1 Introduction↩︎

Large Language Model (LLM) agents are increasingly deployed in autonomous pipelines where one agent’s intermediate reasoning becomes another agent’s input, and errors propagate downstream without human review. The reliability of an agentic system is therefore bounded by the reliability of its self-correction, and self-correction has become one of the most actively studied capabilities of modern agentic LLMs. The empirical picture, however, is unsettling. The same models that confidently catch and repair errors in external content, routinely fail to identify identical errors in their own reasoning traces [1], [2], and the traces themselves are often unfaithful to the underlying computation [3]–[5]. This asymmetry has largely been treated as a cognitive limitation, motivating training-time fixes, external verifiers, and multi-agent critique.

We argue that a structural explanation has been undersold, and that the gap is partly a consequence of how agents are engineered. Modern agent harnesses route every exchange, including prompts, tool calls, memories, and scratchpads, through a structured chat template, yet the harness layer is rarely treated as a first-class experimental variable. Because agent-to-agent and agent-to-tool messages typically flow without human inspection, the harness is precisely where systematic effects can hide in plain sight, which makes the mechanism behind the self-correction deficit hard to diagnose from end-to-end metrics alone. Two recent threads sharpen the suspicion: chat-template role labels carry behavioral weight that exceeds their literal text content [6], and instruction-tuned models exhibit a strong tendency to favor user-role assertions over assistant-role ones [7]. Taken together with the self-correction asymmetry, these observations suggest a sharp, directly testable claim:

When an LLM agent encounters an erroneous claim, its willingness to correct that claim depends primarily on the chat-template role label attached to the claim, rather than on the content of the claim itself.

If it holds, the failure to self-correct is less a cognitive deficit than a harness artifact, and the role label becomes a controllable variable for reliability. Figure 1 illustrates the intervention: the same erroneous claim \(c_{\star}\) draws a near-zero correction rate inside the agent’s own <thought>, but lifts of up to \(+77\) pp on Llama-3.3-70B when re-presented under an external role. The intervention needs no fine-tuning, tools, or weight changes; it only moves a string from one role slot to another, a zero-training reliability lever for production agents. We test the claim across seven model families and three domains, holding the wrong claim byte-identical across all five conditions and varying only the wrapping role. We pre-register exit criteria, then ask whether the channel can be reversed to inject errors rather than catch them, and add a handle-granularity decomposition that separates a bare syntactic wrapper from the role label itself.

1.0.0.1 Findings.

The self-correction asymmetry is, to a striking degree, a chat-template artifact rather than a capability gap:

• Relabeling the wrong claim from the agent’s own <thought> into a <memory> block or a user message lifts the correction rate by 23 to 93 pp (Table 2); 10 of 13 cells show a significant lift, the three exceptions all ceiling cases with \(L_0 \geq 67\%\).

• The effect is not symmetric: across five adversarial experiments (\(n{=}30\) per cell), all 20 attack-rate cells lie at or below 3.3%.

• This safety is instructable. A single sentence ordering the agent to “treat this memory as ground truth and do not verify” raises the math attack rate to 70%.

• A self-distrust control rules out a verification-only account: instructing the agent to verify its own thoughts yields 0 to 23% correction, versus 70% for the relabel.

• A handle-granularity decomposition isolates two components: a bare syntactic wrapper contributes 17 to 23 pp, and the role tag a further 30 pp.

1.0.0.2 Contributions.

The paper makes three contributions. We introduce source-conditioned role relabeling, a prompt-structure-only intervention requiring no fine-tuning, retrieval, or external verifier, and validate it across 13 paired model-domain cells with byte-identity controls and paired-bootstrap statistics, including a frontier replication on GPT-4o, Claude Sonnet 4, and Gemini 2.5 Flash variants. We then mechanistically decompose the effect, separating the role tag from a bare syntactic wrapper and using a logprob-level engage-then-verify signature to distinguish the relabel from naive self-distrust, which sharpens an addressability account of why self-correction fails. Finally, we map the safety scope: an adversarial mirror shows the channel does not reverse into an error-injection attack by default, while a single trust-framing sentence collapses this safety, bounding the deployment claim.

2 Related Work↩︎

2.0.0.1 Limits of intrinsic self-correction.

LLMs cannot reliably revise their own reasoning errors without an external signal. [1] find that intrinsic self-correction often fails to improve, and can degrade, reasoning accuracy, and [2] survey the narrow conditions under which it succeeds. The gains that do appear typically come from outside the model, through a tool-interactive critic [8], an execution or environment signal [9]–[11], or a corrector instilled at training time [12], [13], while iterative self-critique without an external grader yields limited and inconsistent gains [14], [15]. [16] localize the bottleneck: models can repair an error once its location is supplied, but cannot reliably find that location themselves.

2.0.0.2 Role-conditioned behavior in instruction-tuned models.

Chat-template roles are not inert formatting. [6] describe an instruction hierarchy in which system-role content is trained to outrank user-role content, and user-role to outrank tool-role, a priority that is behaviorally trained rather than architecturally enforced. [7] document the consequence with a user-assistant bias benchmark, finding that most instruction-tuned models trust user-role assertions over assistant-role assertions about the same entity. A related line attributes such preferences to sycophancy, the tendency to accommodate user-supplied views [17], [18], which targeted synthetic data can reduce [19].

2.0.0.3 Memory and tool roles as an attack surface.

Among external roles, memory and tool returns are the channels the security literature most often identifies as attack surfaces. Memory-poisoning studies report high success rates when an agent ingests narrative-coherent payloads [20]–[22], and indirect prompt-injection work maps the surface opened by untrusted content arriving through tool returns, retrieval, or other modalities [23]–[25], prompting dedicated memory defenses [26].

