but not for losing ones, and not for every model. An exploratory analysis shows what sets the sign: after the record, the failed move's log-probability barely depends on how likely it was before (slope 0.18). Moves the model would not have played become more likely, and greedy decoding starts to produce them; moves it was about to play become less likely, but greedy decoding still repeats 38% of them. A description of the failure that omits the move string keeps the model's preference instead. Along the OLMo 2 1B post-training ladder the inversion is present in the base model and largely removed at the DPO stage. RAGEN's default models invert in RAGEN's own Sokoban format before any RL. A "do not repeat" instruction does nothing, a clean retry is the worst harness, and a decoder ban stops exact repeats but not illegal play. All measurements ran in float32 on a free Colab GPU, which first reproduced the original paper's number.

Esmail Gumaan

Faculty of Computer Science and Mathematics, University of Passau, Germany

LLM Agents LLM Agent Reliability Game-Playing Agents

Ask PDF

Abstract

LLM Agents

Explore similar work

Loud Failures, Quiet Failures: Fault Detection and Recovery in Tool-Using Language Model Agents

Why Retrying Fails: Context Contamination in LLM Agent Pipelines

Feedback That Backfires in Games: Do LLM Players Repeat the Move They Just Watched Fail?