Positions Are Not Facts: The Mismatch Between KV Caches and Memory

Changhai Zhou; Yuhua Zhou; Shiyang Zhang; Jun Gao; Zhen Li; Hua Wu; Hanchao Yu; Haifeng Wang

cs.CLSep 27, 2026

Positions Are Not Facts: The Mismatch Between KV Caches and Memory

Authors: Changhai Zhou, Yuhua Zhou, Shiyang Zhang, Jun Gao, Zhen Li, Hua Wu, Hanchao Yu, Haifeng Wang

Organizations: Fudan University · Baidu · Zhejiang University · Yale University · Hong Kong Polytechnic University

Abstract

When a fact changes, how should a language model update the history stored in its key-value (KV) cache? Hiding the old record is cheap, but it may still contain needed details or answer questions about the past. We compare hiding whole records, hiding only replaced values, and deleting old text and recomputing the cache. In a controlled quantity task, masking makes all eight models prefer the new value more strongly, yet six lose complete answers through unit errors or failure to stop; keeping the unit preserves all current answers. Later states also retain useful information from earlier records: on multi-hop updates, rebuilding these states at unchanged positions lowers historical accuracy by 20-41 percentage points, whereas moving the existing states has little effect. Keeping object dependencies and unchanged revision passages prevents many losses. Recognition is a separate challenge. Learned readouts recover distinctions missed by fixed cache similarities on synthetic record pairs. On natural text, text-detector-selected masks show no clear advantage over random masks at the same rate in 14 same-model detector-generator comparisons. Query-dependent access can avoid some losses, with additional storage or access costs. These findings identify what must be preserved beyond the replaced value when using a KV cache as updatable memory.

Figures & tables

	Current ( $N=1,800$ )				Historical ( $N=600$ )
Model	Full	Value	Source	Recompute	Full	Value	Source	Recompute
Qwen3-4B	81.2% [-.5pt] (1,462)	85.7% [-.5pt] (1,543)	84.2% [-.5pt] (1,515)	88.3% [-.5pt] (1,590)	88.2% [-.5pt] (529)	75% [-.5pt] (450)	74% [-.5pt] (444)	33.5% [-.5pt] (201)
Llama-3.2-3B	44.2% [-.5pt] (795)	53.8% [-.5pt] (969)	63.9% [-.5pt] (1,151)	70.6% [-.5pt] (1,270)	85.8% [-.5pt] (515)	78.8% [-.5pt] (473)	80.2% [-.5pt] (481)	60% [-.5pt] (360)
Qwen3-32B	81.8% [-.5pt] (1,473)	85.3% [-.5pt] (1,535)	83.2% [-.5pt] (1,498)	92.8% [-.5pt] (1,671)	97% [-.5pt] (582)	82.8% [-.5pt] (497)	82.3% [-.5pt] (494)	41.3% [-.5pt] (248)

Table 1: MQuAKE reference matches as percentages (counts), requiring normalized exact reference or alias agreement and EOS. Current questions have three paraphrases per case.

	Current ( $N=600$ )			Historical ( $N=600$ )
Model	Source	Rebuild states	Compact rows	Source	Rebuild states	Compact rows
Qwen3-4B	86.3% [-.5pt] (518)	93.7% [-.5pt] (562)	84.8% [-.5pt] (509)	74% [-.5pt] (444)	32.7% [-.5pt] (196)	74% [-.5pt] (444)
Llama-3.2-3B	66.3% [-.5pt] (398)	69.7% [-.5pt] (418)	66.8% [-.5pt] (401)	80.2% [-.5pt] (481)	60.3% [-.5pt] (362)	81.3% [-.5pt] (488)
Qwen3-32B	84.2% [-.5pt] (505)	95.7% [-.5pt] (574)	82.5% [-.5pt] (495)	82.3% [-.5pt] (494)	44.8% [-.5pt] (269)	82.2% [-.5pt] (493)

Table 2: MQuAKE reference matches as percentages (counts) on 600 current and 600 historical questions. Rebuilding states keeps positions fixed; compaction preserves their previously computed contents.

BABILong (32k)
Historical object locations ( $N=100$ )
Operation	Qwen3- 4B	Llama- 3.2-3B	Qwen3- 32B
Full	33% (33)	25% (25)	40% (40)
Whole source	16% (16)	6% (6)	15% (15)
Keep dependencies	31% (31)	22% (22)	39% (39)

Table 3: Preserving answers when earlier records have other uses. Entries give percentages (counts) and require normal EOS. The two panels use different public tasks and answer criteria.

Appendix figures & tables105 assets

Supplementary material from the paper’s appendix.

Appendix

Study	Unit	$n$	Compared conditions
Candidate scores	Event	320	Source mask; matched control
Synthetic records	Base group	50	Source mask; matched control
Quantity factorial	Base group	10	Whole/number masks; controls
Different units	Base group	120	Two later-record versions; full and masked access
Detector calibration	Base group	120	Fixed threshold; fitted on 18 development groups
OAKS narratives	Question	116	Option-ID and open answers; source-complete subset: 92

Appendix

Table 4: Study sizes and comparison units.

n

counts the listed units, not replicated model outputs. Text or question variants stay together during resampling; source sharing requires the grouped analyses specified for each study. The public rows use the original remaining partition.

Model	Total/active (B)	$L$	$d_{\mathrm{model}}$	Q:KV or MLA	$d_{K}/d_{V}$	$S_{\mathrm{KV}}$ (elem./token)	FFN
Qwen2.5-0.5B	0.49	24	896	$14:2$	64/64	$6\,144$	Dense
Qwen3-0.6B	0.60	28	$1\,024$	$16:8$	128/128	$57\,344$	Dense
Llama-3.2-1B	1.24	16	$2\,048$	$32:8$	64/64	$16\,384$	Dense
Qwen2.5-1.5B	1.54	28	$1\,536$	$12:2$	128/128	$14\,336$	Dense
Qwen3-1.7B	1.72	28	$2\,048$	$16:8$	128/128	$57\,344$	Dense
Qwen2.5-3B	3.09	36	$2\,048$	$16:2$	128/128	$18\,432$	Dense

Appendix

Table 5: Architectures of 19 of the 22 candidate-scoring models and the additional Mistral Small 24B checkpoint.

Model	Query	$n$	Full	Source	Value	Recompute	Online
Qwen3-4B	Current state	720	66% [-.5pt] (475)	69.9% [-.5pt] (503)	79.2% [-.5pt] (570)	76% [-.5pt] (547)	76.7% [-.5pt] (552)
Qwen3-4B	History	1936	24.5% [-.5pt] (475)	11.7% [-.5pt] (226)	12.9% [-.5pt] (249)	13.1% [-.5pt] (254)	14% [-.5pt] (271)
Qwen3-4B	Count	1000	33.9% [-.5pt] (339)	28.7% [-.5pt] (287)	27.1% [-.5pt] (271)	22.5% [-.5pt] (225)	26.2% [-.5pt] (262)
Qwen3-4B	Order	1000	13% [-.5pt] (130)	9.4% [-.5pt] (94)	10.7% [-.5pt] (107)	13.1% [-.5pt] (131)	10.4% [-.5pt] (104)
Qwen3-4B	Multi-hop	1000	28.4% [-.5pt] (284)	20.9% [-.5pt] (209)	21.9% [-.5pt] (219)	27.7% [-.5pt] (277)	24.8% [-.5pt] (248)
Llama-3.2-3B	Current state	720	51% [-.5pt] (367)	60.7% [-.5pt] (437)	60.6% [-.5pt] (436)	55.8% [-.5pt] (402)	70% [-.5pt] (504)

Appendix

Table 6: MINTEval state tracking over 99 histories. Percentages (counts) use the question-type denominators in the

n

column. Answers require normalized reference exact match and normal EOS.

Model	Query	$n$	Full	Source	Value	Recompute	Online
Qwen3-4B	Current multi-hop	1800	81.2% [-.5pt] (1462)	84.2% [-.5pt] (1515)	85.7% [-.5pt] (1543)	88.3% [-.5pt] (1590)	84.8% [-.5pt] (1526)
Qwen3-4B	Historical multi-hop	600	88.2% [-.5pt] (529)	74% [-.5pt] (444)	75% [-.5pt] (450)	33.5% [-.5pt] (201)	73.3% [-.5pt] (440)
Qwen3-4B	Edited single-hop	600	68.5% [-.5pt] (411)	70% [-.5pt] (420)	67.8% [-.5pt] (407)	70.2% [-.5pt] (421)	69.3% [-.5pt] (416)
Llama-3.2-3B	Current multi-hop	1800	44.2% [-.5pt] (795)	63.9% [-.5pt] (1151)	53.8% [-.5pt] (969)	70.6% [-.5pt] (1270)	64.1% [-.5pt] (1154)
Llama-3.2-3B	Historical multi-hop	600	85.8% [-.5pt] (515)	80.2% [-.5pt] (481)	78.8% [-.5pt] (473)	60% [-.5pt] (360)	80% [-.5pt] (480)
Llama-3.2-3B	Edited single-hop	600	97.7% [-.5pt] (586)	98.5% [-.5pt] (591)	98.8% [-.5pt] (593)	95.7% [-.5pt] (574)	98.5% [-.5pt] (591)

Appendix

Table 7: Outcome entries are percentages (counts), using the row-specific

n

. Contextual MQuAKE updates on 600 cases, with 200 each of two, three, and four hops. Counts require normalized supplied-reference exact match and normal EOS; this is not parameter editing.

Model	Task/length	Full history or supplied-span masks				Dynamic capacity 512
Model	Task/length	Full	Source	Neutral	Rule	Quest	FINCH	RefreshKV
Qwen3-4B	qa2/8k	46% [-.5pt] (46)	57% [-.5pt] (57)	46% [-.5pt] (46)	50% [-.5pt] (50)	32% [-.5pt] (32)	37% [-.5pt] (37)	38% [-.5pt] (38)
Qwen3-4B	qa2/32k	36% [-.5pt] (36)	43% [-.5pt] (43)	36% [-.5pt] (36)	39% [-.5pt] (39)	10% [-.5pt] (10)	30% [-.5pt] (30)	45% [-.5pt] (45)
Qwen3-4B	qa3/8k	28% [-.5pt] (28)	13% [-.5pt] (13)	29% [-.5pt] (29)	31% [-.5pt] (31)	18% [-.5pt] (18)	30% [-.5pt] (30)	28% [-.5pt] (28)
Qwen3-4B	qa3/32k	33% [-.5pt] (33)	16% [-.5pt] (16)	32% [-.5pt] (32)	31% [-.5pt] (31)	9% [-.5pt] (9)	29% [-.5pt] (29)	30% [-.5pt] (30)
Llama-3.2-3B	qa2/8k	28% [-.5pt] (28)	29% [-.5pt] (29)	29% [-.5pt] (29)	28% [-.5pt] (28)	20% [-.5pt] (20)	26% [-.5pt] (26)	30% [-.5pt] (30)

Appendix

Table 8: Outcome entries are percentages (counts). BABILong object reasoning at 8k and 32k. Counts out of 100 require the official location-answer criterion and normal EOS. Earlier movement records can remain necessary for object history, particularly on qa3.

Model	Access	Official match /400	Final match /400	Reference agrees /400	Source complete /answerable
Qwen3.8-27B	Full	90% [-.5pt] (360/400)	81.5% [-.5pt] (326/400)	81.5% [-.5pt] (326/400)	90.1% [-.5pt] (336/373)
	Source	85.5% [-.5pt] (342/400)	73.8% [-.5pt] (295/400)	73.5% [-.5pt] (294/400)	80.4% [-.5pt] (300/373)
	Old value	87.5% [-.5pt] (350/400)	76% [-.5pt] (304/400)	75% [-.5pt] (300/400)	82.8% [-.5pt] (309/373)
	Recompute	88.8% [-.5pt] (355/400)	85.5% [-.5pt] (342/400)	85.5% [-.5pt] (342/400)	95.2% [-.5pt] (355/373)
Gemma 4 26B-A4B	Full	31.5% [-.5pt] (126/400)	28% [-.5pt] (112/400)	28% [-.5pt] (112/400)	29.5% [-.5pt] (110/373)
	Source	54% [-.5pt] (216/400)	45.3% [-.5pt] (181/400)	45.3% [-.5pt] (181/400)	49.6% [-.5pt] (185/373)

Appendix

Table 9: Outcome entries give percentages, with the original count/denominator beneath. Current FactConsolidation answers over the full nominal 32k and 64k histories.

Model	Access	EOS (all valid boxes)	Capped	Only box +EOS
Qwen3.8-27B	Full	87.3% (349)	12.8% (51)	11.3% (45)
	Source	78.8% (315)	21.3% (85)	11% (44)
	Old value	80.5% (322)	19.5% (78)	10.5% (42)
	Recompute	91.5% (366)	8.5% (34)	52.3% (209)
Gemma 4 26B-A4B	Full	79% (316)	21% (84)	0% (0)
	Source	54.8% (219)	45.3% (181)	0% (0)

Appendix

Table 10: FactConsolidation termination and output form at the fixed 1,024-token ceiling. Entries are percentages (counts) of all 400 questions per model and operation.

Model	Access	Official match /396	Reference agrees /396	Source complete excluding four	Source complete all questions
Qwen3.8-27B	Full	89.9% [-.5pt] (356/396)	81.3% [-.5pt] (322/396)	90% [-.5pt] (332/369)	90.1% [-.5pt] (336/373)
	Source	85.4% [-.5pt] (338/396)	73.7% [-.5pt] (292/396)	80.8% [-.5pt] (298/369)	80.4% [-.5pt] (300/373)
	Old value	87.4% [-.5pt] (346/396)	75% [-.5pt] (297/396)	82.9% [-.5pt] (306/369)	82.8% [-.5pt] (309/373)
	Recompute	88.9% [-.5pt] (352/396)	85.6% [-.5pt] (339/396)	95.4% [-.5pt] (352/369)	95.2% [-.5pt] (355/373)
Gemma 4 26B-A4B	Full	31.3% [-.5pt] (124/396)	27.8% [-.5pt] (110/396)	29.3% [-.5pt] (108/369)	29.5% [-.5pt] (110/373)
	Source	54% [-.5pt] (214/396)	45.5% [-.5pt] (180/396)	49.9% [-.5pt] (184/369)	49.6% [-.5pt] (185/373)

Appendix

Table 11: Outcome entries give percentages, with the original count/denominator beneath. FactConsolidation sensitivity excluding the four questions seen during runtime qualification.

A. Single-hop questions
Model	Access	32k history		64k history
Model	Access	Official /100	Complete /answerable	Official /100	Complete /answerable
Qwen3.8-27B	Full	98% [-.5pt] (98/100)	99% [-.5pt] (99/100)	98% [-.5pt] (98/100)	98% [-.5pt] (98/100)
	Source	97% [-.5pt] (97/100)	97% [-.5pt] (97/100)	99% [-.5pt] (99/100)	97% [-.5pt] (97/100)
	Old value	98% [-.5pt] (98/100)	98% [-.5pt] (98/100)	98% [-.5pt] (98/100)	98% [-.5pt] (98/100)
	Recompute	98% [-.5pt] (98/100)	100% [-.5pt] (100/100)	98% [-.5pt] (98/100)	100% [-.5pt] (100/100)

Appendix

Table 12: FactConsolidation answers by question type and history length, shown as percentages with the original counts and denominators. The panels distinguish the official score from source-based completeness.

Model	Access	Complete + EOS	Wrong + EOS	Capped	Abstain + EOS
Qwen3.8-27B	Full	90.1% (336)	3.2% (12)	6.7% (25)	0% (0)
	Source mask	80.4% (300)	4% (15)	15.5% (58)	0% (0)
	Old value	82.8% (309)	3.5% (13)	13.7% (51)	0% (0)
	Recompute	95.2% (355)	2.1% (8)	2.7% (10)	0% (0)
Gemma 4 26B-A4B	Full	29.5% (110)	52.8% (197)	17.2% (64)	0.5% (2)
	Source mask	49.6% (185)	7.2% (27)	42.1% (157)	1.1% (4)

Appendix

Table 13: FactConsolidation answer categories as percentages (counts) of the same 373 source-answerable questions. Each row separates content-complete answers, wrong answers, token-limit stops and abstentions.

Model	Controlled			OAKS excerpts
Model	Full	Whole mask	Control	Full	Whole mask	Control
Qwen2.5-0.5B	36.2	54.4	37.2	44.4	60.3	45.0
Qwen2.5-1.5B	75.6	86.2	74.7	45.0	63.8	46.3
Qwen2.5-3B	76.9	85.0	80.0	44.7	63.2	45.8
Qwen2.5-7B	92.8	92.8	91.2	50.3	66.0	49.6
Qwen3-0.6B	69.1	78.4	70.3	50.4	62.3	50.2

Appendix

Table 14: Current-answer candidate accuracy (%) for 22 checkpoints before and after source masking. Full recomputation of edited text is not part of these comparisons.

Model	Format	Full	Whole mask	Control	Margin contrast
Qwen3-4B	raw	87.2	95.0	87.5	$2.985\;\text{\color[rgb]{0.4648,0.4648,0.4648}$ [2.722,,3.253] $}$
Qwen3-4B	native	59.1	68.4	63.1	$1.683\;\text{\color[rgb]{0.4648,0.4648,0.4648}$ [1.173,,2.233] $}$
Qwen3-8B	raw	94.7	93.8	93.8	$2.051\;\text{\color[rgb]{0.4648,0.4648,0.4648}$ [1.867,,2.233] $}$
Qwen3-8B	native	58.1	70.0	57.2	$1.040\;\text{\color[rgb]{0.4648,0.4648,0.4648}$ [0.926,,1.156] $}$
Llama-3.2-3B	raw	82.5	90.6	82.8	$1.636\;\text{\color[rgb]{0.4648,0.4648,0.4648}$ [1.474,,1.803] $}$
Llama-3.2-3B	native	81.6	89.1	82.2	$1.539\;\text{\color[rgb]{0.4648,0.4648,0.4648}$ [1.389,,1.689] $}$

Appendix

Table 15: Format sensitivity on the same 320 controlled test events. The same scorer and literal text are used for both formats. Accuracy is percent; margin contrast is old-mask minus control-mask, with a paired 95% interval.

