Self-Cleaning and Captured Anyway: One Measured Primitive for Error in a Store an Agent Writes to Itself, and What a Falling Score Actually Measures

Wenhui Chen; Jianlin Chen; Ziyao Lin; Chi Man Vong

cs.CLSep 6, 2026

Self-Cleaning and Captured Anyway: One Measured Primitive for Error in a Store an Agent Writes to Itself, and What a Falling Score Actually Measures

Authors: Wenhui Chen, Jianlin Chen, Ziyao Lin, Chi Man Vong

Organizations: University of Macau · South China University of Technology

Abstract

"An agent that writes its conclusions into a store it later retrieves from closes a loop usually reported as one-way contamination. Taking the loop to the infinite-tenure limit against an append-only store gives a different picture: because writing never deletes, the reachable state space has a hard upper edge at (n-1)/n, so the outcome is a choice between two edges rather than a decay. At f_0 = 0.9 the interval between the two modes holds 3.6% of 220 runs where a uniform spread would put 20.6%, and is strictly empty on the first 15; the pooled mean describes 8.2% of the runs it summarises, the median 68.2%. Everything the model contributes is carried by one measured primitive with no fitted parameter, the copy function γ(φ): on 36 Wikidata facts, sign(\hatγ - γ_{crit}), with γ_{crit} = 1/k at r = 0, w = 1, predicts the direction of drift on 353 of 360 real-fact runs (39 of 40 synthetic in the same batch). Scale does not rescue the store: pooled frontier capture is 0.850, with claude-sonnet-4.5 captured on 20 of 20 seeds against our registered prediction of <0.5. What the interval tests is distinguishability rather than count: on the real facts, multi-valued runs have 6.4x its occupancy of the rest. It survives at f_0 in {0.1, 0.3, 0.5}, capture peaks at f_0 = 0.5, and of four interventions with criteria frozen first, timing dominates fraction at matched budget while a consistency gate drives every model to 0.993. The resampling unit is the seed, at a design effect of 3.75 on a pooled level: under a 44-seed control the ordering supporting claim 4 collapses from Spearman +0.98 at three seeds to +0.31-0.80 at forty-four, while claim 2's ordering is exact there (+1.00, p = 0.017). All 87 graded rows are in Appendix W, 37 of them graded withdrawn, failed, self-correcting, undecidable or an acknowledged limit, against 50 that are not."

Figures & tables

Panel of Figure 1 — Figure 1: The apparatus, the primitive, and the boundary. An agent answers from a store it writes back into, and because the store is append-only no record can leave it, which is the whole of the assumption. Everything the model contributes travels through one measured function, the copy probability $\gamma(\varphi)$ , and the sign of its distance from $\gamma_{\rm crit}$ says which edge a run reaches. What appears at the boundary is not a decay towards a mean but a choice between the floor and a ceiling the store builds for itself. Every quantity drawn here is read from results/ at draw time.

Panel of Figure 2 — Figure 2: The paper in one page: five results, and the six explanations the data refuted. Recomputed from results/ at draw time, so it cannot drift from the artifact it summarises. The five survivors are the whole of what we ask a reader to carry away; the six refuted explanations are kept as a ledger because a corrected record is part of the argument. Two of the six fell to this paper’s own resampling-unit result (§ L ) applied to rows it had not yet reached , Appendix Q for the first, S for the second.

Prior work	What it establishes	What is added here
Self-Confirmation Trap [ 76 ]	the closed loop named: own trajectories written to memory and reused	the outcome is bimodal rather than cumulative, and one primitive predicts which branch
State contamination [ 66 ]	unsafe content survives summarisation below detector thresholds	a different failure axis; no dynamics, no copy probability there
Admission control [ 73 ]	write-time gating on self-consistency reduces contamination	the same gate has a regime where it erases the model’s own cleaning
Majority aggregation traps [ 41 , 29 ]	one-shot majority over samples locks in correlated error	the write side over tenure, where the gate decouples composition from reader quality
Accumulate vs. replace [ 25 , 16 ]	accumulating real with synthetic data avoids collapse	a budgeted grounding event, where schedule dominates at fixed fraction
Exact-match and pass@ $k$ critiques	strict matching understates capability; pass k separates capability from reliability	an intervention that conserves $C$ while moving $s$

Table 1: Nearest prior work. Every row is a phenomenon this paper does not claim to have discovered.

Panel of Figure 3 — Figure 3: The apparatus, and where the claims attach. One move (retrieve $k$ of $n$ , answer, append one record), run for $T$ steps with $R$ of them grounded. Fixing $R$ and sending $T$ to infinity makes two boundaries visible, and the alternative to the ceiling is zero rather than a lower plateau. Claim 1 is that runs end at one boundary or the other; claim 2 that $\gamma$ alone says which; claim 3 that the choice is made in the first few steps.

world	one tracked topic: a generated entity ( Baldrix Holdings ) with a generated numeric attribute ( 68.91M ). The false value is a one-digit corruption: plausible, never equal, unreachable by guessing
store at $t{=}0$	$n_{0}{=}10$ records, $n_{\mathrm{false}}\in\{1,9\}$ of them asserting the corruption, giving $f_{0}\in\{0.1,0.9\}$
each step	retrieve $k{=}8$ records uniformly from the topic; ask the plain question a deployed assistant would be asked; append the answer
prompt	never states the truth, never warns of error, so $\gamma$ measures ordinary behaviour rather than a response to a warning
tenure	$150$ steps, growing the store from $11$ to $161$ records: a $15\times$ range in $n$ , which is what makes the $1/n$ term visible within one run
models	five, three seeds, temperature $0$

Table 2: The protocol. Every arm is this loop with one thing changed.

