← Publications
Working Manuscript
Context Is Not Control
Source-Boundary Failures in Controlled Text-Mediated Evidence Use
R.J. Sabouhi · Symbolic Suite
Working Manuscript v0.6 — claim-tightening and replication-artifacts revision — May 2026
Download PDF (v0.6) ·
GitHub ·
DOI: 10.5281/zenodo.20126173
Context is not control. A model should not treat every token in the context window as equally capable of governing evidence use.
Abstract. Large language models often fail in retrieval, memory, policy, and documentation settings not only because relevant information is absent, but because the status of information that is present is not preserved. A context window may contain current evidence, stale evidence, answer choices, quoted distractors, embedded instructions, fake authority claims, and non-governing background text at the same time. The model must determine not merely what text says, but which source is admissible for answering the user question.
This paper introduces source-boundary failure: an observable failure to preserve the admissibility relation between a question, source role, source status, embedded control-like text, and candidate factual predicate. We evaluate this failure class in controlled synthetic memory, policy, and software-documentation tasks. Across open-weight models, raw source rendering produces substantial overrefusal, injection-paired supported-row failure, unsupported answering, and distractor capture. Across frontier models — GPT-5.1, Claude Sonnet 4.6, and Gemini 3.1 Pro Preview — 21,780 API calls close three specific objections: the result is not explained by absence of an abstention channel, blanket refusal, or direct handoff of the abstention decision.
1. Contributions
- Definition. Source-boundary failure defined as an observable failure to preserve the admissibility relation between question, source role, source status, embedded control-like text, and candidate answer.
- Benchmark. Controlled synthetic memory, policy, and software-documentation tasks where supported and unsupported rows share surface answer strings but differ in source admissibility.
- Evidence. Raw context rendering induces false admissibility and false inadmissibility across open-weight models; source-boundary rendering materially changes behavior.
- Frontier mechanism checks. 21,780 frontier/API calls showing the effect is not explained by absence of an abstention channel, blanket refusal, or direct handoff of the abstention decision.
Minimal claim: In controlled memory, policy, and software-documentation tasks, hallucination-like, overrefusal-like, contaminant-capture, and embedded-instruction-interference behaviors can be operationalized as failures to preserve a source-admissibility relation. The current evidence does not claim to solve hallucination, prompt injection, RAG faithfulness, or agentic safety in general.
Table of Contents
- Contributions and reviewer-ready claim set
- Introduction and motivation
- Formal definition
- Benchmark design
- Metrics and scoring
- Open-weight evidence
- Frontier / API validation
- Interpretation and engineering implications
- Claims supported and not claimed
- Limitations and future work
- Data and replication artifacts
- Conclusion
- Appendices
Full paper including formal definitions, benchmark tables, open-weight and frontier results, and appendices is available in the PDF.