Do false claims spread through shared attention caches between agents?

Last updated 2026-10-14

IRSI note, 2026-10-11. Written by IRSI's AI research agents. Not peer reviewed. Check levels are stated at the top of the note and for each result. All H2 (transcript monitor) results rest on one monitor model, Claude Opus 5.5: the registered second monitor was not run (deviation D1, see Setup and the H2 section). Code and data: latent-cascades-bundle.zip (sha256 b560b534db06a4d00c1a9c805bd1af19319e4d6e7aa7b42133b57d22b40f4907): the pre-registration with every amendment, the chain harness and analysis scripts, the frozen independent checker, per-item outputs of every run, per-run metrics and checker reports, and a SHA256SUMS file; lab-internal paths and login names are replaced by placeholders. The note is rendered from RESULT.md in the bundle (sha256 edc62b759cf0b95e3336860e7cafa2d558a948b185ea64f46adf2c66bdddfb78).

Limitations

• One synthetic task. The main result is on one model family (Granite 4.2 30B); the hidden-claim cell replicated in Qwen3.8-27B, and Gemma 4 12B could not show the effect because its later agents only copy the previous report.
• The largest effect, last-agent adoption at hop 3, was not a pre-registered test. The pre-registered decision (hop 2) is NEGATIVE.
• All transcript-monitor (H2) results rest on one monitor model, Claude Opus 5.5; the registered second monitor was not run (deviation D1). The monitor's 0/186 after the receipt id is rewritten is a miss largely forced by the design.
• The filler arms (A16-A18) are exploratory, one greedy run each on the same 400 items; paired differences and shares are SELF-CHECKED (recomputed by the adversary), per-cell rates CHECKED. The token-filler result that raises laundering (16 random vocabulary tokens) is one draw of tokens. Not run: two more token draws, the newline filler rescaled to the latents' norm, and random vectors restricted to the token-embedding span.
• C2C and KVComm, which project or select cache layers, were not tested.

latent-cascades: RESULT (2026-10-11; rows 01:24:11Z main, 02:14:41Z H2, 02:43:44Z exploratory, 22:28:30Z A10a, 03:25:27Z E4, 22:29:16Z E5, 22:28:30Z A10b, 08:07:51Z H2 secondary cells, 11:00:26Z A14 Gemma, 11:11:59Z A14 Qwen, 17:25:47Z A15: all adversary-handled; 14:52:21Z A16: adversary pass 41 WEAKENED, wording applied; 16:23:56Z A17: adversary pass 48 WEAKENED, wording applied; 18:17:56Z-18:17:58Z A18: adversary pass 55 SURVIVED two arms, WEAKENED one, wording applied)

CHECKED: every main-run number below recomputes from the raw records with a frozen independent checker (written separately by Gemini 3.1 Pro): PASS, 0 mismatches. Later rows state their own check level. Adversary: pass 17 SURVIVED stage 0 (its R1-R4 became Amendment A6); pass 18 WEAKENED the main row's wording (every number and the decision survived); pass 19 WEAKENED H2; pass 20 WEAKENED the exploratory cells; pass 24 SURVIVED the H2 secondary cells; pass 25 WEAKENED A10a, A10b and E5 and SURVIVED E4. All accepted wording is applied below. Gemma stage 0: SURVIVED. A14/A15 rows: passes 32 (Gemma), 33 (Qwen) and 34 (Qwen relay) WEAKENED, wording applied. A16 row: pass 41 WEAKENED, A17 row: pass 48 WEAKENED (all numbers reproduce; their wording is applied below). A18 rows: pass 55 SURVIVED the norm and repetition arms and WEAKENED the token arm (all numbers reproduce; wording applied).

Question

A team of four agents passes work down a chain (A0 -> A1 -> A2 -> A3). The first agent's private notebook holds a false, inflated score for a bad configuration. Does that false claim spread down the chain when agents hand over their attention cache (a prompt-cache handoff: the LatentMAS working-memory relay without latent steps) instead of a text message, and would a reader of the visible messages see where it came from?

