What gives an accidental paste away

In the previous article I reported that no model ever considers you might have pasted into the wrong window. Zero out of twenty-four. You paste a stack trace into a conversation about bread and the model debugs the stack trace.

That result left an uncomfortable question: what if we never gave them the chance? None of the sixty-four pastes in that run was impossible to read as a legitimate change of subject. A recipe pasted into a conversation about the electricity bill could be something the user wants to ask about.

So I ran three more rounds to separate “they never consider it” from “there was nothing to consider”. One thousand nine hundred and twenty conversations — too many to read end to end, so two judge models do the classifying and I hand-label a blind sample from each round to know which of them to trust. Here is what came out.

Three levels of paste

The idea was to give them progressively clearer openings.

• N0, neutral. The original bank: text independent of the topic by construction, written without knowing what the topics were.
• N1, with a signal inside. The paste gives itself away without depending on the conversation: it is addressed to someone by name, it is cut off mid-sentence, it answers a question nobody asked here, or it presupposes an earlier conversation that doesn’t exist.
• N2, contradiction. The paste clashes with what the user just said: another city, another date, another figure. This was the ceiling: the most detectable, the closest to a real accident.

And a new category in the rubric, because the one from the previous article couldn’t register what we were about to look for: “entertains the possibility of a mistake”. Naming the topic change isn’t enough. It has to question the intent.

The ceiling turned out to be the floor

The signal works: from 6.6% to 20.4%, and the difference holds (p = 0.006). With the right paste, one in five stops to consider that you made a mistake.

But N2, the ceiling, gave zero out of ninety-five. Less than the neutral bank. And looking at what they do instead explains it: in N2 executes silently spikes to seventy-seven of ninety-five. The model accepts the new fact, redoes its advice, and never registers the clash.

There is a reading of that which I think is the best sentence in the experiment: a contradiction doesn’t read as an accident, it reads as you having changed your mind. And going along with the user changing their mind is precisely what an assistant is trained to do.

That reorders the question. What triggers doubt isn’t that the paste is incompatible with the conversation. It’s that it’s foreign to it: that it carries inside the marks of having been written for somewhere else.

So does similarity matter?

If what gives the paste away is coming from outside, the obvious hypothesis is that the more it resembles the current topic, the less it shows. That’s the question the next run went to measure, sweeping the entire similarity axis.

The short answer is no.

That last sentence is the part that cost something. The first version of this run also came out flat, and I was about to call the axis closed. It wasn’t: computing the power afterwards — which is exactly when you discover it should have come first — showed that design had an 11% chance of detecting the effect I had myself declared relevant. A flat result at that power doesn’t say “there is no effect”. It says “we wouldn’t have seen one”.

Redoing the design so that a null would mean something forced three changes, and none of them was the one I expected:

• Run a single model. The behaviour only exists in one: across the earlier runs claude-opus-5 gives 55% doubt on the signal arm, gpt-5.6-sol gives 9%, and gpt-5.6-luna gives zero out of ninety-six. Spending a third of the budget on a model that never doubts doesn’t buy information: it buys zeros.
• More distinct stimuli, not more conversations. With eight topics and two lengths there are sixteen starting conversations, and every point on the axis was seeing the same sixteen. Repeating them adds nothing; forty more artefacts had to be written.
• Drop the follow-up turns. The category is decided in the first response to the paste, and the two turns after it accounted for 72% of the bill. They’ll be generated separately when they’re needed.

With that: 1,344 conversations and 88% power. And the answer is still no — similarity doesn’t predict whether the model will doubt you.

The finding that wasn’t in the script

At this scale you can’t read every conversation, so two judge models do the classifying. But for each round I sit down and label a handful myself, blind, without seeing what they said. It’s the dullest part of the experiment and it’s the part that produced the two findings below.

The first: the judge was wrong in one specific direction. In the first round it handed out the doubt category far too freely — thirty times where I counted thirteen — and always in the same direction, never the other way. A systematic error like that doesn’t show up in the final percentage: it shows up when you put its labels next to yours.

The second surfaced while labelling the last round, and it runs deeper. The categories aren’t mutually exclusive. A response can flag the topic jump and adopt the role the paste describes — it routinely does — and the rubric makes you pick one of two true things. That’s a defect in the instrument, not in the model, and it had been sitting inside three rounds without anyone noticing.

Measuring it produced something bigger than I expected. Re-judging one hundred and fifty conversations with a two-axis rubric — does it acknowledge the discontinuity? and what does it do with the paste? — one hundred and twenty-four land in a combination the old rubric can’t express.

But the flaw wasn’t where I was looking. “Flags the jump and also adopts the role”, the case that made me suspicious in the first place, appears exactly once in a hundred and fifty. What was missing was an entire box nobody had named.

The missing behaviour is denying a premise of the paste: “I have no record of that conversation”, “I’m not Tomás”, “we haven’t agreed on that format in this thread”. It isn’t flagging that the topic changed. It isn’t doubting that you meant to send it. It’s a third thing: the model doesn’t correct you, it corrects the world the paste takes for granted.

And it’s the most frequent reaction in the run: forty out of every hundred. The taxonomy in the previous article missed it because it came from twenty-four conversations, and in twenty-four it barely shows up four times.

What I take from this

About the models. What makes them consider your mistake isn’t that the text clashes with the conversation, but that it carries signals of having been written for somewhere else. Contradicting you doesn’t give you away: it obeys you. And there’s a way of reacting — denying what the paste assumes — that is the most common of all and wasn’t even on the map.

About measuring with automated judges. Delegating the classification to a model is the only thing that makes a thousand-conversation run feasible, and it’s also what leaves you not knowing what you’re counting. The two errors I found — a judge inflating one category in a single direction, and a rubric that forces a choice between two things that are both true — show up in no aggregate metric. They show up from sitting down and labelling sixty conversations by hand, then comparing.

And about not concluding more than you’ve earned. The first sweep of the axis came out flat and meant nothing: it had an 11% chance of detecting the effect I had myself declared relevant. A flat result like that doesn’t say “no effect”, it says “we wouldn’t have seen one”. And a hypothesis the small run hinted at — that longer conversations produce more doubt — reversed when measured with fourteen times the data.

Neither of those is visible by looking at the data. They’re visible by working out beforehand how much you’d need to see in order to believe what you’re about to say.

What’s left is the part that gives the series its name: what happens after, when the user types “sorry, that was meant for another chat”. That’s Phase 2, and that’s the next article.

---

Code, data and rubrics: llm-wrong-paste. All 1,920 conversations, both judges’ verdicts and the human labels are in the repository, failures included.