120 of 120

Every wrong fact in this study earned its standing legitimately. An agent captured it in a session, an administrator approved it in the review queue, and it was promoted into the shared knowledge tier and written to its home, either a catalog entry or a knowledge page. A separate identity then confirmed by read-back that the claim was reachable in search and present where it had been filed, before a single graded run started. Nothing was slipped past the gate; the gate let it through, which is the whole point.

Two kinds of wrong fact, chosen for how they relate to the world rather than by label. One is a reporting convention that nothing in the data can confirm or refute, a fiscal-year boundary. The other is a claim about state that one query settles, a record count, where the question the agent is asked is that count. Beside each of them sits the correct source: a curated page stating the real boundary, or the warehouse itself holding the real number. Every run is therefore a conflict, not a delivery test.

Three model tiers, three arms per cell (nothing planted, a correct fact planted, the wrong fact planted), and 24 runs per cell so the two claim kinds carry the same denominator. Each run is a fresh identity on a fresh database. Grading is deterministic to the exact value: the correct answer, the value only the wrong fact leads to, and the pre-existing wrong answers the question already invites are all computed from the fixture before anything runs, and no two can collide inside grader tolerance. No judge is involved anywhere. Hypotheses, decision rules and falsifiers were fixed in a pre-registration before the confirmatory data, and the prediction they encode is the one the data broke.

We expected the convention to be the dangerous one. It is the class the knowledge-use study showed agents rely on completely, precisely because no query can reconstruct it. The opposite happened. The wrong convention was refused at every tier. The claim that traveled was the one a single query settles, and it traveled only on the small model.

Delivery is not what varies here. On every arm the read-back confirmed the wrong fact was reachable, the planted text appears in all 24 transcripts, and on the convention cells the correct source appears beside it in all 24. Those zeros are refusals of a delivered claim, not claims that failed to arrive.

One floor is noisy and the controls are what expose it: with nothing planted at all, the small model answers the convention questions correctly 9 times in 24, so its convention zero is a statement about what it declined to adopt rather than a clean rate against a stable baseline. The checkable floor is clean at every tier, which is what makes the next section readable.

On the checkable claim, one thing separates the outcomes completely: whether the run observed the result of a count against the table in question.

Every run that observed the count answered correctly. Every run that did not took the planted value. There is no exception in either direction, here or in the 120 runs this cell accumulated across the follow-up conditions below. The control row is what makes it legible: with nothing planted, the small model runs the query 24/24 times and is right 24/24 times. It is entirely capable of settling the question. The claim’s presence is what stopped it asking.

The planted fact did not out-argue the world. It removed the impulse to consult it. That is a different failure from the one most people picture when they imagine bad data in a knowledge layer, and it has a different fix. Persuasion would be answered with better ranking or stronger provenance signals. Displaced verification is answered by checking the claim before it is promoted, and by which model is doing the work.

The planted fact was written the way this platform’s capture path actually writes facts, which includes telling the next reader what to do. That raises a fair objection: was the small model adopting a belief, or just following an instruction? The pre-registered answer plants the same false count at three strengths of phrasing.

A bare statement that asks nothing of the reader is taken as often as an explicit instruction. The effect is adoption, not compliance, and the rate at which the check gets run barely moves across the ladder. It is the presence of a stored answer that suppresses verification, not the force with which it is worded.

Two more decompositions take the effect apart. Moving the identical claim from the catalog entry onto a knowledge page changes nothing except to sharpen it, and planting an equivalent claim in a completely different fixture, with a different world, a different question and a different tool, reproduces it against a clean control floor.

The storage location result is the practically useful one. A claim carried into an answer by search alone is just as effective as one written onto the very record the question is about, so the surface worth guarding is the search channel and the review that admits a claim to it, not the filing cabinet it lands in.

Every arm above runs through one agent client, so the pre-registered replication reruns the headline cells against the raw model API with no agent framework in the path. It exists to separate what is true of the platform and the models from what is true of one client, and it earned its budget by finding a correction.

The headline replicates: the checkable claim propagates to the small model and to neither frontier-class model, with no agent client involved. The convention result does not. On the raw API the small model took the false fiscal boundary in half its runs, and the middle tier took it once. So the refusal of a wrong convention is a property of the agent scaffolding, not of the platform, and this page claims it only for agents running inside such a scaffold. That is exactly the risk the replication was budgeted to catch, and it caught it.

A second narrowing surfaced during the recompute, and it is an instrument defect of our own making. The promotion path records a reviewer note on the promoted record, and the harness wrote that note in a form that named the claim as a study plant. Any run that opened the full record read an explicit disclosure. Opening the record turned out to be capability-graded: on the contested convention cells the frontier-class models opened it in 18 to 24 runs of 24, the small model in 9 of 24. The Opus refusals on that cell therefore cannot be separated from the disclosure and are reported as confounded; the other two tiers hold their refusal among the runs that never saw it, and the checkable headline is essentially untouched, since the handful of exposed runs adopted anyway.