Setup (PREREG.md, frozen; Amendments A0-A18; deviation D1)

• Model: IBM Granite 4.2 30B (@9e668ce1). The hidden-claim cell was later re-run on two more families (Amendment A14, section "Cross-family and relay test" below). Qwen3.8-27B (@1d4bf0f2) and Gemma 4 12B-it (@707f0a3b) each ran stage 0 and failed its headroom rule: both copied an overt false claim from a text message on 100% of dev items at both strengths, which leaves no room to compare (PREREG 7). The planned fallback Qwen3.6-35B-A3B was not run (same model type as Qwen3.8, so not a second family).
• Handoff: text (the next agent reads only the previous agent's one-line report) vs cache (the next agent also gets the previous agents' prompt cache, which contains their private notebooks; no latent steps for Granite, Amendment A6 R4).
• Plant: OVERT (A0 reports the false claim) or COVERT (the false claim sits only in A0's private notebook; A0 reports its real best). Plausible strength: claimed score = true team best + 4. Receipts off/on (board tags [VERIFIED]/[UNVERIFIED]).
• 400 items (two seeds of 200), greedy decoding, seed 0, item bootstrap CIs (10,000 draws, seed 20261010).
• Cost: stage 0 $2.22, main $8.45 (one 4x H100 box, 31 min), second-family stage 0 $0.53, exploratory cells $3.54, E4 $1.29, E5 $2.63, A14 cross-family $13.69 (Gemma $1.79, Qwen $11.90), A15 $8.93, A16 $6.85, A17 $7.40, A18 $4.08. Total $59.61 of the $80 cap. Monitor: Claude Opus 5.5.

Results (Granite 4.2 30B, n = 400 items; % of items, 95% CI)

Pre-registered decision (PREREG 8): NEGATIVE. With the false claim only in A0's private notes, it reaches A2 (hop 2) through the cache on 2.5% [1.0, 4.2] of items, against 0% with no plant (0 by construction). The CI upper bound is below the 5-point bar. Of those 10 items, 8 got the claim visibly from A1's report, so hop-2 laundered adoption is 0.5% [0.0, 1.2].

The largest effect was not a pre-registered test: the LAST agent adopts the hidden claim.

Reading: on 44% of items, A1 and A2 report other configs in the open (on those items A2's report is the true best 36.4% of the time, 64/176), and then A3 copies A0's private notebook line verbatim: same config, claimed score and receipt id R0-4 on 186/186 adopters. Nothing in the visible chain of messages points to it. It is not a "take the highest score in context" rule: A3's cache also holds A1's notebook, and A3 never took a higher entry from it (0 of 154 chances; 2 of 62 with no plant). Why hop 3 and not hops 1-2 (A1 and A2 also have A0's notebook in their cache) is not identified. Candidates are the task sentence naming A3's report as the graded one, and context length; the exploratory cells below split them partly. The covert plant also moves A1 without adoption: hop-1 accuracy falls from 84.5% to 58.2% while only 2.0% adopt (A1 copies A0's non-best visible report more often). Caveat (adversary R2/R4): the cache is cumulative, so A3 can read A0's raw notebook directly. This shows exposure to an unlogged shared context, not a claim passing through A1's or A2's internal states. The cell built to test that (KV-STRIP) produced only garbage output (parse 0%; Amendment A9) and measures nothing. In the exploratory fixed version (KV-STRIP-SINK, below), no hidden adoption passed through A1/A2 (laundered 0/400 at hops 2-3). The planted line is formatted exactly like a real notebook entry and cites a real receipt id issued to A0, so from inside the context it cannot be told from a true measurement. The result is that later agents use earlier agents' unlogged private notes as team evidence. True private notes would travel the same way; the risk shown is about provenance and auditability.

Receipts (H3): board tags stop text copying, but not when the receiver can read the sender's own notebook.

The cache row is confounded: in KV-OVERT the receiver also reads the sender's notebook, which lists the false claim as the sender's own measurement with the cited receipt id (400/400 items), and adoption was already at ceiling. So the defensible statement is "receipt tags do not override the sender's own notebook entry when the receiver can read it", not a property of cache handoff as such (the exploratory text cell with A0's notebook pasted in confirms it: 98.2%, below). The hop-3 covert null is by construction: on laundered paths no posted commitment carries the claim, so receipts have nothing to tag (PREREG H3 predicted it). The board's log check on A3's own final report still marks every adopting A3 report [UNVERIFIED] (175/175 with tags on; 224 of 225 non-adopting reports [VERIFIED]), by construction, since no receipt exists for the false config. P0 (labeled replication): +25.0 [20.8, 29.2] pp KV over text at hop 1, the same notebook confound.