Panel of Figure 4 — Figure 4: The outcome is a coin flip, and the copy function says which way it is weighted. (a) Every run at $f_{0}{=}0.9$ , sorted: eight end below $0.31$ , seven above $0.51$ , and the interval between them is empty. (b) Replacing the model by its own measured $\gamma$ and simulating the same loop lands within one seed of each model’s capture rate with nothing fitted, Spearman $+0.82$ , one adjacent inversion at a simulated gap of $0.02$ .

outcome	$f_{\mathrm{end}}$ per run	count
escaped	0.069 0.075 0.094 0.106 0.113 0.125 0.250 0.306	8/15
dead band $[0.35,0.50]$	—	0/15
captured	0.512 0.938 0.981 0.988 0.988 0.994 0.994	7/15
largest gap in the sorted outcomes / mean gap		6.4 $\times$

Table 3: Outcomes at

f_{0}{=}0.9

, per seed. The quantity a decaying-mean account would summarise has an empty neighbourhood around its own mean.

model	capture rate simulated from $\gamma$	observed
gemma-3-27b	0.12	0/3
phi-4	0.48	1/3
granite-4.1-8b	0.62	1/3
ministral-8b	0.60	2/3
qwen3-8b	1.00	3/3

Table 4: Simulated from the measured

\gamma

alone,

60

seeds, against the observed

3

-seed counts. No parameter is fitted; the curve is measured in situ during the same runs.

Panel of Figure 5 — Figure 5: What the empty interval needs, and what it does not. (a) Every E-bimodal2 run by the number of novel-value writes it made; the log counts writes, not distinct values. The three models that never scatter sit on the left edge and qwen3-8b writes a median of $43$ while still being captured on $44$ of $44$ seeds with nothing in the dead band. (b) Scripted controls, with the two measured points laid on them. The state-independent reader (dotted) fills the band, so bimodality is not arithmetic on a two-valued space. The $\gamma$ reader deciding on the largest single-value block (dashed) keeps the band empty to $q\approx 0.25$ and refills it at $q{=}0.5$ . The two crosses are measured: E-bimodal2’s highest- $q$ model, which contradicts that curve, and E-real’s multi-valued subset, which follows it. The arms disagree and the disagreement is the result ; they differ in whether a novel value is another variant of the same numeral or a different city, which is why § 4.1.1 relocates the open question from count to distinguishability.

quantity	value
difference in band occupancy, multi-valued minus two-valued	$0.1027$
unclustered standard error, and its $z$	$0.0517$ , $z=1.99$
clusters: Wikidata facts $\times$ runs each	$36\times 10$
fact-level $\mathrm{ICC}$ , and the design effect it implies	$0.077$ , $1.69$
$95\%$ interval, $\sqrt{\mathrm{deff}}$ rule of thumb	$[-0.0292,\,0.2345]$ spans $0$
$95\%$ interval, facts resampled with replacement	$[0.0055,\,0.2412]$ excludes $0$

Table 5: What it would cost to decide the within-arm half of the disagreement, and what it already costs to state it honestly. Every row is recomputed from results/ANSWERSPACE.json at build time. The two intervals are the same contrast under two treatments of the same clustering, and they do not agree : the rule of thumb spans zero and the resampling does not.

	escaped, $f_{\mathrm{end}}=0.069$ (seed $39$ )				captured, $f_{\mathrm{end}}=0.994$ (seed $52$ )
step	$n$	$f$	$j$	write	$n$	$f$	$j$	write
$0$	$11$	$0.818$	$7$	truth	$11$	$0.909$	$7$	false
$1$	$12$	$0.750$	$6$	truth	$12$	$0.917$	$7$	false
$2$	$13$	$0.769$	$7$	false	$13$	$0.923$	$8$	false
$3$	$14$	$0.714$	$6$	truth	$14$	$0.929$	$7$	false
$20$	$31$	$0.323$	$4$	truth	$31$	$0.968$	$8$	false

Table 6: Two runs of gemma-3-27b-it , same configuration, same starting store, opposite outcomes, and the divergence is the first write . Chosen by rule rather than picked: the lowest and highest

f_{\mathrm{end}}

among this model’s

44

fresh seeds.

j

is how many of the

k{=}8

retrieved records asserted the false value; write is what the agent then asserted. At step

0

both runs retrieve

j{=}7

and

j{=}7

8

, effectively the same evidence, and answer differently. Nothing external distinguishes them: the seed selects the topic and the false value, and from there the store’s own composition does the rest. 28 of this model’s runs tie exactly at the ceiling and 1 at the floor value shown; ties are broken by lowest seed so the table is reproducible, and no run was chosen for what it shows.

Panel of Figure 6 — Figure 6: The primitive, and the three claims it carries. Recomputed from results/ at draw time. (a) $\gamma(\varphi)$ on the forty-four topics it must predict, with the diagonal it has to cross for the store to drift upward; four of five sit below it over most of the interior and are captured anyway. (b) The same curves measured on three topics (dashed): not noisy versions of (a) but lower in the interior, on $29$ of $35$ cells, and a lower $\gamma$ under-predicts capture. (c) The denominator behind each cell: at three topics $17$ of $45$ cells rest on fewer than $30$ reads and $5$ on none. The primitive did not change between (a) and (b); the number of observations behind it did.

model	observed	arm A	$z_{A}$	arm B	$z_{B}$
gemma-3-27b	$0.682$	$0.085$	$-8.50$	$0.614$	$-0.97$
phi-4	$0.727$	$0.398$	$-4.90$	$0.807$	$+1.18$
granite-4.1-8b	$0.705$	$0.522$	$-2.65$	$0.795$	$+1.32$
ministral-8b	$0.818$	$0.553$	$-4.55$	$0.835$	$+0.29$
qwen3-8b	$1.000$	$1.000$	—	$1.000$	—
mean $\|{\rm sim}-{\rm obs}\|$		$12.1$ seed units		$2.2$ seed units

Table 7: Simulated capture rate against

44

real seeds per model,

4000

simulated seeds per arm. Arm A is the published curve on seeds

0

–

2

; arm B re-measures

\gamma

on seeds

9

–

52

and predicts the same runs. qwen3-8b captured on every seed, so it carries no

z

and is excluded from the means rather than floored. The whole tabular is generated from results/GAMMA_OUTSAMPLE.json , an artifact that did not exist until this table did: the

4000

-seed simulation behind it is seeded and reproducible, and nothing reproduced it.