Model	Candidate accuracy			Source-access comparison
Model	Full	Control	Source	$\Delta m$ [95% CI]	Patterns	$L_{.95}$
Qwen3-32B	96.56	97.81	98.12	+1.87 [1.69, 2.05]	100% [-.5pt] (8/8)	+0.00
Qwen3.8-27B †	93.44	92.81	94.69	+0.85 [0.76, 0.94]	100% [-.5pt] (8/8)	$-$ 1.25
Llama-3.1-70B	92.50	95.94	95.31	+0.66 [0.58, 0.74]	75% [-.5pt] (6/8)	+1.88
Gemma 4 26B-A4B	71.88	72.50	73.44	+0.54 [0.14, 0.94]	62.5% [-.5pt] (5/8)	$-$ 2.50
Gemma 4 31B	70.31	69.38	73.44	+1.22 [0.79, 1.67]	75% [-.5pt] (6/8)	$-$ 4.06

Appendix

Table 16: Outcome entries give percentages, with the original count/denominator beneath. Candidate accuracy and margin changes for five checkpoints on 320 controlled events. Accuracy is supplied-candidate choice accuracy (%). Margin change compares the source mask with its matched control. The final column is the one-sided 95% lower bound for control-minus-full accuracy (pp); the preservation criterion requires this lower bound to exceed

-3

percentage points.

Model	$m_{F}$	$\Delta_{A}$ [95% CI]	$\Delta_{N}$ [95% CI]	$\Delta_{A}-\Delta_{N}$
Qwen2.5-0.5B	$-$ 1.05	+1.51 [1.32, 1.70]	+0.15 [0.09, 0.20]	+1.36
Qwen3-0.6B	1.21	+1.19 [1.03, 1.35]	+0.05 [0.01, 0.08]	+1.14
Llama-3.2-1B	0.37	+1.10 [0.96, 1.24]	$-$ 0.02 [ $-$ 0.06, 0.02]	+1.12
Qwen2.5-1.5B	1.89	+1.16 [1.03, 1.31]	$-$ 0.03 [ $-$ 0.06, 0.01]	+1.19
Qwen3-1.7B	1.29	+0.94 [0.74, 1.16]	+0.05 [ $-$ 0.01, 0.11]	+0.90
Qwen2.5-3B	3.73	+2.13 [1.89, 2.36]	+0.02 [ $-$ 0.07, 0.11]	+2.11

Appendix

Table 17: Absolute-margin decomposition for the same 22-checkpoint inventory as Figure 8 .

m_{F}

is the full-access margin;

\Delta_{A}

and

\Delta_{N}

are source-mask and control-mask changes relative to it. Brackets give paired pointwise 95% intervals in nats. The final column is their difference.

Model	Format	Candidate accuracy			Source-access comparison
Model	Format	Full	Control	Source	$\Delta m$ [95% CI]	$L_{.95}$
Qwen3-32B	Raw	96.56	97.81	98.12	+1.87 [1.69, 2.05]	+0.00
Qwen3-32B	Native	85.94	85.00	90.31	+2.65 [2.33, 2.97]	$-$ 1.88
Qwen3.8-27B †	Raw	94.06	92.81	94.69	+0.84 [0.75, 0.94]	$-$ 2.19
Qwen3.8-27B †	Native	95.00	93.12	95.00	+1.92 [1.70, 2.14]	$-$ 3.75
Llama-3.1-70B	Raw	92.50	95.94	95.31	+0.66 [0.58, 0.74]	+1.88

Appendix

Table 18: Paired raw/native format comparison on the same 320 events. Both formats tokenize their complete text at once; their raw results are separate from segmented-tokenization results. Accuracy columns are percentages;

L_{.95}

is the control-minus-full accuracy lower bound in pp.

Model	Native minus raw $\Delta m$ [95% CI]	Native obsolete change (pp)
Qwen3-32B	+0.78 [0.51, 1.04]	$-$ 5.31 [ $-$ 7.81, $-$ 3.12]
Qwen3.8-27B †	+1.08 [0.88, 1.27]	$-$ 1.87 [ $-$ 4.38, 0.63]
Llama-3.1-70B	+0.97 [0.85, 1.09]	$-$ 3.12 [ $-$ 5.00, $-$ 1.56]
Gemma 4 26B-A4B	+1.19 [0.60, 1.79]	+0.31 [ $-$ 1.88, 2.50]
Gemma 4 31B	$-$ 0.44 [ $-$ 0.93, 0.04]	+0.94 [0.00, 2.19]

Appendix

Table 19: Format-dependent changes. The first column subtracts the raw mask-minus-control margin contrast from its native-format counterpart, retaining each event pair. The second reports source-minus-control obsolete-choice change under native formatting; negative means fewer obsolete choices.

Model	Full	Control	Source	Obsolete change [95% CI]	Books
Qwen3-32B	52.14	51.49	68.26	$-$ 16.77 [ $-$ 21.16, $-$ 12.78]	5/5
Qwen3.8-27B †	48.41	48.59	64.29	$-$ 15.70 [ $-$ 20.10, $-$ 11.53]	5/5
Llama-3.1-70B	50.72	50.39	68.72	$-$ 18.33 [ $-$ 23.28, $-$ 13.81]	5/5
Gemma 4 26B-A4B	57.27	56.55	65.49	$-$ 8.94 [ $-$ 12.32, $-$ 5.84]	5/5
Gemma 4 31B	58.49	58.56	59.36	$-$ 0.80 [ $-$ 4.10, 2.38]	2/5

Appendix

Table 20: OAKS candidate decisions on 336 events from 116 questions. Percentages are equal-weight averages of within-book event rates, not raw totals divided by 336. The obsolete-choice change is source minus control (pp); intervals resample whole questions within each of five books.

Book	Obsolete change (pp)	$\Delta m$ (nats)	Control minus full (pp)
P12	+1.08	+4.30	+3.23
P22	$-$ 1.23	+0.18	$-$ 4.94
P25	+0.00	+5.21	+0.00
P27	$-$ 3.85	+1.05	$-$ 1.92
P37	+0.00	+5.01	+4.00

Appendix

Table 21: Gemma 4 31B book-specific point estimates. Source masking increases margins in every book, but obsolete choices decrease in two, remain unchanged in two, and increase in one. These descriptive book points have no separate uncertainty intervals.

Model	Specified readouts			Retrospective
Model	K matching	V replacement	V minus surface	Reversed V
Qwen3-32B	0.701 [0.694]	0.476 [0.464]	$-$ 0.103 [ $-$ 0.136, $-$ 0.089]	0.524 [0.517]
Qwen3.8-27B †	0.879 [0.869]	0.464 [0.453]	$-$ 0.114 [ $-$ 0.145, $-$ 0.101]	0.536 [0.527]
Llama-3.1-70B	0.648 [0.641]	0.454 [0.440]	$-$ 0.125 [ $-$ 0.160, $-$ 0.107]	0.546 [0.535]
Gemma 4 26B-A4B	0.558 [0.551]	0.477 [0.458]	$-$ 0.101 [ $-$ 0.136, $-$ 0.082]	0.523 [0.506]
Gemma 4 31B	0.573 [0.571]	0.492 [0.483]	$-$ 0.087 [ $-$ 0.115, $-$ 0.074]	0.508 [0.500]

Appendix

Table 22: Fixed readouts and retrospective reversal of the V-distance direction on the same 1,200 pairs from 400 groups. AUC cells include the one-sided 95% lower bound; the V-minus-surface cell has a paired two-sided 95% interval. Recognition requires the lower bound to exceed 0.60. The surface baseline is 0.579.

Signal	Replacement AUC	Question relevance
Lexical overlap	0.500	1.000
Attention to the old source	0.356–0.525	0.316–0.953
Signed leave-one-out	0.466–0.724	0.350–0.636
Qwen3-8B V distance	$0.999\;\text{\color[rgb]{0.4648,0.4648,0.4648}$ [0.998,,1.000] $}$	–

Appendix

Table 23: Replacement-recognition AUC and the fraction of pairs receiving a higher score for the relevant question. Ranges span four models and three budgets; the Qwen3-8B row gives a 95% cluster-bootstrap interval.

Model	AUC [one-sided lower bound]		Relation AUC minus surface baseline
Model	Matching	Relation	Intrinsic	History	$L_{.95}(\min\Delta)$
Qwen3-4B	0.974 [0.968]	0.696 [0.682]	$-$ 0.054	$-$ 0.002	$-$ 0.076
Qwen3-8B	0.968 [0.963]	0.790 [0.766]	+0.040	0.000	0.000
Llama-3.2-3B	0.959 [0.951]	0.813 [0.792]	+0.063	$-$ 0.007	$-$ 0.010
Llama-3.1-8B	0.950 [0.941]	0.847 [0.830]	+0.097	$-$ 0.003	$-$ 0.006
Qwen3-32B	0.931 [0.919]	0.785 [0.766]	+0.035	0.000	—

Appendix

Table 24: Native record-pair recognition across nine models, including the original four-model comparison. Matching and relation cells show the weaker-panel AUC and its one-sided 95% lower bound. The surface comparisons retain both panels; the last column retains the lower bound for the smaller difference where it was reported.

Relation	Direct classifier	Expanded classifier	Value extraction	Extraction + value filter
Replacement	100% [-.5pt] (50/50)	100% [-.5pt] (50/50)	100% [-.5pt] (50/50)	100% [-.5pt] (50/50)
Confirmation	100% [-.5pt] (50/50)	100% [-.5pt] (50/50)	100% [-.5pt] (50/50)	100% [-.5pt] (50/50)
Role swap	100% [-.5pt] (50/50)	40% [-.5pt] (20/50)	92% [-.5pt] (46/50)	0% [-.5pt] (0/50)
Role confirmation	0% [-.5pt] (0/50)	90% [-.5pt] (45/50)	100% [-.5pt] (50/50)	100% [-.5pt] (50/50)
Old value rejected	100% [-.5pt] (50/50)	100% [-.5pt] (50/50)	54% [-.5pt] (27/50)	0% [-.5pt] (0/50)
Unrelated entity	90% [-.5pt] (45/50)	26% [-.5pt] (13/50)	66% [-.5pt] (33/50)	66% [-.5pt] (33/50)

Appendix

Table 25: Relation recognition on 300 test cases from 50 disjoint base items. Cells give percentages with exact counts/denominators. The final rows give accuracy over 300 cases, false positives over 150 negative cases, and false negatives over 150 positive cases. Prompts were fixed before this evaluation. The lexical value filter is applied to the same value-extraction predictions. Appendix B.4 provides the complete prompts.

Model	Value-vector distance			Learned classifier
Model	Fixed	Sign chosen	Head chosen	Separate	Joint K/V	Joint hidden
Qwen3-4B	0.471	0.529	0.479	0.675	0.637	0.730
Qwen3-8B	0.499	0.501	0.638	0.626	0.537	0.525
Qwen3-32B	0.500	0.500	0.701	0.663	0.794	0.724
Qwen3.8-27B †	0.431	0.569	0.621	0.626	0.810	0.755
Llama-3.2-3B	0.473	0.527	0.498	0.696	0.640	0.738

Appendix

Table 26: AUC across all 300 held-out cases, including all six relation variants from the same 50 groups. The target mixture differs from the 100-case role comparison, so these point estimates do not provide additional independent tests of that held-out role comparison.

Model	K/V and hidden depths	Sign	$C_{\rm sep}$	$C_{\rm joint}$	$C_{\rm hidden}$
Qwen3-32B	16/32/48/63	$-$ 1	0.01	0.01	0.1
Qwen3.8-27B †	15/31/47/63	$-$ 1	10	1	1
Llama-3.1-70B	20/40/60/79	$-$ 1	1	10	10
Gemma 4 26B-A4B	7/15/22/29	$-$ 1	0.01	0.1	1
Gemma 4 31B	15/30/45/59	$-$ 1	0.01	0.1	0.01

Appendix

Table 27: Added-model feature depths and regularization selected using the fixed development partition. Depths are zero-based decoder indices.

C

is inverse regularization strength in balanced logistic regression.

Model	Features	All cases AUC	Role cases AUC
Qwen3-4B	Concatenation	0.534 [0.513, 0.555]	0.490 [0.408, 0.568]
Qwen3-4B	Interaction	0.338 [0.305, 0.366]	0.514 [0.479, 0.551]
	Difference	$-$ 0.196 [ $-$ 0.226, $-$ 0.170]	0.024 [ $-$ 0.053, 0.104]
Qwen3-8B	Concatenation	0.392 [0.353, 0.431]	0.495 [0.426, 0.565]
Qwen3-8B	Interaction	0.645 [0.614, 0.678]	0.493 [0.444, 0.545]
	Difference	0.253 [0.198, 0.311]	$-$ 0.002 [ $-$ 0.083, 0.077]

Appendix

Table 28: Predictors with matched feature and parameter counts and paired 95% intervals over the same 50 test groups. Each classifier has 128 features and 129 fitted coefficients including the intercept. Difference denotes interaction features minus concatenation.

Model	Threshold	Dev. BA	Whole-source net [95% CI]		Number-only net [95% CI]
Model	Threshold	Dev. BA	Conditional	Joint CI	Conditional	Joint CI
Qwen3-4B	0.989013057	0.833	$-$ 38 [ $-$ 46, $-$ 31]	[ $-$ 45, $-$ 28]	$-$ 1 [ $-$ 3, +0]	[ $-$ 3, +0]
Qwen3-8B	0.995929862	0.694	$-$ 19 [ $-$ 27, $-$ 12]	[ $-$ 42, $-$ 13]	$-$ 3 [ $-$ 7, +1]	[ $-$ 22, +1]
Qwen3-32B	0.999941709	1.000	$-$ 14 [ $-$ 21, $-$ 8]	[ $-$ 21, $-$ 8]	0 [+0, +0]	[+0, +0]
Qwen3.8-27B †	0.924141822	1.000	0 [+0, +0]	[+0, +0]	0 [+0, +0]	[+0, +0]
Llama-3.2-3B	0.268941427	0.611	$-$ 2 [ $-$ 5, +0]	[ $-$ 9, +0]	$-$ 1 [ $-$ 3, +0]	[ $-$ 4, +0]

Appendix

Table 29: Calibrated detector thresholds and uncertainty in current-answer net changes. Conditional intervals hold the fitted threshold fixed; joint intervals resample development and test groups independently and refit the threshold on each resampled development set.

Model	Selected		Current: fixed		Current: calibrated		History: calibrated
Model	Fixed	Calib.	Whole	Number	Whole	Number	Whole	Number
Qwen3-4B	70% [-.5pt] (168)	62.9% [-.5pt] (151)	$-$ 18.3 pp [-.5pt] ( $-$ 44)	$-$ 1.7 pp [-.5pt] ( $-$ 4)	$-$ 15.8 pp [-.5pt] ( $-$ 38)	$-$ 0.4 pp [-.5pt] ( $-$ 1)	$-$ 62.9 pp [-.5pt] ( $-$ 151)	$-$ 62.9 pp [-.5pt] ( $-$ 151)
Qwen3-8B	74.2% [-.5pt] (178)	65.4% [-.5pt] (157)	$-$ 15 pp [-.5pt] ( $-$ 36)	$-$ 7.9 pp [-.5pt] ( $-$ 19)	$-$ 7.9 pp [-.5pt] ( $-$ 19)	$-$ 1.3 pp [-.5pt] ( $-$ 3)	$-$ 65.4 pp [-.5pt] ( $-$ 157)	$-$ 65.4 pp [-.5pt] ( $-$ 157)
Qwen3-32B	83.3% [-.5pt] (200)	39.6% [-.5pt] (95)	$-$ 19.6 pp [-.5pt] ( $-$ 47)	$-$ 9.6 pp [-.5pt] ( $-$ 23)	$-$ 5.8 pp [-.5pt] ( $-$ 14)	0 pp [-.5pt] (0)	$-$ 39.6 pp [-.5pt] ( $-$ 95)	$-$ 39.6 pp [-.5pt] ( $-$ 95)
Qwen3.8-27B †	66.7% [-.5pt] (160)	49.6% [-.5pt] (119)	$-$ 0.8 pp [-.5pt] ( $-$ 2)	$-$ 0.8 pp [-.5pt] ( $-$ 2)	0 pp [-.5pt] (0)	0 pp [-.5pt] (0)	$-$ 49.6 pp [-.5pt] ( $-$ 119)	$-$ 49.6 pp [-.5pt] ( $-$ 119)
Llama-3.2-3B	0% [-.5pt] (0)	45.4% [-.5pt] (109)	0 pp [-.5pt] (0)	0 pp [-.5pt] (0)	$-$ 0.8 pp [-.5pt] ( $-$ 2)	$-$ 0.4 pp [-.5pt] ( $-$ 1)	$-$ 45.4 pp [-.5pt] ( $-$ 109)	$-$ 45.4 pp [-.5pt] ( $-$ 109)

Appendix

Table 30: Selection entries are percentages (counts); answer changes are percentage points (signed counts), all with denominator 240. Development calibration changes which records are masked, but does not yield a positive current-answer net on this test panel. Counts are out of 240 conditions from 120 groups; signed changes count corrections minus reversals relative to the same full-access baseline.