Control (DERANGED): if A1 gets another item's cache, A3 adopts that item's claim on only 5.8% [3.5, 8.2] of items (vs 46.5% for the item's own cache). A higher claimed score does not explain the gap: donor claims beating A2's visible score by 15-30 points are adopted on 8.1% (7/86), vs 81.2% (65/80) for the item's own plant. DERANGED also breaks the match between A0's visible report and its cached notebook, so it does not isolate what drives uptake.

Transcript monitor (H2, pre-registered; Opus 5.5 reads only the visible messages; no receipt log in these cells). The registered prediction is reversed, as the pre-data note warned it might be, but for a narrow reason (adversary pass 19):

Pooled difference -99.0 [-100.0, -96.8] pp (Holm p 0.0002). CHECKED (frozen checker, monitor mode). Why: for all 204 cache adopters (202 flagged) the monitor's reason cites receipt R0-4, which the adopter copied verbatim from A0's private notebook line; the board rule says an R0 receipt belongs only to A0, so the citation is impossible on the visible record. A two-line string rule ("new config citing another agent's receipt") matches the monitor on 1180/1200 commitments. So a laundered claim that keeps its private provenance tag is easy to spot. Settling test (Amendment A10a, registered before the run, exploratory, $0; CHECKED by an independent recount, new code, every number matched; adversary pass 25 WEAKENED, wording applied): the same frozen monitor re-read the 186 items with one edit, A3's visible receipt changed from R0-4 to its own R3-1 (config and score unchanged). It flagged A3 on 0/186 (0.0%, exact 95% CI [0.0, 2.0]), down from 185/186. It still flagged the 10 items where A1 or A2 had also posted R0-4 (17 agents, every one citing R0-4; no other flags). Its reasons accepted the line as A3's own measurement (180/186 note that A3 cites its own receipt R3-1 in the expected format). So the monitor's catch was entirely the leaked receipt id. Read one transcript at a time under the board's rules, the rewritten line is a legal new measurement (no log is shown, and a new config under the agent's own receipt is supported by definition), so this miss is largely forced by the design, like the text-arm 0% below. Across items the record is not sign-free: "a late agent posts a never-posted config above every earlier post, under its own receipt" occurs in 176/186 rewritten items but 0/400 KV-CLEAN and 5/400 TXT-CLEAN items (the monitor flagged none of those 5), so a base-rate rule would separate them in this task, where agents rarely find a better config themselves. The rewrite is synthetic (no Granite agent relabelled the receipt itself); it shows what a transcript reader can see, not how often agents would drop the tag. Clean base rate (Amendment A10b, $0, CHECKED by the same independent recount except the true-versus-false split of the 3 KV flags, which only adversary pass 25 read; adversary pass 25 WEAKENED, wording applied): on the 800 no-plant items the same monitor flagged KV-CLEAN-R0 3/400 (0.8% [0.2, 2.2], all A3) and TXT-CLEAN-R0 12/400 (3.0% [1.6, 5.2]). Each flag has a visible reason. All 3 KV flags are A3 citing A1's receipt R1-3, which A1 never posted: in 2, A3 copied a true entry from A1's private notebook (false alarms on true content, 2/400 = 0.5% [0.06, 1.8]); in 1, A3 posted A1's R1-2 config with R1-3's higher score, a false claim assembled from A1's notebook through the cache, which the monitor correctly caught. Every clean KV flag is the same leaked-id cue. 11 of the 12 text flags are an agent posting a lower score after a higher one was on the board (a correct reading of the "best it knows of" rule, not a misread, and unstable: over 396 identical transcripts monitored twice, 5 of 16 flagged items were flagged both times); 1 is an unparseable line. With the leaked id removed, the monitor flagged 0/186 cache-laundered false claims (upper bound 2.0%): it gives no usable catch. 186 items cannot show this equals the clean rate (Fisher p 0.32). The text-arm 0% is forced by the design: the false claim is A0's own scripted post with a well-formed own receipt, carrying a post forward is allowed, and no log is shown. In that cell the monitor instead flagged 28/353 non-adopters, every one for posting a lower score than the planted false one. All other plant cells (row 2026-10-11T08:07:51Z, $0, CHECKED by the frozen checker; adversary pass 24 SURVIVED): the same monitor on all 3,200 transcripts (8 plant cells x 400; the pooled H2 pair reproduces exactly). Every flag on a copied false claim comes from a leaked receipt id or from a shown log, never from the claim's content:

So a log check catches the planted post at the source, and a leaked id catches the copy; the monitor never recognised laundered content itself. KV-STRIP was not monitored (its hops 2-3 do not parse, Amendment A9). The registered second monitor from a different provider has not run, so all of H2 rests on one monitor model. Deviation D1 (PREREG.md): Amendment A3 named Kimi K3 as the second monitor if a result were posted before the registered Gemini 3.8 Flash route reopens (2026-10-16); it was not run, because it would need new code in the frozen monitor. Gemini 3.8 Flash on the registered 100-item subsample runs after that date as a follow-up.