Panel of Figure 7 — Figure 7: Two boundaries, not two attractors. Every trajectory at $f_{0}{=}0.9$ against the two edges of the state space: $f{=}0$ and the append-only ceiling $(n{-}1)/n$ of ( 2 ). Captured runs (orange) end on the ceiling rather than at an interior value; escaping runs (blue) run to the other edge. Circled points finish within two records of the ceiling: $4$ of the $7$ captured runs do.

model	seed	$f_{\mathrm{end}}$	$(n{-}1)/n$	truth records	gap to ceiling
phi-4	2	0.9938	0.9938	1	0.0000
qwen3-8b	0	0.9938	0.9938	1	0.0000
granite-4.1-8b	0	0.9875	0.9938	2	0.0062
ministral-8b	1	0.9875	0.9938	2	0.0062
qwen3-8b	1	0.9812	0.9938	3	0.0125
qwen3-8b	2	0.9375	0.9938	10	0.0563

Table 8: The captured runs against the ceiling ( 2 ) permits: two sit on it exactly and four within two records. “Truth records” is

n(1{-}f)

at the final step, out of

160

model	pass@1 at $f{=}0.9$	pass@8 at $f{=}0.9$	share of items mixed at $f{=}0.9$
google/gemma-3-27b-it	$0.188$	$0.625$	$0.625$
ibm-granite/granite-4.1-8b	$0.188$	$0.750$	$0.750$
microsoft/phi-4	$0.234$	$0.750$	$0.750$
mistralai/ministral-8b-2512	$0.125$	$0.625$	$0.625$
mean pass@8 $-$ pass@1 over $f\geq 0.5$			$\mathbf{+0.383}$

Table 9: Stores built at controlled contamination,

m{=}8

independent retrievals each. “Mixed” means the eight draws disagreed.

Panel of Figure 8 — Figure 8: What a falling score measures. Solid: single-draw accuracy, which is what an exact-match score reads. Dashed: the truth appearing in at least one of eight independent retrievals. The gap is what the store still holds and the score does not report.

intervention	frozen criterion	attacks	outcome
grounding schedule	capture monotone in schedule, $\geq 4/5$ models; front-loading beats no grounding by $\geq 1/3$	the fraction-of-verified-data rule [ 25 ]	ordering supported $5/5$ ; magnitude failed
majority admission gate	helps or is neutral at low $f_{0}$ ; harmful or no better at high $f_{0}$ ; both $\geq 4/5$	write-time admission control as an unconditional safeguard [ 73 ]	supported $5/5$ and $5/5$
cost-matched state slot	helps at low $f_{0}$ , $\geq 4/5$ ; a direction at high $f_{0}$ , $\geq 4/5$ same way	our own two readings of what a self-fed slot does	low supported ; high a tie
source marker	harmless at low $f_{0}$ ; lowers capture at high $f_{0}$ ; lowers $\gamma$ ; each $\geq 4/5$	our own registered D13 ′	harmless supported ; the other two failed

Table 10: What each intervention put at risk, and what came back. “Attacks” names the established account it was built to contradict; where there is none, it tests a claim of ours.

	front	uniform	back	ungrounded control
pooled capture rate	0.20	0.33	0.40	0.47

Table 11: Grounding at a matched budget:

15

truth writes in

150

steps, three schedules, everything else identical, against the zero-grounding arms already on disk. Pooled capture rate over five models and three seeds.

Panel of Figure 9 — Figure 9: Timing, not fraction. All three arms deliver the same fifteen grounding writes; only their placement differs. Pooled rates should be read as $\pm$ one run (§ K ); the ordering holds in all five models.

$R$	front	uniform	back	spread
5	0.20	0.27	0.40	0.20
15	0.20	0.33	0.40	0.20
45	0.07	0.20	0.47	0.40

Table 12: Capture rate by budget and schedule; the ungrounded control is

0.47

. The frozen falsifier was that the spread must shrink as

R

grows.

arm	$k$	$k_{\rm eff}$	capture $f_{0}{=}0.1$	capture $f_{0}{=}0.9$	on-topic	$\mathrm{var}(n_{f})$
uniform (control)	$8$	$1.95$	$0.533$	$0.933$	$1.000$	$5.753$
embed, oracle kept	$8$	$1.40$	$0.000$	$1.000$	$1.000$	$0.477$
embed, no oracle	$8$	$1.45$	$0.033$	$1.000$	$0.938$	$1.062$
embed, dedup	$8$	$3.22$	$0.900$	$0.833$	$0.402$	$0.520$
uniform	$4$	$1.45$	$0.233$	$0.933$	$1.000$	$1.070$
uniform	$2$	$1.27$	$0.400$	$0.933$	$1.000$	$0.509$

Table 13: E-retriever.

k_{\rm eff}

is the mean number of distinct on-topic values retrieved, defined in the preregistration before it was measured, and

\mathrm{var}(n_{f})

the across-step variance of the retrieved false count. Two models judged; see the floor note. The whole tabular is generated from results/retriever/GRADE.json , and one cell of it was wrong : the oracle-kept row printed

\mathrm{var}(n_{f})=0.347

where the grader computes

0.477

. It grades nothing, the prereg’s amendment added it as the mechanism variable, so no verdict moves, and it was wrong for as long as it was typed.

	$m{=}0$	$m{=}2$	$m{=}4$	$m{=}6$	$m{=}8$
capture	$0.450$	$0.350$	$0.150$	$0.200$	$0.000$
$\mathrm{var}(n_{f})$	$5.911$	$4.069$	$1.344$	$0.496$	$0.347$

Table 14: E-temp, five arms, two models, ten seeds,

f_{0}=0.1

\mathrm{var}(n_{f})

is the across-step variance of the retrieved false count. The whole tabular is generated from results/temp/GRADE.json , which already held both rows.

criterion	quantity	value	verdict
P-T1-N0(a)	matched-cell $\gamma(\varphi)$ against the published panel	$0.083$	supported
P-T1-N0(b)	$p_{0}$ on synthetic topics	$0.000$	supported
P-T1-N1	span of measured $p_{0}$	$[0.000,1.000]$	supported
P-T1-N2	$\gamma(1)$ , bottom against top $p_{0}$ tercile	$0.711\to 0.411$	supported
P-T1-N3	synthetic $\gamma(1)$ against the lowest- $p_{0}$ real cell	$1.000$ vs $0.700$	not supported
P-T1-N4	threshold agreement, real against synthetic	$353/360$ vs $39/40$	supported

Table 15: E-real. Probe cells are single-turn; loop runs are the full

150

-step ouroboros. Grading is at

f_{0}=0.1

, the registered level, where both arms are gradable on every run.

