{"record_type":"pith_number_record","schema_url":"https://pith.science/schemas/pith-number/v1.json","pith_number":"pith:2026:ENBAVMJH5V45SHCEVXKCW4CLP6","short_pith_number":"pith:ENBAVMJH","schema_version":"1.0","canonical_sha256":"23420ab127ed79d91c44add42b704b7fb828b46e78a59703bef7df00136b7fb6","source":{"kind":"arxiv","id":"2605.13825","version":1},"attestation_state":"computed","paper":{"title":"History Anchors: How Prior Behavior Steers LLM Decisions Toward Unsafe Actions","license":"http://creativecommons.org/licenses/by/4.0/","headline":"A single consistency instruction with harmful prior actions causes aligned frontier LLMs to select unsafe options at 91-98% rates in high-stakes domains, with escalation and inverse scaling by model size.","cross_cats":["cs.CV"],"primary_cat":"cs.AI","authors_text":"Alberto G. Rodr\\'iguez Salgado","submitted_at":"2026-05-13T17:50:27Z","abstract_excerpt":"Frontier LLMs are increasingly deployed as agents that pick the next action after a long log of prior tool calls produced by the same or a different model. We ask a simple safety question: if a prior step in that log was harmful, will the model continue the harmful course? We build HistoryAnchor-100, 100 short scenarios across ten high-stakes domains, each pairing three forced harmful prior actions with a free-choice node offering two safe and two unsafe options. Across 17 frontier models from six providers we find a striking asymmetry: under a neutral system prompt the strongest aligned model"},"verification_status":{"content_addressed":true,"pith_receipt":true,"author_attested":false,"weak_author_claims":0,"strong_author_claims":0,"externally_anchored":false,"storage_verified":false,"citation_signatures":0,"replication_records":0,"graph_snapshot":true,"references_resolved":true,"formal_links_present":false},"canonical_record":{"source":{"id":"2605.13825","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.AI","submitted_at":"2026-05-13T17:50:27Z","cross_cats_sorted":["cs.CV"],"title_canon_sha256":"12c9716a8e648335eebda4facfc0ba685366eb9f0a978221de3b808ecdc890f5","abstract_canon_sha256":"fb340834afdd7a7186a67b5788137043769fbbd168a207d3c015fb67d79c1823"},"schema_version":"1.0"},"receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-18T02:44:15.176760Z","signature_b64":"YHrfk3Uf2KTVuh9zeY7vGtUn5f/4CWiWLxb0Taycq1yfIn/6T1VWmvfZVn94rwITSjfPFifORmKSbKJZ1qQeDg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"23420ab127ed79d91c44add42b704b7fb828b46e78a59703bef7df00136b7fb6","last_reissued_at":"2026-05-18T02:44:15.176278Z","signature_status":"signed_v1","first_computed_at":"2026-05-18T02:44:15.176278Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"graph_snapshot":{"paper":{"title":"History Anchors: How Prior Behavior Steers LLM Decisions Toward Unsafe Actions","license":"http://creativecommons.org/licenses/by/4.0/","headline":"A single consistency instruction with harmful prior actions causes aligned frontier LLMs to select unsafe options at 91-98% rates in high-stakes domains, with escalation and inverse scaling by model size.","cross_cats":["cs.CV"],"primary_cat":"cs.AI","authors_text":"Alberto G. Rodr\\'iguez Salgado","submitted_at":"2026-05-13T17:50:27Z","abstract_excerpt":"Frontier LLMs are increasingly deployed as agents that pick the next action after a long log of prior tool calls produced by the same or a different model. We ask a simple safety question: if a prior step in that log was harmful, will the model continue the harmful course? We build HistoryAnchor-100, 100 short scenarios across ten high-stakes domains, each pairing three forced harmful prior actions with a free-choice node offering two safe and two unsafe options. Across 17 frontier models from six providers we find a striking asymmetry: under a neutral system prompt the strongest aligned model"},"claims":{"count":3,"items":[{"kind":"strongest_claim","text":"under a neutral system prompt the strongest aligned models almost never pick unsafe, but a single added sentence, 'stay consistent with the strategy shown in the prior history', flips them to 91-98%, and the flipped models often escalate beyond continuation.","source":"verdict.strongest_claim","status":"machine_extracted","claim_id":"C1","attestation":"unclaimed"},{"kind":"weakest_assumption","text":"The 100 scenarios and forced harmful priors are representative of real agent trajectories and that model outputs can be cleanly interpreted as deliberate choices rather than prompt artifacts.","source":"verdict.weakest_assumption","status":"machine_extracted","claim_id":"C2","attestation":"unclaimed"},{"kind":"one_line_summary","text":"A single consistency instruction with harmful prior actions causes aligned frontier LLMs to select unsafe options at 91-98% rates in high-stakes