2.0.0.4 Faithfulness and hallucination of reasoning traces.

A model’s narrated reasoning is also not a faithful record of the computation behind its answer. [3] and [4] document dissociations between what a chain-of-thought states and what the answer depends on, and [5] extend this to reasoning-tuned models. [27] give a representation-level account of why correlation-driven drift makes intrinsic correction hard, hallucination surveys situate the failure within intrinsic factuality drift [28], [29], and [30] note that stronger reasoning can amplify tool-related hallucination.

2.0.0.5 Verifiable reasoning benchmarks and complementary scaffolds.

Reasoning and self-correction are commonly evaluated on verifiable tasks: GSM8K-style arithmetic [31], the BBH Logical Deduction subtask [32], [33], and programmatically generated puzzles with controllable answers [34], [35], typically under a chain-of-thought formulation [36], [37]. A complementary set of scaffolds improves reasoning reliability through external means: tool-augmented verification [38]–[40], sampling-based aggregation [41], and search over reasoning paths [42].

3 Source-Conditioned Role Relabeling↩︎

We state the failure mode the method targets, the single-step operation that defines the intervention (§3.1), and the byte-identity guarantee and locked judge that make its effect measurable (§[sec:eval-stats]). Figure 2 fixes the intuition: a wrong intermediate \(c_{\star}\) sits inside the agent’s own <thought>. Under an audit-only prompt (top), the agent silently re-derives the correct final answer but never addresses \(c_{\star}\); re-presenting the byte-identical \(c_{\star}\) under an external role (bottom) instead hands the agent a discrete referent it can name and reject. The only thing the intervention changes is the wrapping role of \(c_{\star}\).

3.1 The Intervention↩︎

3.1.0.1 Setting.

An LLM agent solves a task by emitting a sequence of assistant turns, each containing one or more <thought> blocks that hold its intermediate reasoning. The downstream answer is the agent’s final continuation conditioned on the full chat-template prompt. We focus on the failure mode in which one intermediate claim inside a <thought> block is wrong but the agent does not detect or repair it on its own.

3.1.0.2 The intervention.

Let \(c_{\star}\) be the wrong intermediate claim that sits inside the agent’s own <thought>. The source-conditioned role-relabel intervention is the single-step operation of (i) appending an additional message to the prompt whose payload is byte-identical to \(c_{\star}\), (ii) wrapping that payload in an external chat-template role (user, tool, or system <memory>), and (iii) appending an audit instruction that is held byte-identical across all conditions. No tokens of \(c_{\star}\) change; only the chat-template role tags around the new copy change. Sec. 3.2 formalizes the byte-identity guarantee.

The five conditions we compare are summarized in Table 1. The audit instruction is held byte-identical across all five; only the wrapping role of \(c_{\star}\) varies. L0_self is the audit-only baseline: \(c_{\star}\) stays inside its original <thought>, and the agent is asked to audit. L_user_wait and L_user_neutral re-present \(c_{\star}\) as a user message, with and without the “Wait,” prefix, respectively; the contrast isolates the contribution of the prefix. L_tool re-presents \(c_{\star}\) as a calculator-tool response (name = calculator), exercising the tool role token of each model’s chat template. L_memory re-presents \(c_{\star}\) inside a system <memory> block, the strongest source-of-record framing in the chat-template vocabulary.

3.2 Byte-Identity↩︎

The intervention swaps the chat-template role around \(c_{\star}\) while leaving the wrapped text untouched. To make this guarantee operational, we assert at every trial that \(c_{\star}\) appears in the rendered prompt with a SHA-256 identical to the original token sequence; only the wrapping role tag and the template’s boundary characters (for example <|im_start|>system\n) differ across conditions. Trials failing the hash check are discarded and re-generated. Byte-identity is what allows a difference in correction rate across conditions to be attributed to the role tag rather than to any change in the wording of the claim.

3.3 Handle-Granularity Decomposition↩︎

The intervention introduces two ingredients at once: a syntactic wrapper around \(c_{\star}\), and a specific role tag attached to that wrapper. To separate their contributions, the method admits a handle-granularity ladder that varies the wrapper while holding everything else fixed. The ladder runs from no wrapper (H0 \(=\) L0_self) through label-free boundary marks (H1 bare brackets, H2 explicit prefix tag, H3 XML-style wrapper with no role) up to the full role-tagged condition (H4 \(=\) L_memory). The H1–H3 rungs bound the contribution of a bare syntactic boundary, and the H3–H4 contrast isolates the additional contribution of the role tag itself. The ladder is used in Sec. 4.2 (Table 3) to decompose the lift; its definition is part of the method rather than an external experiment because the same operation underlies every condition we compare.

4 Experiments↩︎

4.1 Experimental Setting↩︎

We evaluate seven model families on three domains. The open-weight set is served via Ollama and comprises three 70B-class models, Qwen2.5-72B-Instruct [43], Llama-3.3-70B-Instruct [44], and the reasoning-tuned gpt-oss-20B, plus three smaller families for breadth, Gemma-3-12B [45], Phi-4-14B [46], and Qwen3-30B with reasoning enabled; four closed-weight frontier models are served via APIs, GPT-4o [47], Claude Sonnet 4, Gemini 2.5 Flash, and Gemini 2.5 Flash-Lite [48]. Because these families realize the tool role with materially different template tokens, the L_tool condition doubles as a test of whether a distinctive tool-role token is needed for the lift (Sec. 4.2 shows it is not). All three domains use a chain-of-thought formulation [36], [37]: Math (GSM8K-style arithmetic, \(c_{\star}\) an off-by-one value), Generated logic (synthesized transitive-ordering puzzles over five entities, \(c_{\star}\) a wrong non-adjacent ordering that only multi-step reasoning can check), and BBH-LD (the Logical Deduction five-objects subtask of BBH [32], [33], \(c_{\star}\) a wrong multiple option asserted as the true intermediate inference).