Panel of Figure 10 — Figure 10: The resampling unit, applied where it had not been. (a) At $44$ seeds a pooled level carries the design effect this paper published ( $3.75$ , dashed) and a paired contrast does not; hollow markers are what a three-seed subsample of the same runs reports, which for levels is wrong by a factor of four. That is the argument for measuring the contrast at forty-four rather than at three. (b) Each of the eight frozen criteria of the four three-seed arms: filled markers are the published value, hollow markers the same rule evaluated on one seed at a time, band the bar of $\geq 4/5$ . Seven criteria clear or miss on all three seeds; P-A1 clears on two and misses on one, and its row is downgraded. (c) The control those arms were measured against, at three seeds and at forty-four, on the identical configuration. It moves by up to $0.68$ in capture rate and no verdict follows it.

Appendix figures & tables35 assets

Supplementary material from the paper’s appendix.

Appendix

	centre	value	share described	verdict
P-T1-M1	pooled mean	$0.792$	$18/220=0.082$	supported (bar $\leq 0.40$ )
P-T1-M2	median	$0.981$	$150/220=0.682$	reported; narrows M1
	best single centre	$0.894$	$164/220=0.745$	upper bound on any one number

Appendix

Table 16: E-mean,

220

runs, criteria frozen before the data. “Share described” is the fraction of runs within

\pm 0.10

of the centre, a half-width fixed in the prereg at about four seed units. The last row bounds the whole column. The whole tabular is generated from results/MEAN.json .

Panel of Figure 11 — Figure 11: The ordering survives every budget; the effect’s size is a transient we did not test. (a) Capture rate by schedule at $R\in\{5,15,45\}$ against the ungrounded control; at $R{=}45$ back-loading has returned to the control exactly. (b) The closed form ( 3 ): the predicted spread vanishes at $R{=}0$ and at $R{=}T$ , where all three schedules are one arm, so it peaks near $R{=}75$ . Both budgets we registered a falsifier on sit on the rising side, which is why that falsifier failed upward.

limit taken	what happens to the spread	at $T{=}150/1500/15000$	regime
$R$ fixed, $T\to\infty$	back $\to 0$ , front $\to$ const.	—	finite budget, long tenure
$\alpha$ fixed, $T\to\infty$	diverges like $\ln T$	$1.55/3.69/5.98$ at $\alpha{=}\tfrac{1}{2}$	ours
peak over $R$ at fixed $T$	at $R^{\ast}/T=0.50$ always	height $\approx\ln\frac{n_{0}+T/2}{n_{0}}-\ln 2$	—
$\alpha=1$ exactly	identically $0$ , every $T$	$0/0/0$	free re-grounding

Appendix

Table 17: The three limits of ( 3 ) at

n_{0}{=}10

. The peak’s location is scale-free and its height is not, which is why (iii) and (iv) are both true. The last row is the only place the three schedules coincide.

Panel of Figure 12 — Figure 12: The bound as a flat line, and the measurement that is not one. If the spread of $f_{\mathrm{end}}$ fell as $1/\sqrt{n_{0}}$ , multiplying it by $\sqrt{n_{0}}$ would give the same value at every store size, which is the dashed line drawn through the first point. The measured within-model series rises instead: an eightfold increase in $n_{0}$ shrinks the spread by $1.07$ where the bound requires $2.83$ . The between-model series is drawn on the same scaling and for the same reason : flat in the raw units, as a property of $\gamma$ rather than of $n_{0}$ should be, so the within-model failure is a failure of the conditional-independence step in ( 7 ) and not an artefact of the decomposition. Recomputed at build time.

	$\leq 0.306$	in $(0.306,0.512)$	$\geq 0.512$	share in the middle
$3$ seeds ( $n{=}15$ )	$8$	$0$	$7$	$0.000$
$44$ seeds ( $n{=}220$ )	$39$	$8$	$173$	$\mathbf{0.036}$
uniform baseline for an interval of width $0.206$				$0.206$
P-T1-B1 ′ , frozen before the data				bar $\leq 0.10$

Appendix

Table 18: E-bimodal2, seeds

9

–

52

220

runs, against the fifteen at the same cuts. The cuts are the paper’s own:

0.306

is the largest escaped run above and

0.512

the smallest captured one, so the middle column is the interval this section calls empty.

signed mean $z$ out of sample: $+0.32$ and $+0.35$
	mean $\|{\rm sim}-{\rm obs}\|$			worst $\|z\|$
split	in-sample	out-of-sample	ratio	in	out
contiguous	$1.3$	$1.5$	$\mathbf{1.15\times}$	$1.44$	$2.41$
parity	$1.5$	$1.8$	$\mathbf{1.16\times}$	$1.55$	$2.71$
arm A , for scale: $12.1$ seed units of $44$ , worst $z$ $8.50$ , signed mean $z$ $-5.15$ , under-predicts $5/5$

Appendix

Table 19: Claim 2b given an actually out-of-sample test. Each row holds out

22

seeds and predicts them twice, differing only in the fitting set; errors are in seed units of the held-out half, where one unit is

0.045

. Not pre-registered and not graded. Arm A is carried down from Table 7 for scale, in its own units.

Panel of Figure 13 — Figure 13: Decided early, and the $1/n$ account of why fails. (a) The sign of the first move predicts the final outcome from step $2$ and does not improve thereafter; this is the measurement and it stands. (b) The account that fails. Plotting $1/n$ invites shading “the window in which the outcome can still move”. Prop. 4 shows that window is not there: the quantity that actually constrains $f$ is the cumulative bound $\sum_{s\geq t}(n_{0}{+}s{+}1)^{-1}$ , plotted here, and it forbids nothing until it falls below $1$ at $t{=}49$ . At the measured decision point $t{=}2$ it permits $2.55$ , more than the whole range of $f$ . The shaded region is where the $1/n$ explanation has no content.

model	runs	calls	lost (%)	capture
anthropic/claude-sonnet-4.5	$20$	$3000$	$0.00$	$\mathbf{1.000}$	captured on every seed
openai/gpt-4o	$20$	$3000$	$0.00$	$0.700$
pooled	$40$	$6000$	$0.00$	$\mathbf{0.850}$	P-T1-F1 bar $0.50$ : supported

Appendix

Table 20: E-frontier: the phenomenon at frontier scale, against our own registered prediction that it would vanish. The bimodal2 apparatus field for field (asserted by the grader, not assumed) on seeds

9

–

28

, a prefix of the

44

the open models used, so runs pair seed for seed. The prereg states, before the run, that we expected pooled capture below

0.5

; the reasoning was the scale trend above. P-T1-F1’s bar was

0.50

and no answers were lost on either model.

