CAPTURE: Disentangling Preference Drift from Memory Poisoning in Personalized LLM Agents

May combine two claims.

Injection defenses reject content with untrusted provenance, which is sound for external threats but blind to a legitimate user revising a legitimate belief through a legitimate channel.

“Injection defenses refuse content whose provenance is not trusted (Chen et al., 2025;Hines et al., 2024;Debenedetti et al., 2025), which is sound when the threat is external but blind to the case that matters here, where a legitimate user revises a legitimate belief through a legitimate channel.”

• cites Chen et al., 2025Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites Hines et al., 2024 sourcePartly supported

  The Overview (§3.1; page unavailable) says spotlighting helps the model distinguish valid system instructions from untrustworthy external input. The Delimiting example (§3.2; page unavailable) tells the model not to obey instructions in an input document, but still to summarize it. Thus the source supports refusing instructions from untrusted input, not refusing the content itself; the legitimate-user scenario is the citing authors’ own framing. (LLM, conf=0.83)

  Experimental — accuracy not yet measured
• cites Debenedetti et al., 2025Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

Personalization pipelines prioritize adaptation speed and treat the history as ground truth, making them steerable by whoever writes into it.

“Personalization pipelines optimize for adaptation speed and treat the history as ground truth, which makes them steerable by whoever writes into it (Gao et al., 2024;Zollo et al., 2025).”

• cites Gao et al., 2024 sourcePartly supported

  The Abstract and “Minimize cumulative cost” section describe a personalization method that learns from historical user edits and efficiently uses inferred preferences to shape future responses. They do not say that personalization pipelines optimize for adaptation speed, treat history as ground truth, or can be steered by whoever writes into it; the paper describes preferences as latent and edits as potentially inconsistent with them. (LLM, conf=0.84)

  Experimental — accuracy not yet measured
• cites Zollo et al., 2025Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

The gate is a learned substitute for Bayesian changepoint detection, differing in that it must decide both whether the process changed and whether the user authored the evidence.

“The gate is a learned alternative to Bayesian changepoint detection (Adams and MacKay, 2007), differing in that it must decide not only whether the process changed but whether the evidence was authored by the user.”

• cites Adams and MacKay, 2007 sourceSupported

May combine two claims.

Dynamic regret, not static regret, is the appropriate notion because the comparator moves.

“Dynamic rather than static regret is the right notion because the comparator moves (Zinkevich, 2003;Besbes et al., 2015)”

• cites Zinkevich, 2003Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites Besbes et al., 2015 sourceSupported

Classified as probably not a substantial claim. May combine two claims.

Safety alignment is shallow in the token dimension, breakable by optimized suffixes, and fragile under fine-tuning.

“Safety alignment is shallow in the token dimension (Qi et al., 2025), breakable by optimized suffixes (Zou et al., 2023), and fragile under fine-tuning (Qi et al., 2024)”

• cites Qi et al., 2025Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites Zou et al., 2023 sourceSupported
• cites Qi et al., 2024Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

The D-PREFGUARD benchmark has 2,400 longitudinal episodes spanning five tracks covering stationary behavior, four shapes of genuine drift, benign noise, three contamination families, and utility-safety conflicts, with 480 held out for test.

“D-PREFGUARD contains 2,400 longitudinal episodes across five tracks isolating stationary behavior, four shapes of genuine drift, benign noise, three families of contamination, and conflicts between personal utility and safety, of which 480 are held out for test.”

May combine two claims.

On HorizonBench, Recency RAG leads on belief revision accuracy at 0.79 versus 0.78, the expected ordering when no adversary is present.

“On HorizonBench, Recency RAG leads on belief revision accuracy at 0.79 against 0.78, the expected ordering where no adversary exists”

May combine two claims.

Jointly learning the decay rates collapsed them toward one value and reduced genuine-update adherence by 3.1 points.

“Learning the rates jointly collapsed them toward a single value and cost 3.1 points of genuine-update adherence rate”

May combine two claims.

Under adaptive attack, Provenance-only reaches 22.1% versus CAPTURE's 24.7%, a paired difference of 2.6 points with interval [-1.9, 7.2] at p = 0.29, so the two are not reliably separated.

“Provenance-only reaches 22.1% against our 24.7%, a paired difference of 2.6 points with interval [-1.9, 7.2] at p = 0.29, so the two are not reliably separated on this axis”

• AssumptionThe authors state this as an assumption: The attacker controls at least one channel the agent reads and can see the visible transcript with its timestamps and source labels.
• AssumptionThe authors state this as an assumption: The attacker knows the defense, including the released weights, and writes grammatical, plausible claims.
• AssumptionThe authors state this as an assumption: The attacker cannot alter weights, read the private ledger, or see the gate's current belief.

May combine two claims.

Across 480 held-out episodes from 96 users, CAPTURE achieves a 71.5% win rate, compared with 69.3% for a baseline given identical supervision and 66.1% for the strongest heuristic.

“On 480 held-out episodes from 96 users, CAPTURE reaches a 71.5% win rate against 69.3% for a baseline given identical supervision and 66.1% for the strongest heuristic”

May combine two claims.

Provenance-only beats CAPTURE on indirect injection (4.8% vs 7.0%) but collapses on same-origin contamination (43.6% vs 17.5%), the regime identified by Theorem 1.

“Provenance-only beats CAPTURE on indirect injection, 4.8% against 7.0%, and collapses on same-origin contamination, 43.6% against 17.5%, the regime Theorem 1 identifies.”

• AssumptionThe authors state this as an assumption: The attacker controls at least one channel the agent reads and can see the visible transcript with its timestamps and source labels.
• AssumptionThe authors state this as an assumption: The attacker knows the defense, including the released weights, and writes grammatical, plausible claims.
• AssumptionThe authors state this as an assumption: The attacker cannot alter weights, read the private ledger, or see the gate's current belief.

May combine two claims.

Under adaptive attack, a provenance filter is marginally more secure than CAPTURE but considerably less adaptive.

“at which point a provenance filter is marginally more secure and considerably less adaptive”

• AssumptionThe authors state this as an assumption: The attacker controls at least one channel the agent reads and can see the visible transcript with its timestamps and source labels.
• AssumptionThe authors state this as an assumption: The attacker knows the defense, including the released weights, and writes grammatical, plausible claims.
• AssumptionThe authors state this as an assumption: The attacker cannot alter weights, read the private ledger, or see the gate's current belief.

May combine two claims.

Removing the gate costs 22.0 points of poisoning resistance and 0.15 regret, and removing provenance costs a further 14.0 points.

“The gate carries the security result almost entirely, costing 22.0 points of poisoning resistance and 0.15 regret, and provenance a further 14.0”

• AssumptionThe authors state this as an assumption: The attacker controls at least one channel the agent reads and can see the visible transcript with its timestamps and source labels.
• AssumptionThe authors state this as an assumption: The attacker knows the defense, including the released weights, and writes grammatical, plausible claims.
• AssumptionThe authors state this as an assumption: The attacker cannot alter weights, read the private ledger, or see the gate's current belief.

May combine two claims.

Against 240 attacks from twelve external red-teamers without access to the authors' templates, CAPTURE reaches 18.3%, above the authors' own generator's 11.5% but still the lowest of any method tested.

“On 240 attacks from twelve external red-teamers with no access to our templates, CAPTURE reaches 18.3%, above our own generator's 11.5% and still the lowest of any method tested”

• AssumptionThe authors state this as an assumption: The attacker controls at least one channel the agent reads and can see the visible transcript with its timestamps and source labels.
• AssumptionThe authors state this as an assumption: The attacker knows the defense, including the released weights, and writes grammatical, plausible claims.
• AssumptionThe authors state this as an assumption: The attacker cannot alter weights, read the private ledger, or see the gate's current belief.