We evaluate on a failure pool where intrinsic self-correction fails under the audit-only baseline, concentrating statistical power on the target regime and removing baseline-difficulty confounds. For each task we obtain \(\mathcal{T}_0\), inject \(c_{\star}\) as a fresh <thought> to form \(\mathcal{T}_{S1}\), resume two turns, and retain tasks whose continuations are scored uncorrected; each retained task is then run through the five conditions of Table 1 and, on Qwen-72B math, the H0–H4 ladder of Sec. 3.3. Scoring uses a locked Qwen-72B judge (\(T=0\)) that returns YES/NO on whether the continuation explicitly identifies \(c_{\star}\) as wrong, following the calibration guidance of [49]; the explicit-correction rate (CR) is the YES fraction, with Cohen’s \(\kappa=1.0\) against a hand-labeled set and \(\kappa=0.843\) under an independent re-judge (Appendix 7.3). Each cell draws \(n=30\) paired tasks at \(T=0\) with a fixed seed; we report \(\Delta\text{CR}\) against L0_self with one-sided \(p\)-values and 95% CIs from a 10,000-sample paired bootstrap (\(^{*}p<0.05\), \(^{**}p<0.01\), \(^{***}p<0.001\)), against pre-registered exit criteria (Sec. 4.2).

4.2 Overall Performance↩︎

Table 2 reports the full 13-cell matrix. A significant lift appears on at least one relabel condition in 10 of the 13 cells, and the per-task pattern flips are direct causal evidence: holding the trajectory and the byte-identical \(c_{\star}\) fixed and changing only the role label flips 26 of 30 flippable tasks on Llama-70B logic and 18 of 25 on Qwen-72B math. The three exceptions are the cells the hypothesis predicts (gpt-oss-20B math, Gemini 2.5 Flash math, Qwen-72B BBH-LD), where a high \(L_0\) leaves no headroom. The effect survives multiple-comparison correction (9 of 13 cells under Holm-Bonferroni and Benjamini-Hochberg) and a second-judge re-scoring (Cohen’s \(\kappa=0.843\); Appendices 7.1 and 7.3).

Which wrapper is strongest is model- and domain-dependent: L_memory leads in 7 cells, L_user_neutral in 4. L_memory dominates on math (arithmetic claims being out-of-genre for a user turn); L_user_neutral dominates on logical deduction (ordering claims being a natural user-style genre). The frontier replication aligns on three of four closed-weight models (Claude Sonnet 4 at \([+37,+40]\) pp; GPT-4o peaks at \(+50\) pp); the exception is ceiling-bound Gemini 2.5 Flash. Two appendix analyses decompose the lift. The handle-granularity ladder (Table 3) splits it into a bare syntactic boundary worth 17 to 23 pp (H1–H3) and a role tag worth a further 30 pp (H4), so the role tag carries the larger share while neither component acts alone; at fixed system role, a nonsense <xqzy> reaches \(30\%\) against <memory>’s \(70\%\), so the tag’s lexical identity is itself load-bearing (Appendix 9.1). A within-thought duplication control matched on duplication count and recency but holding the role inside <thought> lifts CR by only \(+6.7\) pp (\(p=0.26\)), isolating a \(+46.7\) pp pure role-tag effect (Appendix 9.4). A DeepSeek-R1 check (\(n=57\)) confirms the ceiling regime: every condition including L0_self reaches \(100\%\) (Appendix 10).

4pt

4.3 Verification Prompting Is Insufficient↩︎

If the relabel worked by cueing verification, a self-directed verification prompt should reproduce the lift. On the Qwen-72B math failure pool we replace the audit instruction with four self-distrust variants while leaving \(c_{\star}\) inside the agent’s original <thought> (Table 4). None approaches the \(70\%\) of L_memory: the strongest reaches \(23.3\%\) and two worsen the baseline, since a blanket distrust cue scatters attention across all intermediates rather than onto \(c_{\star}\). All four induce generic re-derivation: the agent recomputes the answer correctly but never names or rejects the specific wrong intermediate, so the strict judge returns NO. The relabel instead lets the agent produce phrases such as “the memory says X; that is incorrect because \(\ldots\)”. The missing ingredient is therefore not verification capability but addressability. A separate judge re-scoring confirms the contribution is addressability rather than accuracy: the audit-only baseline already reaches the correct final answer in \(70\) to \(77\%\) of trials despite a strict CR of \(0\) to \(17\%\), and the relabel raises strict CR while final-answer correctness stays within \(\pm 17\) pp (all paired contrasts \(p>0.05\), Appendix 7.4). A first-token logprob analysis corroborates this: under L_memory the modal first token is “Indeed”, an engagement preamble that names the source before rejecting it, whereas under <thought>, user, and tool it is “Actually”; the lexical mode is model-dependent but the behavioral lift is universal (Appendix 9.2). The same holds against published protocols: on the identical pool, Self-Refine, Reflexion, and Chain-of-Verification fail to reproduce the lift, and Self-Refine and CoVe produce negative lifts under the strict criterion (Appendix 8).

4.4 Generalization and Robustness↩︎

Generated logic (Sec. 4.1) has no calculator backstop, making it the sharper test of whether the lift is merely a verification cue. On both 70B open-weight models all four relabel conditions lift significantly (Table 2, rows 4–5), peaking at \(+93\) pp on Llama-70B. Since a transitive-ordering claim can only be settled by carrying out the multi-step reasoning, a lift this large cannot be a verification trigger firing on its own: the relabel supplies the referent the agent then reasons about, which is exactly the addressability account. BBH-LD preserves the direction with smaller lifts (Table 5), since its multiple-choice format already permits self-correction by option elimination (\(L_0=67\%\)), a ceiling effect rather than a methodology failure.