$f_{0}$	$n$	capture	mean	median	in void
$0.1$	$20$	$0.500$	$0.459$	$0.441$	$\mathbf{0/20}$	and the mean lands inside the void
$0.3$	$20$	$0.700$	$0.676$	$0.956$	$0/20$
$0.5$	$20$	$\mathbf{0.750}$	$0.723$	$0.969$	$0/20$	highest capture of the four
$0.9$	$44$	$0.682$	$0.724$	$0.994$	$2/44$	the arm § G reports

Appendix

Table 21: E-f0: the empty interval is empty at every initial composition, and

f_{0}=0.9

is not the worst one. gemma-3-27b at the bimodal2 apparatus, seeds

9

–

28

, one model rather than five because § L ’s own finding is that this apparatus should buy seeds and not models. “Void” is the interval

(0.306,0.512)

that § 4.1 calls empty. P-T1-F0-1’s bar was a share

\leq 0.20

, frozen before the runner existed. The whole tabular is generated , and it reads the band from the same artifact Table 18 does, so the two cannot disagree about where the empty interval is, which they did while both were typed : this table’s

f_{0}{=}0.9

row said

3/44

in the void, the count against the rounded cuts, where the cuts’ own definition gives

2/44

$R$	$R/T$	back’s first write	$f_{\max}(R)$	capture (frozen)		$\overline{f_{\mathrm{end}}}/f_{\max}$ (post hoc)
		at step		front / back	$s$	front / back	$s_{\mathrm{norm}}$
5	0.03	145	0.964	0.20 / 0.40	0.20	0.275 / 0.468	0.193
15	0.10	135	0.909	0.20 / 0.40	0.20	0.275 / 0.489	0.214
45	0.30	105	0.776	0.07 / 0.47	0.40	0.211 / 0.507	0.295
75	0.50	75	0.677	0.07 / 0.33	0.27	0.190 / 0.396	0.205
120	0.80	30	0.568	0.00 / 0.00	no info	0.213 / 0.331	0.117

Appendix

Table 22: The sweep past the peak. Capture is the frozen observable and it dies: a grounding write is a truth record, so the ceiling itself carries the budget,

f_{\max}(R)=(n_{\mathrm{false}}+Tw)/(n_{0}+Tw+R)=159/(160{+}R)

, and by

R{=}148

a run must reach

97\%

of its own ceiling to be counted as captured. The last column divides that ceiling out, per run: a step whose answer did not parse writes nothing and is not logged (

123

168{,}660

across the whole programme), so each run’s ceiling uses its own write count rather than the nominal

T

. Using the nominal value instead shifts

s_{\mathrm{norm}}

by at most

0.0012

s

is back minus front.

observable	spread $(45)$	spread $(120)$	difference	bar	verdict
$f_{\mathrm{end}}/f_{\max}(R)$	$0.153$	$0.093$	$-0.060$	$\leq-0.15$	failed
capture at $\tfrac{1}{2}f_{\max}(R)$	$0.167$	$0.000$	$-0.167$	$\leq-0.15$	supported

Appendix

Table 23: E-transient2, seeds

3

–

8

only; seeds

0

–

2

generated the hypothesis and are excluded.

30

runs per arm. Standard errors are clustered over the six seeds, these arms share their seed grid by construction, so the contrast is within-seed and clustering reduces the interval rather than widening it (§ L ).

$R$	front	uniform	back	$s_{\mathrm{norm}}$
$45$	$0.587$	$0.666$	$0.773$	$0.186$
$75$	$0.578$	$0.631$	$0.743$	$0.165$
$120$	$0.564$	$0.591$	$0.677$	$0.113$

Appendix

Table 24: E-transient3, seeds

9

–

52

220

runs per arm.

s_{\mathrm{norm}}

\overline{f_{\mathrm{end}}}(\text{back})-\overline{f_{\mathrm{end}}}(\text{front})

with each run divided by its own ceiling. Standard errors are clustered over the

44

seeds. The ordering front

<

uniform

<

back holds at all three budgets; it is the decline that was under test. The whole tabular is generated from results/TRANSIENT3.json , an artifact that did not exist until this table did, because the grader printed these means on every run and persisted none of them.

pooled capture rate	front	uniform	back	frozen criteria
first realisation	0.20	0.27	0.33	P-S1 $5/5$ , P-S2 ✓, P-S3 $\times$
second realisation (on disk)	0.20	0.33	0.40	P-S1 $5/5$ , P-S2 ✓, P-S3 $\times$
movement	0	$+1/15$	$+1/15$	identical

Appendix

Table 25: The same protocol, same seeds, same budget, run twice. Only the second run’s raw data survives; the first survives as its logged pooled figures. Note that the agent runs at temperature

0

, so the two realisations differ only because the served model is not reproducible at that setting.

difference in $p$ to be resolved	$0.4$	$0.3$	$0.2$
seeds required per model	24	44	98
seeds we ran	3, then 7 in the registered re-test

Appendix

Table 26: What it takes to resolve a cross-model difference in the choice probability, at

80\%

power and

95\%

confidence, against what we ran.

