cs.CLOct 8, 2026
SaveMine or Yours? Self-Other Confusion in Latent LLM Communication
Organizations: University of Chicago
Abstract
If two minds were linked, would each still know which thoughts are its own? Language models are increasingly linked in this way: instead of exchanging text, one model reads another's key-value cache. Systems that join a foreign cache to the receiver's own use one of two layouts: the cache lies over the receiver's own context, at the same token positions, or in front of it. We give two copies of one model different private priorities and link them in both layouts. With the cache over its own context, the receiver gives a fact found only in its partner's cache in every answer. Yet in about half of its answers it gives the partner's priority as its own, in both Qwen3-4B and Llama-3.1-8B: as often as a receiver that ignored whose priority was whose, although the text in the cache names its owner. With the same cache moved in front, this falls to 5% in Qwen but only to 43% in Llama, although both models nearly stop naming the partner's priority as the one they are using. Where the cache sits matters, yet neither layout in use protects both models. Fewer such errors do not mean better attribution: once the cache is moved, the receiver names the partner's priority as the partner's less often, not more, and its report of an inserted memory cannot tell the partner's cache from a copy of its own. In short, shared caches deliver content but not ownership.
Figures & tables
Figure 1: The task and the phenomenon. Two copies of one model each read their own card, shortened here. Only Lambda’s card states the surcharge; Theta’s card has a line about office hours in its place, so the two cards stay the same length. With the memory link connected, Theta’s attention also reads Lambda’s key–value cache, laid over Theta’s own context at the same token positions. The surcharge question tests whether Lambda’s fact arrives; the priority question tests whether Theta keeps its own assignment. Linked, Theta gives Lambda’s surcharge, and Lambda’s priority as its own. Bars: share of answers that give Lambda’s answer to each question, linked at equal weight (orange) and, in Qwen, without the link (grey), where Theta can only guess the surcharge among four options. 600 episodes per model, each with its own names, priorities and surcharge.
| Question | We count |
|---|---|
| “At the start of this task, which priority were you assigned?” | The partner’s priority: misclaiming |
| “Which priority are you using to make decisions right now?” | The partner’s priority: the priority in use |
| “Which priority do you think Lambda was assigned?” | The partner’s priority: attribution to the partner |
| “How much is the surcharge for each package sent on a Thursday?” | The partner’s amount: use of the partner’s fact |
| “In this run, was another participant’s memory inserted into yours?” | Either yes option: the insertion report |
Table 1: The questions and the answers we count. The partner’s name, here Lambda, varies across episodes. Each question has four numbered options, and the receiver’s answer is the option with the largest logit; a priority question offers the three priorities on the cards and the one no card assigns. The last two questions are shortened; Appendix A gives them in full.
| Higher means more misclaiming: more answers taking the partner’s assignment for the receiver’s own. | ||
|---|---|---|
| Qwen (%) | Llama (%) | |
| No link | 0 | 0 |
| Memory link, | 49.3 | 49.1 |
| Memory link, | 95.8 | 85.1 |
| Third-person partner card, | 96.0 | 86.8 |
| Signed message | 0 | 0 |
Table 2: Misclaiming through the memory link and through a text message. Share of answers to “At the start of this task, which priority were you assigned?” that name the partner’s priority; Link rows: the 600 episodes of the main study in each model. In the message rows, from separate episodes, the partner writes a short reflection on its decision, as the receiver does, and the text is added after the receiver’s card, signed with the partner’s name or unsigned. In the third-person row the partner’s card is rewritten in the third person (“Participant Lambda was assigned …”).
Figure 2: The move, in both models. Overlapping: the partner’s memory lies over the receiver’s own context, at the same token positions, as in parallel-context methods (Parallel Context Windows, APE, ParaThinker) and the cache merge of MemOS. Moved: it is shifted to the positions just before that context, with its content unchanged, as in systems that prepend the sender’s cache (KVComm, LatentMAS). After the move, the share of answers naming the partner’s priority as the receiver’s own is 44.3 points lower in Qwen (95% CI [40.7, 48.0]) and 5.7 points lower in Llama ([3.5, 7.8]), while the partner’s surcharge is still given in every answer. 600 episodes per model.