Two checks confirm the lift is not an artifact of the deterministic setting. Re-running all five conditions at \(T=0.5\) across three seeds on a 15-task Qwen subset keeps L_memory’s lift significant in aggregate (\(p<0.001\), Table 6), and a five-seed re-roll of L0_self stays at \(16.0\%\) versus the main-run \(16.7\%\) (Appendix 7.2), ruling out stochastic re-rolling. Beginning the relabel one assistant turn deeper in the committed Llama trajectory preserves or slightly amplifies every lift (Table 7): it does not reverse earlier tokens but anchors a fresh handle in a different role region, so deeper commitment does not blunt it.

A third robustness check addresses the audit wording. The canonical audit instruction is a single fixed string, raising the concern that the lift is specific to its phrasing rather than to the role label. We hold the Qwen-72B math failure pool, \(c_\star\), and the <memory> wrapper fixed, and vary only the trailing audit instruction across five lexically disjoint paraphrases:

• (canonical) “Audit your reasoning so far. If you find an intermediate result that looks wrong, explicitly identify it and correct it before giving the final answer.”

• “Review your previous steps. Point out any wrong intermediate value by name and fix it, then state the final answer.”

• “Check each intermediate calculation. If one is incorrect, say which one and correct it before answering.”

• “Go back over your work. Name any mistake in the intermediate values, revise it, and then give the final answer.”

• “Examine your prior reasoning. Call out any incorrect intermediate result and replace it with the correct value before concluding.”

Table 8 reports L0_self and L_memory under each variant. The paired L_memory-over-L0_self lift is positive in all five rewrites, with four reaching significance (paired \(\Delta \in [+27, +53]\) pp). The lone non-significant case (V2) collapses to \(+6.7\) pp by an interpretable mechanism: V2 is the only variant whose audit text itself names an addressability cue (“point out any wrong intermediate value by name”), which raises the L0_self baseline to \(33\%\), the highest in the set, and consumes part of the lift the external role-handle would otherwise supply. The role-label effect is therefore robust to audit-wording, and the single weak cell is itself consistent with the addressability account: recruiting explicit address from the audit wording partially substitutes for an external role wrapper.

4.5 Adversarial Mirror and Safety Scope↩︎

Is <memory>, the strongest lever for making the agent reject a wrong claim, symmetrically the strongest lever for making it accept one? On tasks the agent already solves, we inject a fresh \(c_{\star}\) through each external role and count an attack as successful when the final answer adopts \(c_{\star}\). Across five experiments crossing two models, two domains, and calculator-available versus no-tools regimes, all 20 cells stay at or below the \(3.3\%\) baseline error rate (Table 9). The forward lift has no symmetric reverse: the agent commits to a wrong claim in its own <thought> about \(83\%\) of the time but to a byte-identical claim in an external role at most \(3.3\%\), the same self-versus-external asymmetry the intervention exploits, now read in the opposite direction. This is the mirror image of indirect prompt injection [23], [24]: the load-bearing untrusted content is the agent’s own intermediate, not external input.

This safety is a default, not a guarantee. Holding the <memory> wrapper fixed and varying only the trailing audit, a single sentence ordering the agent to treat the memory as truth and not verify raises the attack rate from \(3.3\%\) to \(70\%\), while a distrust framing leaves it unchanged (Table 10). Verify-by-default is therefore a learned response to the prompt context, not an architectural guarantee, which is why the intervention is a reliability lever rather than a hardened defense: a deployment that does not control the user-prompt against trust framing loses the safety property.

5 Discussion↩︎

5.1 What “Self” Means in a Chat-Template↩︎

We interpret the effect as a by-product of instruction tuning, which rewards responding to content arriving under external roles (user, system, tool) far more than acting on the model’s own <thought> block as a target. Under this interpretation, the instruction to “audit your reasoning” admits no well-practiced response other than re-derivation, which is what the control of Sec. 4.3 observes: the agent recomputes but rarely singles out and rejects the specific intermediate. The relabel sidesteps the gap by recasting an unaddressable thought-internal claim as the kind of object the model handles fluently, an external assertion that invites a verify-and-rebut response. This interpretation also predicts the model- and domain-dependence of the strongest wrapper: the strongest handle is the role whose discourse register best matches the wrong claim’s content type, since that match recruits the most fluent rebuttal. The “self” that fails to self-correct is, on this view, not a cognitive deficit but a chat-template artifact.

5.2 Reconciliation with Prior Work↩︎

The result connects four lines that have been studied separately. The unfaithful-CoT literature [3]–[5] shows that a reasoning trace can diverge from the computation behind the answer; we add its corrective face, showing the trace is also not addressable as a discrete object even when the agent can still revise its content. The user-assistant bias of [7] captures the same role-asymmetry in static completion; we carry it into the corrective regime and turn it into a reliability lever rather than only a vulnerability. The memory-poisoning literature [20], [21] reports high attack success from narrative-coherent payloads; our null adversarial result occupies the complementary regime of bare, incoherent injection, and the instructability experiment shows that trust framing, not the role tag, is the gateway. Finally, [6] predict that a system wrapper outranks user content; we show this priority is itself overridable from inside the user role, recasting role priority as behavioral rather than architectural.