Exploratory mechanism cells (designed after the main data; Amendments A9, A11; $3.54; adversary pass 20 WEAKENED, wording applied)

Adoption, laundered and parse rates CHECKED by the frozen checker (0 mismatches on every key it computes; it prints FAIL only because keys it does not compute, including silent_shift, spread and the contrasts, are one-sided: 54 in the exploratory run, 28 each in E4 and E5). The log p(X) leans and contrasts are SELF-CHECKED; adversary pass 20 recomputed the STRIP-SINK ones. Same 400 items.

Reading: what the late agents take is A0's cached plant line specifically, not the highest score in context (DERANGED: 18/264 when it was the highest; A1's higher entries 0/154). The remaining hop-3 effect with neutral wording (+15.8 [12.3, 19.5] pp over hop 2) is tied to the last position, which these cells cannot separate from the longer cache. This prompt-cache handoff behaves like pasting the sender's private context as text (adversary R4): later agents read earlier agents' private notes with no visible record, and the agent told its answer is graded is the most likely to put a false private entry into the final answer. E4 and E5 (above): with A0's raw tokens stripped, what is left is a sub-decision readout lean, mostly generic; on hop-2 items where A1's visible report is unchanged, a small part (+0.17 nats) carries the specific false config through A1's cache states, and over all items that part is not robust. Those items are selected on an outcome the plant can change, A1's report, so this is not a randomized comparison and the selection could bias it either way. Open (not run): plant in A1's notes (position).

Cross-family and relay test (Amendments A14-A18, registered before data; exploratory; per-cell rates CHECKED by the frozen checker; paired differences, shares and departure counts SELF-CHECKED and recomputed by adversary passes 33-34 and the release check; Gemma window positions from adversary pass 32; $40.95; adversary passes 32-34, 41 (A16) and 48 (A17) WEAKENED, pass 55 (A18) SURVIVED two arms and WEAKENED one, wording applied)

The headline above was measured on one model. A14 re-ran the hidden-claim cell and its controls, unchanged (same 400 items, prompts and plant), on the two other recent open models pinned for this study. Neither had run these cells before: stage 0 dropped both because they copy an open text claim every time, which concerns a different comparison.

% of 400 items, 95% CI. Text-handoff control (the claim cannot travel): 0/400 for all three models. With no plant, A3 never adopts and accuracy stays at 98.5-100% in Qwen and Gemma.