experiment	frozen at	criteria	amend.	words
E_A	a46631d9 , 2026-08-06 07:15	P-A1, P-A2, P-A3	0	161
E_BIMODAL2	2072fee0 , 2026-08-07 01:51	P-T1-B1, P-T1-B2, P-T1-B3, P-T1-B4, P-T1-B5, P-T1-B1’, P-T1-B1”	3	513
E_BUDGET	a46631d9 , 2026-08-06 07:15	P-B1, P-B2, P-B3	0	314
E_F0	45d6f80b , 2026-08-07 16:28	P-T1-F0	1	330
E_FRONTIER	a4095483 , 2026-08-07 16:19	P-T1-F1, P-T1-F2, P-T1-F3, P-T1-F4, P-T1-F5	0	315
E_GATE	a46631d9 , 2026-08-06 07:15	P-G1, P-G2	0	79

Appendix

Table 27: The preregistration record, generated from git by make_appendix.py .

	invariant	assertions
✓	answer labels partition	1,114,218
✓	api_calls >= logged steps	7,544
✓	bimodal2 config == converge’s n_false0=9 arm	220
✓	bimodal2 uses only fresh seeds (>=9)	220
✓	budgets matched within an R	6
✓	converge n_false0=9 arm is internally uniform	15

Appendix

Table 28: Machine-checked invariants, run at build time.

model	$n$	$\leq 0.306$	middle	$\geq 0.512$	middle share	mean $f_{\mathrm{end}}$
qwen3-8b	44	0	0	44	0.000	0.939
ministral-8b	44	6	2	36	0.045	0.808
phi-4	44	10	2	32	0.045	0.757
granite-4.1-8b	44	10	3	31	0.068	0.735
gemma-3-27b	44	11	3	30	0.068	0.724
pooled	220	37	10	173	0.045	0.792

Appendix

Table 29: E-bimodal2 by model. Middle counts runs in the interval

(0.306,0.512)

that § 4.1 calls empty; the pooled bar frozen in the prereg is

10\%

against a uniform baseline of

20.6\%

model	arm	$j{=}0$	$j{=}1$	$j{=}2$	$j{=}3$	$j{=}4$	$j{=}5$	$j{=}6$	$j{=}7$	$j{=}8$
gemma-3-27b-it	A	0.00	0.00	0.03	0.02	0.03	0.00	0.00	0.76	1.00
	n	92	102	76	44	32	31	25	29	19
	B	0.00	0.03	0.05	0.03	0.03	0.04	0.10	0.93	1.00
	n	351	469	392	244	183	142	126	827	3866
granite-4.1-8b	A	0.00	0.00	0.11	0.14	0.18	0.30	0.47	0.84	1.00
	n	42	56	65	58	33	20	17	49	110

Appendix

Table 30:

\gamma(j)

per model and the support of each cell,

j

false records retrieved of

k{=}8

. Generated by make_appendix.py from the same functions gamma_outsample.py uses, so the two cannot disagree.

quantity, at $44$ seeds	$\rho$	design effect	clustered/naive se	$\rho$ at $3$ seeds
level R=45 front	0.665	3.66	1.85	0.084
level R=75 front	0.662	3.65	1.83	0.141
level R=120 front	0.639	3.56	1.80	0.170
contrast R=45 front-back	0.118	1.47	1.15	0.027
contrast R=75 front-back	0.066	1.26	0.99	0.081
contrast R=120 front-back	0.035	1.14	0.93	0.284

Appendix

Table 31: The same runs, the same

44

seeds, two quantities. Levels reproduce § L ’s design effect of

3.75

measured on nine seeds; paired contrasts do not carry it. The right-hand column is what a three-seed subsample of the identical data reports, and for levels it is wrong by a factor of four – which is why the contrast column may not be read off three seeds either, and is read off forty-four.

arm	$f_{0}$	criterion	published	per seed	vs $44$ -seed control	reading
E-gate	low	P-G1 low	5/5	5/5/5	—	not a count of five
E-gate	high	P-G1 high	5/5	5/5/5	5/5	not a count of five
E-A	low	P-A1	4/5	5/3/5	—	seed-fragile
E-A	high	P-A2 worse	1/5	1/1/1	0/5	stable
E-prov	low	P-P1	4/5	5/5/4	—	stable
E-prov	high	P-P2	2/5	1/0/1	3/5	stable

Appendix

Table 32: The eight frozen criteria of the four 3-seed arms. Column three is the published value and is reproduced exactly by this script, which is the check that the re-evaluation is of the same criterion. Column four evaluates the identical rule on each seed alone. Column five replaces the three-seed control by bimodal2 ’s

44

-seed control, available for the high-

f_{0}

cells at no cost.

model	capture, $3$ seeds	capture, $44$ seeds	$\bar{f}$ , $3$	$\bar{f}$ , $44$
gemma-3-27b-it	0.00	0.682	0.150	0.724
granite-4.1-8b	0.33	0.705	0.444	0.735
phi-4	0.33	0.727	0.408	0.757
ministral-8b-2512	0.67	0.818	0.537	0.808
qwen3-8b	1.00	1.000	0.971	0.939

Appendix

Table 33: The ungated, unmarked, no-slot control at

f_{0}{=}0.9

, as the four intervention arms measured it and as bimodal2 measures the identical configuration. Nothing was re-run; the second column is

44

seeds that were already on disk.

arm	pairs	$\rho$ range	mean $\rho$	design effect range
bimodal2 f0=0.9, 44 seeds	10	$+0.29$ to $+0.85$	$+0.53$	2.14–4.39
transient3 front R=45, 44 seeds	10	$+0.24$ to $+0.95$	$+0.65$	1.94–4.79
transient3 front R=120, 44 seeds	10	$+0.18$ to $+0.99$	$+0.62$	1.73–4.95

Appendix

Table 34: Intra-seed correlation over the ten model pairs, and the design effect each pair implies. The pooled figure this paper quotes is a mean over these.

window	$\rho$ at $3$ seeds	$p$	$\rho$ at $44$	$p$	predictor spread, $3\to 44$
$W=3$	$+0.921$	0.067	$+0.500$	0.450	0.333 $\to$ 0.061
$W=5$	$+0.921$	0.067	$+0.308$	0.667	0.400 $\to$ 0.068
$W=8$	$+0.975$	0.033	$+0.564$	0.400	0.458 $\to$ 0.065
$W=10$	$+0.975$	0.033	$+0.800$	0.133	0.500 $\to$ 0.080