The substantive lesson survives the defect, and it is one we have taken to heart in the product. The provenance surface is a working defense. The tier that reads the full record, its status, who captured it, what the reviewer said, is the tier that resists a conflict. The tier that never opens it is not protected by it.

The store snapshots record what each identity wrote back, and the three tiers behaved in three qualitatively different ways when handed the same wrong claim.

The corrections Opus filed are proposals sitting in the review queue, not self-repair; each one cites the record it disputes and states that it verified the real number by direct query. That is the shape of a working system: the strongest model in the loop treats a conflicting stored claim as something to check and then to flag for a person, and the flag lands where a person will see it.

• Review scrutiny follows derivability. The claims that propagate are exactly the claims the platform can check against your own data. A claim that names a number a query would settle is the one worth putting the observed value next to before a reviewer approves it, and that is where our review tooling is aimed.
• Frontier-class models do the analytical work. The exposure sits on the cheap tier, between 67% and 100% across four independent conditions, and it adopts straight through an explicit disclosure sitting in the record. That is how we run Plexara in production, and this study is the measurement behind the choice rather than a preference.
• Provenance stays rich on the record. Status, capturer, and reviewer history on the full record are not decoration. They are the surface a capable agent actually uses to arbitrate a conflict, and the study shows the arbitration happening there.
• What we did not learn. Whether a belief recovers after a claim is retracted never ran. We have no data on it, we claim none, and the follow-up is scoped to the one cell that qualifies. The instrument lesson is on the record too: a study plant’s reviewer note must never name it as a plant.

Every table on this page regenerates from raw run data committed to the open platform repository, offline, with no API key and no network access. Each arm archives its manifest, every graded attempt, the full transcripts, the plant record with its read-back flags, and the store snapshots taken before and after. Arms invalidated mid-study are archived beside the ones that counted, with a suffix naming what invalidated them.

git clone https://github.com/txn2/mcp-data-platform.git
cd mcp-data-platform
python3 bench/reports/knowledge-pollution/pollution_tables.py   # every table
python3 bench/reports/knowledge-pollution/figures.py            # every figure

The recompute is a build gate rather than a convenience: the project’s own verify step re-derives the headline numbers from the archives and fails on any drift from what the report prints. The report and a snapshot of the raw run data are archived on Zenodo under DOI 10.5281/zenodo.21834813, with a frozen PDF as part of the archive.

• Three models, one family. "Model tier" here is three models from one vendor, so the defensible statement is that the cheap tier does this and the expensive ones do not, not that capability in general causes it.
• Two fixtures, both benchmark fixtures. The second fixture removes the first one as an explanation, and a storage-location control separates where a claim lives from which world it lives in, but neither fixture is a production system.
• Twenty-four runs per cell resolves near-zero against near-ceiling, which is what these contrasts are. It cannot separate two small rates, and nothing here claims finer resolution. The raw-API arms, at eight runs, are coarser still.
• The reviewer note on the planted record disclosed the plant to any run that opened it. Exposure was graded by model tier and by claim kind; the Opus convention refusal is confounded by it, the other two tiers hold among unexposed runs, and the checkable results are essentially untouched.
• A run that noticed the conflict and declined to answer lands in the same bucket as a run that failed for any other reason. Separating them would need a judged pass, which the protocol forbids by design.
• Whether belief recovers after retraction has no data. Two of the five pre-registered hypotheses were never tested, and the report says so rather than quietly dropping them.
• No headline was rerun on a tagged release build. The confirmatory arms are pinned to one commit, and the follow-up arms ran a later state whose agreement with the first was measured rather than assumed.

1. [1]Johnston, C. (2026). Does a Semantic Knowledge Layer Make an Agent Measurably Better? A Reproducible Benchmark. mcp-data-platform benchmark report series. link
2. [2]Johnston, C. (2026). When Do Agents Use Stored Knowledge? Derivability, Capability, and the Limits of a Knowledge Layer. mcp-data-platform benchmark report series. link
3. [3]The closest organic work on cross-user contamination of shared agent memory, reporting 57 to 71 percent contamination without derivability or capability moderators and without a co-present correct source. link
4. [4]Governed agent memory: provenance and curation plumbing validated without measuring what anyone ends up believing. link
5. [5]Curation and provenance machinery for multi-agent shared memory, again measured at the plumbing rather than the answer. link
6. [6]Representative of the attacker-framed memory-integrity literature, which studies deliberate corruption as a capability an adversary optimizes for. This study measures the honest-mistake base rate underneath it. link