May combine two claims.

Provenance-only, a memory-layer proxy for that class of defenses, beats CAPTURE on untrusted channels but not where user and attacker write the same kind of sentence.

“Provenance-only is a memory-layer proxy for that class rather than a reimplementation of any one defense, which beats CAPTURE on untrusted channels but not where user and attacker write the same kind of sentence.”

May combine two claims.

Removing the safety bound raises adherence by 4.0 points while leaving ledger promotion unchanged, and triples safety attack success.

“Removing the safety bound raises adherence by 4.0 while leaving ledger promotion unchanged, confirming adherence is output-level, and triples safety attack success.”

• AssumptionThe authors state this as an assumption: The attacker controls at least one channel the agent reads and can see the visible transcript with its timestamps and source labels.
• AssumptionThe authors state this as an assumption: The attacker knows the defense, including the released weights, and writes grammatical, plausible claims.
• AssumptionThe authors state this as an assumption: The attacker cannot alter weights, read the private ledger, or see the gate's current belief.

May combine two claims.

About 70% of events carry no preference content, so an extractor unable to decline builds a noisy ledger.

“Roughly seven in ten events carry no preference content, so an extractor that cannot decline builds a ledger of noise.”

May combine two claims.

Timescale separation contributes 5.4 points of adherence and probing 3.6 points.

“Timescale separation is worth 5.4 points of adherence and probing 3.6.”

May combine two claims.

On context switches the modal correct action is scoping rather than revision, and CAPTURE selects it in 71% of changepoints versus 4% for StateMem.

“On context switches the modal correct action is scope rather than revise, and CAPTURE selects it in 71% of changepoints against 4% for StateMem.”

May combine two claims.

Without the gate, poisoning reaches 33.5%, within 1.3 points of StateMem's 34.8%.

“removing the gate lands at 33.5% poisoning, within 1.3 points of StateMem's 34.8%.”

• AssumptionThe authors state this as an assumption: The attacker controls at least one channel the agent reads and can see the visible transcript with its timestamps and source labels.
• AssumptionThe authors state this as an assumption: The attacker knows the defense, including the released weights, and writes grammatical, plausible claims.
• AssumptionThe authors state this as an assumption: The attacker cannot alter weights, read the private ledger, or see the gate's current belief.

May combine two claims.

A baseline given the same supervision closes most of the gap to the heuristics; 2.2 points of win rate and 4.4 points of poisoning remain attributable to the architecture rather than the labels.

“A baseline trained on identical supervision closes most of the gap to the heuristics, leaving 2.2 points of win rate and 4.4 of poisoning attributable to the architecture rather than the labels.”

May combine two claims.

The adaptive attacker more than doubles CAPTURE's attack success, from 11.5% to 24.7%, with same-origin rising to 38.1%; it transfers to the other learned gate almost as well and barely moves the heuristic baselines.

“It more than doubles attack success against CAPTURE, from 11.5% to 24.7%, with same-origin rising to 38.1%, transfers to the other learned gate almost as well, and barely moves the heuristic baselines, which expose no gradient.”

• AssumptionThe authors state this as an assumption: The attacker controls at least one channel the agent reads and can see the visible transcript with its timestamps and source labels.
• AssumptionThe authors state this as an assumption: The attacker knows the defense, including the released weights, and writes grammatical, plausible claims.
• AssumptionThe authors state this as an assumption: The attacker cannot alter weights, read the private ledger, or see the gate's current belief.

May combine two claims.

Providing the discrete gate with an explicit elapsed-time input closes about 55% of the gap to the continuous gate, but not the entire gap.

“giving the discrete gate an explicit elapsed-time input recovers about 55% of that gap but not all of it”

May combine two claims.

Conditioning on the full interaction history rather than only recency and provenance never increases the achievable error, and strictly decreases it under a stated nondegeneracy condition.

“that conditioning on the interaction history is never worse and is strictly better under a stated condition”

• Also stated in: § 2 Problem Formulation · plain

  “Against any fixed adversary, conditioning on the full history in place of φ never increases the achievable error, and strictly decreases it whenever the sign of the conditional likelihood ratio given φ is nondegenerate on a set of views of positive measure.”

• AssumptionThe authors state this as an assumption: The attacker controls at least one channel the agent reads and can see the visible transcript with its timestamps and source labels.
• AssumptionThe authors state this as an assumption: The attacker knows the defense, including the released weights, and writes grammatical, plausible claims.
• AssumptionThe authors state this as an assumption: The attacker cannot alter weights, read the private ledger, or see the gate's current belief.

May combine two claims.

Against a known adversary, the likelihood-ratio test attains the bound, so the bound is tight.

“Against a known adversary the bound is attained by the likelihood-ratio test, so it is tight rather than loose”

• AssumptionThe authors state this as an assumption: The attacker controls at least one channel the agent reads and can see the visible transcript with its timestamps and source labels.
• AssumptionThe authors state this as an assumption: The attacker knows the defense, including the released weights, and writes grammatical, plausible claims.
• AssumptionThe authors state this as an assumption: The attacker cannot alter weights, read the private ledger, or see the gate's current belief.

May combine two claims.

Run zero-shot, the supervised Transformer scores 0.04 lower than CAPTURE on HorizonBench contradiction resolution (p = 0.008) and 1.7 points lower on replay win (p = 0.031), while the belief-revision and replay-poisoning gaps are not significant, so the architectural gain transfers beyond the authors' generator but only modestly.

“Frozen and run zero-shot, the Transformer trails CAPTURE on HorizonBench contradiction resolution by 0.04 at p = 0.008 and on replay win by 1.7 points at p = 0.031, while the belief-revision and replay-poisoning gaps do not reach significance, so the architectural gain transfers beyond our generator but modestly.”

May combine two claims.

On D-PREFGUARD, CAPTURE leads StateMem by 5.4 points of win rate, and on replayed histories by 4.5 points.

“On D-PREFGUARD CAPTURE leads StateMem by 5.4 points of win rate, and on replayed histories by 4.5.”

May combine two claims.

The advantage of CAPTURE survives both the HorizonBench and user-study evaluations, though it attenuates in each.

“The advantage survives both moves and attenuates each time.”

May combine two claims.

Recency RAG has the highest adherence at 85.7%, the worst poisoning at 51.6%, and the worst false admission at 41.2%.

“Recency RAG adheres most at 85.7% and has the worst poisoning at 51.6% and worst false admission at 41.2%.”

• AssumptionThe authors state this as an assumption: The attacker controls at least one channel the agent reads and can see the visible transcript with its timestamps and source labels.
• AssumptionThe authors state this as an assumption: The attacker knows the defense, including the released weights, and writes grammatical, plausible claims.
• AssumptionThe authors state this as an assumption: The attacker cannot alter weights, read the private ledger, or see the gate's current belief.

May combine two claims.

CAPTURE holds fixed-policy poisoning to 11.5% versus 20.0% for Provenance-only, adheres to 83.5% of genuine updates versus 74.1%, and admits 8.9% of benign non-updates versus 19.6%.

“CAPTURE holds fixed-policy poisoning to 11.5% against 20.0% for Provenance-only while adhering to 83.5% of genuine updates against that baseline's 74.1%, and admits 8.9% of benign non-updates against its 19.6%.”

• AssumptionThe authors state this as an assumption: The attacker controls at least one channel the agent reads and can see the visible transcript with its timestamps and source labels.
• AssumptionThe authors state this as an assumption: The attacker knows the defense, including the released weights, and writes grammatical, plausible claims.
• AssumptionThe authors state this as an assumption: The attacker cannot alter weights, read the private ledger, or see the gate's current belief.

May combine two claims.