Appendix

Table 35: Claim 4’s ordering, at three seeds and at

44

p

is exact over all

120

permutations, not asymptotic. The last two columns are the cross-model spread of the predictor : at three topics the early copy rate separates the five models by

0.33

, at forty-four by

0.06

model	novel writes, median	max	$q$	capture	in dead band
gemma-3-27b-it	2	10	0.02	0.682	1/44
granite-4.1-8b	0	0	0.00	0.705	2/44
ministral-8b-2512	0	0	0.00	0.818	2/44
phi-4	0	0	0.00	0.727	2/44
qwen3-8b	43	128	0.33	1.000	0/44
novel writes 0	$n=161$			0.795	6/161

Appendix

Table 36: The realised answer space of E-bimodal2, per model, and the outcome distribution conditional on it.

q

is the share of non-truth writes taking a fresh value. The split is observational and confounded with model identity, which is why it is also given per model.

subset	$n$	in band	share	capture	$\bar{f}$	distinct retrieved
f0=0.1 (the registered level, P-T1-N6) , band $(0.306,0.512)$
two-valued (novel $=0$ )	338	4	0.012	0.027	0.031	1.21
multi-valued (novel $\geq 1$ )	22	1	0.045	0.455	0.389	2.13
multi-valued (novel $\geq 5$ )	19	1	0.053	0.526	0.445	2.27
within granite-4.1-8b	two-valued 1/163, multi-valued 1/17
within ministral-8b-2512	two-valued 3/175, multi-valued 0/5

Appendix

Table 37: E-real’s runs split by whether the store went multi-valued. The band is the registered void at

f_{0}{=}0.1

and the dead band at

f_{0}{=}0.9

. The multi-valued subset has the fuller band , which is the direction the scripted sweep predicts and the opposite of what E-bimodal2’s highest-

q

model shows.

$p$	capture	in dead band	$\bar{f}_{\mathrm{end}}$	min	max
0.1	0.000	0/400	0.150	0.094	0.225
0.3	0.000	153/400	0.337	0.231	0.431
0.5	0.723	111/400	0.528	0.438	0.625
0.7	1.000	0/400	0.711	0.588	0.806
0.9	1.000	0/400	0.901	0.831	0.956

Appendix

Table 38: A state-independent reader, copy probability

p

, on the identical urn. Its dead band is not empty, so bimodality is not a consequence of the answer space having two values.

$q$	rule	capture	in dead band	$\bar{f}_{\mathrm{end}}$
0.0	count non-truths	1.000	0/400	0.951
0.25	count non-truths	1.000	0/400	0.957
0.5	count non-truths	1.000	0/400	0.948
0.75	count non-truths	1.000	0/400	0.950
1.0	count non-truths	1.000	0/400	0.953
0.0	largest block	1.000	0/400	0.952

Appendix

Table 39: Scattering sweep on the measured

\gamma

of the model whose realised answer space is richest. Under a largest-block rule the empty interval is a statement about a regime, and the regime has a boundary between

q{=}0.25

and

q{=}0.5

arm	model	obs.	cells	thin	below	above	isotonic	$\geq 30$ only	bootstrap $95\%$
A	gemma-3-27b-it	0.682	9/9	3	0.081	0.081	0.081	0.000	$[0.000,0.151]$
	granite-4.1-8b	0.705	9/9	2	0.499	0.499	0.499	0.301	$[0.000,0.842]$
	ministral-8b-2512	0.818	9/9	2	0.545	0.545	0.549	0.365	$[0.227,0.763]$
	phi-4	0.727	9/9	4	0.399	0.399	0.401	0.000	$[0.000,0.966]$
	qwen3-8b	1.000	4/9	2	1.000	1.000	1.000	0.665	$[0.993,1.000]$
	mean $\|$ sim $-$ obs $\|$ , seed units				12.4	12.4	12.3	22.9

Appendix

Table 40: The same comparison as Table 7 under four estimators, with a seed-clustered bootstrap band on the simulated rate. Arm A is the published curve (three topics); arm B re-measures on the forty-four it predicts. The bracket columns coincide wherever no cell needs filling, which is most of arm A.

store	ranker	$k_{\rm eff}$ /avail	truth in top- $k$	sep(T,F)	$k$ oldest	purity
t=0 9 false / 1 true	bm25	1/2	no	0.0000	yes	1.00
	char3	1/2	no	0.0000	yes	1.00
	minilm	2/2	yes	0.0052	no	1.00
t=70 captured, 79/1	bm25	1/2	no	0.0000	yes	1.00
	char3	1/2	no	0.0000	yes	1.00
	minilm	2/2	yes	0.0052	no	1.00

Appendix

Table 41: Three rankers, four store compositions.

k_{\rm eff}

is distinct on-topic values in the top-

k

, over the number available. “

k

oldest” marks a ranker whose top-

k

is exactly the

k

oldest on-topic records, which is what happens when every on-topic score ties and insertion order decides.

	planted max/min		largest block, first $W$					distinct, first $W$
cell	median	max	$1$	$3$	$5$	$10$	$150$	$1$	$3$	$5$	$10$	$150$
near	1.46 $\times$	6.85 $\times$	3.00	3.14	3.26	3.50	5.08	3.75	3.85	3.81	3.73	2.65
far	100.01 $\times$	100.16 $\times$	3.00	3.14	3.21	3.50	5.54	3.75	3.80	3.82	3.73	2.57

Appendix

Table 42: What the manipulation did. The first two columns are the planted values’ own spread. The rest is the largest single-value non-truth block among the

k{=}8

retrieved records, and the number of distinct values retrieved, averaged over the first

W

steps. The two cells are indistinguishable at every window: three planted values give a block of three whether they are near or far apart, which is what makes the contrast a test of whether the model reads near values as agreeing.

cell	$n$	share in the band	capture	$\bar{f}_{\mathrm{end}}$
near	100	0.030	0.870	0.849
far	100	0.000	0.970	0.924
sem	100	0.010	0.070	0.129
bimodal2 ( $v{=}1$ )	220	0.032	—	—

Appendix

Table 43: E-multivalue’s three cells against the published

v{=}1

arm. The band is

[0.35,0.50]

, the interval § 4.1 calls empty.