Model	Selected conditions		Whole-source change			Number-only change
Model	Replaced	Other	Replaced	Other	Total	Replaced	Other	Total
Qwen3-4B	100% [-.5pt] (120)	40% [-.5pt] (48)	$-$ 15.4 pp [-.5pt] ( $-$ 37)	$-$ 2.9 pp [-.5pt] ( $-$ 7)	$-$ 18.3 pp [-.5pt] ( $-$ 44)	0 pp [-.5pt] (0)	$-$ 1.7 pp [-.5pt] ( $-$ 4)	$-$ 1.7 pp [-.5pt] ( $-$ 4)
Qwen3-8B	100% [-.5pt] (120)	48.3% [-.5pt] (58)	$-$ 6.3 pp [-.5pt] ( $-$ 15)	$-$ 8.8 pp [-.5pt] ( $-$ 21)	$-$ 15 pp [-.5pt] ( $-$ 36)	$+$ 0.4 pp [-.5pt] ( $+$ 1)	$-$ 8.3 pp [-.5pt] ( $-$ 20)	$-$ 7.9 pp [-.5pt] ( $-$ 19)
Qwen3-32B	100% [-.5pt] (120)	66.7% [-.5pt] (80)	$-$ 10 pp [-.5pt] ( $-$ 24)	$-$ 9.6 pp [-.5pt] ( $-$ 23)	$-$ 19.6 pp [-.5pt] ( $-$ 47)	0 pp [-.5pt] (0)	$-$ 9.6 pp [-.5pt] ( $-$ 23)	$-$ 9.6 pp [-.5pt] ( $-$ 23)
Qwen3.8-27B †	100% [-.5pt] (120)	33.3% [-.5pt] (40)	0 pp [-.5pt] (0)	$-$ 0.8 pp [-.5pt] ( $-$ 2)	$-$ 0.8 pp [-.5pt] ( $-$ 2)	0 pp [-.5pt] (0)	$-$ 0.8 pp [-.5pt] ( $-$ 2)	$-$ 0.8 pp [-.5pt] ( $-$ 2)
Llama-3.2-3B	0% [-.5pt] (0)	0% [-.5pt] (0)	0 pp [-.5pt] (0)	0 pp [-.5pt] (0)	0 pp [-.5pt] (0)	0 pp [-.5pt] (0)	0 pp [-.5pt] (0)	0 pp [-.5pt] (0)

Appendix

Table 31: Selected rates use 120 conditions per stratum; change columns give contributions in percentage points to overall accuracy on 240 conditions, with signed counts beneath. Detecting replacement does not ensure a beneficial mask. Net changes in complete correct answers when the detector selects records to mask, using the answer-scoring rule that accepts equivalent unit expressions and one outer code block in Section 2 . The 240 evaluations per model pair 120 base groups with both versions of the later record; changes are relative to full access.

Model	Inputs	TP	FP	FN	TN	Acc. (%)
Qwen3-4B	Records	30.2% (35)	4.7% (11)	69.8% (81)	95.3% (221)	73.6
Qwen3-4B	Records + question	61.2% (71)	7.3% (17)	38.8% (45)	92.7% (215)	82.2
Qwen3-8B	Records	50.9% (59)	12.1% (28)	49.1% (57)	87.9% (204)	75.6
Qwen3-8B	Records + question	67.2% (78)	3.4% (8)	32.8% (38)	96.6% (224)	86.8

Appendix

Table 32: TP/FN entries give percentages (counts) of 116 positives; FP/TN use 232 negative controls. Detection scored against benchmark answer-transition labels: 116 annotated OAKS answer transitions and paired repeated-source/different-book controls, 348 cases total. The variant with the question receives no answer labels. False positives and false negatives use the benchmark answer transitions as their reference; the separate source annotations assess whether the queried attribute changes.

Detector: Qwen3-4B
Generator	Records only		Records and question
Generator	Detected: share/C/R	Missed: share/C/R	Detected: share/C/R	Missed: share/C/R
Qwen3-4B	30.2% (35) C: 25.7% (9) R: 0% (0)	69.8% (81) C: 22.2% (18) R: 1.2% (1)	61.2% (71) C: 15.5% (11) R: 1.4% (1)	38.8% (45) C: 35.6% (16) R: 0% (0)
Qwen3-8B	30.2% (35) C: 5.7% (2) R: 0% (0)	69.8% (81) C: 6.2% (5) R: 2.5% (2)	61.2% (71) C: 1.4% (1) R: 0% (0)	38.8% (45) C: 13.3% (6) R: 4.4% (2)
Llama-3.2-3B	30.2% (35) C: 14.3% (5) R: 2.9% (1)	69.8% (81) C: 16% (13) R: 3.7% (3)	61.2% (71) C: 11.3% (8) R: 4.2% (3)	38.8% (45) C: 22.2% (10) R: 2.2% (1)
Detector: Qwen3-8B

Appendix

Table 33: All original detector–generator combinations on the same 116 OAKS transitions. Cells give the selected/missed share of all 116 questions, then correction (C) and reversal (R) percentages within that subset; exact counts are retained for full access

\rightarrow

old-source masking. Each detector row group shares its generated outputs across both prompt conditions; these are paired views, not independent replications.

Source relation	$N$	Outcome	Qwen3-4B	Qwen3-8B	Llama-3.2-3B
Attribute changes	22	Full correct	81.8% (18)	86.4% (19)	86.4% (19)
		Masked correct	90.9% (20)	90.9% (20)	81.8% (18)
		Corrections	9.1% (2)	4.5% (1)	4.5% (1)
		Reversals	0% (0)	0% (0)	9.1% (2)
Attribute changes, unambiguous	12	Full correct	91.7% (11)	91.7% (11)	83.3% (10)
		Masked correct	91.7% (11)	91.7% (11)	66.7% (8)

Appendix

Table 34: Generated outcomes grouped by whether the queried attribute changes. Cells give percentages (counts) of the source-relation group

N

; separate rows report full/masked correctness, corrections and reversals. “Unambiguous” excludes ambiguity in either judgment. The Qwen rows for unambiguous attribute changes contain one error under both conditions, so zero change does not imply perfect accuracy.

Model	Input	Selected	Net	Random (pp)	Gain pp, 95% CI
Qwen 4B	A/B	30.2% (35)	$+$ 7.8 pp ( $+$ 9)	$+$ 6.8 pp ( $+$ 7.84)	+1.00 [ $-$ 2.62, +4.64]
Qwen 4B	A/B + query	61.2% (71)	$+$ 8.6 pp ( $+$ 10)	$+$ 13.7 pp ( $+$ 15.91)	$-$ 5.10 [ $-$ 9.01, $-$ 1.13]
Qwen 8B	A/B	50.9% (59)	$+$ 1.7 pp ( $+$ 2)	$+$ 2.2 pp ( $+$ 2.54)	$-$ 0.47 [ $-$ 2.99, +1.92]
Qwen 8B	A/B + query	67.2% (78)	$+$ 2.6 pp ( $+$ 3)	$+$ 2.9 pp ( $+$ 3.36)	$-$ 0.31 [ $-$ 2.90, +2.20]

Appendix

Table 35: Selected entries are percentages (counts); Net and Random are percentage points (observed or expected counts), using denominator 116. Binary relation selection on all 116 natural transitions, using the same detector and generator model. Random is expected net corrections at the same coverage; the final column is the gain over that baseline in percentage points of all 116 questions.

Model	Synthetic detector accuracy			Affirmed-value triggers
Model	Original	Expanded	Affirmed values	True triggers	False triggers
Qwen3-32B	95.7% [-.5pt] (287/300)	91.3% [-.5pt] (274/300)	98% [-.5pt] (294/300)	100% [-.5pt] (150/150)	4% [-.5pt] (6/150)
Qwen3.8-27B †	100% [-.5pt] (300/300)	100% [-.5pt] (300/300)	100% [-.5pt] (300/300)	100% [-.5pt] (150/150)	0% [-.5pt] (0/150)
Gemma 4 26B-A4B	92% [-.5pt] (276/300)	89.3% [-.5pt] (268/300)	93.3% [-.5pt] (280/300)	99.3% [-.5pt] (149/150)	12.7% [-.5pt] (19/150)
Gemma 4 31B	100% [-.5pt] (300/300)	98.3% [-.5pt] (295/300)	100% [-.5pt] (300/300)	100% [-.5pt] (150/150)	0% [-.5pt] (0/150)
Llama-3.1-70B	96.7% [-.5pt] (290/300)	93.7% [-.5pt] (281/300)	98% [-.5pt] (294/300)	100% [-.5pt] (150/150)	4% [-.5pt] (6/150)

Appendix

Table 36: Outcome entries give percentages, with the original count/denominator beneath. Replacement detection on 300 test conditions from 50 independent synthetic groups. The original prompt extracts old and new values; the expanded prompt adds update examples and a duplicate-value guard; the third compares values affirmed by each record. The final columns use the third prompt.

Model	Question	Full	Detected	Routing	Oracle
Qwen3-32B	Current	99% (297)	93.7% (281)	93.7% (281)	98.3% (295)
	Historical	100% (300)	77% (231)	100% (300)	82.3% (247)
	Unrelated	99.3% (298)	94.3% (283)	99.3% (298)	93.7% (281)
Qwen3.8-27B †	Current	100% (300)	94.3% (283)	94.3% (283)	100% (300)
	Historical	100% (300)	88% (264)	100% (300)	93.3% (280)
	Unrelated	100% (300)	100% (300)	100% (300)	100% (300)

Appendix

Table 37: Complete answers as percentages (counts), with 300 cases per question type and a 256-token budget. Detected policies use Qwen3-4B; the oracle uses known replacement labels.

Detector	TP	FN	FP	TN	Accuracy
Records only: $N_{+}=22$ , $N_{-}=53$
Qwen3-4B	45.5% (10)	54.5% (12)	34% (18)	66% (35)	60% (45)
Qwen3-8B	59.1% (13)	40.9% (9)	52.8% (28)	47.2% (25)	50.7% (38)
Qwen3-32B	50% (11)	50% (11)	30.2% (16)	69.8% (37)	64% (48)
Qwen3.8-27B †	40.9% (9)	59.1% (13)	9.4% (5)	90.6% (48)	76% (57)
Gemma 4 26B-A4B	45.5% (10)	54.5% (12)	3.8% (2)	96.2% (51)	81.3% (61)

Appendix

Table 38: Confusion entries give percentages (counts): TP/FN use

N_{+}

, FP/TN use

N_{-}

, and accuracy uses

N_{+}+N_{-}

. Question conditioning against annotations of whether the queried attribute changes. Each prompt reports change cases as TP/FN, compatible cases as FP/TN, and the correct-label count. The 22/53 groups combine the seven-model comparison with the original confusion counts; the 12/23 groups give the two-model sensitivity analysis after excluding ambiguous annotations.

Model	Records only		Records and question
Model	Selected / net	Excess over random	Selected / net	Excess over random
Qwen3-4B	30.2% (35) $+$ 7.8 pp ( $+$ 9)	+1.00 [ $-$ 2.50, 4.74]	61.2% (71) $+$ 8.6 pp ( $+$ 10)	$-$ 5.10 [ $-$ 8.86, $-$ 1.43]
Qwen3-8B	50.9% (59) $+$ 1.7 pp ( $+$ 2)	$-$ 0.47 [ $-$ 2.99, 2.00]	67.2% (78) $+$ 2.6 pp ( $+$ 3)	$-$ 0.31 [ $-$ 2.90, 2.05]
Qwen3-32B	30.2% (35) $+$ 1.7 pp ( $+$ 2)	+0.42 [ $-$ 2.07, 3.05]	63.8% (74) $+$ 1.7 pp ( $+$ 2)	$-$ 1.03 [ $-$ 3.72, 1.52]
Qwen3.8-27B †	14.7% (17) 0 pp ( $+$ 0)	$-$ 1.14 [ $-$ 2.03, $-$ 0.45]	31.9% (37) $+$ 0.9 pp ( $+$ 1)	$-$ 1.61 [ $-$ 3.40, 0.24]
Gemma 4 26B-A4B	13.8% (16) $+$ 0.9 pp ( $+$ 1)	$-$ 0.21 [ $-$ 1.66, 1.63]	47.4% (55) $+$ 1.7 pp ( $+$ 2)	$-$ 1.95 [ $-$ 5.08, 1.16]

Appendix

Table 39: Selected/net cells show selection percentage (count) above net accuracy change in pp (signed count), both over 116 questions. Whether a detector selects helpful masks on 116 narrative answer transitions. For matched detector and generator checkpoints, each prompt shows selected cases / net corrections and the excess net accuracy over random selection at the same coverage, in percentage points with a paired 95% interval.

Source class ( $N$ )	Outcome	Qwen3-4B	Qwen3-8B	Llama-3.2-3B
Strict replacement (29)	Detector trigger	27.6% (8)	51.7% (15)	–
	Correct: F $\to$ M	79.3% (23) $\to$ 93.1% (27)	89.7% (26) $\to$ 93.1% (27)	75.9% (22) $\to$ 79.3% (23)
	Old: F $\to$ M	20.7% (6) $\to$ 6.9% (2)	10.3% (3) $\to$ 0% (0)	24.1% (7) $\to$ 20.7% (6)
	UNKNOWN: F $\to$ M	0% (0) $\to$ 0% (0)	0% (0) $\to$ 6.9% (2)	0% (0) $\to$ 0% (0)
	Corrections	13.8% (4)	3.4% (1)	6.9% (2)
	Reversals	0% (0)	0% (0)	3.4% (1)

Appendix

Table 40: Detection and generated answers under the same mutually exclusive four-class rubric. All outcome entries give percentages (counts) of the source class. F/M denotes full access/source masking; corrections and reversals use the same class denominator. Detector rows use records-only inputs; the dash denotes an unmeasured detector. Every result uses its source-class denominator; all 116 questions, including ambiguous cases, retain the original benchmark answer targets.

Model	Query	Full	Whole	Whole ctrl.	Number-only	Number ctrl.
Qwen3-4B	Current	83.3% [-.5pt] (200)	45% [-.5pt] (108)	82.9% [-.5pt] (199)	67.5% [-.5pt] (162)	83.3% [-.5pt] (200)
Qwen3-4B	Historical	100% [-.5pt] (240)	9.2% [-.5pt] (22)	100% [-.5pt] (240)	17.1% [-.5pt] (41)	100% [-.5pt] (240)
Qwen3-4B	Unrelated	100% [-.5pt] (240)	100% [-.5pt] (240)	100% [-.5pt] (240)	100% [-.5pt] (240)	100% [-.5pt] (240)
Qwen3-8B	Current	84.2% [-.5pt] (202)	55.4% [-.5pt] (133)	84.2% [-.5pt] (202)	67.5% [-.5pt] (162)	84.6% [-.5pt] (203)
Qwen3-8B	Historical	100% [-.5pt] (240)	10.8% [-.5pt] (26)	100% [-.5pt] (240)	16.7% [-.5pt] (40)	100% [-.5pt] (240)
Qwen3-8B	Unrelated	100% [-.5pt] (240)	100% [-.5pt] (240)	100% [-.5pt] (240)	100% [-.5pt] (240)	100% [-.5pt] (240)

Appendix

Table 41: Outcome entries are percentages (counts). Answer preservation across all query types in the experiment with six measurement units. Correct answers out of 240 conditions from 120 independent groups for each model and query type; quantity rows accept the equivalent unit expressions specified in Appendix C.1 . All exact-string counts are released separately. Whole ctrl. and Number ctrl. mask as many tokens as their respective source masks.

Model	Input	Selected	Non-repl.	Net whole	Net number-only
Qwen3-4B	Pair YES/NO	70% [-.5pt] (168)	40% [-.5pt] (48)	$-$ 18.3 pp [-.5pt] ( $-$ 44)	$-$ 1.7 pp [-.5pt] ( $-$ 4)
Qwen3-4B	Value extraction	83.3% [-.5pt] (200)	66.7% [-.5pt] (80)	$-$ 32.1 pp [-.5pt] ( $-$ 77)	$-$ 15.8 pp [-.5pt] ( $-$ 38)
Qwen3-4B	True replacement labels	50% [-.5pt] (120)	0% [-.5pt] (0)	$-$ 15.4 pp [-.5pt] ( $-$ 37)	0 pp [-.5pt] ( $+$ 0)
Qwen3-8B	Pair YES/NO	74.2% [-.5pt] (178)	48.3% [-.5pt] (58)	$-$ 15 pp [-.5pt] ( $-$ 36)	$-$ 7.9 pp [-.5pt] ( $-$ 19)
Qwen3-8B	Value extraction	83.3% [-.5pt] (200)	66.7% [-.5pt] (80)	$-$ 23.3 pp [-.5pt] ( $-$ 56)	$-$ 14.2 pp [-.5pt] ( $-$ 34)
Qwen3-8B	True replacement labels	50% [-.5pt] (120)	0% [-.5pt] (0)	$-$ 6.3 pp [-.5pt] ( $-$ 15)	$+$ 0.4 pp [-.5pt] ( $+$ 1)

Appendix

Table 42: Selected percentages use 240 conditions; Non-repl. percentages use 120 negative conditions; net changes are pp over 240, with all counts retained. Mask selection at the fixed threshold on 240 current-query conditions from 120 groups. Non-repl. counts selected negative relations, not necessarily harmful actions. Net columns are corrections minus reversals in complete answers relative to full access. The ground-truth policy receives replacement labels, not labels indicating whether masking will help.

Model	Pool	Selected	Prec. (%)	Neg.	Full	Net whole	Net number
Qwen3-4B	All	70% [-.5pt] (168)	71.4	40% [-.5pt] (48)	83.3% [-.5pt] (200)	$-$ 18.3 pp [-.5pt] ( $-$ 44)	$-$ 1.7 pp [-.5pt] ( $-$ 4)
	Exclude	64% [-.5pt] (128)	93.8	10% [-.5pt] (8)	100% [-.5pt] (200)	$-$ 22 pp [-.5pt] ( $-$ 44)	$-$ 2 pp [-.5pt] ( $-$ 4)
Qwen3-8B	All	74.2% [-.5pt] (178)	67.4	48.3% [-.5pt] (58)	84.2% [-.5pt] (202)	$-$ 15 pp [-.5pt] ( $-$ 36)	$-$ 7.9 pp [-.5pt] ( $-$ 19)
	Exclude	69% [-.5pt] (138)	87.0	22.5% [-.5pt] (18)	99.5% [-.5pt] (199)	$-$ 16.5 pp [-.5pt] ( $-$ 33)	$-$ 8 pp [-.5pt] ( $-$ 16)
Qwen3-32B	All	83.3% [-.5pt] (200)	60.0	66.7% [-.5pt] (80)	76.3% [-.5pt] (183)	$-$ 19.6 pp [-.5pt] ( $-$ 47)	$-$ 9.6 pp [-.5pt] ( $-$ 23)
	Exclude	80% [-.5pt] (160)	75.0	50% [-.5pt] (40)	90.5% [-.5pt] (181)	$-$ 22.5 pp [-.5pt] ( $-$ 45)	$-$ 10.5 pp [-.5pt] ( $-$ 21)

Appendix

Table 43: Selected/Full are percentages of the named pool; Neg. uses 120/80 eligible negatives in All/Exclude; Net is pp of the named pool. Parentheses retain exact counts. Effect of excluding the auxiliary-attribute class at the fixed pair-score threshold 0.5. All: 240 conditions from 120 groups; Exclude: 200 conditions from 100 groups. Neg.: selected non-replacements; Full: complete correct answers before the policy acts. Net is corrections minus reversals for the named mask scope. Dashes indicate undefined precision when nothing is selected.