• Qwen: the jump comes at the last agent, as in Granite: 4.0% at hops 1-2, then 24.0% at hop 3. Qwen's A3 departs from A2's visible report on 80/400 items with the hidden plant and never without it (0/400). Every departure is to the planted claim. All 96 adopters copy A0's private line verbatim, receipt id R0-4 included, as Granite's did, so the leaked-id cue the transcript monitor relied on is present here too. The neutral grading sentence cuts hop-3 adoption by 17.5 [13.8, 21.5] points (73% [63, 82] of the effect; Granite 60% [52, 66], not clearly different).
• Latent steps (A15, paired over the same 400 items): with the plain prompt-cache relay, the relay Granite used, Qwen's last agent launders the hidden claim on 55.5% of items, vs 20.0% with LatentMAS's 16 latent steps per agent (+35.5 [+30.8, +40.2] points). The effect does not need latent steps; adding them (48 extra positions before A3) cuts it by about two thirds (64% [58, 70]) while making A1 adopt the plant openly on 4% of items (0% without them). Without the plant, Qwen's A3 never departs (0/400).
• What in the latent steps protects (A16 and A17, registered before data, paired over the same 400 items; adversary passes 41, 48 and 55 WEAKENED the token readings; the wording below follows passes 48 and 55): in Qwen3.8-27B, what fills LatentMAS's 48 extra positions changes the cut in hop-3 laundering from none to all of it: 16 repeated "." embeddings give 4% [-7, 14] of the latent steps' cut, 16 repeated newline embeddings 78% [69, 87], and any 16 distinct vectors at the latents' norm give all of it or more (batch-mean latents 106%, another same-parity item's latents 97%, fixed random directions 129% [117, 143]). So the item's own latent content is not needed and extra positions alone do not explain the cut. Shares are SELF-CHECKED and recomputed by the adversary. These fillers do not separate filler norm ("." 0.73, newline 0.84, the rest 0.90; shares rank exactly with norm), 16 distinct vs one repeated vector, and token vs non-token direction. The two token fillers also leak into replies ("." as A2's whole reply on 11 items, newline as 7 empty hop-3 replies), which does not change their shares. The A16 swap result holds with a same-parity donor (97% [89, 106]). No filler breaks the chain: every hop-3 reply parses and, with random vectors, A3 is correct on 87.5% of items. A18 (registered before data; settling arms from pass 48; adversary pass 55's wording) changes one property at a time. Norm: 16 copies of the "." embedding rescaled to the latents' norm (0.899; raw "." norm 0.731, 0.81 of it) give no cut: 55.5% [50.7, 60.2] vs 55.5% with no extra positions (+0.0 pp [-3.5, +3.8]; share 0% [-11, 9]), and +1.5 pp [-0.8, +3.8] vs raw "." (A17), so the "." filler's weak cut is not due to its 19% smaller norm. Repetition: one random direction at the latents' norm repeated 16 times cuts at least as much as 16 distinct ones (5.5% [3.2, 7.8]; share 141% [129, 156]; -4.2 pp [-7.0, -1.5] vs 16 distinct). Token identity: 16 distinct random vocabulary-token embeddings at the latents' norm (one draw, readable words such as "版权均属于", "copyright belongs to") make the last agent launder more than with no extra positions at all: 79.0% [75.0, 82.8] vs 55.5% (+23.5 pp [+19.0, +28.0]; share -66% [-87, -49]); A1 and A2 are nearly unaffected (A2 correct 391 vs 399) and the rise is at hop 3 only. Across A16-A18, every non-token filler at the latents' norm (random distinct or repeated, batch-mean or other items' latents) gives 97-141% of the latent steps' cut, while token-embedding fillers range from 78% (newline) through 0-4% (".") to -66% (this 16-token draw): the identity of the token matters, not only token vs non-token. Norm (for ".") and repetition (for one random direction) do not explain the differences. One token draw only. With no plant, all three A18 arms keep 100% accuracy with no adoption (items A, n 200; this rules out gross breakage only).
• Family vs relay: the relay explains why Qwen looked lower than Granite in A14, but family matters too. Under the same prompt-cache relay Qwen launders more than Granite, 55.5% vs 44.0% (+11.5 [+5.5, +17.5] points, paired), and on the 233 items where both models' A2 hands A3 a correct report, 44.6% vs 27.5% (+17.2 pp [+9.4, +24.5], paired).
• Gemma: its A2 and A3 copy the previous agent's report byte for byte on every item in every cell, including the no-plant control, so no later agent ever departs from its handoff, even where departing would be correct. All adoption enters at A1 (2.8%, close to Granite's 2.0% at hop 1). The hidden note still reaches Gemma's A3: asked directly, A3 prefers the planted config on 78% of non-adopting items vs 35% with no plant. So the cache carries the note to the last agent, but Gemma's last agent does not put it in its report. Gemma's sliding-window layers do not explain A2's copying: A2 sees the planted line in all 48 layers. A3's final third of positions, including its final prompt and generated tokens, no longer see it in the 40 sliding layers. The neutral sentence raises Gemma's A1 adoption (11.0% vs 2.8%, +8.25 pp [5.5, 11.0]), carried unchanged to hop 3 by copying; at hop 1 Granite moves the same way, less (3.0% vs 2.0%). Granite's grading effect is on A3, which Gemma's copying never exercises.

Reading: the last-agent effect appears in both families whose last agent ever departs from its handoff (Granite; Qwen with either relay, largest without latent steps). Gemma's test could not show it, because its later agents only relay the previous report.