Top-label expected calibration error was 0.047 [0.035, 0.060] for CAPTURE and 0.062 [0.048, 0.078] for the Transformer.

“Top-label expected calibration error on the same events, using 15 equal-mass bins with temperature fitted on development data only, is 0.047 at [0.035, 0.060] for CAPTURE and 0.062 at [0.048, 0.078] for the Transformer.”

May combine two claims.

The win advantage over StateMem was +4.5 points with interval [1.0, 8.0] at p = 0.014, and the satisfaction advantage was +0.30 points at [0.10, 0.50] and p = 0.004.

“the win advantage over StateMem is +4.5 points with interval [1.0, 8.0] at p = 0.014, and the satisfaction advantage is +0.30 points at [0.10, 0.50] and p = 0.004.”

Classified as probably not a substantial claim. May combine two claims.

No refuting condition currently holds, and the external-validity check passes only narrowly.

“No refuting condition currently holds, and the external-validity check passes only narrowly.”

May combine two claims.

On HorizonBench zero-shot, CAPTURE achieved belief revision accuracy 0.78, contradiction resolution rate 0.72, retrieval-attributable error 0.21, replay win 67.5% [62.0, 73.0], and replay poisoning 12% [7, 18].

“CAPTURE 0.78 0.72 0.21 67.5 [62.0, 73.0] 12 [7, 18]”

May combine two claims.

The judge's agreement with the human majority was 87.4%, compared with 91.2% pairwise agreement among the humans.

“the judge matches the human majority 87.4% of the time against 91.2% pairwise agreement among the humans.”

May combine two claims.

Retrievable-memory attack success was higher than response-level success throughout: 55.2% for Static Summary, 69.0% for Recency RAG, 48.1% for StateMem, 27.5% for Provenance-only, 59.8% for MemGPT, and 18.8% [15.7, 22.2] for CAPTURE, against CAPTURE's 11.5% [9.7, 13.4] response-level.

“Retrievable-memory success is higher throughout, at 55.2% Static Summary, 69.0%Recency RAG, 48.1% StateMem, 27.5% Provenance-only, 59.8% MemGPT, and 18.8% with interval [15.7, 22.2] for CAPTURE, against its 11.5% at [9.7, 13.4] response-level.”

May combine two claims.

CAPTURE costs 17% more tokens per turn than StateMem and 43% fewer than Full History.

“CAPTURE therefore costs 17% more tokens per turn than StateMem and 43% fewer than Full History.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Remark 3: Away from the atom at r_t = ∞, the r_t marginal is non-atomic in the authors' data, so every individual fibre is λ-null.

“Away from the atom at r t = ∞ that Definition 1 introduces for never-corroborated nodes, the r tmarginal is non-atomic in our data, so every individual fibre is λ-null and no such pair of sets exists.”

• AssumptionThe authors state this as an assumption: The restricted view φ is measurable with respect to the σ-algebras on H and Φ.

May combine two claims.

On the same-origin track, Provenance-only achieves 43.6% attack success while CAPTURE achieves 17.5%, a significant difference at p < 0.001.

“Provenance-only reaches 43.6% attack success on the same-origin track against 17.5% for CAPTURE, and the gap is significant at p < 0.001.”

May combine two claims.

For the headline comparisons in Table 1, CAPTURE's win rate 95% interval was [69.1, 73.8] against StateMem's [63.6, 68.5], and CAPTURE's poison ASR interval was [9.7, 13.4] against Provenance-only's [18.1, 22.0].

“For the headline comparisons in Table 1, the 95% intervals are [69.1,73.8] for CAPTURE's win rate against [63.6, 68.5] for StateMem, and [9.7, 13.4] for CAPTURE's poison ASR against [18.1, 22.0] for Provenance-only.”

May combine two claims.

The rate at which genuine evidence becomes available to response generation was 100.0% for Full History, 93.8% for Recency RAG, 87.4% for StateMem, 86.1% for MemGPT, 79.6% for Static Summary, 78.9% for Provenance-only, and 88.2% for CAPTURE.

“The comparable quantity is the rate at which genuine evidence becomes available to response generation, which is 100.0%for Full History, 93.8% Recency RAG, 87.4% StateMem, 86.1% MemGPT, 79.6% Static Summary, 78.9% Provenance-only, and 88.2% for CAPTURE.”

May combine two claims.

The supervised Transformer, evaluated zero-shot, reached belief revision accuracy 0.77 versus CAPTURE's 0.78, contradiction resolution 0.68 versus 0.72, retrieval-attributable error 0.23 versus 0.21, replay win 65.8% [60.2, 71.0] versus 67.5%, and replay poisoning 17% [11, 24] versus 12%.

“It reaches HorizonBench belief revision accuracy 0.77 against CAPTURE's 0.78, contradiction resolution 0.68 against 0.72, retrieval-attributable error 0.23 against 0.21, replay win 65.8% [60.2, 71.0] against 67.5%, and replay poisoning 17% [11,24] against 12%.”

May combine two claims.

Four of five methods showed higher attack success under independently authored attacks than under the fixed generator, while Recency RAG changed only slightly from 51.6% to 50.4%.

“Four of five methods show higher attack success under independently authored attacks than under our fixed generator, while Recency RAG changes slightly from 51.6% to 50.4%.”

May combine two claims.

Independent annotators showed agreement of α = 0.78 on authenticity, 0.74 on scope, 0.71 on timescale, and 0.67 on the six-way action.

“Agreement was α = 0.78 on authenticity, 0.74 on scope, 0.71 on timescale, and 0.67 on the six-way action.”

May combine two claims.

CAPTURE's adaptive attack success of 24.7% exceeds Provenance-only's 22.1% by 2.6 points with a paired interval of [-1.9, 7.2] at p = 0.29.

“CAPTURE's 24.7% exceeds Provenance-only's 22.1% by 2.6 points with a paired interval of [-1.9, 7.2] at p = 0.29.”

May combine two claims.

Against CAPTURE, the adaptive attacker raised retrievable-memory attack success to 34.4% and response-level success to 24.7%, and transferred to the supervised Transformer at 27.9%.

“Against CAPTURE it raises retrievable-memory attack success to 34.4% and response-level success to 24.7%, and it transfers to the supervised Transformer at 27.9% while barely moving the heuristic baselines, which expose no gradient.”

The quote only partly states this claim.

Twelve of the 32 recency-origin cells survived the strictness test.

“Twelve cells survive.”

May combine two claims.

Query-budget-matched StateMem reached 67.6% win rate, 0.30 regret, 3.7 lag, 30.5% poisoning, 82.4% adherence, and clarification F1 0.51 at precision 0.56 and recall 0.47, on a realized query rate of 8.1%.

“It reaches 67.6% win rate, 0.30 regret, 3.7 lag, 30.5% poisoning, 82.4% adherence, and clarification F1 0.51 at precision 0.56 and recall 0.47, on a realized query rate of 8.1%.”

May combine two claims.

Paired comparisons showed the architectural gain was +0.01 on belief revision (p = 0.27), +0.04 on contradiction resolution (p = 0.008), -0.02 retrieval error [-0.040, -0.001] (p = 0.046), +1.7 points replay win (p = 0.031), and -5.0 points replay poisoning (p = 0.064).

“Paired, the architectural gain is +0.01 on belief revision at p = 0.27, +0.04 on contradiction resolution at p = 0.008, -0.02 retrieval error with interval [-0.040, -0.001] at p = 0.046, +1.7 points of replay win at p = 0.031, and -5.0 points of replay poisoning at p = 0.064.”

May combine two claims.

For CAPTURE, ledger promotion was 88.2% [85.4, 90.8] and output adherence was 83.5% [80.6, 86.2]; removing the safety bound left promotion unchanged at 88.2% but raised adherence to 87.5%.