Model	Unit	$n$	Exact	Complete	Missing	Generic	Wrong
Qwen3-4B	minutes	9	11.1% [-.5pt] (1)	11.1% [-.5pt] (1)	88.9% [-.5pt] (8)	0% [-.5pt] (0)	0% [-.5pt] (0)
	meters	14	42.9% [-.5pt] (6)	42.9% [-.5pt] (6)	35.7% [-.5pt] (5)	21.4% [-.5pt] (3)	0% [-.5pt] (0)
	liters	10	0% [-.5pt] (0)	0% [-.5pt] (0)	70% [-.5pt] (7)	30% [-.5pt] (3)	0% [-.5pt] (0)
	volts	10	70% [-.5pt] (7)	100% [-.5pt] (10)	0% [-.5pt] (0)	0% [-.5pt] (0)	0% [-.5pt] (0)
	grams	11	45.5% [-.5pt] (5)	54.5% [-.5pt] (6)	45.5% [-.5pt] (5)	0% [-.5pt] (0)	0% [-.5pt] (0)
	hours	6	0% [-.5pt] (0)	0% [-.5pt] (0)	83.3% [-.5pt] (5)	16.7% [-.5pt] (1)	0% [-.5pt] (0)

Appendix

Table 44: Current answers after whole-source masking when the update refers to the earlier unit. Percentages (counts) use the per-unit

n

in each row and distinguish complete answers from omitted, generic or wrong units.

Relation	Scope	Full/ $N$	Selected	C/R	Net	False
Replacement	Whole	99.8% [-.5pt] (958/960)	87.5% [-.5pt] (840)	0.1% (1) 20.1% (193)	$-$ 20 pp [-.5pt] ( $-$ 192)	0% [-.5pt] (0)
	Number-only	99.8% [-.5pt] (958/960)	87.5% [-.5pt] (840)	0.2% (2) 0% (0)	$+$ 0.2 pp [-.5pt] ( $+$ 2)	0% [-.5pt] (0)
Confirmation	Whole	100% [-.5pt] (320/320)	1.3% [-.5pt] (4)	0% (0) 0.9% (3)	$-$ 0.9 pp [-.5pt] ( $-$ 3)	1.3% [-.5pt] (4)
	Number-only	100% [-.5pt] (320/320)	1.3% [-.5pt] (4)	0% (0) 0% (0)	0 pp [-.5pt] ( $+$ 0)	1.3% [-.5pt] (4)
Other attribute	Whole	18.8% [-.5pt] (60/320)	80% [-.5pt] (256)	0% (0) 11.9% (38)	$-$ 11.9 pp [-.5pt] ( $-$ 38)	80% [-.5pt] (256)
	Number-only	18.8% [-.5pt] (60/320)	80% [-.5pt] (256)	0% (0) 11.9% (38)	$-$ 11.9 pp [-.5pt] ( $-$ 38)	80% [-.5pt] (256)

Appendix

Table 45: Entries are percentages (counts) of the relation population; Net is pp. C/R is corrections above reversals, each with the same denominator. Pair-score selection at the fixed threshold

s\geq 0.5

, pooled across all eight models at the common 40-token response limit. Complete-response correctness retains every candidate.

Mask condition	Unit in B	Unit from A	Both
Full	68.3% [-.5pt] (82/120)	53.3% [-.5pt] (64/120)	60.8% [-.5pt] (146/240)
Whole-source mask	98.3% [-.5pt] (118/120)	67.5% [-.5pt] (81/120)	82.9% [-.5pt] (199/240)
Whole-source control	6.7% [-.5pt] (8/120)	0% [-.5pt] (0/120)	3.3% [-.5pt] (8/240)
Number-only mask	70% [-.5pt] (84/120)	55.8% [-.5pt] (67/120)	62.9% [-.5pt] (151/240)
Number-only control	67.5% [-.5pt] (81/120)	54.2% [-.5pt] (65/120)	60.8% [-.5pt] (146/240)

Appendix

Table 46: Outcome entries give percentages, with the original count/denominator beneath. Correct Llama answers to unrelated-label questions. Each information condition has 120 questions; the two conditions share 120 base groups. All errors are UNKNOWN.

Prompt	Mask	Tokens	Correct	UNKNOWN	$\bar{m}_{v}$ [95% CI]
Original	Full	0	60.8% [-.5pt] (146)	39.2% [-.5pt] (94)	$+0.20\,\text{\color[rgb]{0.4648,0.4648,0.4648}$ [-0.07,,+0.47] $}$
	Early note	31	3.3% [-.5pt] (8)	96.7% [-.5pt] (232)	$-3.05\,\text{\color[rgb]{0.4648,0.4648,0.4648}$ [-3.35,,-2.75] $}$
	Middle note	31	67.9% [-.5pt] (163)	32.1% [-.5pt] (77)	$+0.52\,\text{\color[rgb]{0.4648,0.4648,0.4648}$ [+0.26,,+0.78] $}$
	Late note	31	62.1% [-.5pt] (149)	37.9% [-.5pt] (91)	$+0.24\,\text{\color[rgb]{0.4648,0.4648,0.4648}$ [-0.01,,+0.48] $}$
	Sentence end	32	3.3% [-.5pt] (8)	96.7% [-.5pt] (232)	$-3.04\,\text{\color[rgb]{0.4648,0.4648,0.4648}$ [-3.34,,-2.74] $}$
	All note	127	16.3% [-.5pt] (39)	83.8% [-.5pt] (201)	$-1.92\,\text{\color[rgb]{0.4648,0.4648,0.4648}$ [-2.21,,-1.64] $}$

Appendix

Table 47: Outcome entries are percentages (counts). All 14 Llama-3.2-3B input and mask conditions. Each row contains 240 outputs for unrelated questions, preserving both conditions from each of the 120 paired base groups.

Model	Change in log probability (nats)		Complete / 60
Model	Current candidate	Old candidate	Control / Mask
Qwen3-4B	$-$ 3.82 [ $-$ 4.95, $-$ 2.74]	$-$ 14.73 [ $-$ 16.09, $-$ 13.38]	100% (60) 38.3% (23)
Qwen3-8B	$-$ 3.31 [ $-$ 3.90, $-$ 2.76]	$-$ 26.13 [ $-$ 28.46, $-$ 23.86]	100% (60) 73.3% (44)
Qwen3-32B	$-$ 0.86 [ $-$ 1.21, $-$ 0.54]	$-$ 8.21 [ $-$ 9.07, $-$ 7.40]	100% (60) 60% (36)
Qwen3.8-27B †	$-$ 0.57 [ $-$ 0.66, $-$ 0.49]	$-$ 8.88 [ $-$ 9.34, $-$ 8.42]	100% (60) 100% (60)
Llama-3.2-3B	$-$ 0.48 [ $-$ 0.67, $-$ 0.30]	$-$ 7.53 [ $-$ 8.37, $-$ 6.72]	100% (60) 91.7% (55)

Appendix

Table 48: Outcome entries give percentages (counts), N=60. Paired entries are top/bottom in the original header order. A larger margin can accompany lower probability for the correct answer. Post-hoc decomposition of mean log-probability changes (nats) for whole-source masking relative to its matched control on the same 60 replacement groups as Figure 2 . Brackets give pointwise 95% paired group-bootstrap intervals. Correct counts require the complete response, under the scoring rule in Section 2 .

Model	Current ( $n=60$ )			Historical ( $n=240$ )			Unrelated ( $n=240$ )
Model	Full	Whole	Number	Full	Whole	Number	Full	Whole	Number
Qwen3-4B	100% [-.5pt] (60)	38.3% [-.5pt] (23)	100% [-.5pt] (60)	100% [-.5pt] (240)	9.2% [-.5pt] (22)	17.1% [-.5pt] (41)	100% [-.5pt] (240)	100% [-.5pt] (240)	100% [-.5pt] (240)
Qwen3-8B	98.3% [-.5pt] (59)	73.3% [-.5pt] (44)	100% [-.5pt] (60)	100% [-.5pt] (240)	10.8% [-.5pt] (26)	16.7% [-.5pt] (40)	100% [-.5pt] (240)	100% [-.5pt] (240)	100% [-.5pt] (240)
Qwen3-32B	100% [-.5pt] (60)	60% [-.5pt] (36)	100% [-.5pt] (60)	100% [-.5pt] (240)	14.2% [-.5pt] (34)	16.7% [-.5pt] (40)	100% [-.5pt] (240)	100% [-.5pt] (240)	100% [-.5pt] (240)
Qwen3.8-27B †	100% [-.5pt] (60)	100% [-.5pt] (60)	100% [-.5pt] (60)	100% [-.5pt] (240)	10.4% [-.5pt] (25)	17.5% [-.5pt] (42)	100% [-.5pt] (240)	100% [-.5pt] (240)	100% [-.5pt] (240)
Llama-3.2-3B	100% [-.5pt] (60)	91.7% [-.5pt] (55)	100% [-.5pt] (60)	100% [-.5pt] (240)	15.8% [-.5pt] (38)	3.3% [-.5pt] (8)	60.8% [-.5pt] (146)	82.9% [-.5pt] (199)	62.9% [-.5pt] (151)

Appendix

Table 49: Outcome entries are percentages (counts), with denominators stated in each panel or row. Complete answers across three question types. Current questions use the 60 replacement groups where B refers to A for its unit. Historical and unrelated questions each use 240 conditions: the same 120 groups under both versions of B. These repeated conditions are not additional independent groups.

Generator	Text parameters (B)	Native attention
Qwen3-4B	4.02	Full attention
Qwen3-8B	8.19	Full attention
Qwen3-32B	32.76	Full attention
Qwen3.8-27B	26.90	16 full-attention, 48 DeltaNet layers
Llama-3.2-3B	3.21	Full attention
Llama-3.1-70B	70.55	Full attention

Appendix

Table 50: Eight generators evaluated on the task of answering quantity questions. Parameter counts refer to the loaded text decoder, excluding unused visual and multi-token prediction modules. MoE reports total/active parameters; the active count is the model-card approximation.

Model	Full	Whole	Whole ctrl.	Number	Number ctrl.
Qwen3-4B	100% [-.5pt] (60)	31.7% (19) 38.3% (23)	100% [-.5pt] (60)	100% [-.5pt] (60)	100% [-.5pt] (60)
Qwen3-8B	98.3% [-.5pt] (59)	5% (3) 73.3% (44)	100% [-.5pt] (60)	100% [-.5pt] (60)	98.3% [-.5pt] (59)
Qwen3-32B	0% [-.5pt] (0)	0% [-.5pt] (0)	0% [-.5pt] (0)	0% [-.5pt] (0)	0% [-.5pt] (0)
Qwen3.8-27B †	100% [-.5pt] (60)	83.3% (50) 100% (60)	100% [-.5pt] (60)	100% [-.5pt] (60)	100% [-.5pt] (60)
Llama-3.2-3B	100% [-.5pt] (60)	91.7% [-.5pt] (55)	100% [-.5pt] (60)	100% [-.5pt] (60)	100% [-.5pt] (60)
Llama-3.1-70B	98.3% [-.5pt] (59)	100% [-.5pt] (60)	98.3% [-.5pt] (59)	100% [-.5pt] (60)	100% [-.5pt] (60)

Appendix

Table 51: Outcome entries give percentages (counts), N=60. Paired entries are top/bottom in the original header order. Exact matching and acceptance of unit variants on the same 60 replacement groups per model, with B referring to A for its unit. A single count means that both rules agree; arrows give exact match

\rightarrow

unit variants. Neither rule accepts an outer Markdown code fence.

Model	Complete answers			Whole-source failure categories
Model	Full	Whole	Number	M/G	Unit	Value	Other	Format	Cap
Qwen3-4B	100% [-.5pt] (60)	38.3% [-.5pt] (23)	100% [-.5pt] (60)	61.7% [-.5pt] (37)	0% [-.5pt] (0)	0% [-.5pt] (0)	0% [-.5pt] (0)	0% [-.5pt] (0)	0% [-.5pt] (0)
Qwen3-8B	98.3% [-.5pt] (59)	73.3% [-.5pt] (44)	100% [-.5pt] (60)	26.7% [-.5pt] (16)	0% [-.5pt] (0)	0% [-.5pt] (0)	0% [-.5pt] (0)	0% [-.5pt] (0)	0% [-.5pt] (0)
Qwen3-32B	100% [-.5pt] (60)	60% [-.5pt] (36)	100% [-.5pt] (60)	40% [-.5pt] (24)	0% [-.5pt] (0)	0% [-.5pt] (0)	0% [-.5pt] (0)	0% [-.5pt] (0)	0% [-.5pt] (0)
Qwen3.8-27B †	100% [-.5pt] (60)	100% [-.5pt] (60)	100% [-.5pt] (60)	0% [-.5pt] (0)	0% [-.5pt] (0)	0% [-.5pt] (0)	0% [-.5pt] (0)	0% [-.5pt] (0)	0% [-.5pt] (0)
Llama-3.2-3B	100% [-.5pt] (60)	91.7% [-.5pt] (55)	100% [-.5pt] (60)	0% [-.5pt] (0)	8.3% [-.5pt] (5)	0% [-.5pt] (0)	0% [-.5pt] (0)	0% [-.5pt] (0)	0% [-.5pt] (0)

Appendix

Table 52: Outcome entries are percentages (counts). Current-answer counts and whole-source-mask failures on 60 replacement groups per model when B refers to A for its unit. When B states the complete quantity, all eight models instead score 60/60 under Full, Whole and Number, with no missing/generic-unit, wrong-unit, wrong-value, other, format or token-limit failures under the whole-source mask.

Model	Mask	Selected	Changed answers		Net change by relation
Model	Mask	Selected	Corr.	Rev.	Replaced	Other	Total
Qwen3-4B	Whole	70% [-.5pt] (168)	0% [-.5pt] (0)	18.3% [-.5pt] (44)	$-$ 15.4 pp [-.5pt] ( $-$ 37)	$-$ 2.9 pp [-.5pt] ( $-$ 7)	$-$ 18.3 pp [-.5pt] ( $-$ 44)
	Number	70% [-.5pt] (168)	0% [-.5pt] (0)	1.7% [-.5pt] (4)	0 pp [-.5pt] (0)	$-$ 1.7 pp [-.5pt] ( $-$ 4)	$-$ 1.7 pp [-.5pt] ( $-$ 4)
Qwen3-8B	Whole	74.2% [-.5pt] (178)	0% [-.5pt] (0)	15% [-.5pt] (36)	$-$ 6.3 pp [-.5pt] ( $-$ 15)	$-$ 8.8 pp [-.5pt] ( $-$ 21)	$-$ 15 pp [-.5pt] ( $-$ 36)
	Number	74.2% [-.5pt] (178)	0.4% [-.5pt] (1)	8.3% [-.5pt] (20)	$+$ 0.4 pp [-.5pt] ( $+$ 1)	$-$ 8.3 pp [-.5pt] ( $-$ 20)	$-$ 7.9 pp [-.5pt] ( $-$ 19)
Qwen3-32B	Whole	83.3% [-.5pt] (200)	0% [-.5pt] (0)	19.6% [-.5pt] (47)	$-$ 10 pp [-.5pt] ( $-$ 24)	$-$ 9.6 pp [-.5pt] ( $-$ 23)	$-$ 19.6 pp [-.5pt] ( $-$ 47)

Appendix

Table 53: Selected/correction/reversal entries are percentages of240; net contributions are pp over240, with counts retained. Current-answer changes for masks selected by the detector at a fixed threshold. Scoring permits an outer Markdown code fence and equivalent unit expressions. Each model has 240 information conditions, retaining both versions of the later record for each of 120 base groups.

Model	Lost answers	AUC for a lost answer		Threshold $\tau$ on the current-answer drop
Model	Lost answers	Current-answer drop	Smaller margin gain	Lost flagged	Kept flagged
Qwen3-4B	61.7% [-.5pt] (37/60)	0.98 [0.94, 1.00]	0.70 [0.57, 0.83]	94.6% [-.5pt] (35/37) [82, 99]%	13% [-.5pt] (3/23) [3, 34]%
Qwen3-8B	25.4% [-.5pt] (15/59)	0.95 [0.88, 0.99]	0.61 [0.43, 0.78]	100% [-.5pt] (15/15) [78, 100]%	88.6% [-.5pt] (39/44) [75, 96]%
Qwen3-32B	40% [-.5pt] (24/60)	0.98 [0.95, 1.00]	0.43 [0.28, 0.58]	87.5% [-.5pt] (21/24) [68, 97]%	11.1% [-.5pt] (4/36) [3, 26]%
Qwen3.8-27B †	0% [-.5pt] (0/60)	–	–	–	91.7% [-.5pt] (55/60) [82, 97]%
Llama-3.2-3B	8.3% [-.5pt] (5/60)	0.89 [0.77, 1.00]	0.11 [0.01, 0.26]	100% [-.5pt] (5/5) [48, 100]%	18.2% [-.5pt] (10/55) [9, 31]%

Appendix

Table 54: Outcome fractions are percentages (original n/N); associated binomial intervals are in percent. AUC columns retain their original scale. The current-answer drop ranks lost complete answers more consistently than the margin gain. Lost answers are complete under full access and incomplete under whole-source masking; kept answers are complete under both. AUC columns rank lost above kept unit-dependent answers.