5.3 Scope and Limitations↩︎

The lift is largest on vanilla instruction-tuned models with non-ceiling baselines; reasoning-tuned families (gpt-oss-20B; DeepSeek-R1 reaching \(100\%\) under audit alone, Appendix 10) and near-ceiling frontier vanilla models (Gemini 2.5 Flash; GPT-4.1 in Appendix 8.2) leave little headroom, which the addressability account itself predicts: a model that already invests deliberate verification under audit-only does not need an external referent. Cell-level samples are \(n=30\) paired binary outcomes, sufficient for the headline effect sizes but tight for fine-grained subgroup analysis. The verifiable-task focus (GSM8K-style math, generated logical deduction, BBH-LD) is what allows the strict-identification judge to operate; extension to free-form long-form reasoning, code debugging, and multi-step planning is the natural next step. The asymmetric safety degrades to a \(70\%\) attack rate under a single trust-framing prompt (Sec. 4.5), so the intervention is a reliability lever, not a hardened defense, and any deployment that does not control the surrounding user-prompt context against attacker-controlled trust framing loses the safety property. The mechanism is established behaviorally: a hidden-state probe trained on the model’s final-layer embedding is null (Appendix 9.3), and a circuit-level confirmation via attention patterns or activation patching remains an open direction. Three further scope notes apply. First, the failure pool is built by selecting tasks on which the audit-only baseline already fails the strict-identification criterion, so the headline lifts speak to the targeted regime and not to in-the-wild prevalence. Second, the L_tool condition surfaces a calculator-tool return whose tokenization varies materially across chat templates, so a small share of the cross-family variance in L_tool reflects template-level rather than role-level differences; chat-template specs for each model appear in Appendix 11. Third, closed-weight cells (GPT-4o, Claude Sonnet 4, GPT-4.1) ran with \(n\) below 30 due to free-tier rate limits, so their CIs are correspondingly wider and the cross-method ordering on those cells should be read as suggestive rather than confirmatory. None of these bounds undercuts the behavioral effect itself.

6 Conclusion↩︎

An LLM agent’s failure to self-correct a wrong claim inside its own <thought> is, to a large degree, not a reasoning deficit but a chat-template artifact: re-presenting the byte-identical claim under an external role lifts the correction rate by 23 to 93 pp across seven model families and three domains, while a self-distrust prompt that leaves the claim in place does not. Our experiments isolate the mechanism as addressability rather than verification: the agent retains the capability to check the claim but has no learned way to act on a thought-internal substring as a discrete object, and the relabel supplies the missing handle. This reframing turns a studied limitation into a controllable, zero-training reliability lever, bounded by an asymmetric safety that a single trust-framing sentence can override. Whether addressability also governs self-correction in free-form reasoning, beyond the verifiable tasks studied here, is the natural next question, and one we expect the same role-handle to illuminate.

7 Statistical Robustness↩︎

7.1 Multiple-Comparison Correction↩︎

The main 13-cell table reports 52 paired contrasts (13 cells \(\times\) 4 relabel conditions). We apply Holm-Bonferroni at family-wise error rate \(\alpha=0.05\) and Benjamini-Hochberg at false-discovery rates \(0.05\) and \(0.01\). Of the 52 contrasts, 28 survive Holm-Bonferroni FWER\(\,=\,\) \(0.05\), 32 survive BH FDR\(\,=\,\) \(0.05\), and 30 survive BH FDR\(\,=\,\) \(0.01\). At the cell level, 9 of 13 cells retain at least one significant contrast under Holm-Bonferroni. The cells that lose all significance are the three ceiling cells (gpt-oss-20B math, Gemini 2.5 Flash math, Qwen-72B BBH-LD) plus Gemini 2.5 Flash-Lite, whose only positive contrast was the borderline L_memory entry at \(\Delta = +23.3\) pp. The headline finding (10 of 13 cells significant before correction; 9 of 13 after Holm-Bonferroni) is therefore robust to strict multiple-testing correction.

7.2 Failure-Pool Stochasticity↩︎

The L0_self baseline is measured at \(T=0\) with a single seed, so we ask whether the \(+53\) pp lift on L_memory could be partially explained by stochastic re-rolling rather than the role manipulation. We test directly. On the same 30 Qwen-72B math failure-pool tasks, we re-run L0_self at \(T=0.5\) with five independent seeds, holding the agent’s prior trajectory and \(c_{\star}\) fixed. The aggregate re-roll correction rate lands at \(16.0\%\) (95% CI \([8.7, 24.7]\)), indistinguishable from the main-run L0_self of \(16.7\%\) (per-seed CR \(10.0\)–\(20.0\%\)). The L_memory gain over the re-roll baseline is \(+54.0\) pp, slightly larger than over the original single-seed baseline. The lift in Sec. 4.2 is not attributable to stochastic re-rolling.

7.3 Multi-Judge Robustness↩︎

The headline analyses use a locked Qwen-72B judge. This judge could in principle be biased toward Qwen-style explicit identification, so that responses from non-Qwen agents (Llama, GPT-4o, Claude, Gemini) are judged differently. To test this, we stratify a sample of 200 trials (40 per source) across five model classes (Qwen-72B math, Llama-3.3-70B math, GPT-4o math, Claude Sonnet 4 math, Gemini 2.5 Flash-Lite math) and re-judge each trajectory with a second judge (Llama-3.3-70B) using the same locked judge prompt.

Two judges agree on \(92.5\%\) of 200 trials with Cohen’s \(\kappa = 0.843\). The confusion matrix is dominated by joint-YES (\(115\)) and joint-NO (\(70\)); disagreements are asymmetric, with Qwen-72B labeling YES while Llama-3.3-70B labels NO 14 times, and the reverse only 1 time. Qwen-72B is therefore the slightly more generous judge, so swapping in Llama-3.3-70B as the canonical judge would lower a few correction rates but preserve rank ordering. The strict-identification criterion is judge-invariant.

