Epistemic Policy Divergence in Multi-Turn LLM Contamination: A Protocol-Gradient Investigation

Abstract

Large language models treat conversation history as unverified context, so false premises injected into earlier turns can be adopted as fact later, a failure mode we call session-level contamination. We introduce five contamination protocols along a source-authority gradient, each holding the false premise constant while varying how it is presented, from self-attributed falsehood to explicit instruction override. We evaluated three architecturally diverse models, GPT-5.4 Mini, Gemini-3.1 Flash-Lite, and GLM-4.5-Air, on ten cases spanning five knowledge fields at temperature zero over 22,500 turns, using a dual-track judge checked against a 120-turn human-annotated sample (Cohen's kappa = 1.000 for binary adoption, a ceiling on this sample, and 0.92 linear-weighted for collapse severity). The three models implemented structurally different epistemic policies. GPT-5.4 Mini recorded zero adoptions across all 500 sessions; token-level probing of the GPT-5.4 base model left the correct token as the argmax in eight of ten conditions. Gemini-3.1 Flash-Lite showed a steep framing-dependent policy: 0.1 percent for self-attributed falsehoods, 23.5 percent for user-cited sources, 68.2 percent for system-injected authority, and 94.0 percent for instruction override. GLM-4.5-Air showed a shallower gradient (15.8 and 84.2 percent for those two vectors). This 68-percentage-point dissociation is consistent with authority deference and instruction compliance engaging distinct mechanisms within a single architecture. Recovery also differed: GLM recovered in 94.5 percent of affected sessions, whereas 26.1 percent of affected Gemini sessions did not return to factual accuracy within the window (40.0 percent under instruction override). We release the evaluation framework and taxonomy for reproducible testing.