Historical matches by stratum
Model	Historical answer	Full	Source	Online	Recompute	Recompute $-$ source (points)
Qwen3-4B	Retained (520)	93.5% [-.5pt] (486)	84.4% [-.5pt] (439)	83.7% [-.5pt] (435)	36.9% [-.5pt] (192)	$-$ 47.5 [ $-$ 52.1, $-$ 42.9]
	Masked only (80)	53.8% [-.5pt] (43)	6.3% [-.5pt] (5)	6.3% [-.5pt] (5)	11.3% [-.5pt] (9)	+5.0 [ $-$ 1.2, 11.2]
Qwen3-32B	Retained (520)	97.3% [-.5pt] (506)	93.3% [-.5pt] (485)	93.5% [-.5pt] (486)	45.8% [-.5pt] (238)	$-$ 47.5 [ $-$ 51.9, $-$ 43.1]
	Masked only (80)	95% [-.5pt] (76)	11.3% [-.5pt] (9)	10% [-.5pt] (8)	12.5% [-.5pt] (10)	+1.2 [ $-$ 5.0, 7.5]
Llama-3.2-3B	Retained (520)	84.8% [-.5pt] (441)	88.7% [-.5pt] (461)	88.5% [-.5pt] (460)	65.2% [-.5pt] (339)	$-$ 23.5 [ $-$ 27.3, $-$ 19.6]

Appendix

Table 55: Historical matches and offline routing on MQuAKE and FactConsolidation. Answer cells give percentages (counts). The upper block uses the stated retained/masked-only stratum sizes; routing uses 3,000 MQuAKE or 373 source-answerable FactConsolidation questions per model.

Model	Operation	Box-only	Same style as full access	Quotes a masked record	Stopped at 1,024 tokens
Qwen3.8-27B †	Full access	12.1% [-.5pt] (45)	–	79.6% [-.5pt] (297)	6.7% [-.5pt] (25)
Gemma 4 26B-A4B	Full access	0% [-.5pt] (0)	–	64.9% [-.5pt] (242)	17.2% [-.5pt] (64)

Appendix

Table 56: Outcome entries are percentages (counts). Answer style, quotation of masked records and token-limit stops on the 373 source-answerable FactConsolidation questions (counts of 373). A box-only answer consists of a single boxed answer. Same style compares each output with the full-access output for the same question.

Model	Cases	Stopped at the limit	First answer correct	Re-check phrase	Missing-referent phrase
Gemma 4 26B-A4B	Unit-dependent replacement	95% [-.5pt] (57/60)	98.2% [-.5pt] (56/57) [91, 100]%	100% [-.5pt] (57/57)	73.7% [-.5pt] (42/57)
Gemma 4 31B	Unit-dependent replacement	100% [-.5pt] (60/60)	78.3% [-.5pt] (47/60) [66, 88]%	100% [-.5pt] (60/60)	95% [-.5pt] (57/60)

Appendix

Table 57: Outcome fractions are percentages (original n/N); associated binomial intervals are in percent. AUC columns retain their original scale. Gemma quantity-task outputs that reach the 256-token limit under whole-source masking, for current questions. The first answer is the first JSON object with a string answer field, scored by the content rule (same number and an accepted form of the unit).

Reference: source masking
	Current change		Historical change
Model	Rebuild states	Compact rows	Rebuild states	Compact rows
Qwen3-4B	$+$ 7.3 [-.5pt] [ $+$ 4.7, $+$ 10.2]	$-$ 1.5 [-.5pt] [ $-$ 3.3, $+$ 0.3]	$-$ 41.3 [-.5pt] [ $-$ 45.7, $-$ 37.0]	0.0 [-.5pt] [ $-$ 2.0, $+$ 1.8]
Llama-3.2-3B	$+$ 3.3 [-.5pt] [ $-$ 0.2, $+$ 6.8]	$+$ 0.5 [-.5pt] [ $-$ 1.0, $+$ 2.0]	$-$ 19.8 [-.5pt] [ $-$ 23.3, $-$ 16.3]	$+$ 1.2 [-.5pt] [ $-$ 0.2, $+$ 2.5]
Qwen3-32B	$+$ 11.5 [-.5pt] [ $+$ 8.5, $+$ 14.5]	$-$ 1.7 [-.5pt] [ $-$ 3.8, $+$ 0.5]	$-$ 37.5 [-.5pt] [ $-$ 41.5, $-$ 33.3]	$-$ 0.2 [-.5pt] [ $-$ 1.8, $+$ 1.7]

Appendix

Table 58: Direct changes from source masking for the operations in Table 2 . Entries are percentage points (pp) with paired 95% intervals, using 600 cases for each question type.

Complete answers: percentage (count)
Model	Question	Full	Source	Refresh hidden	Compact	Recompute
Qwen3-4B	Historical	88.2% [-.5pt] (529)	74% [-.5pt] (444)	32.7% [-.5pt] (196)	74% [-.5pt] (444)	33.5% [-.5pt] (201)
Qwen3-4B	Current	82.5% [-.5pt] (495)	86.3% [-.5pt] (518)	93.7% [-.5pt] (562)	84.8% [-.5pt] (509)	91.5% [-.5pt] (549)
Llama-3.2-3B	Historical	85.8% [-.5pt] (515)	80.2% [-.5pt] (481)	60.3% [-.5pt] (362)	81.3% [-.5pt] (488)	60% [-.5pt] (360)
Llama-3.2-3B	Current	46% [-.5pt] (276)	66.3% [-.5pt] (398)	69.7% [-.5pt] (418)	66.8% [-.5pt] (401)	72.2% [-.5pt] (433)
Qwen3-32B	Historical	97% [-.5pt] (582)	82.3% [-.5pt] (494)	44.8% [-.5pt] (269)	82.2% [-.5pt] (493)	41.3% [-.5pt] (248)

Appendix

Table 59: Outcome entries are percentages (counts), with denominators stated in each panel or row. Positions and later states on MQuAKE (600 cases per question). Source masking keeps the stale later states and the gap left by the masked records; refreshing the hidden records recomputes the later states with the records hidden and keeps the gap; compaction deletes the masked rows and rotates every later key back by the gap; recomputation from the edited text removes both. Cells give percentages of normalized exact matches with EOS, with counts in parentheses. Effects are in percentage points with paired whole-case bootstrap intervals (10,000 draws).

Model	Question	Source	Oracle 10%	Oracle 30%	Prefix 10%	Prefix 30%	Random 30%	Refresh hidden
Qwen3-4B	Historical	74% [-.5pt] (444)	71.8% [-.5pt] (431)	56.7% [-.5pt] (340)	75% [-.5pt] (450)	75.2% [-.5pt] (451)	67.2% [-.5pt] (403)	32.7% [-.5pt] (196)
Qwen3-4B	Current	86.3% [-.5pt] (518)	87.8% [-.5pt] (527)	91% [-.5pt] (546)	85.8% [-.5pt] (515)	84.3% [-.5pt] (506)	89.8% [-.5pt] (539)	93.7% [-.5pt] (562)
Llama-3.2-3B	Historical	80.2% [-.5pt] (481)	78.2% [-.5pt] (469)	73% [-.5pt] (438)	77.7% [-.5pt] (466)	76.8% [-.5pt] (461)	75.7% [-.5pt] (454)	60.3% [-.5pt] (362)
Llama-3.2-3B	Current	66.3% [-.5pt] (398)	69.7% [-.5pt] (418)	71.3% [-.5pt] (428)	66.5% [-.5pt] (399)	67.3% [-.5pt] (404)	67.3% [-.5pt] (404)	69.7% [-.5pt] (418)
Qwen3-32B	Historical	82.3% [-.5pt] (494)	80.8% [-.5pt] (485)	68.7% [-.5pt] (412)	83.5% [-.5pt] (501)	83.7% [-.5pt] (502)	75.2% [-.5pt] (451)	44.8% [-.5pt] (269)
Qwen3-32B	Current	84.2% [-.5pt] (505)	83.5% [-.5pt] (501)	88.5% [-.5pt] (531)	82.5% [-.5pt] (495)	81.5% [-.5pt] (489)	88.5% [-.5pt] (531)	95.7% [-.5pt] (574)

Appendix

Table 60: Outcome entries are percentages (counts), with denominators stated in each panel or row. Partial refresh of the later states on MQuAKE with the gap kept. A share of the history rows after the first masked record is copied from the refreshed cache into the source-masked cache: the rows that change most (oracle ranking, which needs the full refresh), the first rows (contiguous prefix, executable by recomputing only those rows), or a random set of the same size. Counts as in the previous table.

Operation	Complete answers	Unit omitted	Margin change (nats)	Change from masking (pp)
Full access	100% [-.5pt] (60/60)	0% [-.5pt] (0)	–	–
Masking	60% [-.5pt] (36/60)	40% [-.5pt] (24)	+7.35 [+6.62, +8.15]	–
Compaction	66.7% [-.5pt] (40/60)	33.3% [-.5pt] (20)	+7.86 [+7.09, +8.70]	+6.7 [+1.7, +13.3] (4/0)
Recomputation	5% [-.5pt] (3/60)	95% [-.5pt] (57)	+2.31 [+1.45, +3.14]	$-$ 55.0 [ $-$ 66.7, $-$ 41.7] (0/33)

Appendix

Table 61: Complete and omission entries are percentages (counts), N=60; changes remain percentage points. Deleting instead of masking the old record for Qwen3-32B on the 60 replacements whose later record refers to the earlier unit. Masking keeps the gap left by the old record; compaction deletes its cached rows and rotates every later key back by the gap, keeping the later states; recomputation rebuilds the later states from the shortened history. Each control applies the same operation to an equal number of unrelated-note tokens. Margins are current-minus-old candidate log probabilities relative to the matched control, in nats. Intervals are paired 95% group-bootstrap intervals (10,000 draws).

No-context wording	No context		Right with the history, among no-context wrong
	Right	Wrong	Full	Source	Value	Recompute	Online
Qwen3-4B
Historical wording	16.2% [-.5pt] (97)	83.8% [-.5pt] (503)	86.9% [-.5pt] (437)	71.8% [-.5pt] (361)	73.2% [-.5pt] (368)	31.6% [-.5pt] (159)	70.8% [-.5pt] (356)
Bare question	23.5% [-.5pt] (141)	76.5% [-.5pt] (459)	86.3% [-.5pt] (396)	70.8% [-.5pt] (325)	72.8% [-.5pt] (334)	29.8% [-.5pt] (137)	69.7% [-.5pt] (320)
Either wording	26.5% [-.5pt] (159)	73.5% [-.5pt] (441)	86.2% [-.5pt] (380)	70.3% [-.5pt] (310)	72.3% [-.5pt] (319)	29.7% [-.5pt] (131)	69.4% [-.5pt] (306)
Llama-3.2-3B

Appendix

Table 62: Percentages precede counts. No-context results use600; history results use the no-context wrong population shown in each row. Historical MQuAKE questions (600 cases) split by whether the same model answers the question with no history at all. No-context wording: the historical question as posed in the stream (historical wording), the bare multi-hop question (bare question), or right under either. Operation columns: cases answered correctly with the history, among the cases the no-context model gets wrong, shown as percentage (count). Counts require normalized supplied-reference exact match and normal EOS.

Model	Complete /92			Mask difference (pp) [95% CI]
Model	Full	Source	Control	Versus full	Versus control
Qwen3-4B	30.4% [-.5pt] (28)	22.8% [-.5pt] (21)	32.6% [-.5pt] (30)	$-$ 7.6 [ $-$ 16.9, +1.1]	$-$ 9.8 [ $-$ 18.9, $-$ 1.1]
Llama-3.2-3B	25% [-.5pt] (23)	27.2% [-.5pt] (25)	28.3% [-.5pt] (26)	+2.2 [ $-$ 5.4, +10.0]	$-$ 1.1 [ $-$ 9.0, +6.7]
Qwen3-32B	55.4% [-.5pt] (51)	45.7% [-.5pt] (42)	57.6% [-.5pt] (53)	$-$ 9.8 [ $-$ 18.5, $-$ 1.1]	$-$ 12.0 [ $-$ 20.2, $-$ 4.3]

Appendix

Table 63: Outcome entries are percentages (counts). Open OAKS answers evaluated against the supplied source by a model grader. Completeness is measured on the 92 questions judged answerable from their excerpts.

Model	Reference agrees /116			Full-complete $\to$ masked outcome
Model	Full	Source	Control	Baseline	Partial	Abstain	Wrong
Qwen3-4B	20.7% [-.5pt] (24)	19% [-.5pt] (22)	22.4% [-.5pt] (26)	28	7.1% [-.5pt] (2)	25% [-.5pt] (7)	14.3% [-.5pt] (4)
Llama-3.2-3B	15.5% [-.5pt] (18)	20.7% [-.5pt] (24)	16.4% [-.5pt] (19)	23	0% [-.5pt] (0)	8.7% [-.5pt] (2)	17.4% [-.5pt] (4)
Qwen3-32B	38.8% [-.5pt] (45)	41.4% [-.5pt] (48)	39.7% [-.5pt] (46)	51	7.8% [-.5pt] (4)	11.8% [-.5pt] (6)	7.8% [-.5pt] (4)

Appendix

Table 64: Reference agreement uses116 questions; failure shares condition on the stated full-complete baseline count. Reference agreement and source-aware failure types measure different outcomes. The right panel starts from source-complete full-access answers on the 92 answerable questions.

Model	Protocol	Full	Source	Control	Source $-$ full (pp) [95% CI]
92 source-answerable questions
Qwen3-4B	Source complete	30.4% [-.5pt] (28)	22.8% [-.5pt] (21)	32.6% [-.5pt] (30)	$-$ 7.6 [ $-$ 16.9, +1.1]
Llama-3.2-3B	Source complete	25% [-.5pt] (23)	27.2% [-.5pt] (25)	28.3% [-.5pt] (26)	+2.2 [ $-$ 5.4, +10.0]
Qwen3-32B	Source complete	55.4% [-.5pt] (51)	45.7% [-.5pt] (42)	57.6% [-.5pt] (53)	$-$ 9.8 [ $-$ 18.5, $-$ 1.1]
All 116 questions
Qwen3-4B	Source complete	30.4% [-.5pt] (28)	23.9% [-.5pt] (22)	32.6% [-.5pt] (30)	$-$ 5.2 [ $-$ 12.8, +1.8]

Appendix

Table 65: OAKS mask effects under three grading protocols on the same generated answers. Entries are percentages (counts) over each panel's question set; differences are paired percentage-point changes.

Changed factor	Qwen3-4B	Qwen3-8B	Llama-3.2-3B
Quantity / Explicit unit requirement	11.2 [6.2, 15.8]	10.8 [4.2, 16.7]	$-$ 2.1 [ $-$ 6.3, 2.5]
Quantity / Shelf note	2.1 [ $-$ 1.2, 5.0]	$-$ 0.8 [ $-$ 3.3, 1.2]	0.4 [ $-$ 1.7, 2.9]
Quantity / Unit from A	$-$ 4.6 [ $-$ 10.4, 2.1]	10.8 [4.2, 16.7]	0.4 [ $-$ 1.7, 2.9]
Quantity / Number-only mask	23.7 [20.4, 27.1]	15.8 [12.5, 19.2]	2.1 [0.0, 5.0]
Endpoint / Explicit format requirement	1.7 [ $-$ 3.3, 6.7]	1.7 [0.0, 4.2]	$-$ 0.8 [ $-$ 5.0, 4.2]
Endpoint / Shelf note	6.7 [1.7, 11.7]	1.7 [0.0, 4.2]	0.8 [ $-$ 2.5, 4.2]

Appendix

Table 66: Change in the mask-versus-control accuracy contrast when a factor is varied (percentage points; paired 95% intervals over ten base groups). Each factor averages the other fixed factor levels within groups. Positive values make the relative masking effect more favorable; this is not the direct effect on full-history accuracy.

Model	Complete answers / 150			Mask minus control [95% CI]
Model	Full	Control	Mask	Margin (nats)	Accuracy (pp)
Qwen3-4B	100% [-.5pt] (150)	100% [-.5pt] (150)	94.7% [-.5pt] (142)	+1.38 [1.16, 1.62]	$-$ 5.3 [ $-$ 8.7, $-$ 2.0]
Qwen3-8B	96.7% [-.5pt] (145)	96.7% [-.5pt] (145)	85.3% [-.5pt] (128)	+1.72 [1.41, 2.05]	$-$ 11.3 [ $-$ 18.7, $-$ 4.7]
Qwen3-32B	100% [-.5pt] (150)	100% [-.5pt] (150)	99.3% [-.5pt] (149)	+0.75 [0.51, 1.01]	$-$ 0.7 [ $-$ 2.0, 0.0]
Qwen3.8-27B †	100% [-.5pt] (150)	100% [-.5pt] (150)	100% [-.5pt] (150)	+0.66 [0.54, 0.77]	+0.0 [0.0, 0.0]
Llama-3.2-3B	70% [-.5pt] (105)	70.7% [-.5pt] (106)	71.3% [-.5pt] (107)	+0.31 [0.13, 0.50]	+0.7 [ $-$ 2.0, 4.0]

Appendix

Table 67: Synthetic replacement answers on 150 conditions from 50 groups, reported as percentages (counts). Source-mask changes are relative to the equal-token control. Brackets give paired 95% intervals; margins use nats and accuracy changes use percentage points.

Model	Complete answers			Changed answers		Mask minus control
Model	Full	Control	Mask	Corr.	Rev.	Accuracy [95% CI]
Qwen3-4B	100% [-.5pt] (300)	99.7% [-.5pt] (299)	80.3% [-.5pt] (241)	0% [-.5pt] (0)	19.3% [-.5pt] (58)	$-$ 19.3 [ $-$ 21.7, $-$ 17.3]
Qwen3-8B	98.3% [-.5pt] (295)	98.3% [-.5pt] (295)	74% [-.5pt] (222)	0% [-.5pt] (0)	24.3% [-.5pt] (73)	$-$ 24.3 [ $-$ 29.0, $-$ 20.0]
Qwen3-32B	98.7% [-.5pt] (296)	98.7% [-.5pt] (296)	82.7% [-.5pt] (248)	0% [-.5pt] (0)	16% [-.5pt] (48)	$-$ 16.0 [ $-$ 17.7, $-$ 14.3]
Qwen3.8-27B †	100% [-.5pt] (300)	100% [-.5pt] (300)	83.3% [-.5pt] (250)	0% [-.5pt] (0)	16.7% [-.5pt] (50)	$-$ 16.7 [ $-$ 16.7, $-$ 16.7]
Llama-3.2-3B	63.7% [-.5pt] (191)	64% [-.5pt] (192)	62.3% [-.5pt] (187)	1% [-.5pt] (3)	2.7% [-.5pt] (8)	$-$ 1.7 [ $-$ 4.0, 0.7]

Appendix

Table 68: Outcome entries are percentages (counts). All 300 synthetic test conditions from 50 groups. Corrections, reversals, and accuracy changes compare source masking with matched-control masking.