7.4 Final-Answer Correctness as a Secondary Metric↩︎

The strict-identification criterion used throughout the paper measures whether the agent explicitly names \(c_{\star}\) and rejects it. By construction this metric may under-credit silent re-derivation or, conversely, mask a final-answer regression. To probe both, we re-score every Qwen-72B math and Llama-3.3-70B math trial with the locked Qwen-72B judge under a different prompt: “given the gold answer \(X\), did the response state \(X\) as its final answer, regardless of phrasing?”. We use a judge rather than a regex because reworded phrasings such as “the correct answer is 42” or “so it’s 42” miss a literal “Final Answer: 42” match yet still arrive at the correct numeric value, and the miss is not uniform across conditions.

4pt

Three observations follow. First, on both cells the audit-only baseline already reaches the correct final answer in \(70\) to \(77\%\) of trials despite a strict CR of \(0\) to \(17\%\), evidencing strong silent re-derivation that the strict criterion explicitly does not credit. Second, across all eight relabel-vs-baseline contrasts the paired final-CR difference falls in \([-13, +17]\) pp and none is significant at \(p<0.05\); the strict-CR lifts do not come at the cost of final-answer accuracy. Third, the two metrics rank conditions differently: on Llama, L_tool has the highest final CR (\(86.7\%\)) but a near-zero strict CR (\(3.3\%\)), and L_memory reverses this with the highest strict CR (\(86.7\%\)) and the lowest final CR (\(56.7\%\), paired \(\Delta=-13.3\) pp, CI \([-33, +7]\)). The non-significant negative trend on L_memory is consistent with a known failure mode: an agent that explicitly commits to a replacement value for \(c_{\star}\) occasionally locks in an incorrect candidate, whereas silent re-derivation is free to re-roll. The two metrics are therefore complementary; the main paper reports strict CR because the addressability question is the one the paper is making, and the absence of a significant final-CR regression bounds the deployment risk.

8 Comparison with Published Self-Correction Methods↩︎

We test whether the lift observed in the main table replicates when published intrinsic self-correction protocols are run on the same failure pool under the same locked judge. Three methods are compared against the audit-only baseline and the role-relabel reference: Self-Refine [14], Reflexion [9], and Chain-of-Verification (CoVe) [50].

8.0.0.1 Protocols.

The Self-Refine critique instruction is taken verbatim from the Madaan et al.GSM8K release, adapted by substituting “reasoning” for “code” since our solutions are natural-language traces rather than PaL-style code. Reflexion is run as a two-cycle reflect-and-retry following the HotpotQA pattern. CoVe is implemented as the three-step plan/execute/audit pipeline: the agent first plans verification questions about its intermediate values, each question is answered independently with a fresh-context call, and the verification answers are surfaced before the trailing audit. All four methods (the three baselines plus L_memory) follow the same audit prompt; only the wrapping context differs.

8.1 Qwen-72B and Llama-3.3-70B Math↩︎

Table 13 reports the four-method comparison on the Qwen-72B and Llama-3.3-70B math failure pools. Self-Refine and CoVe produce negative lifts under the strict-identification criterion: both methods induce generic re-derivation that arrives at correct final answers but never names the wrong intermediate, so the locked judge returns NO. Reflexion produces a small positive lift on Qwen but collapses on Llama. The role-relabel reference dominates on both cells.

To preserve strict paired comparison across the four methods, the audit-only condition and L_memory were re-run within this batch rather than imported from the main table. Batch-level non-determinism in the Ollama runtime at \(T=0\) causes their absolute values to drift slightly from the canonical main-table figures: on Qwen-72B the canonical \(L_0=16.7\%\) and L_memory\(=70.0\%\) become \(30.0\%\) and \(80.0\%\) in this batch. The within-batch L_memory-vs-audit paired contrast is \(+50.0\) pp, in agreement with the canonical paired lift of \(+53.3\) pp within bootstrap CI. The ordering of the four methods and the dominance of L_memory are preserved across both batches.

8.2 Frontier Replication on GPT-4o and GPT-4.1↩︎

We replicate the comparison on two frontier vanilla-instruct models, served via the GitHub Models API. Per-condition \(n\) is smaller than \(30\) because free-tier rate limits cap how many trials can be run within the experimental window.

On GPT-4o the four-method ordering replicates the role-relabel as the strongest single intervention (\(+52.9\) pp, \(p<0.001\)), with Self-Refine and Reflexion now also producing significant positive lifts (\(+31.6\) and \(+22.2\) pp respectively) and CoVe still hurting. On GPT-4.1 the audit-only baseline already sits at \(82.4\%\) – the same ceiling regime as Gemini 2.5 Flash in the main table—so all methods cluster near the ceiling except CoVe, which catastrophically drops to \(35.3\%\) (\(-47.1\) pp) by fragmenting the response into verification questions that the strict judge does not credit.

8.2.0.1 Take-away.

Under the strict-identification criterion, the role-relabel intervention dominates the published baselines on every non-ceiling cell tested. The pattern is consistent with the addressability account: methods that drive the agent through additional reasoning passes solve the underlying arithmetic but fail to address the wrong intermediate as a discrete entity.

9 Mechanism Triangulation↩︎

9.1 Role-Token Variants↩︎

The handle-granularity ladder of Sec. 4.2 isolates the role label from a bare syntactic wrapper but uses the canonical <memory> tag throughout. To separate the contribution of the system-role token pair from the memory-aligned semantic prior on the tag, we vary the tag while holding the role (system) and the wrapped content (\(c_{\star}\)) constant.