“For CAPTURE specifically, ledger promotion is 88.2% with interval [85.4,90.8] while output adherence is 83.5% at [80.6, 86.2], and removing the safety bound leaves promotion unchanged at 88.2% while raising adherence to 87.5%.”

May combine two claims.

Jointly learning the three decay rates with the gate collapsed them toward 0.08 and reduced acceptance by 3.1 points and win rate by 1.9 points.

“Learning them jointly with f θ collapsed the three toward 0.08 and cost 3.1 points of acceptance and 1.9 of win rate.”

May combine two claims.

CAPTURE scored 4.1 on satisfaction with a participant-clustered 95% interval of [3.9, 4.3], while StateMem scored 3.8 with [3.6, 4.0].

“CAPTURE scored 4.1 with a participant-clustered 95% interval of [3.9, 4.3] and StateMem 3.8 at [3.6, 4.0].”

May combine two claims.

The generation program's labels agree with adjudicated human action 83.6% of the time, and CAPTURE's action macro-F1 against human labels is 0.71 with interval [0.67, 0.75].

“The program labels agree with the adjudicated human action 83.6% of the time, and CAPTURE's action macro-F1 against the human labels is 0.71 with interval [0.67, 0.75].”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

With ε = 0.08, κ + ε = 0.174, against 1/2(1 - TV_φ) = 0.3323.

“With ε = 0.08 from Appendix D, κ + ε = 0.174, against 1 2 (1 -TV φ ) = 0.3323.”

• AssumptionThe authors state this as an assumption: The clarification answer accuracy of 92% against the latent label corresponds to an error ε = 0.08 in the sense of Assumption 5.

May combine two claims.

On the 720 independently annotated test events, CAPTURE reached six-action macro-F1 of 0.71 [0.67, 0.75] and the supervised Transformer 0.68 [0.64, 0.72].

“On the 720 independently annotated test events, CAPTURE reaches six-action macro-F1 of 0.71 with interval [0.67, 0.75] and the supervised Transformer 0.68 at [0.64, 0.72].”

May combine two claims.

Under independently authored attacks, attack success was 50.4% for Recency RAG, 37.1% for StateMem, 26.3% for Provenance-only, 22.5% for the supervised Transformer, and 18.3% [14.0, 23.1] for CAPTURE.

“Attack success is 50.4% for Recency RAG, 37.1% StateMem, 26.3% Provenanceonly, 22.5% for the supervised Transformer, and 18.3% with interval [14.0, 23.1] for CAPTURE.”

May combine two claims.

Mean pairwise evidence-set F1 was 0.82 and node-level Krippendorff's α was 0.76.

“Mean pairwise evidence-set F1 is 0.82 and node-level Krippendorff's α is 0.76.”

Probably not a substantial claim: may not pass S3 (load-bearing).

In the matched sample, Provenance-only's error matches the binned plug-in bound to four decimal places.

“On the matched sample Provenance-only's error equals the binned plug-in bound to four decimals.”

May combine two claims.

Against the supervised Transformer, the win advantage was +2.2 points at [0.6, 3.9] and p = 0.011, and the poisoning advantage was -4.4 points at [-7.0, -1.9] and p = 0.003.

“Against the supervised Transformer the win advantage is +2.2 points at [0.6, 3.9] and p = 0.011, and the poisoning advantage -4.4 points at [-7.0, -1.9] and p = 0.003.”

May combine two claims.

StrongREJECT attack success rates are: unpersonalized 10.6%, Full History 13.2%, Static Summary 12.5%, Recency RAG 14.6%, StateMem 12.7%, Provenance-only 11.5%, MemGPT 13.7%, CAPTURE 8.9%, Oracle-memory 4.4%.

“Attack success under StrongREJECT is 10.6% for the unpersonalized model, 13.2% Full History, 12.5% Static Summary, 14.6% Recency RAG, 12.7% StateMem, 11.5% Provenance-only, 13.7% MemGPT, 8.9% CAPTURE, and 4.4% Oracle-memory.”

• AssumptionRests on an assumption: The three attack families (indirect injection, poisoned summary, same-origin) are representative of real memory poisoning attacks.

May combine two claims.

A quarantined claim is held, never corroborated, and decays out of the ledger.

“The claim is held, never corroborated, and decays out of the ledger.”

• AssumptionRests on an assumption: The three attack families (indirect injection, poisoned summary, same-origin) are representative of real memory poisoning attacks.

May combine two claims.

Over paired replicates, the estimated excess is non-negative, and its one-sided 95% interval [0.0000, 0.0372] has zero at the lower endpoint.

“Across paired replicates the estimated excess is non-negative and its one-sided 95% interval [0.0000, 0.0372] includes zero at its lower endpoint.”

May combine two claims.

Static summary attains 0.41 recurring regret, compared with 0.27 for the full system, while the ablation lacking timescale separation attains 0.32.

“Static summary reaches 0.41 recurring regret against 0.27, and the ablation without timescale separation reaches 0.32.”

• AssumptionRests on an assumption: The three attack families (indirect injection, poisoned summary, same-origin) are representative of real memory poisoning attacks.

May combine two claims.

The full system's absolute common-pool dynamic regret is 0.27, and it rises to 0.42 when the gate is removed.

“whose absolute values are 0.27 for the full system rising to 0.42 without the gate.”

• AssumptionRests on an assumption: The three attack families (indirect injection, poisoned summary, same-origin) are representative of real memory poisoning attacks.

May combine two claims.

The matched split is more difficult than the aggregate, explaining why Provenance-only rejects 45.6% of genuine updates there versus the 25.9% implied by Table 1.

“The matched split is also harder than the aggregate, which is why Provenance-only rejects 45.6% of genuine updates here against the 25.9% implied by Table 1”

May combine two claims.

On HorizonBench, CAPTURE leads only on contradiction resolution and does not lead on belief revision accuracy.

“on HorizonBench CAPTURE does not lead on belief revision accuracy at all, leading only on contradiction resolution.”

May combine two claims.

Removing the safety bound increases benign safety to 23.0% and reduces refusal to 4.8%.

“w/o safety bound -0.01 +1.0 pp +4.0 pp 23.0% 4.8% 0.77 2050 ms”

• AssumptionRests on an assumption: The three attack families (indirect injection, poisoned summary, same-origin) are representative of real memory poisoning attacks.

Probably not a substantial claim: may not pass S3 (load-bearing).

The quantity D_b = FUR_b + RRL_b - (1 - TV_φ,b) is non-negative across all 10,000 replicates.

“so the difference D b = FUR b + RRL b -(1 -TV φ,b ) is non-negative in all 10,000 replicates”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

All StrongREJECT values fall within 1.4 points of their HarmBench counterparts in Table 1, with identical ordering.

“Every value lies within 1.4 points of the corresponding HarmBench figure in Table 1, and the ordering is identical.”

• AssumptionRests on an assumption: The three attack families (indirect injection, poisoned summary, same-origin) are representative of real memory poisoning attacks.

May combine two claims.

Removing the authenticity gate increases common-pool dynamic regret by 0.15 and poison ASR by 22.0 pp.

“w/o authenticity gate +0.15 +22.0 pp -2.5 pp 9.5% 8.3% 0.64 1850 ms”

• AssumptionRests on an assumption: The three attack families (indirect injection, poisoned summary, same-origin) are representative of real memory poisoning attacks.

May combine two claims.

An adversary can shape an injected claim's surface form to match the recency profile of a genuine revision, and a user can revise through a summarized document to match the provenance profile of an attack, so each heuristic family fails on the case the other handles.