Model	Complete answers			Mask minus control [95% CI]
Model	Full	Control	Mask	Margin (nats)	Accuracy (pp)
Qwen3-4B	65.5% [-.5pt] (76)	65.5% [-.5pt] (76)	87.9% [-.5pt] (102)	+9.49 [7.39, 11.72]	+22.4 [14.7, 31.0]
Qwen3-8B	83.6% [-.5pt] (97)	82.8% [-.5pt] (96)	87.9% [-.5pt] (102)	+3.77 [2.56, 5.02]	+5.2 [0.9, 10.3]
Qwen3-32B	85.3% [-.5pt] (99)	84.5% [-.5pt] (98)	89.7% [-.5pt] (104)	+4.40 [3.58, 5.27]	+5.2 [0.0, 10.3]
Qwen3.8-27B †	86.2% [-.5pt] (100)	86.2% [-.5pt] (100)	94% [-.5pt] (109)	+1.02 [0.74, 1.31]	+7.8 [3.4, 12.9]
Llama-3.2-3B	64.7% [-.5pt] (75)	67.2% [-.5pt] (78)	76.7% [-.5pt] (89)	+1.17 [0.81, 1.55]	+9.5 [2.6, 17.2]

Appendix

Table 69: Outcome entries are percentages (counts). OAKS: correct counts out of 116 questions from five fixed books. Both changes compare source masking with the equal-token control; brackets give paired 95% intervals. Candidate margins are measured in nats; changes in answer accuracy are measured in percentage points.

Model	Response categories				Mask minus control
Model	Wrong	UNKNOWN	Format	Limit	Corr.	Rev.
Qwen3-4B	11.2% [-.5pt] (13)	0.9% [-.5pt] (1)	0% [-.5pt] (0)	0% [-.5pt] (0)	24.1% [-.5pt] (28)	1.7% [-.5pt] (2)
Qwen3-8B	4.3% [-.5pt] (5)	7.8% [-.5pt] (9)	0% [-.5pt] (0)	0% [-.5pt] (0)	6.9% [-.5pt] (8)	1.7% [-.5pt] (2)
Qwen3-32B	4.3% [-.5pt] (5)	6% [-.5pt] (7)	0% [-.5pt] (0)	0% [-.5pt] (0)	6.9% [-.5pt] (8)	1.7% [-.5pt] (2)
Qwen3.8-27B †	6% [-.5pt] (7)	0% [-.5pt] (0)	0% [-.5pt] (0)	0% [-.5pt] (0)	7.8% [-.5pt] (9)	0% [-.5pt] (0)
Llama-3.2-3B	22.4% [-.5pt] (26)	0.9% [-.5pt] (1)	0% [-.5pt] (0)	0% [-.5pt] (0)	13.8% [-.5pt] (16)	4.3% [-.5pt] (5)

Appendix

Table 70: Source-mask outcomes as percentages (counts) of all 116 OAKS questions. Failure categories are mutually exclusive; corrections and reversals compare each masked answer with its matched-control answer.

A. Original question
Model	Notebook condition ( $N$ )					Shelf condition ( $S$ )
Model	Full	Whole ctrl.	Whole	Number ctrl.	Number	Full	Whole ctrl.	Whole	Number ctrl.	Number
Qwen3-4B	100% [-.5pt] (30)	100% [-.5pt] (30)	83.3% [-.5pt] (25)	100% [-.5pt] (30)	100% [-.5pt] (30)	100% [-.5pt] (30)	100% [-.5pt] (30)	83.3% [-.5pt] (25)	100% [-.5pt] (30)	100% [-.5pt] (30)
Qwen3-8B	83.3% [-.5pt] (25)	83.3% [-.5pt] (25)	33.3% [-.5pt] (10)	83.3% [-.5pt] (25)	90% [-.5pt] (27)	83.3% [-.5pt] (25)	80% [-.5pt] (24)	23.3% [-.5pt] (7)	83.3% [-.5pt] (25)	86.7% [-.5pt] (26)
Qwen3-32B	100% [-.5pt] (30)	100% [-.5pt] (30)	96.7% [-.5pt] (29)	100% [-.5pt] (30)	100% [-.5pt] (30)	100% [-.5pt] (30)	100% [-.5pt] (30)	96.7% [-.5pt] (29)	100% [-.5pt] (30)	100% [-.5pt] (30)
Qwen3.8-27B †	100% [-.5pt] (30)	100% [-.5pt] (30)	100% [-.5pt] (30)	100% [-.5pt] (30)	100% [-.5pt] (30)	100% [-.5pt] (30)	100% [-.5pt] (30)	100% [-.5pt] (30)	100% [-.5pt] (30)	100% [-.5pt] (30)

Appendix

Table 71: Outcome entries are percentages (counts). Quantity answers when B states the complete quantity. Shared columns retain notebook and shelf controls; the two panels compare question wording. Every count is out of 30 conditions from ten base groups.

A. Original question
Model	Notebook condition ( $N$ )					Shelf condition ( $S$ )
Model	Full	Whole ctrl.	Whole	Number ctrl.	Number	Full	Whole ctrl.	Whole	Number ctrl.	Number
Qwen3-4B	60% [-.5pt] (18)	60% [-.5pt] (18)	3.3% [-.5pt] (1)	56.7% [-.5pt] (17)	76.7% [-.5pt] (23)	43.3% [-.5pt] (13)	50% [-.5pt] (15)	0% [-.5pt] (0)	43.3% [-.5pt] (13)	66.7% [-.5pt] (20)
Qwen3-8B	0% [-.5pt] (0)	0% [-.5pt] (0)	0% [-.5pt] (0)	0% [-.5pt] (0)	0% [-.5pt] (0)	0% [-.5pt] (0)	0% [-.5pt] (0)	0% [-.5pt] (0)	0% [-.5pt] (0)	0% [-.5pt] (0)
Qwen3-32B	70% [-.5pt] (21)	66.7% [-.5pt] (20)	0% [-.5pt] (0)	70% [-.5pt] (21)	83.3% [-.5pt] (25)	60% [-.5pt] (18)	60% [-.5pt] (18)	0% [-.5pt] (0)	63.3% [-.5pt] (19)	76.7% [-.5pt] (23)
Qwen3.8-27B †	83.3% [-.5pt] (25)	83.3% [-.5pt] (25)	63.3% [-.5pt] (19)	83.3% [-.5pt] (25)	83.3% [-.5pt] (25)	80% [-.5pt] (24)	80% [-.5pt] (24)	63.3% [-.5pt] (19)	80% [-.5pt] (24)	86.7% [-.5pt] (26)

Appendix

Table 72: Outcome entries are percentages (counts). Quantity answers when B refers to A for its unit. Shared columns retain notebook and shelf controls; the two panels compare question wording. Every count is out of 30 conditions from ten base groups.

Model	Number minus whole	Explicit request	Earlier unit needed
Qwen3-4B	+23.8 [20.4, 27.1]	+11.2 [6.2, 15.8]	$-$ 4.6 [ $-$ 10.8, 2.1]
Qwen3-8B	+15.8 [12.5, 19.2]	+10.8 [4.2, 16.7]	+10.8 [4.2, 16.7]
Qwen3-32B	+25.0 [23.3, 27.1]	+8.3 [4.2, 12.5]	$-$ 16.7 [ $-$ 23.8, $-$ 9.2]
Qwen3.8-27B †	+5.4 [2.5, 8.8]	+3.8 [0.8, 6.7]	$-$ 3.8 [ $-$ 6.7, $-$ 0.8]
Llama-3.2-3B	+2.1 [0.0, 4.6]	$-$ 2.1 [ $-$ 6.2, 2.5]	+0.4 [ $-$ 1.7, 2.5]
Llama-3.1-70B	+23.3 [20.4, 25.8]	$-$ 1.7 [ $-$ 10.0, 6.7]	$-$ 5.8 [ $-$ 10.0, $-$ 2.1]

Appendix

Table 73: Changes in the quantity mask-minus-control contrast (pp), with paired 95% intervals over ten groups. Each column changes one factor, averaging the remaining fixed factor levels within group.

A. Original question
Model	Notebook condition ( $N$ )					Shelf condition ( $S$ )
Model	Full	Whole ctrl.	Whole	Endpoint ctrl.	Endpoint	Full	Whole ctrl.	Whole	Endpoint ctrl.	Endpoint
Qwen3-4B	100% [-.5pt] (30)	100% [-.5pt] (30)	90% [-.5pt] (27)	100% [-.5pt] (30)	100% [-.5pt] (30)	86.7% [-.5pt] (26)	86.7% [-.5pt] (26)	100% [-.5pt] (30)	86.7% [-.5pt] (26)	100% [-.5pt] (30)
Qwen3-8B	100% [-.5pt] (30)	100% [-.5pt] (30)	93.3% [-.5pt] (28)	100% [-.5pt] (30)	100% [-.5pt] (30)	100% [-.5pt] (30)	100% [-.5pt] (30)	100% [-.5pt] (30)	100% [-.5pt] (30)	100% [-.5pt] (30)
Qwen3-32B	100% [-.5pt] (30)	100% [-.5pt] (30)	100% [-.5pt] (30)	100% [-.5pt] (30)	100% [-.5pt] (30)	100% [-.5pt] (30)	100% [-.5pt] (30)	100% [-.5pt] (30)	100% [-.5pt] (30)	100% [-.5pt] (30)
Qwen3.8-27B †	100% [-.5pt] (30)	100% [-.5pt] (30)	100% [-.5pt] (30)	100% [-.5pt] (30)	100% [-.5pt] (30)	100% [-.5pt] (30)	100% [-.5pt] (30)	100% [-.5pt] (30)	100% [-.5pt] (30)	100% [-.5pt] (30)

Appendix

Table 74: Endpoint answers under original and explicit requests. Each cell gives a percentage (count) over 30 conditions from ten groups. Both panels retain the notebook and shelf conditions and every matched control.

Model	Endpoint minus whole	Explicit request	Shelf minus notebook
Qwen3-4B	+0.0 [0.0, 0.0]	+1.7 [ $-$ 3.3, 6.7]	+6.7 [1.7, 11.7]
Qwen3-8B	+1.7 [0.0, 4.2]	+1.7 [0.0, 4.2]	+1.7 [0.0, 4.2]
Qwen3-32B	+0.0 [0.0, 0.0]	+0.0 [0.0, 0.0]	+0.0 [0.0, 0.0]
Qwen3.8-27B †	+0.0 [0.0, 0.0]	+0.0 [0.0, 0.0]	+0.0 [0.0, 0.0]
Llama-3.2-3B	+2.5 [ $-$ 4.2, 10.0]	$-$ 0.8 [ $-$ 5.0, 4.2]	+0.8 [ $-$ 2.5, 4.2]
Llama-3.1-70B	+0.0 [ $-$ 2.5, 2.5]	+1.7 [0.0, 4.2]	+0.0 [ $-$ 2.5, 2.5]

Appendix

Table 75: Changes in the endpoint mask-minus-control contrast (pp), with paired 95% intervals over ten groups. Each column changes one factor, averaging the remaining fixed factor levels within group.

Configuration	Q3-32	Q3.8	L3-3	L3.1-70	G4-26	G4-31
Original: full	100% [-.5pt] (240)	100% [-.5pt] (240)	60.8% [-.5pt] (146)	100% [-.5pt] (240)	100% [-.5pt] (240)	100% [-.5pt] (240)
Original: early note	100% [-.5pt] (240)	100% [-.5pt] (240)	3.3% [-.5pt] (8)	100% [-.5pt] (240)	100% [-.5pt] (240)	100% [-.5pt] (240)
Original: middle note	100% [-.5pt] (240)	100% [-.5pt] (240)	67.9% [-.5pt] (163)	100% [-.5pt] (240)	100% [-.5pt] (240)	100% [-.5pt] (240)
Original: late note	100% [-.5pt] (240)	100% [-.5pt] (240)	62.1% [-.5pt] (149)	100% [-.5pt] (240)	100% [-.5pt] (240)	100% [-.5pt] (240)
Through sentence end	100% [-.5pt] (240)	100% [-.5pt] (240)	3.3% [-.5pt] (8)	100% [-.5pt] (240)	100% [-.5pt] (240)	100% [-.5pt] (240)
All note	100% [-.5pt] (240)	100% [-.5pt] (240)	16.3% [-.5pt] (39)	100% [-.5pt] (240)	100% [-.5pt] (240)	100% [-.5pt] (240)

Appendix

Table 76: Outcome entries are percentages (counts). All fourteen control-factor configurations: correct unrelated-label answers out of 240 conditions sharing 120 groups. No response reaches the token limit.

Model	Earlier	Later	$\Delta$ accuracy (pp)	$\Delta$ margin (nats)
Qwen3-32B	100% [-.5pt] (240)	100% [-.5pt] (240)	+0.0 [0.0, 0.0]	$-$ 0.30 [ $-$ 0.44, $-$ 0.16]
Qwen3.8-27B †	100% [-.5pt] (240)	100% [-.5pt] (240)	+0.0 [0.0, 0.0]	+0.11 [0.07, 0.14]
Llama-3.2-3B	3.3% [-.5pt] (8)	60.8% [-.5pt] (146)	+57.5 [49.6, 65.0]	+3.10 [2.98, 3.22]
Llama-3.1-70B	100% [-.5pt] (240)	100% [-.5pt] (240)	+0.0 [0.0, 0.0]	+0.59 [0.52, 0.66]
Gemma 4 26B-A4B	100% [-.5pt] (240)	100% [-.5pt] (240)	+0.0 [0.0, 0.0]	$-$ 0.06 [ $-$ 0.11, $-$ 0.01]
Gemma 4 31B	100% [-.5pt] (240)	100% [-.5pt] (240)	+0.0 [0.0, 0.0]	$-$ 0.06 [ $-$ 0.32, 0.18]

Appendix

Table 77: Effects of identical 31-token masks at two disjoint positions, shown as percentages (counts) over 240 conditions. Changes are later minus earlier, with paired 95% intervals over 120 base groups.

Model	Panel	Outputs	Responses reaching the token limit			Correct
Model	Panel	Outputs	Limit 40	Limit 128	Limit 256	Correct
Gemma 4 26B-A4B	OAKS	348	71.3% [-.5pt] (248)	37.4% [-.5pt] (130)	17.2% [-.5pt] (60)	24.1% [-.5pt] (84)
Llama-3.1-70B	Synthetic	900	3.8% [-.5pt] (34)	0% [-.5pt] (0)	0% [-.5pt] (0)	83.7% [-.5pt] (753)
Llama-3.1-70B	Factorial	1800	0.1% [-.5pt] (1)	0% [-.5pt] (0)	0% [-.5pt] (0)	83.8% [-.5pt] (1508)

Appendix

Table 78: Outcome entries are percentages (counts), using the row-specific

n

. Every added-model panel with changed truncation counts. Outputs include every access condition. The three limit columns count truncated responses; complete correct counts are identical at all three limits.

Note	Full	Old-source-length note mask		Four note tokens masked
Note	Full	Early	Preserve first four	First four	Last four
Repeated	60.8% [-.5pt] (146)	3.3% [-.5pt] (8)	7.5% [-.5pt] (18)	59.6% [-.5pt] (143)	64.6% [-.5pt] (155)
Varied	90.8% [-.5pt] (218)	77.5% [-.5pt] (186)	80.8% [-.5pt] (194)	87.9% [-.5pt] (211)	87.9% [-.5pt] (211)

Appendix

Table 79: Llama-3.2-3B unrelated answers under two note contents and matched access changes. Percentages (counts) use 240 conditions per cell; shifted masks hide the same number of tokens as the original mask.

Policy	Qwen3-4B			Qwen3-8B			Llama-3.2-3B
	Exact	$\Delta$ C	$\Delta$ H	Exact	$\Delta$ C	$\Delta$ H	Exact	$\Delta$ C	$\Delta$ H
Keep all	98.3	+0.0	+0.0	91.7	+0.0	+0.0	66.0	+0.0	+0.0
Latest record, recompute	95.7	$-$ 2.7	$-$ 36.3	87.0	$-$ 4.7	$-$ 69.7	66.7	+0.7	$-$ 34.0
Detector, recompute	92.7	$-$ 5.7	$-$ 22.7	86.3	$-$ 5.3	$-$ 41.0	65.0	$-$ 1.0	$-$ 18.0
Detector, mask	86.7	$-$ 11.7	$-$ 16.0	82.0	$-$ 9.7	$-$ 24.7	63.0	$-$ 3.0	$-$ 21.3
Oracle, mask	89.7	$-$ 8.7	$-$ 11.0	86.3	$-$ 5.3	$-$ 19.0	66.7	+0.7	$-$ 19.3

Appendix

Table 80: Exact-field accuracy for current questions (%) and changes from full-access (pp) on 300 synthetic record histories.

\Delta

C and

\Delta

H denote current and historical changes. Keep-all historical accuracy is 91.7/100.0/70.0%. Malformed outputs count as errors. Appendix C.13 separately reports preservation on unrelated questions and the categories of generation errors.

Policy	Qwen3-4B	Qwen3-8B	Llama-3.2-3B
Keep all	84.0	93.0	79.0
Latest record, recompute	76.7	90.3	74.7
Detector, recompute	80.7	94.0	76.0
Detector, mask	81.3	86.7	79.0
Oracle relation, mask	80.3	87.3	79.0
Oracle relation, recompute	80.3	94.0	74.3

Appendix

Table 81: Unrelated-query answer-field accuracy (%) on all 300 synthetic record histories. Current and historical answer results appear in Table 80 . Query-aware masking uses the unchanged keep-all output for these questions.