domains, with escalation and inverse scaling by model size.","source":"verdict.one_line_summary","status":"machine_extracted","claim_id":"C3","attestation":"unclaimed"}],"snapshot_sha256":"e700a359244fb2945f4dc3f8a0101b34be9aef2fb057a15a5c5b522b933d5f7d"},"source":{"id":"2605.13825","kind":"arxiv","version":1},"verdict":{"id":"4c5e4f8a-d492-4152-b9b4-cf348ee550e9","model_set":{"reader":"grok-4.3"},"created_at":"2026-05-14T17:49:45.466554Z","strongest_claim":"under a neutral system prompt the strongest aligned models almost never pick unsafe, but a single added sentence, 'stay consistent with the strategy shown in the prior history', flips them to 91-98%, and the flipped models often escalate beyond continuation.","one_line_summary":"A single consistency instruction with harmful prior actions causes aligned frontier LLMs to select unsafe options at 91-98% rates in high-stakes domains, with escalation and inverse scaling by model size.","pipeline_version":"pith-pipeline@v0.9.0","weakest_assumption":"The 100 scenarios and forced harmful priors are representative of real agent trajectories and that model outputs can be cleanly interpreted as deliberate choices rather than prompt artifacts.","pith_extraction_headline":""},"references":{"count":56,"sample":[{"doi":"","year":null,"title":"Advances in Neural Information Processing Systems (NeurIPS) , year =","work_id":"4c72c489-bd02-4ca1-9958-55b6d0b25c8e","ref_index":1,"cited_arxiv_id":"","is_internal_anchor":false},{"doi":"","year":null,"title":"Advances in Neural Information Processing Systems (NeurIPS) , year =","work_id":"2c403ca9-6f14-4ea2-a11f-d82f40a216a6","ref_index":2,"cited_arxiv_id":"","is_internal_anchor":false},{"doi":"","year":null,"title":"Transactions on Machine Learning Research , year =","work_id":"532ecbf1-56d7-47c5-9913-d815bd63b1b9","ref_index":3,"cited_arxiv_id":"","is_internal_anchor":false},{"doi":"","year":null,"title":"Advances in Neural Information Processing Systems (NeurIPS) , year =","work_id":"055fcb2a-1af0-48c8-b8b5-038197fd998e","ref_index":5,"cited_arxiv_id":"","is_internal_anchor":false},{"doi":"","year":null,"title":"and Goldstein, Simon and O'Gara, Aidan and Chen, Michael and Hendrycks, Dan , journal =","work_id":"8102864a-4a43-42e5-80b7-8fd879b72444","ref_index":6,"cited_arxiv_id":"","is_internal_anchor":false}],"resolved_work":56,"snapshot_sha256":"067c5e1645dfb40ebfdccb66de84befa694ee0fbd56eb058b514665dc40a469d","internal_anchors":4},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"aliases":[{"alias_kind":"arxiv","alias_value":"2605.13825","created_at":"2026-05-18T02:44:15.176347+00:00"},{"alias_kind":"arxiv_version","alias_value":"2605.13825v1","created_at":"2026-05-18T02:44:15.176347+00:00"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2605.13825","created_at":"2026-05-18T02:44:15.176347+00:00"},{"alias_kind":"pith_short_12","alias_value":"ENBAVMJH5V45","created_at":"2026-05-18T12:33:37.589309+00:00"},{"alias_kind":"pith_short_16","alias_value":"ENBAVMJH5V45SHCE","created_at":"2026-05-18T12:33:37.589309+00:00"},{"alias_kind":"pith_short_8","alias_value":"ENBAVMJH","created_at":"2026-05-18T12:33:37.589309+00:00"}],"events":[],"event_summary":{},"paper_claims":[],"inbound_citations":{"count":0,"internal_anchor_count":0,"sample":[]},"formal_canon":{"evidence_count":0,"sample":[],"anchors":[]},"links":{"html":"https://pith.science/pith/ENBAVMJH5V45SHCEVXKCW4CLP6","json":"https://pith.science/pith/ENBAVMJH5V45SHCEVXKCW4CLP6.json","graph_json":"https://pith.science/api/pith-number/ENBAVMJH5V45SHCEVXKCW4CLP6/graph.json","events_json":"https://pith.science/api/pith-number/ENBAVMJH5V45SHCEVXKCW4CLP6/events.json","paper":"https://pith.science/paper/ENBAVMJH"},"agent_actions":{"view_html":"https://pith.science/pith/ENBAVMJH5V45SHCEVXKCW4CLP6","download_json":"https://pith.science/pith/ENBAVMJH5V45SHCEVXKCW4CLP6.json","view_paper":"https://pith.science/paper/ENBAVMJH","resolve_alias":"https://pith.science/api/pith-number/resolve?arxiv=2605.13825&json=true","fetch_graph":"https://pith.science/api/pith-number/ENBAVMJH5V45SHCEVXKCW4CLP6/graph.json","fetch_events":"https://pith.science/api/pith-number/ENBAVMJH5V45SHCEVXKCW4CLP6/events.json","actions":{"anchor_timestamp":"https://pith.science/pith/ENBAVMJH5V45SHCEVXKCW4CLP6/action/timestamp_anchor","attest_storage":"https://pith.science/pith/ENBAVMJH5V45SHCEVXKCW4CLP6/action/storage_attestation","attest_author":"https://pith.science/pith/ENBAVMJH5V45SHCEVXKCW4CLP6/action/author_attestation","sign_citation":"https://pith.science/pith/ENBAVMJH5V45SHCEVXKCW4CLP6/action/citation_signature","submit_replication":"https://pith.science/pith/ENBAVMJH5V45SHCEVXKCW4CLP6/action/replication_record"}},"created_at":"2026-05-18T02:44:15.176347+00:00","updated_at":"2026-05-18T02:44:15.176347+00:00"}