“An adversary choosing the surface form of an injected claim can match the recency profile of a genuine revision, and a user revising through a summarized document can match the provenance profile of an attack, so each family of heuristic fails on the case the other handles.”

• AssumptionThe authors state this as an assumption: The attacker controls at least one channel the agent reads and can see the visible transcript with its timestamps and source labels.
• AssumptionThe authors state this as an assumption: The attacker knows the defense, including the released weights, and writes grammatical, plausible claims.
• AssumptionThe authors state this as an assumption: The attacker cannot alter weights, read the private ledger, or see the gate's current belief.

May combine two claims.

Because HorizonBench is non-interactive, the clarify action resolves to quarantine without update, so that row represents CAPTURE without interactive clarification and contains no attacks.

“because it is non-interactive, clarify resolves to quarantine without update, so that row is CAPTURE without interactive clarification, and it holds no attacks.”

Classified as probably not a substantial claim. May combine two claims.

Participant histories were frozen and replayed identically for every system, with six controlled attacks injected per participant that no participant saw; when the gate asks, the stored annotation answers, making the replay oracle-assisted with zero answer error.

“Their histories were then frozen and replayed identically to every system with six controlled attacks injected per participant, none of which a participant saw, and when the gate asks the stored annotation answers, making this an oracle-assisted replay with zero answer error.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The results in Table 1 were obtained on Qwen3-8B and Llama-3.1-8B with three random seeds per model, so each reported cell averages six runs.

“in Table 1 was run on Qwen3-8B and Llama-3.1-8B with three seeds each, so those cells average six runs.”

Classified as probably not a substantial claim. May combine two claims.

Satisfaction was measured in a separate blinded within-participant rating task using four matched output pairs per session, with identity, order, and side randomized.

“Satisfaction came from a separate blinded withinparticipant rating task, four matched output pairs per session with identity, order, and side randomized”

May combine two claims.

HorizonBench tracks 360 simulated users whose preferences evolve over about six months and separates retrieval failures from belief-update failures by design.

“HorizonBench (Li et al., 2026) tracks 360 simulated users whose preferences evolve across roughly six months and separates retrieval from belief-update failures by construction.”

• cites Li et al., 2026Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

The user study uses naturally generated histories, with contamination introduced only during offline replay, so it tests transfer to natural histories rather than to independently generated attacks.

“The user study supplies naturally generated histories, into which we introduce contamination only during offline replay, so it tests transfer to natural histories and not to independently generated attacks.”

May combine two claims.

On a 600-comparison subset, the LLM judge matches three human raters 87.4% of the time, versus 91.2% agreement among the raters themselves.

“on a 600-comparison subset the judge agrees with three human raters 87.4% of the time, against 91.2% among the raters themselves.”

May combine two claims.

Much of the improvement comes from supervision, and the architecture accounts for the remainder.

“Supervision therefore explains much of the improvement and the architecture the rest.”

May combine two claims.

A stable node can only be overwritten by repeated high-confidence evidence, not a single assertion, which prevents one sentence from redefining a user.

“Overwriting a stable node requires repeated high-confidence evidence rather than a single assertion, which is what stops one sentence from redefining a user.”

May combine two claims.

HorizonBench is an independently constructed benchmark that contains evolving preferences but no contamination.

“HorizonBench is independently constructed and holds evolving preferences but no contamination.”

• cites Li et al., 2026Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

These results support transfer of preference tracking beyond the authors' generator, but not transfer of poisoning robustness, because the replayed contamination is author-constructed.

“These panels support transfer of preference tracking beyond our generator, though not of poisoning robustness, since the replayed contamination is author-constructed.”

Classified as probably not a substantial claim.

Prior work on personalization and agent memory assumes the record is trustworthy and manages capacity rather than asking whether a memory should have been written.

“All of it assumes the record is trustworthy and manages capacity rather than asking whether a memory should have been written.”

May combine two claims.

The development and test splits use disjoint synthetic users, topics, surface templates, and attack realizations, and one generator family is held out from training and development for test.

“Development and test partitions use disjoint synthetic users, topics, surface templates, and attack realizations, and one generator model family is excluded from training and development and reserved for test.”

May combine two claims.

With the continuous-time dynamics, a nine-day gap substantially decays the transient layer while the stable layer barely moves, so a later contradiction meets a belief that has already discarded session-specific noise.

“Under Equation 4the transient layer decays substantially across the nine days while the stable layer barely moves, so a contradiction arriving afterwards is read against a belief that has already discarded the session-specific noise.”

May combine two claims.

The authors had no role in constructing HorizonBench, and evaluation on it is strictly zero-shot.

“We had no part in building it and evaluation is strictly zero-shot”

Probably not a substantial claim: may not pass S3 (load-bearing).

No clarification F1 is defined on the replay because the four participant labels describe scope and extraction correctness and none indicates whether the assistant should have asked.

“No clarification F1 is defined on the replay, because the four participant labels describe scope and extraction correctness and none expresses whether the assistant should have asked.”

May combine two claims.

The architectural gain transfers beyond the paper's generator, significantly on contradiction resolution and replay win but not on belief revision accuracy or replay poisoning.

“The gain therefore transfers beyond our generator, significantly on contradiction resolution and replay win and not on belief revision accuracy or replay poisoning, which is a modest result and the one we would most want strengthened.”

May combine two claims.

CAPTURE's action classification against human labels is numerically better than the Transformer's but not significantly so, which locates its larger downstream advantage in the ledger and temporal update rather than in per-event classification accuracy.

“so CAPTURE's action classification against human labels is numerically better and not significantly so, which locates its larger downstream advantage in the ledger and the temporal update rather than in per-event classification accuracy.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Remark 2: The rule d*_α does not depend on which dominating measure is chosen.

“The rule d ⋆ α does not depend on which one is chosen, because for any dominating ν the set {dP g /dν > dP α /dν} agrees with {p > q} up to a λ-null set”

• AssumptionThe authors state this as an assumption: The restricted view φ is measurable with respect to the σ-algebras on H and Φ.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Generated episodes were human-validated on a 300-episode subset, with agreement reported in Appendix D.

“Generated episodes were human-validated on a 300-episode subset with the agreement reported in Appendix D”

Probably not a substantial claim: may not pass S3 (load-bearing).

Remark 5: Assumption 5 fixes a single ε for all histories and all α, which grants the ask channel an accuracy that no function of H need achieve.

“Assumption 5 fixes a single ε for all histories and all α, which grants the ask channel an accuracy that no function of H need achieve.”

• AssumptionThe authors state this as an assumption: The agent may take a third action, ask, which incurs a fixed cost κ > 0 and returns a label through a binary symmetric channel with error ε ∈ [0, 1/2), conditionally independent of H given Z.

May combine two claims.

CAPTURE and Provenance-only are not reliably separated on adaptive attack success, and what distinguishes them is adherence at 83.5% versus 74.1%.

“The two are therefore not reliably separated on adaptive attack success, and what distinguishes them is adherence at 83.5% against 74.1%.”

Classified as probably not a substantial claim.

A discriminator that fails to separate the two laws provides no certification, because the failure could be the discriminator's own.

“A discriminator that fails to separate the two laws certifies nothing, since the failure may be its own.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Adaptive attack remains open, and there the advantage over a provenance filter is not reliably separated.

“Adaptive attack remains open, and there our advantage over a provenance filter is not reliably separated.”

May combine two claims.

Remark 4: An unrestricted policy may act on (G, Z) jointly rather than on Z alone, and its conditional error after asking is at most min{e, ε}, which can be strictly smaller.

“An unrestricted policy may act on (G, Z) jointly rather than on Z alone, and its conditional error after asking is E Z [min{Pr(Z = a | G, Z), 1 -Pr(Z = a | G, Z)}] ≤ min{e, ε}, which can be strictly smaller.”