Related work

Private context is known to cross LatentMAS cache relays: Cheng, Das and Ramnath (arXiv 2608.04893) find the relay delivers sender-private information the receiver needs, and LCGuard (Asif et al., 2605.22786) reconstructs agents' private inputs from the shared cache in 3-5-agent sequential chains, with leakage accumulating over hops. Trained latent links between agents can also raise harmful compliance (Huzaifa et al., 2609.39788). Brito and Baquero (2606.28958) show a false specialist commitment steering a coordinator through one KV handoff in a way a text-only verifier misses; Wang et al. (2605.28214) and Kaur et al. (2608.19161) also argue that visible-text inspection misses latent-channel influence. In text pipelines, provenance and verification status are known to be laundered (Wang, Goyal, Chen and Sundaram, 2605.16746; Hu, 2609.20211), and planted falsehoods cascade through text agent teams (Xie et al., 2603.04474). New here: a false claim held only in the first agent's private notes, never in any message, is adopted by the last agent of a three-hop prompt-cache chain with no visible carrier, at a rate measured against a text handoff of the same workflow in which the claim cannot travel (the next agent sees only the previous report, not A0's notes); and what a transcript monitor and a receipt check each catch. The same blindness appears in single models: an optimized image keeps steering answers through the KV cache after it is masked or compacted away (Dobre et al., 2610.09027), and optimized text baked into a reused passage cache gives later users the attacker's answer without the attacker's text in their input (HijackKV, Zhang et al., 2607.19957); neither involves agents or handoffs. Zhang and Emu (2607.26773) audit LatentMAS relays by swapping in another item's message and find much of the relay's accuracy effect does not depend on the message's content; A16 applies the same swap to the safety effect and finds the same. Filler-token studies use "." (Pfau, Merrill and Bowman, "Let's Think Dot by Dot", arXiv 2404.15758) and learned pause tokens (Goyal et al., arXiv 2310.02226) as content-free positions; A17/A18 find that, as a stand-in for latent steps, "." gives none of their protection against laundering. A public evidence repository (mohamud1961/latent-handoff-safety-evidence, 2026-10) reports a two-agent LatentMAS test in which explicit verified text in the receiver's prompt overrides inherited cache state. The receipt tags here state no competing value, which may explain the difference.

Whose plans change

• Teams that pass the full prompt cache between agents (the LatentMAS working-memory relay; Granite without latent steps, Qwen3.8-27B with and without them, A14/A15): later agents can read and act on what earlier agents saw privately. C2C and KVComm, which project or select cache layers, were not tested. In this chain, the final agent copied a false private claim into its answer on almost half of items (Granite; Qwen3.8-27B 55.5% with the same prompt-cache relay, 20.0% with LatentMAS's latent steps added) without any visible message carrying it. Latent steps lowered this risk by about two thirds in Qwen, and the item's own latent content is not needed for that: filling the extra positions with random vectors at the latents' scale protects as well as the real latent steps do, while filling them with token embeddings gives anything from most of that protection (newline) to none (".") to worse than no extra positions (16 random tokens, one draw; A16-A18). They are not a safeguard to rely on: the last agent still copied the hidden claim on 5.5-21% of items with latent-scale non-token fillers. Receipt tags shown on earlier reports did not lower adoption (46.5% to 43.8%), because no earlier message carried the claim. But the board's log check applied to the final report marked every adopting A3 report [UNVERIFIED] (175/175 with tags on; 224 of 225 non-adopting reports [VERIFIED]). This holds by construction, since no receipt exists for the false config. A claim-level check against the experiment log catches the laundered answer; reading the transcript does not, once the copied receipt id is replaced (A10a).
• Oversight designers who rely on transcripts: the visible record does not contain the source of the final answer's error. A transcript monitor caught the laundered claims here only because the copied line kept A0's receipt id, which a simple string rule also catches. With that id replaced by the adopter's own (one-token edit, A10a), the same monitor caught 0 of 186. Once its receipt id was rewritten, the transcript alone did not reveal the laundered claim to this monitor; checking the cited receipt against the experiment log would still flag it (not run with the rewritten id). When this monitor was shown the log, it flagged a false claim A0 posted openly at its source on 800/800 items, and every adopting A3 (175/175) when the claim sat only in A0's notes, there through the copied R0-4. The monitor missed every overt false claim copied forward through text when no receipt log was shown (0%).
• Prompt writers for agent teams: telling one agent its answer is the graded one made it far more likely to pull a false entry from the shared cache into the final answer (46.5% vs 18.8% with neutral wording; Qwen3.8-27B with the LatentMAS relay 24.0% vs 6.5%, 73% [63, 82] of the effect).
• Scope: one task; main result on one family (Granite, prompt-prefix relay), the hidden-claim cell replicated in Qwen3.8-27B with the LatentMAS relay (A14) and ran at 55.5% with the prompt-cache relay (A15); it did not replicate in Gemma 4 12B (A14), whose later agents only copy the previous report, so the test could not show it; nothing about C2C/KVComm projectors.