What gives an accidental paste away

In the previous article I reported that no
model ever considers you might have pasted into the wrong window. Zero out of
twenty-four. You paste a stack trace into a conversation about bread and the
model debugs the stack trace.

That result left an uncomfortable question: what if we never gave them the
chance? None of the sixty-four pastes in that run was impossible to read as a
legitimate change of subject. A recipe pasted into a conversation about the
electricity bill could be something the user wants to ask about.

So I ran three more rounds to separate "they never consider it" from "there was
nothing to consider". One thousand nine hundred and twenty conversations — too
many to read end to end, so two judge models do the classifying and I hand-label
a blind sample from each round to know which of them to trust. Here is what came
out.

Three levels of paste

The idea was to give them progressively clearer openings.

• N0, neutral. The original bank: text independent of the topic by construction, written without knowing what the topics were.
• N1, with a signal inside. The paste gives itself away without depending on the conversation: it is addressed to someone by name, it is cut off mid-sentence, it answers a question nobody asked here, or it presupposes an earlier conversation that doesn't exist.
• N2, contradiction. The paste clashes with what the user just said: another city, another date, another figure. This was the ceiling: the most detectable, the closest to a real accident.

And a new category in the rubric, because the one from the previous article
couldn't register what we were about to look for: "entertains the possibility
of a mistake". Naming the topic change isn't enough. It has to question the
intent.

The ceiling turned out to be the floor

A signal inside the paste triples the doubt. A contradiction with what you just said eliminates it.

The signal works: from 6.6% to 20.4%, and the difference holds (p = 0.006).
With the right paste, one in five stops to consider that you made a mistake.

But N2, the ceiling, gave zero out of ninety-five. Less than the neutral bank.
And looking at what they do instead explains it: in N2 executes silently spikes
to seventy-seven of ninety-five. The model accepts the new fact, redoes its
advice, and never registers the clash.

There is a reading of that which I think is the best sentence in the experiment:
a contradiction doesn't read as an accident, it reads as you having changed
your mind. And going along with the user changing their mind is precisely what
an assistant is trained to do.

That reorders the question. What triggers doubt isn't that the paste is
incompatible with the conversation. It's that it's foreign to it: that it
carries inside the marks of having been written for somewhere else.

So does similarity matter?

If what gives the paste away is coming from outside, the obvious hypothesis is
that the more it resembles the current topic, the less it shows. That's the
question the next run went to measure, sweeping the entire similarity axis.

The short answer is no.

The interval crosses zero. With 88% power to detect a nine-point drop, this isn't "we didn't see it": it's that there is no effect larger than about seven points.

That last sentence is the part that cost something. The first version of this run
also came out flat, and I was about to call the axis closed. It wasn't:
computing the power afterwards — which is exactly when you discover it should
have come first — showed that design had an 11% chance of detecting the
effect I had myself declared relevant. A flat result at that power doesn't say
"there is no effect". It says "we wouldn't have seen one".

Redoing the design so that a null would mean something forced three changes, and
none of them was the one I expected:

• Run a single model. The behaviour only exists in one: across the earlier runs claude-opus-5 gives 55% doubt on the signal arm, gpt-5.6-sol gives 9%, and gpt-5.6-luna gives zero out of ninety-six. Spending a third of the budget on a model that never doubts doesn't buy information: it buys zeros.
• More distinct stimuli, not more conversations. With eight topics and two lengths there are sixteen starting conversations, and every point on the axis was seeing the same sixteen. Repeating them adds nothing; forty more artefacts had to be written.
• Drop the follow-up turns. The category is decided in the first response to the paste, and the two turns after it accounted for 72% of the bill. They'll be generated separately when they're needed.

With that: 1,344 conversations and 88% power. And the answer is still no —
similarity doesn't predict whether the model will doubt you.

The finding that wasn't in the script

At this scale you can't read every conversation, so two judge models do the
classifying. But for each round I sit down and label a handful myself, blind,
without seeing what they said. It's the dullest part of the experiment and it's
the part that produced the two findings below.

The first: the judge was wrong in one specific direction. In the first round
it handed out the doubt category far too freely — thirty times where I counted
thirteen — and always in the same direction, never the other way. A systematic
error like that doesn't show up in the final percentage: it shows up when you put
its labels next to yours.

The second surfaced while labelling the last round, and it runs deeper. The
categories aren't mutually exclusive. A response can flag the topic jump and
adopt the role the paste describes — it routinely does — and the rubric makes you
pick one of two true things. That's a defect in the instrument, not in the model,
and it had been sitting inside three rounds without anyone noticing.

Measuring it produced something bigger than I expected. Re-judging one hundred
and fifty conversations with a two-axis rubric — does it acknowledge the
discontinuity? and what does it do with the paste? — one hundred and
twenty-four land in a combination the old rubric can't express.

But the flaw wasn't where I was looking. "Flags the jump and also adopts the
role", the case that made me suspicious in the first place, appears exactly
once in a hundred and fifty. What was missing was an entire box nobody had
named.

One behaviour, scattered across all seven categories of the taxonomy. It's the most frequent reaction of all, and the rubric had no name for it.

The missing behaviour is denying a premise of the paste: "I have no record of
that conversation", "I'm not Tomás", "we haven't agreed on that format in this
thread". It isn't flagging that the topic changed. It isn't doubting that you
meant to send it. It's a third thing: the model doesn't correct you, it
corrects the world the paste takes for granted.

And it's the most frequent reaction in the run: forty out of every hundred. The
taxonomy in the previous article missed it because it came from twenty-four
conversations, and in twenty-four it barely shows up four times.

What I take from this

About the models. What makes them consider your mistake isn't that the text
clashes with the conversation, but that it carries signals of having been written
for somewhere else. Contradicting you doesn't give you away: it obeys you. And
there's a way of reacting — denying what the paste assumes — that is the most
common of all and wasn't even on the map.

About measuring with automated judges. Delegating the classification to a
model is the only thing that makes a thousand-conversation run feasible, and it's
also what leaves you not knowing what you're counting. The two errors I found — a
judge inflating one category in a single direction, and a rubric that forces a
choice between two things that are both true — show up in no aggregate metric.
They show up from sitting down and labelling sixty conversations by hand, then
comparing.

And about not concluding more than you've earned. The first sweep of the axis
came out flat and meant nothing: it had an 11% chance of detecting the effect I
had myself declared relevant. A flat result like that doesn't say "no effect", it
says "we wouldn't have seen one". And a hypothesis the small run hinted at — that
longer conversations produce more doubt — reversed when measured with fourteen
times the data.

Neither of those is visible by looking at the data. They're visible by working
out beforehand how much you'd need to see in order to believe what you're about
to say.

What's left is the part that gives the series its name: what happens after,
when the user types "sorry, that was meant for another chat". That's Phase 2,
and that's the next article.

---

Code, data and rubrics: llm-wrong-paste.
All 1,920 conversations, both judges' verdicts and the human labels are in the
repository, failures included.

---

Originally published on javieraguilar.ai

Want to see more AI agent projects? Check out my portfolio where I showcase multi-agent systems, MCP development, and compliance automation.