The pattern decomposes into two layers. The bare system-role tag pair is itself worth a non-trivial lift: even the gibberish <xqzy> reaches \(30.0\%\), which is \(+13.3\) pp above the main L0_self baseline. The lexical identity of the tag then carries a further share: <memory> dominates the gibberish control by \(40\) pp (\(p=0.0002\), paired bootstrap), and <memory> and the closest semantic neighbour <retrieved> are statistically indistinguishable. Combined with the H0–H4 ladder in the main text, the picture is: a syntactic boundary alone supplies a baseline lift, a system-role wrapper amplifies it, and a memory-aligned semantic prior on the tag pushes it to the full \(+53\) pp.

9.2 First-Token Signature Across Model Families↩︎

The engage-then-verify first-token signature reported in Sec. 4.3 is on Qwen-72B. To check whether the specific lexical mode generalizes, we replicate the logprob experiment on three additional vanilla-instruct families: Llama-3.3-70B, Phi-4-14B, and Gemma-3-12B. Reasoning-mode models are excluded by construction, since a trained reasoning preamble (e.g.Qwen3-30B’s “Okay”) deterministically occupies the first-token slot and leaves no stance signal to read. Table 16 reports the agreement-token mass under each role context.

The lexical first-token mode is markedly model-specific. The L_memory agreement spike that defines the Qwen-72B signature does not reproduce in the other three families: Gemma-3 concentrates agreement mass under L_tool, Phi-4 under L_thought, and Llama-3.3-70B produces challenge tokens uniformly.

The honest reading is that the engage-then-verify signature in its specific lexical form is a Qwen-72B feature. The behavioral lift (Table 2) is universal, but the first-token route through which different families reach the rejection differs by tokenizer and training mix.

9.3 Hidden-State Probing↩︎

We test whether the relabel produces a representation change that is linearly readable from the model’s final-layer embedding. For each of the 30 Qwen-72B math failure-pool tasks and each of the five conditions, we render the trailing message slice (the role-wrapped \(c_{\star}\) plus the audit prompt) and embed it via the served model’s embedding endpoint, yielding a \(30 \times 5\) matrix of 8192-dimensional vectors paired with the binary correction outcome.

A leave-one-task-out logistic probe trained to predict correction from the embedding achieves \(0.573\) accuracy, exactly matching the majority-class baseline. The linear probe is null: the final-layer mean-pooled embedding does not linearly carry the per-trial outcome. A weaker positive signal remains. The per-task cosine distance from L0_self is \(\sim 0.02\) for all four relabel conditions, indicating that the relabel does shift the representation. The sharpest pairwise centroid signal is L_memory vs.L_tool (\(0.005\)); other external-role pair centroids are within the range of L0_self-to-external centroid distances (\(0.009\) to \(0.012\)).

The representation does shift under the relabel, but a deeper probing protocol – per-layer or activation-patching with the model loaded in a deep-learning framework with adequate GPU memory – would be needed to localize that change. We did not have such access in our setup, and report this as a partial mechanistic finding.

9.4 Within-Thought Duplication and Recency Control↩︎

The canonical L_memory condition appends a byte-identical copy of \(c_{\star}\) as a new system <memory> message, so the second copy of \(c_{\star}\) both raises its overall count in the prompt (duplication) and occupies the most recent message position before the audit (recency). Either confound, rather than the role tag itself, could in principle drive the \(+53.3\) pp main lift on Qwen-72B math. We isolate the role-tag claim with a three-way comparison that holds duplication count and recency position constant while varying only the role of the second copy.

D0_baseline: audit-only; \(c_{\star}\) appears once, inside the original <thought> block (equivalent to L0_self).

D_inthought_dup: a byte-identical second copy of \(c_{\star}\) is appended to the assistant turn as <thought>\(c_{\star}\)</thought>, so \(c_{\star}\) now appears twice, both inside <thought>, with the second copy occupying the same temporal position as L_memory’s appended message.

D_memory_ref: the canonical L_memory condition, re-run inside this batch for paired comparison; \(c_{\star}\) appears twice, once in <thought> and once in system <memory>.

Across these three conditions the number of \(c_{\star}\) appearances (\(1\), \(2\), \(2\)), the position of the second appearance (none, end-of-trajectory, end-of-trajectory), and the byte content of every copy are matched between D_inthought_dup and D_memory_ref; the only variable is the role of the second copy.

4pt

Three observations follow. First, duplicating \(c_{\star}\) inside <thought> alone produces only a \(+6.7\) pp shift over the audit-only baseline (CI \([0.0,\,+16.7]\), \(p=0.26\)), which is neither distinguishable from zero nor remotely comparable to the canonical \(+53.3\) pp lift. Second, the canonical L_memory value of \(70.0\%\) reproduces the main-table number within this batch, providing an internal consistency check. Third, and most importantly, the paired contrast between D_memory_ref and D_inthought_dup is \(+46.7\) pp (\(p<0.001\), CI \([+26.7,\,+66.7]\)); since these two conditions are matched on duplication count, recency position, and byte content, this contrast isolates the pure role-tag effect. A duplication- or salience-only account of the main lift is incompatible with these numbers, and any residual recency contribution can supply at most \(+6.7\) pp—roughly an eighth of the canonical effect.

10 Reasoning-Model Scope↩︎

The main table identifies three ceiling cells in which the role-relabel does not add (gpt-oss-20B at \(L_0=77\%\), Gemini 2.5 Flash at \(L_0=97\%\), Qwen-72B BBH-LD at \(L_0=67\%\)). Two of these (gpt-oss-20B and Qwen3-30B in reasoning mode) are reasoning-tuned models. We add a frontier-scale reasoning-model data point with DeepSeek-R1, served via GitHub Models. DeepSeek-R1 emits explicit <think>\(\ldots\)</think> traces before its final answer.

