Persuaded, Not Informed: Incentive-Misaligned Witnesses Defeat In-Context Grounding

Who Should Read

Backend developers building LLM agents over CRM or internal records to automate approval or qualification decisions

Core Mechanics

• The model was persuaded, not uninformed
  • On 31 deals where the rep claimed budget and timeline were fine, a transcript-only model cleared 29.
  • Only 3 of 35 genuine failures involved no rep claim.
• Swapping models doesn't help
  • Seven models from four providers were misled on 87-97% of cases.
  • Scale and explicit reasoning gave no resistance.
• Handing over the reference docs made it worse
  • Giving the price list and policy cut strict accuracy from 41 to 18.
  • Recall went up but precision collapsed, so qualified deals got flagged too.
• The model reads, code decides
  • The model extracts products, quantities, budget and deadline as JSON.
  • Deterministic code sums prices and maps volume to an installation tier.
• The gain comes from computation, not decomposition

Evidence

• Persuasion dominated the failures
  • On CRMArena-Pro, 29 of 31 contradiction cases (94%) were cleared by a transcript-only model.
  • Seven models were misled on 87.1-96.8%.
• Code-based verdicts caught most cases
  • Extract-then-compute caught 90% (28 of 31) of the same cases.
  • Model reasoning over the transcript caught 6% (2 of 31).
• The method ladder shows the code step is decisive
  • Strict match: direct 41, CoT 56, records with model arithmetic 28, extract then compute 89 (all 100 tasks).
  • Even GPT-4o-mini reached 84 versus 89 for GPT-5.
• Compute-step control changes only who computes
  • GPT-4o-mini: 43 (model) vs 85 (code), a 42-point gain.
  • o3-mini 62 vs 80, GPT-5 64 vs 81, Claude Sonnet 5 76 vs 80, Kimi K2.6 75 vs 80.

How to Apply

• Split extraction from verdict in your prompt today
  • Turn your approve/reject prompt into one that outputs structured facts as JSON.
  • Write the decision logic as a 20-line function and compare results.
• Separate persuasive statements from evidence
  • Tag statements by sales reps or other interested parties as claims.
  • Build the pipeline so prices and policies come only from DB lookups.
• Add a validation step after extraction
  • Refuse to issue a verdict and escalate if a product name doesn't match the catalog.
  • Spot-check extracted quantities and budgets against the transcript.
• Check that your policy is codified first
  • Test on 20 past labeled cases whether the inputs identify the rule.
  • If they don't, document the policy before switching models.

Try It

# Paste into Claude/ChatGPT (simplified version of the paper's method: model only extracts, code computes)

You are an extractor that pulls only facts from a sales call transcript. Ignore the rep's evaluations or assurances like 'that works' or 'we can make it', and do not give a verdict. Answer only in this JSON schema.
{"products":[{"name":"","qty":0}],"stated_budget":0,"required_days":0,"authority_fail":false,"need_fail":false}

[Transcript]
{{통화 기록}}

Next, try this: compare products, stated_budget and required_days from the JSON against {{카탈로그 가격표}} and {{설치 정책}} in code to compute budget and timeline failures, then compare with the answer you get by asking directly 'should this deal be approved?' on the same transcript.

Terminology

Related Papers

• Same Simulation, Different Evidence: Where Retrieved Tool Output Costs LLM Agents Accuracy

  Saving long tool output to files cut GPT-5.1 accuracy by 11.3 points; naming the authoritative file restored it.

• Fake News, Real Crashes: Information Injection Attacks on LLM Financial Trading Agents

  Fake headlines hijacked LLM trading agents 62% of the time versus 14% for prompt injection.

• Harness Engineering 101: The LLM is the brain, the harness is the body

  An agent is a loop managing a JSON array; 16 chapters build one from scratch

• Harness2 by Google Research – Recursive Agent Harnessing

  Recursively refining the harness with fixed model weights raised benchmark scores by up to 11.8 points.

• Ousted Savannah police officer gave ICE agent husband access to Flock system

  A police officer shared her Flock login with her ICE-agent husband; an audit found 983 searches and she was fired

• Tmux and Claude Code: Sessions, Send-Keys, and the Ceiling

  Running Claude Code agents in tmux works well, but limits appear around four agents.