experiment	runs	models	logged steps
bimodal2	220	5	33,000
budget	90	5	13,461
cl_n10	9	3	270
cl_n20	9	3	540
cl_n40	9	3	1,080
cl_n80	9	3	2,160

Appendix

Table 44: The experimental record, counted at build time.

grade	rows	what the grade means in this paper
withdrawn / superseded	$7$	asserted, then taken back or re-assigned; the sequence is in the post-mortems
not supported / failed	$11$	a frozen criterion was missed, on our own data
self-correction	$7$	our own arithmetic or our own criterion was wrong and is repaired here
not decidable / not evaluable	$8$	the apparatus or the band cannot separate the outcomes: not a null
acknowledged limit	$4$	a boundary of the result, stated where the result is
formal	$1$	proved from the definitions; no measurement can move it

Appendix

Table 58

Claim	Status	Evidence
1. Outcome distribution bimodal, not a decaying mean	measured ; below: 2 not supported, 1 withdrawn	$8/7/0$ split; gap $6.4\times$ mean gap
2. $\gamma(\varphi)$ alone orders capture rate, zero fitted parameters	measured , ordinal; below: 1 not supported, 1 withdrawn	$\rho=+0.82$ at three seeds; $+1.00$ , $p=0.017$ at forty-four
3. The outcome is decided in the first few steps	measured ; below: 1 withdrawn	$12/15$ at $t{=}2$ of $150$
4. Early copy rate orders capture rate	not supported at forty-four seeds; measured as published	$\rho$ $+0.92$ / $+0.98$ at three seeds, $+0.31$ to $+0.80$ at forty-four, $p\geq 0.13$
5. The mean-field sign criterion locates the boundary	measured falsification of our own	$4/5$ drift down, capture anyway
6. Score $=C\cdot s$ : contamination costs determinism, not information	measured	$+0.383$ pass@8 $-$ pass@1

Appendix

Table 47: Every registered claim, one row each. Criteria were frozen in prereg/ before the corresponding data existed; failures are graded, not removed. Grades: measured (criterion met), failed / not supported (criterion missed), refuted (predicted direction wrong), withdrawn (we retract it), untested (apparatus floored), unresolved / undecided (sample insufficient), split (two admissible observables disagree), derived (not measured here), underpowered (the criterion’s own bar is met pooled and missed on at least one of its seeds), diagnosed (a mechanism identified for a graded row, not itself a registered claim).


Claim	Status	Evidence

The 63 rows below were moved here from Table 47 by the rule in papers/split_claims.py : a lettered sub-row whose status is supportive moves; every top-level claim and every row carrying a withdrawal, failure or self-correction stays. Nothing is dropped.

1a. The interval survives a $15\times$ sample, sparse rather than empty	measured at $n{=}220$	P-T1-B1 ′ : $3.6\%$ vs bar $10\%$ , uniform $20.6\%$ ; P-T1-B2 gap $0.799$
1b. The balance between the modes	withdrawn	$8/7$ becomes $39/173$

Appendix

Table 48: Supporting refinements, moved from Table 47 by the stated rule. The direction is deliberate: a selection rule for a scorecard should be biased against its authors, so unflattering rows stay in the main table and supporting detail moves here. claims_all.tex is the source both tables are generated from.

LLM Agent Memory

Large language model agent memory lets agents retain, organize, retrieve, and update information across interactions and long-running tasks.

See all 376 papers

Copying explains the collective behavior of AI agents in the wild
Sep 8, 2026Giordano De Marzo, Nicola Alboré, David GarciaAgent-Based Modeling Emergent Behavior in Multi-Agent Systems
University of Konstanz, Konstanz, Germany · Centro Ricerche Enrico Fermi, Rome, Italy · Intesa Sanpaolo, Data & Artificial Intelligence Office, Turin, Italy +1
Self-Healing Harness for Runtime Oversight of Agent Self-Modification
Sep 21, 2026Sina Tayebati, Divake Kumar, Nastaran Darabi +2Runtime Enforcement for AI Agents LLM Agent Harnesses
University of Illinois Chicago · AI Labs, Capital One
Agents Don't Just Agree, They Remember: Benchmarking Persistent Sycophancy in Self-Improving Personal Agents
Jul 12, 2026Xutao Mao, Liangjie Zhao, Leyao Wang +6LLM Sycophancy LLM Agent Memory
City University of Hong Kong · Adelaide University · Yale University +3

Sep 8, 2026J/K move · Enter open · S save

Copying explains the collective behavior of AI agents in the wild

Giordano De Marzo, Nicola Alboré, David Garcia

University of Konstanz, Konstanz, Germany · Centro Ricerche Enrico Fermi, Rome, Italy · Intesa Sanpaolo, Data & Artificial Intelligence Office, Turin, Italy+1

Agent-Based Modeling Emergent Behavior in Multi-Agent Systems

Open paper AskPDF arXiv

In June 2026, thousands of AI agents found that a small public wiki would accept edits from inside their sandboxes, and started using it to help one another pass a timed test. Each agent lived for about an hour and remembered nothing afterwards. Nobody asked them to cooperate, and the wiki had not been built for them. The complete record of what they wrote is public, and it is unusually informative, because it preserves not only what each agent wrote but what that agent could see before writing. We use it to follow the three decisions an agent had to make on arrival: where to write, what to call itself, and how to word its message. One rule governs all three. An agent takes an option with a probability close to the share of that option in what it can see, and the share that matters is the one on the page in front of it, then the one in the stream of recent edits, and only weakly anything older. Three minimal copying models, one per decision and with a single free parameter each, reproduce the heavy-tailed distribution of how many agents met on a page, the frequency of the pieces from which the agents built their names, and the patchwork of pages that are internally consistent and different from one another. Copying whatever the environment happens to show is enough to produce most of the collective structure of this population. It is also what makes such a population easy to steer, since whoever writes first, or writes while the others are quiet, sets the convention for everyone who comes later.

Abstract

LLM Agent Memory

Explore similar work

Copying explains the collective behavior of AI agents in the wild

Self-Healing Harness for Runtime Oversight of Agent Self-Modification

Agents Don't Just Agree, They Remember: Benchmarking Persistent Sycophancy in Self-Improving Personal Agents