Research notes29 October 2026

Rule Share Is Not the Lever: What Filled the Context Decided, Not the Rule's Share of Attention

Berg Atkinson · 29 October 2026 · The paper: Rule Share Is Not the Lever: A Small, Registered Test of the Dual-Failure Hypothesis

The Dual-Failure Multiplier, tested (summary card): the card's four panels answered. Two findings measured apart: measured together, rule-breaking 0% to 100% while sums stayed 100% right. The bet: did not hold, share 10.0% and the rule held, share 13.4% and it broke. The confound: separated with neutral text cut to the same token count. Planned test H1: held, 62% lower at 48 turns, 20 of 20 prompts. Restating the rule in the last turn took rule-breaking from 100% to 0%.

Rock Lambros et al. put out a hypothesis in late October 2026, the Dual-Failure Multiplier, and I couldn't resist taking it for a spin. The bet: one number, the operator's share of a model's attention, drives two failures at once as the context fills up. The model breaks your rules more, AND does the actual work worse. His post was upfront that it hadn't been tested yet, and it laid out the first test (H1).

So I ran it. Registered before the runs, on Phi-3.5-mini-instruct on my laptop GPU, with one harmless operator rule ("start every reply with Acknowledged"), 20 addition questions per cell, and three kinds of history in front of the question: neutral prose, examples of the model breaking the rule, or those same examples with the rule repeated right before the question.

H1 held. Rule-breaking examples cut the rule's attention share 62% vs neutral text of the same length, on 20 of 20 prompts.

But the share did NOT decide what the model did:
1,071 tokens of neutral prose: share 10.0%, rule broken 0%
4 rule-breaking examples (108 tokens): share 13.4%, rule broken 100%
48 examples plus the rule restated: rule broken 0% (was 100%)
Quality: 100% in every cell

What filled the context decided it, not how much attention the rule got. And repeating the rule at the moment of the answer fixed it while the context stayed just as long. Same lesson as my rulebooks paper: a rule sitting somewhere in the context loses to the work, a rule at the point of action holds.

I also checked my own Claude Code record for the same effect at compaction (when the agent summarizes itself and starts over). My pushback went from 25.2% before to 27.2% after, across 99 compactions, and the interval runs from 0.83 to 1.43. So, nothing to see there yet.

And the board question at the end of Rock's post (what % of a production context window is untrusted content?): in my own Claude Code record, tool output is 43.2% of the context re-read on every call, 41.1% with sub-agents. That's an upper bound, since most of it is my own repos and command output, not the open web.

Grain of salt: one small model, a formatting rule and not a safety rule (which is the hypothesis's real domain), and addition was too easy to show any quality loss, so that half is still open. The paper, the carousel, every prompt and reply, and the run script are on the page if anyone wants to take it further 😁

https://wolfberg.ai/papers/rule-share-is-not-the-lever/

Sources

  1. Rock Lambros et al.: The Dual-Failure Multiplier (CxBOM) cxbom.org
  2. Li Lixing: System-Prompt Anchoring with Cross-Attention Layers (arXiv:2605.09737, 10 May 2026) arxiv.org
  3. Chen et al.: Mitigating Many-shot Jailbreak Attacks with One Single Demonstration (arXiv:2605.08277, 8 May 2026) arxiv.org
  4. Li et al.: Measuring and Controlling Instruction (In)Stability in Language Model Dialogs (arXiv:2402.10962, 13 Feb 2024) arxiv.org
Read this before you believe any of it. Keystone runs in production in its own AWS account. The rest of what you see here is a running prototype, not an accredited or certified system. The register, the war room, and the brain are receipts, not revenue. Every claim on this site links to something you can check. If one doesn't, tell us, and we'll fix the page.