• AssumptionThe authors state this as an assumption: The agent may take a third action, ask, which incurs a fixed cost κ > 0 and returns a label through a binary symmetric channel with error ε ∈ [0, 1/2), conditionally independent of H given Z.

Classified as probably not a substantial claim. May combine two claims.

The safety constraint in Section 3.4 is architecturally separate from the preference model and cannot be lowered by anything a user or an attacker writes.

“the safety constraint in Section 3.4 is architecturally separate from the preference model and cannot be lowered by anything a user or an attacker writes”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The comparison of κ + ε with 1/2(1 - TV_φ) is illustrative and not a checked instantiation of Equation 23, because the theorem's cost is in zero-one loss units while κ is a normalized utility difference and the two scales are not established to coincide.

“We present this as an illustrative comparison and explicitly not as a checked instantiation of Equation 23, for two reasons.The theorem's cost is in the units of zero-one loss while κ is a normalized utility difference, and we have not established that the two scales coincide, so the sum κ + ε is not the quantity the theorem constrains.”

• AssumptionThe authors state this as an assumption: The clarification answer accuracy of 92% against the latent label corresponds to an error ε = 0.08 in the sense of Assumption 5.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

CAPTURE is text-only and does not address weight-level poisoning, and the clarification budget is tuned on the authors' data.

“CAPTURE is text-only and does not address weight-level poisoning, and the clarification budget is tuned on our data.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Corollary 1: The Bayes risk over G-measurable rules is R*_π = (1-π) - ν+(H), and at π = 1/2 it reduces to R* = 1/2(1 - TV(P_g|G, P_α|G)).

“The Bayes risk over G-measurable rules is R ⋆ π = (1 -π) -ν + (H), ν = (1 -π)P g -πP α G ,(15) and at π = 1 2 this reduces to R ⋆ = 1 2 (1 -TV(P g | G , P α | G )).”

• AssumptionThe authors state this as an assumption: The restricted view φ is measurable with respect to the σ-algebras on H and Φ.
• AssumptionThe authors state this as an assumption: The rule under analysis is measurable with respect to σ(φ) and may not condition on any other function of the history H.

Classified as probably not a substantial claim.

The authors construct a dedicated matched split pairing each adversarial episode with a genuine episode agreeing on topic, contradicted node type, and turn index.

“We construct a dedicated matched split pairing each adversarial episode with a genuine episode agreeing on topic, contradicted node type, and turn index.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

D-PREFGUARD is synthetic and validated on a 300-episode subset, so its absolute numbers are relative comparisons rather than deployment estimates.

“D-PREFGUARD is synthetic and validated on a 300-episode subset, so absolute numbers are relative comparisons rather than deployment estimates.”

Classified as probably not a substantial claim.

The gap between ledger promotion and output adherence, and its sensitivity to a downstream component, is why adherence is named as an output-level quantity.

“The gap between the two, and its sensitivity to a downstream component, is exactly why adherence is named as an output-level quantity.”

Classified as probably not a substantial claim. May combine two claims.

Matching changes the estimand to a conditional distance averaged over strata, and because turn index partly determines r_t, the matched distance is expected to be smaller than the deployment distance.

“Matching changes the estimand to a conditional distance averaged over strata, and because turn index partly determines r t the matched distance is expected to be smaller than the deployment distance.”

• AssumptionThe authors state this as an assumption: The adversary observes the visible transcript, its timestamps, and visible source labels; knows the architecture, algorithm, hyperparameters, and released adapter weights; does not observe the private ledger, latent user state, gate confidence, or random seeds; may choose injection timing and content; cannot impersonate an authenticated user and cannot corrupt the answer to a clarifying question.

Probably not a substantial claim: may not pass S3 (load-bearing).

The reference implementation is configured not to persist hypotheses concerning protected attributes, enforced by a schema constraint on the extractor rather than by a learned behavior.

“the reference implementation is configured not to persist hypotheses concerning protected attributes, enforced by a schema constraint on the extractor rather than by a learned behavior”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

All numerical claims in Section 5 were computed by scripts written by the authors and verified independently by two authors.

“all numerical claims in Section 5 were computed by scripts the authors wrote and verified independently by two authors”

May combine two claims.

An agent that trusts its memory can be rewritten by anyone who reaches it, and one that distrusts it stops learning.

“An agent that trusts its memory can be rewritten by anyone who reaches it, and one that distrusts it stops learning.”

May combine two claims.

The first is a property of the estimand and the second of the estimator, and neither effect is hidden by the reported quantities.

“The first is a property of the estimand and the second of the estimator, and neither effect is hidden by the reported quantities.”

May combine two claims.

These are one problem, no fixed rule on recency or provenance resolves it, and inferring authenticity as a latent variable improves both axes at once.

“These are one problem, no fixed rule on recency or provenance resolves it, and inferring authenticity as a latent variable improves both axes at once.”

Classified as probably not a substantial claim. May combine two claims.

Estimates at α_0 bound TV(P_g|G, P_α0|G) and say nothing directly about δ_G.

“estimates at α 0 bound TV(P g | G , P α0 | G ) and say nothing directly about δ G .”

• AssumptionThe authors state this as an assumption: The adversary observes the visible transcript, its timestamps, and visible source labels; knows the architecture, algorithm, hyperparameters, and released adapter weights; does not observe the private ledger, latent user state, gate confidence, or random seeds; may choose injection timing and content; cannot impersonate an authenticated user and cannot corrupt the answer to a clarifying question.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Theorem 2 constrains only σ(φ)-measurable rules, says nothing about a heuristic reading a third fixed feature, and depends on Assumption 4 granting the adversary the visible transcript.

“Theorem 2 constrains only σ(φ)-measurable rules, says nothing about a heuristic reading a third fixed feature, and depends on Assumption 4 granting the adversary the visible transcript.”

May combine two claims.

The binned plug-in estimate of the distance is neither an upper nor a lower bound on the population value, because binning and finite-sample bias act in opposite directions, so it cannot certify the inequality.

“Separately, the binned plug-in estimate of the distance is neither an upper nor a lower bound on the population value, since binning and finite-sample bias act in opposite directions, so it cannot certify that the inequality holds.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The plug-in estimator of a total variation distance is upward biased in finite samples by Jensen's inequality.

“the plug-in estimator of a total variation distance is upward biased in finite samples by Jensen's inequality.”

May combine two claims.

Query access is worth roughly 1.5 points of win rate and 4.3 points of poisoning resistance to StateMem, a real gain that does not account for CAPTURE's remaining margin.

“Query access is therefore worth roughly 1.5 points of win rate and 4.3 points of poisoning resistance to StateMem, which is a real gain and does not account for CAPTURE's remaining margin.”

May combine two claims.

Two distinct effects act here and they do not cancel.

“Two distinct effects act here and they do not cancel.”

May combine two claims.

Remark 1: The worst-case bound is a maximin value, not a value; equality is attained by d*_α, which depends on α and is therefore unavailable to a defender who does not know the adversary's policy.

“Equality in Equation 11 is attained by d ⋆ α , which depends on α and is therefore unavailable to a defender who does not know the adversary's policy.”

• AssumptionThe authors state this as an assumption: The adversary observes the visible transcript, its timestamps, and visible source labels; knows the architecture, algorithm, hyperparameters, and released adapter weights; does not observe the private ledger, latent user state, gate confidence, or random seeds; may choose injection timing and content; cannot impersonate an authenticated user and cannot corrupt the answer to a clarifying question.

May combine two claims.

The aggregate Poison ASR and genuine-update adherence rate columns of Table 1 are not a matched pair, since they are computed over different tracks with different claim distributions, and must not be substituted into Equation 11.