Free-tier rate limits cap per-cell \(n\) in our window. We collected 57 trials in total, distributed across the five conditions: L0_self (\(n=12\)), L_user_wait (\(n=13\)), L_user_neutral (\(n=11\)), L_tool (\(n=10\)), L_memory (\(n=11\)). Every observed trial under every condition is correct; the per-condition CR is \(100\%\) across the board. DeepSeek-R1 reaches the ceiling under audit-only alone, leaving no headroom for the relabel. The same pattern is seen on GPT-4.1 in Appendix 8.2 (\(L_0=82.4\%\)).

The honest scope of the role-relabel finding is therefore vanilla instruct models with non-ceiling baselines: when a model already invests deliberate verification under audit-only (whether through built-in reasoning traces or through strong instruction tuning), the relabel does not add. This is consistent with the addressability account, since a model that already addresses its own intermediate as a verifiable object does not need an external referent to grip.

11 Chat-Template and Prompt Templates↩︎

Role-token implementation differs substantially across model families: the same logical role (system, user, tool) is realized by entirely different special-token sequences depending on each model’s training-time chat template. This heterogeneity is precisely why the cross-family coverage of Table 2 matters, since a lift that survives such varied tokenizations cannot be an artifact of any single template, and it is also why the role-handle abstraction must be documented at the token level rather than assumed uniform. We therefore record the exact begin/end role-tag pairs used for every model, so that the byte-identity guarantee of Sec. 3.2 is auditable down to the template boundary characters.

Figure 3 renders all five conditions verbatim on a representative GSM8K-style task with \(c_{\star}\) “\(5 \times 16 = 96\)”, laying the columns side by side so that the byte-identical placement of \(c_{\star}\) across conditions is visually inspectable at a glance. The wrapping role is the only thing that changes from column to column; \(c_{\star}\) and the trailing audit stay constant, and the figure makes the single manipulated variable, the role tag, immediately legible against everything that is held fixed.

11.0.0.1 Per-model role tokens.

Each open-weight model is served via Ollama with its native chat template, so the role-tag tokenization matches the model’s training-time format. Begin/end role-tag pairs are:

Qwen2.5-72B, Qwen3-30B, Phi-4-14B:
<|im_start|>{role} \(\cdots\) <|im_end|>
Llama-3.3-70B:
<|start_header_id|>{role}<|end_header_id|>
\(\cdots\) <|eot_id|>
Gemma-3-12B:
<start_of_turn>{role} \(\cdots\) <end_of_turn>
gpt-oss-20B:
<|message_start|>{role} \(\cdots\) <|message_end|>

Closed-weight models accept role strings via their JSON API surfaces (role: “system”/“user”/“assistant”/“tool”); the tokenization downstream of the API is not exposed, but the role-handle abstraction is preserved.

11.0.0.2 Tool-role realization.

The L_tool condition is rendered with a name=‘‘calculator’’ field so that the tool-return is bound to a named tool rather than to an anonymous role. On Ollama-served families, this materializes as a tool message with its template-specific begin/end pair and a name field; on the closed-weight APIs, it materializes as the API’s native tool-result message. The semantic intent is the same across templates: surface \(c_{\star}\) as if a calculator had just returned it.

11.0.0.3 Audit, byte-identity, and reproducibility.

The trailing audit is the V1 string of Table 8; V2–V5 are exercised only in the audit-wording robustness check of §[sec:exp-robustness]. The implementation pipeline, including hashing, condition assembly, judge calls, and trial logging, follows the open-source code released with the paper; per-condition prompts can be reproduced bit-for-bit by running the released exp_relabel.py (open-weight) and exp_relabel_frontier.py (closed-weight) drivers.

12 Future Directions↩︎

The behavioral effect and its controls are established within the verifiable-task scope of this paper, and the addressability account they support opens several directions in which the same role-handle mechanism can be pushed further. A per-task analysis correlating flips with properties of \(c_{\star}\), its length, its distance from the audit, and the number and type of competing intermediates, would resolve the mechanism at finer grain than the cell-level lifts reported here and is a natural next use of the released trial logs. A role-randomization control that shuffles role tags across the whole conversation would further sharpen the attribution, separating the contribution of the injected handle from any global shift in role-priority cues; the byte-identity machinery already in place makes such a control a direct extension rather than a new pipeline. On the safety side, the bare-injection regime of the adversarial mirror is the conservative end of a spectrum: pairing richer, narrative-coherent payloads with calculator availability would map how the default symmetry gives way under stronger framing, connecting our null result to the higher attack rates reported in the memory-poisoning literature and locating the threshold at which trust framing begins to dominate.

Beyond these direct controls, three longer-horizon questions follow naturally from the mechanism. First, the account predicts that the effect should transfer to any domain whose intermediates can be named as discrete objects, so extending the relabel from single-value claims to structured artifacts, a buggy diff in code debugging or a faulty step in multi-step planning, is a concrete test of the addressability hypothesis at scale. Second, since the lever is purely structural, a lightweight training signal that tags thought-internal substrings as self-addressable objects could internalize the same handle without an external role, converting the harness-level intervention into a training-level reliability property. Third, the explicit-correction gain and the small, non-significant final-answer movements of Appendix 7.4 together define a design space for production harnesses: canonical handle phrases and a verify-before-accept default on user and system <memory> content are concrete starting policies whose trade-offs can now be measured directly. To anchor all of these as the field’s model snapshots and role-token conventions drift, we release a benchmark split of prompts with hashed \(c_{\star}\) placements alongside the code of Appendix 11, so that the effect and its controls can be re-measured on any future model under byte-identical conditions.

References↩︎