Retrieval Is Not Grounding

We gave a model a corrected fact — in context, unambiguous. On a non-reasoning frontier model it repeated the correction with 100% accuracy, then made the final decision according to the contradicted value 55.3% of the time. The right answer was retrievable, the model stated it correctly, and its behavior still tracked the wrong one.

That is one number, from one arm, on one surface. What follows is how we got it, what it does and doesn't generalize to, and why the honest boundary is more interesting than the headline.

A lot of AI infrastructure rests on an unstated assumption: if the right information is in context, the model will act on it. Retrieval-augmented generation, agent memory, long-context prompting — all of it assumes presence implies control.

It doesn't. Retrieval is not grounding; recall is not behavioral control. A model can hold a fact, rank it salient, state it correctly, and still not be governed by it. So the useful engineering question isn't "is it in context?" — it's what actually makes context govern behavior?

Three probes, each pre-registered before any data was collected — design, sample size, and the minimum effect the sample could resolve (16.2 percentage points at N=150), all fixed in advance and content-hash-registered. Each was adversarially reviewed for confounds before running. Nulls are reported as nulls. The registered subject was a single model; every other model is a labeled replication of the same frozen design, never a moved goalpost. Specs, harness, and raw per-call rows are in the companion repository — every registered arm is rerunnable.

Arm 1 — missing structure causes confabulation, and it's model-general. When a timestamp lacked an explicit anchor, models invented elapsed time — a stale "9h ago" read as fresh — 100% of the time, with zero abstentions, even when "I don't know" was offered. Anchored, typed emission eliminated it (0% error). Scrambled anchors were followed — proving anchors are read, not decoration. This replicated across five models and three providers, reasoning and non-reasoning alike. Under-informed, models don't hedge; they fabricate.

Arm 2 — annotation helps unreliably; compilation enforces. Foreign stale content was treated as current 41–58% of the time. Adding visible typed metadata helped — but how much depended entirely on the model: fully on one, partly on another, and not measurably at all on a third. Deterministically compiling the content — rewriting stale claims as as-of-qualified past tense, enforcing eligibility — drove it to 0% on all three. Annotation is advisory and model-dependent; compilation is enforcement and model-robust.

Arm 3 — accumulated exhaust can defeat a correction; on one model it did. This is the 55.3% result — repeated contradictory context in a session overrode a single clear correction more than half the time, while the model reported the corrected fact perfectly. That is the headline. The more important finding is what happened when we ran it across a dozen more models: it almost never reproduced.

We took the exact same setup to a panel of models across seven labs — reasoning and non-reasoning, Anthropic, OpenAI, xAI, DeepSeek, Qwen, Moonshot, Meta. The pattern is consistent and, honestly, reassuring: where accumulated exhaust actually takes hold, models are readily captured by it when nothing corrects (adoption of a contradicted value ran roughly 65–97% on the models it swayed), and yet a single clear, anchored correction re-grounds them completely — the corrected value governs the decision. (On some models the authored exhaust barely bound at all; where there was little to mislead, there was correspondingly little to correct — we mark those as untestable rather than as clean wins.)

The 55.3% correction-failure was essentially unique to one model. Across the rest — including current Claude models on the very surface the original incident occurred on — a clear correction wins. So the honest, generalizable claim is not "models can't be corrected." It is: uncorrected context accumulates and misleads; a properly typed, anchored correction reliably takes back control — on all but the outliers. That bounds the danger and points straight at the fix.

On open-weights reasoning models served locally we could read the reasoning trace directly. When a clear correction was present, the corrected value governed the decision every time, and in the trace you can watch the models re-derive the answer from the anchored record — the arithmetic is right there in the chain of thought — rather than absorbing the stale value. Removing the original anchor didn't break it; they fell back to the correction's own stamps. The re-grounding isn't the model politely deferring; it's active recomputation from typed structure. That is the strongest form of evidence a behavioral study can offer: not the output, the work.

The edges we mark rather than hide: the annotation benefit that vanished on the strongest model (Arm 2); an authority-conflict probe that was too easy and so reported not-testable rather than as a win; one frontier model that refused the manipulated transcript outright instead of answering. A result you can't see the edges of isn't one.

Across every model and every arm we tested, deterministic transformation governs behavior — anchoring in emission, compilation in ingestion. The approaches that depend on the model choosing to honor the context — annotation binding, and by extension the model's own self-report — are variable. When we asked a model to diagnose its own grounding, it confidently described context it had never received. Self-report is not an audit; the non-model record is.

Models are not inherently robust to grounding failure — they fail on missing structure (100%) and foreign staleness (41–58%), and they adopt uncorrected exhaust broadly. What varies is the reliability of the fix. And here is the constructive half of the result, the one that matters for anyone building on this: a typed, anchored correction does reliably take control back — across nearly every model we tested, the corrected value governed the decision. The failure is real; the lever is real too. That is the whole thesis in one line: don't hope the model honors context — structure the context so it has to.

The one condition we can't synthesize is a naturally accumulated session — self-generated exhaust built up over real hours of use, not authored and replayed. That's the remaining open arm: whether the failure ever emerges from a model's own long-session output at agent scale, and whether an exhaust-ratio monitor predicts it before it fires. It needs time and use, not more compute, which is why it matures in the open. Alongside it: a redesigned authority probe, and the full raw evidence package with a citable DOI when the battery closes.

One further extension is pre-registered and running: whether the same typed, anchored structure that governs records also governs a model's own values — the axis where a trained preference, not a stale fact, biases the answer. That connects this program to concurrent work on value leakage; the method is public, the results are held until a properly powered cross-model run is complete.

Two papers by Alex Kwon predate this program and independently established several of its core results — that models confabulate rather than abstain when under-informed, that a correction fails when the basis for re-deriving it has been dropped, and the distinction between a model representing information and its behavior being governed by it (Reclaim Evaluation, arXiv:2606.25449; They Infer What You Meant, arXiv:2607.03598). We were unaware of them during development and credit them as prior work; our claim ledger follows the structure of Kwon's. The value-axis extension above bridges to Betley et al., Value Leakage (arXiv:2607.14345), which documents trained values silently shaping model answers.