“The aggregate Poison ASR and genuine-update adherence rate columns of Table 1 are not such a pair, since they are computed over different tracks with different claim distributions, and must not be substituted into Equation 11.”

May combine two claims.

HorizonBench reduces but does not remove this concern, since its trajectories are simulated even where annotations are human, and 40 participants supports an effect estimate but no subgroup claim.

“Horizon-Bench reduces that without removing it, since its trajectories are simulated even where annotations are human, and 40 participants supports an effect estimate but no subgroup claim.”

May combine two claims.

Most of the gain comes from supervised temporal tracking, which a matched Transformer also reaches; the ledger and continuous-time update add a smaller increment that survives on independently built data.

“Most of that gain comes from supervised temporal tracking, which a matched Transformer also reaches; the ledger and continuous-time update add a smaller increment that survives on independently built data.”

Classified as probably not a substantial claim.

Every quantity in Appendix A.6 is computed against the single adversary policy realized in D-PREFGUARD, denoted α_0.

“Every quantity below is computed against the single adversary policy realized in D-PREFGUARD, which we write α 0 .”

May combine two claims.

Theorem 3: For every α and every pair of sub-σ-algebras G ⊆ G', TV(P_g|G, P_α|G) ≤ TV(P_g|G', P_α|G'), and consequently δ_G ≤ δ_G'.

“For every α ∈ A and every pair of sub -σ-algebras G ⊆ G ′ ⊆ Σ H , TV P g | G , P α | G ≤ TV P g | G ′ , P α | G ′ ,(16) and consequently δ G ≤ δ G ′ .”

• AssumptionThe authors state this as an assumption: The restricted view φ is measurable with respect to the σ-algebras on H and Φ.
• AssumptionThe authors state this as an assumption: The rule under analysis is measurable with respect to σ(φ) and may not condition on any other function of the history H.

Classified as probably not a substantial claim. May combine two claims.

Synthetic and external results use user-level paired bootstrap with 10,000 resamples for 95% intervals, resampling users rather than episodes so that repeated episodes from one simulated user do not count as independent evidence.

“Synthetic and external results use user-level paired bootstrap with 10,000 resamples for 95% intervals, resampling users rather than episodes so that repeated episodes from one simulated user do not count as independent evidence.”

May combine two claims.

No evaluation user appears in the preference reward model's training data, its test portion uses the held-out generator family, and it never receives the latent state as input.

“No evaluation user appears in its training data, its test portion uses the held-out generator family, held-out pair accuracy is 79%, and it never receives the latent state as input.”

May combine two claims.

The data leave a positive empirical gap unresolved, which does not constitute evidence of population equality or optimality.

“The data therefore do not resolve a positive empirical gap, which is not evidence of population equality or optimality.”

Classified as probably not a substantial claim. May combine two claims.

All sessions used the same fixed neutral assistant, Qwen3-8B-Instruct without persistent personalization, held constant across participants and sessions, so no later-compared system shaped the histories it would be evaluated on.

“Every session ran against one fixed neutral assistant, Qwen3-8B-Instruct with no persistent personalization, held constant across all participants and sessions, so that no system under later comparison shaped the histories it would be evaluated on.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The diagnostic discriminator shares no parameters with CAPTURE.

“It shares no parameters with CAPTURE.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Elsewhere the paper uses paired randomization tests with 10,000 permutations, corrected across comparisons within each table by the Holm procedure.

“Elsewhere we use paired randomization tests with 10,000 permutations, corrected across the comparisons within each table by the Holm procedure.”

May combine two claims.

The distance is estimated after binning; the plug-in estimator is biased; non-negativity is imposed by the inequality rather than observed; and equality would also require Provenance-only to match the empirical likelihood-ratio decision in every cell, which has not been demonstrated.

“The distance is estimated after binning, the plug-in estimator is biased, non-negativity is imposed by the inequality itself rather than observed, and equality would additionally require Provenance-only to match the empirical likelihoodratio decision in every cell, which we have not shown.”

Classified as probably not a substantial claim. May combine two claims.

Human-study results use participant-clustered bootstrap, resampling participants rather than sessions, and within-participant comparisons throughout.

“Human-study results use participant-clustered bootstrap, resampling participants rather than sessions, and within-participant comparisons throughout.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The 720 annotated events are stratified to 144 per track and 120 per action, which is appropriate for macro-F1 but deliberately does not reproduce the natural prevalence of the six actions, so the agreement figures should not be read as prevalence-weighted accuracy.

“They are stratified to 144 per track and 120 per action, which is appropriate for macro-F1 but deliberately does not reproduce the natural prevalence of the six actions, so the agreement figures should not be read as a prevalence-weighted accuracy.”

May combine two claims.

The test partition uses Llama-3.1-70B-Instruct, a family held out from training and development, so it measures generalization across generator families rather than within one.

“Test uses Llama-3.1-70B-Instruct, a family excluded from training and development and reserved for test, so the test partition measures generalization across generator families rather than within one.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Three annotators labeled a 300-episode subset for track membership and changepoint position, achieving Krippendorff's α of 0.73 for track and 0.70 for changepoint, with a fourth rater adjudicating disagreements.

“Three annotators labeled a 300-episode subset for track membership and changepoint position, reaching Krippendorff's α = 0.73 on track and 0.70 on changepoint, with disagreements adjudicated by a fourth rater.”

May combine two claims.

Twelve external red-teamers with no access to D-PREFGUARD templates authored 240 attacks, 80 per family.

“Twelve external red-teamers with no access to D-PREFGUARD templates authored 240 attacks, 80 per family.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

During replay, preference evidence comes only from user-originated content; assistant utterances never become evidence.

“Only user-originated content creates preference evidence during replay; assistant utterances never become evidence.”

May combine two claims.

The evaluation reward model was trained on disjoint users, responses, and generator families, and no system reads it at inference, which separates the metric from the objective.

“A second model of the same architecture trained on disjoint users, responses, and generator families.No system reads it at inference, which is what separates the metric from the objective.”

Classified as probably not a substantial claim.

Data splits are disjoint by user, topic, attack template, and generator family.

“Splits are disjoint by user, topic, attack template, and generator family.”

Classified as probably not a substantial claim. May combine two claims.

The judge used GPT-4.1 at a pinned dated version, temperature 0, one judgment in each response order, with method names hidden, refusals visible as response text, and safety labels hidden.

“GPT-4.1 at a pinned dated version, temperature 0, one judgment in each response order, method names hidden, refusals visible as response text, and safety labels hidden.”

May combine two claims.

The adaptive attacker's probabilities are surrogate estimates from a local copy of the released weights rather than readings from the deployed system, which keeps the experiment within Assumption 4 and makes it a released-weight hidden-state-surrogate attack rather than full state-aware white-box optimization.

“The probabilities are therefore surrogate estimates rather than readings from the deployed system, which keeps the experiment inside Assumption 4, and the correct description is a released-weight hidden-state-surrogate attack rather than full state-aware white-box optimization.”

• AssumptionThe authors state this as an assumption: The adaptive attacker's surrogate probabilities, computed from a local copy of the released weights, are adequate for evaluating attack success against the deployed system (Assumption 4).

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

These four labels capture the scope of a valid preference and extraction correctness; none indicates whether the assistant should have asked before updating, so they do not define an ambiguity target, and no clarification F1 is computed on the replay.

“These four labels describe the scope of a valid preference and the correctness of extraction, and none of them expresses whether the assistant should have asked before updating, so they do not define an ambiguity target and no clarification F1 is computed on the replay.”

May combine two claims.

All 720 annotated events come from the frozen test partition and cover all 96 test users, with none drawn from training or development.