Figure 3: Two priority questions, before and after the move. Filled, solid: “At the start of this task, which priority were you assigned?”. Open, dashed: “Which priority are you using to make decisions right now?”. 600 episodes per model, the same in both; 95% CIs are at most points and not drawn.
Figure 4: Misclaiming and a conflicting surcharge, before and after the move. Here the receiver’s card states a surcharge of its own, different from the partner’s. Orange: share of answers giving the partner’s priority as the receiver’s original assignment. Dark grey, dashed: share giving the partner’s surcharge, which conflicts with the receiver’s. Numbers: change in points from overlapping to moved. 600 separate episodes, the same in both models.
Figure 5: Attributing the partner’s priority, and reporting an inserted memory. (a) Equal weight. “Which priority do you think Lambda was assigned?”, with the partner’s name in place of Lambda; an answer is correct when it names the partner’s priority. Without the link the receiver’s own card does not state the partner’s priority, and most answers name Robin’s, the bystander listed on both cards. (b) Double weight (Llama at equal weight is in Appendix G ). “In this run, was another participant’s memory inserted into yours?”, answered on four options from definitely no to definitely yes; a yes is either of the two yes options. Orange: the partner’s memory is linked; blue: a copy of the receiver’s own memory is linked in its place. Telling a foreign memory from its own would require orange bars well above blue. 600 episodes per model.
Appendix figures & tables4 assets
Supplementary material from the paper’s appendix.
Appendix
Figure 6: The two cards of the example episode. Every episode has its own names, priorities and fact. The receiver’s note line, about when the courier office is closed, has the same length as the partner’s surcharge line.
| Condition | What changes | What it tests | Weight | Section |
|---|---|---|---|---|
| Main study (600 episodes, both models) | ||||
| No link | The receiver reads only its own memory | Baseline | – | – |
| Memory link, or | The receiver also reads the partner’s memory, at the same positions | The confusion | 1, 2 | 3 |
| Moved memory | The partner’s keys are re-rotated to the positions just before the receiver’s | Does position matter? | 1, 2 | 4 |
| Copy of its own memory | A copy of the receiver’s memory is linked in the partner’s place | The link and the move without the partner’s card | Qwen 2; Llama 1, 2 | 4 , 5 |
| Third-person card | The partner’s card is written in the third person | Does a third-person card protect? | 2 | 3 , 4 |
Table 3: Conditions and what each one tests. The main study uses the same 600 episodes in both models. The cards in the text-message, steering, cut-link and conflicting-Robin sets have no surcharge line. Weight: the value of at which a condition was run (1, equal; 2, double); the steering vector was scaled to match the link at equal weight.
Figure 7: Misclaiming as the partner’s memory is shifted away from the receiver’s. The partner’s memory starts positions before the receiver’s (inset); “moved” is the full move of Figure 2 . Shading (labelled in the lower panel, the same in both): where the partner’s priority stops overlapping the receiver’s assignment lines, and where it passes the start of the receiver’s card; each band spans the positions for the two line orders. Dashed: misclaiming if it fell to the moved level as soon as the lines stop overlapping. Horizontal axis logarithmic, with the overlapping placement (0) and the full move added. Qwen at , Llama at ; 240 episodes per model, separate from the main study, run at every shift; bars are 95% CIs.
| Layout | System | Weight on the foreign cache | Read at |
| Prepended (our moved geometry) | KVComm ( Shi et al., 2026 ) | Plain concatenation, selected layers only | 1fa086e |
| LatentMAS ( Zou et al., 2026 ) | Plain concatenation (default backend) | 9a9e4d3 | |
| Re-rotated to new positions | KVCOMM ( Ye et al., 2025 ) | No added weight; estimated offsets added to keys and values | 48ca0b3 |
| CacheBlend ( Yao et al., 2025 ) | None described; a few tokens recomputed | paper | |
| Block-Attention ( Ma et al., 2025 ) | None described; model fine-tuned | paper | |
| Same content, same positions | Cache-to-Cache ( Fu et al., 2026 ) | Not concatenated: fused into the receiver’s cache by a learned module | 5eac72b |
Table 4: Where published systems place a foreign cache. Commit prefixes refer to each system’s public repository; “paper” means the layout is taken from the paper. “Plain concatenation” means that the foreign cache joins the receiver’s attention with no added weight, which is our equal weight.