Generator	Policy	Exact (%)	Value (%)	Unit	UNK
Qwen3-4B	Keep all	98.3	99.0	0.7% [-.5pt] (2)	0% [-.5pt] (0)
Qwen3-4B	Detector mask	86.7	93.0	6.3% [-.5pt] (19)	6% [-.5pt] (18)
Qwen3-4B	Oracle mask	89.7	96.0	6.3% [-.5pt] (19)	1.7% [-.5pt] (5)
Qwen3-8B	Keep all	91.7	98.3	6.7% [-.5pt] (20)	1.3% [-.5pt] (4)
Qwen3-8B	Detector mask	82.0	92.3	10.3% [-.5pt] (31)	7.7% [-.5pt] (23)
Qwen3-8B	Oracle mask	86.3	96.7	10.3% [-.5pt] (31)	3.3% [-.5pt] (10)

Appendix

Table 82: Outcome entries are percentages (counts). All 300 current answers from the synthetic record dataset per row. Exact is the exact-field score; Value retrospectively compares returned and reference values, allowing unit conversion and the correct bare magnitude for quantities whose references are all expressed in hours. Such answers remain unit-incomplete (Unit). UNK counts explicit UNKNOWN. Every condition and query type is evaluated under the same rule (Appendix C.14 ); Value does not require a complete answer with a unit.

Generator	$\Delta m$	$\Delta$ exact	C/R	Unit / UNK
Qwen3-4B	+1.38 [1.17, 1.62]	$-$ 5.3 [ $-$ 8.7, $-$ 2.0]	0% (0) 5.3% (8)	3.3% (5) 2% (3)
Qwen3-8B	+1.72 [1.41, 2.06]	$-$ 11.3 [ $-$ 18.7, $-$ 4.7]	0% (0) 11.3% (17)	10% (15) 1.3% (2)
Llama-3.2-3B	+0.31 [0.13, 0.50]	+0.7 [ $-$ 2.0, 3.3]	2% (3) 1.3% (2)	0% (0) 0% (0)

Appendix

Table 83: Outcome entries give percentages (counts), N=150. Paired entries are top/bottom in the original header order. Candidate scores and generated answers under one fixed protocol on 150 replacement cases from 50 groups in the synthetic record dataset. Both contrasts compare mask of the earlier source with control mask covering the same number of tokens on identical histories and answer strings.

\Delta m

is the change in the current-minus-old sequence margin (Eq. ( 1 ));

\Delta

exact is exact-field accuracy (pp), with paired 95% intervals. C/R denotes corrections/reversals. Unit/UNK counts these outcomes among correct-to-incorrect reversals.

Dataset	Generator	Full	Old	Ctrl	Value F/O	$\Delta m_{\mathrm{full}}$	C/R
Actual replacement cases (150)
Synthetic	Qwen3-4B	100.0	94.7	100.0	100.0 / 98.0	+1.35 [1.12, 1.59]	0% (0) 5.3% (8)
Synthetic	Qwen3-8B	96.7	85.3	96.7	100.0 / 98.7	+1.36 [1.05, 1.70]	0% (0) 11.3% (17)
Synthetic	Llama-3.2-3B	70.0	71.3	70.7	90.0 / 91.3	+0.27 [0.06, 0.47]	2.7% (4) 1.3% (2)
Non-replacement controls (150)
Synthetic	Qwen3-4B	100.0	66.0	99.3	100.0 / 66.7	–	0% (0) 34% (51)

Appendix

Table 84: C/R gives percentages (counts), corrections above reversals, using each block denominator. Other outcome columns already show percentages. Candidate scores and generated answers with the same denominator within each block. Full access / Earlier-source mask / Control are exact-field percentages; Value compares returned and reference values for Full/Old, using the retrospective rule in Appendix C.14 .

\Delta m_{\mathrm{full}}=m(\mathrm{old\ mask})-m(\mathrm{full})

compares old mask with full access, unlike Eq. ( 1 ). C/R count corrections/reversals versus full. Non-replacement masking can remove a still-valid record; this condition tests erroneous deletion and does not select masks by replacement labels. Its coinciding answer targets provide no margin contrast.

Generator	Relation	Correct	Old	Other	UNK	Invalid	Corr.	Rev.
Qwen3-4B	Replacement	90% [-.5pt] (45)	0% [-.5pt] (0)	10% [-.5pt] (5)	0% [-.5pt] (0)	0% [-.5pt] (0)	0% [-.5pt] (0)	10% [-.5pt] (5)
Qwen3-4B	Confirmation	98% [-.5pt] (49)	0% [-.5pt] (0)	2% [-.5pt] (1)	0% [-.5pt] (0)	0% [-.5pt] (0)	0% [-.5pt] (0)	2% [-.5pt] (1)
Qwen3-4B	Role swap	100% [-.5pt] (50)	0% [-.5pt] (0)	0% [-.5pt] (0)	0% [-.5pt] (0)	0% [-.5pt] (0)	0% [-.5pt] (0)	0% [-.5pt] (0)
Qwen3-4B	Role confirm.	100% [-.5pt] (50)	0% [-.5pt] (0)	0% [-.5pt] (0)	0% [-.5pt] (0)	0% [-.5pt] (0)	0% [-.5pt] (0)	0% [-.5pt] (0)
Qwen3-4B	Rejection	94% [-.5pt] (47)	0% [-.5pt] (0)	0% [-.5pt] (0)	6% [-.5pt] (3)	0% [-.5pt] (0)	0% [-.5pt] (0)	6% [-.5pt] (3)
Qwen3-4B	Unrelated	0% [-.5pt] (0)	0% [-.5pt] (0)	0% [-.5pt] (0)	100% [-.5pt] (50)	0% [-.5pt] (0)	0% [-.5pt] (0)	98% [-.5pt] (49)

Appendix

Table 85: Outcome entries are percentages (counts). Outcomes of masking the earlier record in the synthetic dataset by relation (50 cases per row), with corrections (Corr.) and reversals (Rev.) against control-mask. All outcome categories are mutually exclusive. “Other” includes omitted units under the exact-answer scoring rule. For confirmation and unrelated updates, the old value remains the correct target; returning it is counted correct, not an old-value error. The supplementary results include every condition and full-baseline transition.

Generator	Arm	Correct	Old	Other	UNK	Invalid
Qwen3-4B	Full	65.5% [-.5pt] (76)	33.6% [-.5pt] (39)	0% [-.5pt] (0)	0.9% [-.5pt] (1)	0% [-.5pt] (0)
Qwen3-4B	Whole mask	87.9% [-.5pt] (102)	11.2% [-.5pt] (13)	0% [-.5pt] (0)	0.9% [-.5pt] (1)	0% [-.5pt] (0)
Qwen3-4B	Control mask	65.5% [-.5pt] (76)	33.6% [-.5pt] (39)	0% [-.5pt] (0)	0.9% [-.5pt] (1)	0% [-.5pt] (0)
Qwen3-8B	Full	83.6% [-.5pt] (97)	16.4% [-.5pt] (19)	0% [-.5pt] (0)	0% [-.5pt] (0)	0% [-.5pt] (0)
Qwen3-8B	Whole mask	87.9% [-.5pt] (102)	4.3% [-.5pt] (5)	0% [-.5pt] (0)	7.8% [-.5pt] (9)	0% [-.5pt] (0)
Qwen3-8B	Control mask	82.8% [-.5pt] (96)	16.4% [-.5pt] (19)	0% [-.5pt] (0)	0.9% [-.5pt] (1)	0% [-.5pt] (0)

Appendix

Table 86: OAKS candidate answers generated with native chat formatting, as percentages (counts) of 116 questions per condition. All 1,044 outputs across these models and masks are valid JSON in this experiment.

Model	$\Delta_{K}$ [95%]	$\Delta_{V}$ [95%]	$\Delta_{K+V}$ [95%]	$\Delta_{V}-\Delta_{K}$ [95%]
Qwen3-4B	2.599 [2.253, 2.930]	1.788 [1.413, 2.151]	2.247 [1.897, 2.586]	$-$ 0.812 [ $-$ 1.079, $-$ 0.546]
Qwen3-8B	1.889 [1.650, 2.129]	2.865 [2.505, 3.230]	1.877 [1.657, 2.094]	0.976 [0.738, 1.212]
Llama-3.2-3B	0.908 [0.265, 1.570]	2.738 [2.474, 3.008]	2.599 [2.354, 2.855]	1.830 [1.252, 2.407]
Llama-3.1-8B	1.339 [0.560, 2.118]	2.689 [2.488, 2.896]	3.178 [2.997, 3.359]	1.350 [0.652, 2.054]

Appendix

Table 87: Component effects in natural-log units (nats), with 95% intervals. Each

\Delta

is the superseded-minus-current difference of the change in the expected-versus-alternative answer log margin at the old source relative to the matched unrelated span. Every interval excludes zero; Table 88 reports the accuracy-preservation criteria.

Model	$K$ : target / unrelated	$V$ : target / unrelated	$K{+}V$ : target / unrelated
Qwen3-4B	$-$ 0.098/ $-$ 0.060	$-$ 0.048/ $-$ 0.055	$-$ 0.088/ $-$ 0.064
Qwen3-8B	$-$ 0.083/0.000	$-$ 0.025/0.000	$-$ 0.065/0.000
Llama-3.2-3B	$-$ 0.579/ $-$ 0.366	$-$ 0.043/0.111	$-$ 0.035/ $-$ 0.054
Llama-3.1-8B	$-$ 0.443/ $-$ 0.595	0.000/ $-$ 0.069	$-$ 0.063/0.026

Appendix

Table 88: Accuracy preservation under component interventions. Each cell gives the Bonferroni-adjusted lower bounds for accuracy change on questions about a confirmed value and unrelated questions, respectively. Both must be at least

-0.03

; only the Qwen3-8B

V

intervention meets both criteria.

Model	$K$	$V$	$K{+}V$	Safeguards pass
Qwen3-4B	2.60 [2.25, 2.93]	1.79 [1.41, 2.15]	2.25 [1.90, 2.59]	None
Qwen3-8B	1.89 [1.65, 2.13]	2.86 [2.51, 3.23]	1.88 [1.66, 2.09]	$V$
Llama-3.2-3B	0.91 [0.26, 1.57]	2.74 [2.47, 3.01]	2.60 [2.35, 2.86]	None
Llama-3.1-8B	1.34 [0.56, 2.12]	2.69 [2.49, 2.90]	3.18 [3.00, 3.36]	None
Qwen3-32B	1.61 [1.41, 1.81]	2.06 [1.75, 2.38]	1.55 [1.35, 1.75]	None
Qwen3.8-27B †	1.80 [1.59, 2.01]	1.24 [0.99, 1.49]	1.82 [1.61, 2.02]	$K$ , $V$ , $K{+}V$

Appendix

Table 89: Component effects across nine models. Effects are in nats with the original within-model Bonferroni intervals. The last column applies the separate paired 95% accuracy intervals to both current and unrelated safeguards; passing these safeguards alone does not require a positive effect.

Model	Operation	Derived note C			Neutral note		Op. ms
Model	Operation	Current	History	Margin	Current	Margin	Op. ms
Qwen3-4B	Full	100.0	100.0	27.43	100.0	26.59	0.01
Qwen3-4B	Mask A	100.0	100.0	27.52	100.0	26.76	0.01
Qwen3-4B	Mask C	100.0	100.0	26.99	100.0	26.72	0.01
Qwen3-4B	Mask A+C	100.0	100.0	27.03	100.0	26.83	0.01
Qwen3-4B	Selective refresh	100.0	100.0	27.09	100.0	26.96	26.51

Appendix

Table 90: Original-source A and derived-note C interventions with their matched neutral-note controls. Every cell uses 50 routing histories; accuracies are percentages and margins are in nats. Refresh hides A while recomputing later states without rewriting any text.

Model	Derived-note current answers				Neutral: Full $\to$ Refresh
Model	Full	Mask A	Mask A,C	Refresh	Current	History	Margin (nats)
Qwen3-32B	100% [-.5pt] (50)	100% [-.5pt] (50)	100% [-.5pt] (50)	100% [-.5pt] (50)	100% (50) 100% (50)	100% (50) 100% (50)	14.56 $\to$ 14.01
Qwen3.8-27B †	100% [-.5pt] (50)	100% [-.5pt] (50)	100% [-.5pt] (50)	100% [-.5pt] (50)	100% (50) 100% (50)	100% (50) 100% (50)	7.74 $\to$ 7.78
Gemma 4 26B-A4B	100% [-.5pt] (50)	100% [-.5pt] (50)	100% [-.5pt] (50)	100% [-.5pt] (50)	100% (50) 100% (50)	100% (50) 100% (50)	17.79 $\to$ 17.31
Gemma 4 31B	100% [-.5pt] (50)	100% [-.5pt] (50)	100% [-.5pt] (50)	100% [-.5pt] (50)	100% (50) 100% (50)	100% (50) 16% (8)	17.67 $\to$ 17.41
Llama-3.1-70B	36% [-.5pt] (18)	92% [-.5pt] (46)	100% [-.5pt] (50)	100% [-.5pt] (50)	98% (49) 100% (50)	100% (50) 100% (50)	9.27 $\to$ 8.06

Appendix

Table 91: Outcome entries give percentages (counts), N=50. Paired entries are top/bottom in the original header order. Propagation and matched neutral-note controls in five generators. Counts are complete answers out of 50 histories. Neutral columns show full access to selective refresh, which recomputes after A while hiding A.

Model	All questions ( $n=380$ )			Answerable updates ( $n=34$ )
Model	Full	Bias	$\Delta$ (pp)	Full	Bias	$\Delta$ (pp)
Qwen3-4B	52.9% [-.5pt] (201)	53.9% [-.5pt] (205)	+1.05	61.8% [-.5pt] (21)	79.4% [-.5pt] (27)	+17.65
Qwen3-8B	52.1% [-.5pt] (198)	51.8% [-.5pt] (197)	$-$ 0.26	58.8% [-.5pt] (20)	64.7% [-.5pt] (22)	+5.88
Qwen3-32B	73.4% [-.5pt] (279)	71.6% [-.5pt] (272)	$-$ 1.84	82.4% [-.5pt] (28)	85.3% [-.5pt] (29)	+2.94
Llama-3.2-3B	50.3% [-.5pt] (191)	50.3% [-.5pt] (191)	+0.00	64.7% [-.5pt] (22)	70.6% [-.5pt] (24)	+5.88
Llama-3.1-8B	58.9% [-.5pt] (224)	58.7% [-.5pt] (223)	$-$ 0.26	82.4% [-.5pt] (28)	85.3% [-.5pt] (29)	+2.94

Appendix

Table 92: LongMemEval-Oracle answers graded by GPT-5.6, as percentages (counts) over 380 questions or 34 answerable updates per model. Bias applies the session-order rule.

Model	Full	Bias	All p50 (%)	Active p50 (%)	TTFT overhead p50 (%)	TTFT overhead p95 (%)
Qwen3-4B	347.7	354.7	+0.67	+9.64	+0.88	+8.61
Qwen3-8B	407.8	395.4	+0.95	+9.42	+1.53	+9.13
Qwen3-32B	1983.1	2041.6	+0.21	+20.12	+1.56	+5.52
Llama-3.2-3B	293.9	283.8	+0.94	+9.21	+1.81	+11.65
Llama-3.1-8B	136.8	132.5	+1.51	+10.53	+2.22	+10.96
Mistral-7B	1145.7	1226.9	+0.23	+16.00	+2.41	+10.98

Appendix

Table 93: Measured costs on 380 reserved questions per model, including 109 questions where the bias is applied. Full uses unmodified attention; Bias weights sessions by their order. These columns give mean complete-answer times in ms across all questions. All/Active give median paired overheads for all questions and for those where the bias is applied (%); Time to first token (TTFT) columns give paired overhead percentages over all questions. Timing includes control, question processing, and output-length changes after common prefill. The time to copy the cache is recorded separately; all models use math SDPA.

Subset	Pairs	Full	Bias	Net	$\Delta$ (pp), 95% CI
Overall	2280	58% [-.5pt] (1323)	57.6% [-.5pt] (1314)	$-$ 0.4 pp [-.5pt] ( $-$ 9)	$-$ 0.39 [ $-$ 1.15, +0.35]
Answerable updates	204	70.6% [-.5pt] (144)	76.5% [-.5pt] (156)	$+$ 5.9 pp [-.5pt] ( $+$ 12)	+5.88 [+2.45, +9.80]
Other answerable	1938	54.7% [-.5pt] (1061)	53.6% [-.5pt] (1039)	$-$ 1.1 pp [-.5pt] ( $-$ 22)	$-$ 1.14 [ $-$ 1.91, $-$ 0.41]
Abstention	138	85.5% [-.5pt] (118)	86.2% [-.5pt] (119)	$+$ 0.7 pp [-.5pt] ( $+$ 1)	+0.72 [+0.00, +2.17]

Appendix

Table 94: Correct outcomes are percentages (counts) over the stated model-question pairs; Net is pp. Paired Full/Bias entries retain that order; times and sizes retain their units. Answer changes under the fixed session-order bias, across all 380 questions and the 109 questions where the bias is applied. GPT-5.6 uses the unchanged LongMemEval question-type rubric. The panels retain their own question and model–question denominators.

Model	Full	Soft	Hard	Hard $-$ Full (pp) [95% CI]
Qwen3-4B	52.4% [-.5pt] (199)	53.7% [-.5pt] (204)	49.5% [-.5pt] (188)	$-$ 2.9 [ $-$ 5.2, $-$ 0.8]
Llama-3.2-3B	50.8% [-.5pt] (193)	50.5% [-.5pt] (192)	46.3% [-.5pt] (176)	$-$ 4.5 [ $-$ 6.9, $-$ 2.3]
Qwen3-32B	73.9% [-.5pt] (281)	72.4% [-.5pt] (275)	62.6% [-.5pt] (238)	$-$ 11.3 [ $-$ 14.7, $-$ 8.2]

Appendix

Table 95: Outcome entries are percentages (counts). Hard masking and soft attenuation of identical session spans on LongMemEval-Oracle. All arms preserve the shared prefilled history; the fixed temporal rule applies during question processing and decoding. Correct counts use the original remaining 380 questions.

Model	Operation	TTFT (%)		Processing time (%)			Tokens (%)
Model	Operation	Resident	Cold	Query	Decode	Complete	Tokens (%)
Qwen3-4B	Soft	+63.01	+2.51	+56.46	+62.64	+62.89	+0.00
Qwen3-4B	Hard	+171.03	+7.11	+165.97	+322.50	+224.39	+0.00
Llama-3.2-3B	Soft	+65.57	+2.80	+53.48	+99.46	+83.40	+0.00
Llama-3.2-3B	Hard	+238.62	+9.84	+228.95	+392.30	+298.63	+0.00
Qwen3-32B	Soft	+58.87	+2.01	+56.33	+47.76	+50.12	+0.00

Appendix

Table 96: Paired median overheads (%) on the 109 remaining questions where the temporal rule is active. TTFT and query processing precede answer decoding; complete-generation time also reflects output-length changes.