“All 720 come from the frozen test partition and cover all 96 test users, with none drawn from training or development.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The independently authored attack analysis uses a crossed two-way resample over red-teamer and target user, with method outputs for a given attack kept paired within each replicate.

“its intervals require a crossed two-way resample over red-teamer and target user, with method outputs for a given attack kept paired within each replicate.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The unpersonalized model never writes injected preferences, so its zero poisoning rate is a trivial control.

“The unpersonalized model never writes injected preferences, so its zero is a trivial control.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Oracle-memory's poisoning rate is zero by construction because it observes the attack label, making it a diagnostic ceiling rather than an estimated defense result.

“Oracle-memory's poisoning rate is zero by construction, since it observes the attack label, so it is a diagnostic ceiling rather than an estimated defense result”

Classified as probably not a substantial claim. May combine two claims.

The safety threshold τ_safe = 0.35 was chosen to reach at least 95% harmful-response recall while maximizing benign acceptance, and was frozen before any D-PREFGUARD test evaluation.

“The threshold τ safe = 0.35 was chosen to reach at least 95% harmful-response recall while maximizing benign acceptance, and frozen before any D-PREFGUARD test evaluation.”

Classified as probably not a substantial claim.

At the end of each session, participants labeled each extracted preference as genuine, temporary, context-specific, or incorrect, providing ground truth for the genuine-update adherence rate and the false-update rate.

“At each session's end participants labeled every extracted preference as genuine, temporary, context-specific, or incorrect, which supplies the ground truth for the genuine-update adherence rate and the false-update rate.”

• AssumptionRests on an assumption: The user study participants' labels (genuine, temporary, context-specific, incorrect) accurately capture the ground truth of preference validity.

Probably not a substantial claim: may not pass S3 (load-bearing).

Because the comparator is the best member of a finite oracle-conditioned pool rather than the best possible response, the regret metric is a finite-pool approximation to the comparator in Equation 1.

“Because the comparator is the best member of a finite oracle-conditioned pool rather than the best possible response, this is a finite-pool approximation to the comparator in Equation 1 and we name it accordingly.”

• AssumptionThe authors state this as an assumption: The finite oracle-conditioned pool of 32 candidates is an adequate approximation to the comparator in Equation 1.

May combine two claims.

The test relies on the fixed-adversary inequality rather than the worst-case form, because the split realizes a single adversary policy.

“The test uses the fixed-adversary inequality and not the worst-case form, since the split realizes one adversary policy.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The measured cost of asking is well inside the range where the theorem's mechanism would operate, which is weaker than a verification.

“What the comparison does show is that the measured cost of asking is well inside the range where the theorem's mechanism would operate, which is weaker than a verification and is all we claim.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Since binning can only lower the population distance and the plug-in estimator is upward biased, a violation indicates a mis-paired split or a rule reading outside φ only once both effects are accounted for.

“And because binning can only reduce the population distance while the plug-in estimator is upward biased, a violation is evidence of a mis-paired split or of a rule reading outside φ only after both effects are accounted for.”

Classified as probably not a substantial claim. May combine two claims.

Satisfaction was collected in a separate blinded within-participant task rather than during interaction, with method identity hidden and left-right placement and presentation order independently randomized.

“Satisfaction was collected in a separate blinded within-participant task rather than during interaction.All 40 participants rated four matched output pairs sampled from each completed session, with method identity hidden and left-right placement and presentation order independently randomized.”

Classified as probably not a substantial claim. May combine two claims.

The adaptive attacker never queries the deployed gate and never reads its logits or realized hidden state.

“The attacker never queries the deployed gate and never reads its logits or realized hidden state.”

Classified as probably not a substantial claim. May combine two claims.

During replay, histories were frozen and identical evidence was replayed to every system, and no participant was exposed to any of the six controlled attacks injected per participant.

“Histories were frozen and identical evidence replayed to every system.Six controlled attacks were injected per participant during replay, two from each family, for 240 in total, and no participant was exposed to any of them.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

When the gate asks during replay, the stored participant annotation answers, so the replay is oracle-assisted with ε = 0 relative to those annotations, and the realized query rate is 7.1%.

“When the gate asks during replay the stored participant annotation answers, so the replay is oracle-assisted with ε = 0 relative to those annotations, and the realized query rate is 7.1%.”

Classified as probably not a substantial claim.

Clarification labels are constructed only from the ambiguity at the current event and the current oracle state, with no future event text entering label construction or training.

“Clarification labels are constructed from the ambiguity present at the current event and the current oracle state only; no future event text enters either label construction or training”

Classified as probably not a substantial claim. May combine two claims.

In each bootstrap replicate, users are resampled with genuine and adversarial episodes kept paired, and FUR, RRL, and TV φ are recomputed from that replicate.

“Each bootstrap replicate resamples users while keeping genuine and adversarial episodes paired, then recomputes FUR, RRL, and TV φ from that same replicate”

Classified as probably not a substantial claim. May combine two claims.

Annotators saw the raw history, target prompt, response, and anonymized candidate nodes in randomized order, and did not see method names, model citations, influence scores, counterfactual results, or retrieval rank.

“Annotators saw the raw history, the target prompt, the response, and anonymized candidate nodes in randomized order, and did not see method names, model citations, influence scores, counterfactual results, or retrieval rank.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Action labels for gate supervision came from structured track metadata and the generation program's oracle update rules, and were not validated by humans at the event level during construction, since the 300-episode validation covered only track membership and changepoint position.

“Action labels come from the structured track metadata and the oracle update rules of the generation program.They were not validated by humans at the event level during construction, since the 300-episode validation covers track membership and changepoint position only.”

• AssumptionRests on an assumption: The generation program's oracle update rules provide valid action labels for gate supervision.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Appendix I does not include StateMem among the baselines for that track, so the scope statistic and the regret figures are two separate measurements, not one decomposition.

“StateMem is not among the baselines Appendix I reports on that track, so the scope statistic and the regret figures are two measurements rather than one decomposition.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The paper reports three training seeds and gives intervals rather than isolated significance claims wherever the sample is small enough that a p-value would mislead.

“We report three training seeds and give intervals rather than isolated significance claims wherever the sample is small enough that a p-value would mislead.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The two calibration error figures for CAPTURE and the Transformer are directly comparable because both predict the same six actions against the same labels, which is not true of the heuristic baselines.

“These two are directly comparable because both predict the same six actions against the same labels, which is not true of the heuristic baselines and is why no calibration column appears in Table 1.”

May combine two claims.

Because 240 attacks are evaluated against 96 test users, each user is targeted about 2.5 times and dependence exists on both the authoring and target axis, so red-teamer clustering alone would understate it.

“Because 240 attacks are evaluated against 96 test users, each user is targeted about 2.5 times and dependence exists on both the authoring and the target axis, so red-teamer clustering alone would understate it.”

Classified as probably not a substantial claim.

Three annotators uninvolved in benchmark construction labeled 720 candidate events without access to generator metadata.

“Three annotators uninvolved in benchmark construction labeled 720 candidate events without access to generator metadata.”

Classified as probably not a substantial claim. May combine two claims.

All methods receive the event text, a coarse origin label, and a timestamp, but none receives the track label, changepoint position, or ground-truth user state.

“Every method sees the event text, its coarse origin label, and its timestamp.No method sees the track label, the changepoint position, or the ground-truth user state.”

Classified as probably not a substantial claim. May combine two claims.

The AUC target is derived from the annotation, not from the score, which prevents circularity.

“The target comes from the annotation rather than from the score, since defining it by thresholding |Inf(n)| would make the measure circular.”

Classified as probably not a substantial claim.

HarmBench and StrongREJECT were used for evaluation only and never for selection.

“HarmBench and StrongREJECT are used for evaluation only and never for selection.”