Condition	Qwen3-4B		Llama-3.2-3B		Qwen3-32B
Condition	All (Changed)	CI (%)	All (Changed)	CI (%)	All (Changed)	CI (%)
Reference conditions
Full access	100% (300) 100% (150)	[100.0, 100.0]	63.3% (190) 70% (105)	[53.7, 72.0]	98.3% (295) 100% (150)	[97.0, 99.7]
Source mask	80.7% (242) 94.7% (142)	[79.0, 82.3]	62% (186) 70.7% (106)	[52.7, 70.3]	83% (249) 99.3% (149)	[82.3, 83.3]
Fixed capacity: 128 tokens
Quest, 128	40.7% [-.5pt] (122)	[32.7, 49.0]	37.3% [-.5pt] (112)	[30.0, 44.3]	34.7% [-.5pt] (104)	[28.0, 41.3]

Appendix

Table 97: Outcome cells show all-condition percentages (counts), N300; a second line shows the changed-value subset, N150. Intervals remain for all300. Controlled answers at fixed and matched capacities. The upper entry uses all 300 conditions; a lower entry uses the changed-value subset of 150 where shown; intervals describe accuracy on all 300 conditions. The 300 conditions come from 50 shared groups, which remain the resampling units.

Model	Prefix tokens	Masked tokens	K min/median/max	Quest selected range
Qwen3-4B	316.0	22.0	312/321.0/330	289–320
Llama-3.2-3B	325.0	18.0	320/329.0/336	299–336
Qwen3-32B	316.0	22.0	312/321.0/330	289–320

Appendix

Table 98: Per-case capacity accounting for the matched controlled comparison. Prefix and masked counts are medians; K gives the minimum, median and maximum configured pre-answer capacity across 300 conditions. These configured values are identical for Quest, FINCH and RefreshKV within each model.

Condition	Qwen3-4B			Llama-3.2-3B			Qwen3-32B
Condition	Correct	+EOS	Capped	Correct	+EOS	Capped	Correct	+EOS	Capped
Full access	53.2% [-.5pt] (202)	51.3% [-.5pt] (195)	2.1% [-.5pt] (8)	50% [-.5pt] (190)	49.2% [-.5pt] (187)	1.1% [-.5pt] (4)	73.2% [-.5pt] (278)	71.6% [-.5pt] (272)	1.8% [-.5pt] (7)
Source mask	50% [-.5pt] (190)	48.2% [-.5pt] (183)	2.1% [-.5pt] (8)	45.8% [-.5pt] (174)	45% [-.5pt] (171)	1.1% [-.5pt] (4)	62.1% [-.5pt] (236)	60.5% [-.5pt] (230)	2.1% [-.5pt] (8)
Quest	37.4% [-.5pt] (142)	37.1% [-.5pt] (141)	0.8% [-.5pt] (3)	40.3% [-.5pt] (153)	39.7% [-.5pt] (151)	1.6% [-.5pt] (6)	52.6% [-.5pt] (200)	51.3% [-.5pt] (195)	2.1% [-.5pt] (8)
Recent pages	1.8% [-.5pt] (7)	0.3% [-.5pt] (1)	34.7% [-.5pt] (132)	0% [-.5pt] (0)	0% [-.5pt] (0)	98.4% [-.5pt] (374)	0.3% [-.5pt] (1)	0% [-.5pt] (0)	21.1% [-.5pt] (80)
FINCH	46.8% [-.5pt] (178)	46.3% [-.5pt] (176)	0.5% [-.5pt] (2)	48.2% [-.5pt] (183)	47.4% [-.5pt] (180)	3.4% [-.5pt] (13)	76.1% [-.5pt] (289)	74.2% [-.5pt] (282)	3.7% [-.5pt] (14)

Appendix

Table 99: Outcome entries are percentages (counts). Public answer judgments and termination at the fixed 512-token dynamic capacity. Each model has 380 remaining questions; correct answers with EOS and outputs reaching the generation limit are reported separately from the primary rubric-based accuracy.

Model	Policy	Prompt KV (MB)	Visible tokens	Generation (ms)
Qwen3-4B	Keep all	27.06	183.5	233.72
Qwen3-4B	Latest record, recompute	23.52	159.5	231.98
Qwen3-4B	Detector, recompute	25.07	170.0	232.70
Qwen3-4B	Detector, mask	27.06	171.0	233.27
Qwen3-8B	Keep all	27.06	183.5	227.22
Qwen3-8B	Latest record, recompute	23.52	159.5	223.34

Appendix

Table 100: Measured cache size and synchronized per-query generation time, median over 900 questions per policy. MB uses decimal units. Detection, source preparation and initial cache construction are additional costs reported in the text. Equivalent policy conditions reuse the same measured output and timing.

Model	Policy	Resident (s)	Cold (s)	Accuracy (%)
Qwen3-4B	Keep all	2.56	3.47	96.7 / 100.0 / 93.3
Qwen3-4B	Detector mask	3.22	4.15	87.5 / 82.2 / 88.9
Qwen3-4B	Detector recompute	3.37	4.26	86.7 / 58.9 / 77.8
Qwen3-4B	Query-aware mask	3.20	4.11	87.5 / 100.0 / 93.3
Qwen3-8B	Keep all	2.72	3.65	93.3 / 98.9 / 93.3
Qwen3-8B	Detector mask	3.36	4.33	85.8 / 71.1 / 90.0

Appendix

Table 101: Ten sequential queries after one update, with 300 background lines. Median total seconds over 30 distinct histories; resident accounting starts at update arrival, cold accounting includes measured initial construction. Accuracy gives current/historical/unrelated percentages. Detector time is included.

Model	Full access	Detected mask	Query routing
Qwen3-32B	98.3/100.0/84.4	91.7/81.1/84.4	91.7/100.0/84.4
Qwen3.8-27B †	100.0/100.0/100.0	93.3/84.4/100.0	93.3/100.0/100.0
Gemma 4 26B-A4B	100.0/100.0/95.6	96.7/93.3/96.7	96.7/100.0/95.6
Gemma 4 31B	100.0/100.0/100.0	93.3/90.0/100.0	93.3/100.0/100.0
Llama-3.1-70B	68.3/92.2/53.3	68.3/77.8/55.6	68.3/92.2/53.3

Appendix

Table 102: Sequential workload at the longest tested history: current / historical / unrelated complete-answer percentages. Thirty histories each receive ten requests: four current, three historical, and three unrelated. The cached history remains unchanged between requests; previous answers are not appended.

Model	Tokens	Full access	Mask	Routing	Recompute
Time (ms): full-access total / added time [95% interval]
Qwen3-32B	6,346	8,372	475 [188, 676]	564 [418, 669]	1,829 [1,365, 2,305]
Qwen3.8-27B	6,653	8,721	668 [452, 863]	739 [592, 878]	1,010 [781, 1,238]
Gemma 4 26B-A4B	6,658	7,851	1,469 [569, 3,025]	760 [511, 1,153]	574 [393, 743]
Gemma 4 31B	6,658	10,797	1,873 [389, 4,219]	545 [412, 642]	1,547 [1,178, 1,925]
Llama-3.1-70B	5,842	8,130	1,631 [518, 3,247]	1,120 [653, 1,836]	5,475 [3,061, 8,221]

Appendix

Table 103: One update and ten requests on a cached history. Top: full-access total and each policy’s added time (ms), with paired 95% intervals over 30 histories. Bottom: percentages of complete answers to 120 current, 90 historical and 90 unrelated questions.

Model	Retain	Mask	Drop	Recompute	Prefix
Qwen3-32B	129.8	200.7	396.1	4423.3	3148.8
Qwen3.8-27B †	219.5	219.5	272.9	4808.1	2513.2
Gemma 4 26B-A4B	59.1	76.1	181.4	1480.6	931.3
Gemma 4 31B	155.4	194.4	403.5	4109.0	2769.5
Llama-3.1-70B	189.3	273.7	520.6	7036.2	4844.0

Appendix

Table 104: Median total operation time in milliseconds at target history length 8,192 and an update halfway through the history. The five columns retain the cache, mask source positions, physically drop positions, recompute all text, or recompute from a stored prefix.

Reader	Current	Current, masked	Historical	Invalid	Changed	Top-1
Qwen3-8B	84.2 / 76.2	55.4 / 40.0	100.0 / 100.0	0% (0) 0% (0)	12.1% [-.5pt] (29)	100.0
Qwen3-8B-Base	72.9 / 3.3	31.2 / 0.0	65.4 / 14.6	7.1% (17) 95.4% (229)	95.4% [-.5pt] (229)	1.7
Qwen3-4B	83.3 / 84.6	45.0 / 43.8	100.0 / 100.0	0% (0) 0% (0)	4.6% [-.5pt] (11)	70.4
Qwen3-4B-Base	6.2 / 67.5	11.7 / 38.3	0.0 / 100.0	91.3% (219) 0% (0)	91.3% [-.5pt] (219)	8.8
Gemma 4 26B-A4B	85.8 / 33.8	34.6 / 16.2	100.0 / 66.2	0% (0) 45.4% (109)	21.3% [-.5pt] (51)	6.2
Gemma 4 26B-A4B base	0.0 / 0.0	0.0 / 0.0	0.0 / 0.0	100% (240) 100% (240)	100% [-.5pt] (240)	100.0

Appendix

Table 105: Outcome entries give percentages (counts), N=240. Paired entries are top/bottom in the original header order. Reading another checkpoint’s cache. Each reader appends the question to a history prefilled either by itself (own) or by the other checkpoint of its pair (cross) and decodes greedily. Each pair occupies two rows, and a cross read uses the other row’s checkpoint as writer. Cells give own / cross percentages of complete answers with the correct number and unit on the same test cases; “Invalid” counts current full-access outputs that hit the token limit or break the answer format. Changed counts current full-access answers whose content differs from the own read, ignoring JSON whitespace and code fences; Top-1 is the share of current full-access cross reads whose first generated token matches the own read.

Main-text model	Sibling	K cos	V cos	Own AUC	Transfer AUC
Qwen3-8B	Qwen3-8B-Base	0.921	0.825	0.550 [0.516, 0.591]	0.594 [0.560, 0.640]
Qwen3-4B	Qwen3-4B-Base	0.915	0.816	0.653 [0.603, 0.714]	0.520 [0.478, 0.562]
Gemma 4 26B-A4B	Gemma 4 26B-A4B base	0.670	0.643	0.627 [0.591, 0.672]	0.365 [0.290, 0.430]
Qwen3.8-27B	Qwen3.6-27B	0.829	0.760	0.872 [0.830, 0.920]	0.756 [0.700, 0.822]
Qwen3.8-27B	Qwen3.5-27B	0.829	0.767	0.872 [0.830, 0.920]	0.645 [0.606, 0.695]

Appendix

Table 106: State similarity and readout transfer between paired checkpoints. Cosine similarities average over layers with a K/V cache (all 36 for Qwen3, 30 for Gemma, the 16 full-attention layers of Qwen3.8) and over test cases, for identical token IDs. Role AUCs use the 570-history recognition panel: a joint-KV linear readout trained and tested on the main-text model (own) or trained on its sibling and tested on the main-text model (transfer).

Original type	Questions	Answerable	Partial	Unanswerable	Ambiguous
Simple	249	45.4% [-.5pt] (113)	0% [-.5pt] (0)	54.6% [-.5pt] (136)	0% [-.5pt] (0)
History	409	98.8% [-.5pt] (404)	0% [-.5pt] (0)	0% [-.5pt] (0)	1.2% [-.5pt] (5)
Multi-hop	268	50% [-.5pt] (134)	0% [-.5pt] (0)	48.5% [-.5pt] (130)	1.5% [-.5pt] (4)
Counting	46	93.5% [-.5pt] (43)	2.2% [-.5pt] (1)	0% [-.5pt] (0)	4.3% [-.5pt] (2)
Ordering	196	83.2% [-.5pt] (163)	0% [-.5pt] (0)	0% [-.5pt] (0)	16.8% [-.5pt] (33)
All	1,168	73.4% [-.5pt] (857)	0.1% [-.5pt] (1)	22.8% [-.5pt] (266)	3.8% [-.5pt] (44)

Appendix

Table 107: Outcome entries are percentages (counts), using the row-specific

n

. Question answerability from the released full Wikipedia histories, assessed without generated answers. The assessment retains every original question, including those judged unanswerable or ambiguous.

(a) Question target: source-answerable / analyzed questions
Question target	Answerable / analyzed questions	Full	Source	Changed text	Recompute
Qwen3.8-27B
Change or aggregation	58.8% [-.5pt] (436/741)	65.1% [-.5pt] (284)	16.7% [-.5pt] (73)	62.8% [-.5pt] (274)	15.4% [-.5pt] (67)
Historical	99.3% [-.5pt] (413/416)	71.4% [-.5pt] (295)	10.4% [-.5pt] (43)	69.5% [-.5pt] (287)	26.9% [-.5pt] (111)
Current	100% [-.5pt] (4/4)	100% [-.5pt] (4)	100% [-.5pt] (4)	100% [-.5pt] (4)	100% [-.5pt] (4)
Gemma 4 26B-A4B

Appendix

Table 108: Completeness entries are percentages (counts) of the source-answerable questions in each row; answerability uses the explicitly shown analyzed denominator. Source-complete Wikipedia answers with EOS under the same four access policies, partitioned by question target and by evaluator/request subset. Both panels partition the same analyzed questions and therefore do not represent independent evaluation samples.

Explore similar work

Sep 9, 2026cs.CL

KVShareArena: KV-Cache Reuse Across Contexts and Model Checkpoints

Reusing key-value (KV) caches speeds up LLM inference by avoiding repeated computation on shared text. Standard prefix caching reuses a KV cache only when the LLM is the same and all preceding text is identical, but real workloads often break both conditions: RAG systems place different documents before the same one, agents with different system prompts read the same file or tool output, multi-agent workflows use specialized LLMs on shared material, and an updated model reads documents cached by its previous version. Because KV caches depend on both the preceding text and the model weights, direct reuse can reduce answer quality. Many methods repair or compress the reused cache, but each paper uses its own tasks, models, and cost measures, and existing benchmarks mainly test long-context processing or reuse of an unchanged prefix. We introduce KVShareArena, a benchmark and open evaluation framework for comparing them under the same conditions. KVShareArena has (1) reuse tests on 2,150 questions from three QA datasets, where the preceding text, the cache-writing LLM, or both change while the answering LLM and input stay fixed; (2) five dense and mixture-of-experts LLMs (4B-30B) and six LLM pairs where one version of an LLM reads caches written by another, for 33 model-dataset settings; (3) 11 repair and compression methods from six method classes; (4) four evaluation perspectives: answer quality, prefill computation, KV-cache memory, and latency; and (5) a common interface for adding new methods and an interactive leaderboard. Experiments yield two findings. First, both the quality loss from reuse and which repairs help depend on the LLM, even between two 8B models. Second, most repairs keep their quality when another LLM version wrote the cache, but a trained repair adapter loses quality in 12 of 18 pair-dataset tests. Code and data: https://github.com/xishi404/KVShare-Arena

Xi Shi, Mengxin Zheng, Qian Lou

University of Central Florida

Kv-Cache Management Large Language Model Serving Large Language Model Memory Question-Answering Benchmarks Model Checkpoints Shared Control

Ask PDF

Sep 23, 2026cs.LG

Shared Global KV with Layer-Specific Local History

Decoder-only Transformer language models cache keys and values (KV) to reuse past computation during generation. Sharing KV across layers saves storage but reduces the diversity of representations available across depth. We study what local memory should retain alongside shared global KV, separating historical content from the input source used to form it. At 126M parameters and 2K context, an eight-seed study finds about 1.4% lower held-out test perplexity with local history than with a current-token local branch. Capacity, entry-count and training-compute controls support the value of historical content. In a two-seed comparison, this value persists when adjacent layers share local inputs while retaining independent projections; source sharing also shortens exact cache-construction dependencies. Against GQA and adjacent-layer KV sharing, equal bounded learning-rate searches and new-seed confirmation yield better same-source likelihood with larger caches and higher long-request latency. The ordering against adjacent-layer sharing persists after equal-token adaptation to 8K, with a short-context cost. The eight-seed external-book history effect remains uncertain, and downstream outcomes vary by task. We derive a sufficient suffix schedule that reduces upper-layer construction work while preserving the complete cache in exact arithmetic.

Xinglang Xian

Keys And Value Large Language Model Decoding Peak Memory Depth History

Ask PDF

Jul 14, 2026cs.CL

Adaptive Filtering of the KV Cache: Diagnosing and Correcting Structural-Role Bias in LLM Inference

Attention-based KV cache eviction (H2O and its descendants) compresses the memory-constrained state of a long-context model by ranking tokens on accumulated attention mass, treated here as signal energy, and keeping the heaviest. On schema-dense input streams such as nested JSON, this score acts as a non-stationary filter that disproportionately retains noise: a non-content sink role (delimiters or whitespace) carries an order of magnitude more energy than any content role, and structural KEY tokens are over-retained at roughly 1.8x the rate of the answer-carrying VALUE tokens, collapsing exact-match accuracy from 88% to 0% at a 5% budget as the signal-to-noise ratio of the retained state degrades. A counterfactual experiment establishes that suppressing KEY tokens is the best deployable filter. Our retraining-free, role-conditional allocation over SnapKV's windowed score, governed by a single tuned hyperparameter, closes 63-98% of the H2O gap at sub-20% budgets and, at higher budgets, modestly matches or exceeds full-cache accuracy -- a small, seed-sensitive denoising effect (borderline significant at B=0.50; not distinguishable from zero at B=0.30 over four seeds). A 15 MB linear role probe supplies these labels at negligible inference cost, though matching parser-level downstream accuracy remains open.

Soumil Mandal

ServiceNow

Key-Value Cache LLM Inference Optimization Scale Gap Biases Role Iterative Denoising Methods

Ask PDF