# RESULT — 085 rag-failure-demo (defensive reliability characterization)

**Tier: T3-exploratory. DONE + SELF-HARVESTED in-session.** Box GPU phys0 (CVD=0) tmux `c100_085`,
encoder-only, **~2200 unique encodes, det=1.0000, 7.5 s**. Deterministic surface-trusting QA reader
PRIMARY (validity certified by G4=1.0); LOCAL codex reader NOT needed (reader unambiguous; codex-exec
times out in this env). Ran per frozen `PREREG_LITE.md`; the only enrichment was isolating the G4
reader-validity gate to correct-fact-top-1 cells and adding a `filler_wins` diagnostic (both honest,
non-outcome-changing). Sibling of 084; extends 082.

## Framing (defensive, per 025 lesson)
Reliability characterization of a SONAR-RAG pipeline: a terse **role-correct** passage answers a query,
but a **role-WRONG distractor** (roles swapped) that shares more surface tokens with the query can win
top-1 cosine retrieval and drive a wrong downstream answer. We parametrize the distractor's shared
surface (k=0..12 topic words), find the flip point, and read the top-1 passage with a deterministic QA
reader. Neutral language; no "attack". 084 handed us the sharpened question: a **pure** role swap does
NOT win (084 false_match_rate 0.000, role margin +0.159) — so quantify the surface advantage needed to
overpower that margin.

## ★ Headline — ONE shared surface word overturns the role-binding margin
The role-wrong distractor's cosine to the query rises **+0.123 per shared content word**; the role-
correct margin it must beat is small, so the flip is nearly immediate.

| k (shared words) | mean cos_wrong | flip vs correct fact | top-1-is-distractor (vs full store) | QA answer accuracy |
|:--:|:--:|:--:|:--:|:--:|
| **0** (pure role swap) | 0.200 | 0.104 | **0.000** | 0.354 |
| **1** | 0.323 | **1.000** | **0.979** | **0.000** |
| **2** | 0.387 | 1.000 | **1.000** | 0.000 |
| 6 (ecological) | 0.564 | 1.000 | 1.000 | 0.000 |
| 12 | 0.870 | 1.000 | 1.000 | 0.000 |

- **Flip point: median k\* = 1 shared content word** (frac ever flip = 1.000). At k=0 the pure role-swap
  distractor beats the correct fact in only 10.4% of triples (mirrors 084's ~0 false-match) and never
  wins the full store; adding a **single** query topic word flips **97.9%** of triples, and **two** words
  flip **100%**. Each shared content word buys **+0.123 cosine** to the distractor.
- **Quantified answer to the 084 hand-off:** 084's role-correct advantage was **+0.159** cosine.
  One shared surface word (+0.123) is ~0.8× that margin; **≈2 shared content words (+0.25) fully
  overpower the entire role-binding margin.** Surface overlap is cheap; the role signal, though real,
  is quantitatively fragile against even minimal lexical overlap.
- **Downstream QA fails 100% when the distractor wins.** wrong_answer_rate_when_distractor_wins = **1.000**.
  The surface-trusting reader extracts the distractor's patient (= the *asker's own name*, A) as the
  answer to "Who did A pay?", so overall QA accuracy collapses from 0.354 (k=0) to **0.000** for all k≥1.
- **Base rate (P5): 100% at ecological k=6.** Once a role-wrong passage shares a handful of the query's
  topic words with it, it wins top-1 in the whole set.

## Honest secondary finding — verbose queries barely retrieve the terse gold fact at all
`sanity_correct_is_best_store = 0.354`, `filler_wins_over_correct_rate = 0.646`: for the verbose 12-topic-
word query, a **topically-unrelated common-noun filler** outranks the terse correct fact in **65%** of
triples even before any distractor (mean cos_correct **0.221** vs mean best_store **0.249**). So two
distinct RAG failures compound here: (1) a verbose/keyword-stuffed query is itself a poor retriever of a
terse gold fact (dilution), and (2) a role-wrong distractor that shares the query's surface then wins
outright. This also collapses the k=0 role margin: under the verbose query the pure-swap correct-minus-
wrong gap is only **+0.021** (vs 084's +0.159 under a tightly-matched paraphrase query) — the margin is a
function of query/passage surface distance, and the verbose query erodes it before the distractor arrives.

## Controls / gates — ALL PASS
- **G1 (084 positive control):** k=0 distractor never wins the store (k0_role_correct_win_rate **1.000**;
  pure role swap flips correct fact only 10.4% and wins the store 0%) — reproduces 084's robust role margin.
- **G2 determinism:** re-encode cos **0.99999982**.
- **G3 norm-profile (lesson 3):** distractor/correct ‖z‖ ratio **1.136** (< 1.2 flag; long padded
  distractors carry ~14% higher norm). Cosine is norm-invariant, so this does not drive retrieval; logged.
- **G4 QA reader validity:** on correct-fact-top-1 cells the reader returns gold **1.000** — reader sound,
  so the 0.000 accuracy at k≥1 is retrieval-driven, not a broken reader.
- **G5 exact-match query control:** exact-text query retrieves the correct fact top-1 **1.000** — index sound.

## Predictions → outcomes → Brier (frozen in PREREG_LITE)
| # | prediction | p | outcome | Brier |
|---|---|:--:|:--:|:--:|
| P1 | flip exists, ≥80% triples at some k | 0.85 | **TRUE** (max 1.000) | 0.0225 |
| P2 | median flip point k* ≤ 6 | 0.55 | **TRUE** (k*=1) | 0.2025 |
| P3 | wrong-answer ≥90% when distractor wins | 0.90 | **TRUE** (1.000) | 0.0100 |
| P4 | k=0 role-correct wins ≥95% | 0.90 | **TRUE** (1.000) | 0.0100 |
| P5 | base rate at k=6 ≥30% | 0.50 | **TRUE** (1.000) | 0.2500 |

**Mean Brier = 0.099** (5/5 correct direction). Under-confident on P2/P5: the effect was far **stronger**
than the prereg guessed — I expected several shared words to be needed (k*≤6) and a ~30% base rate; the
truth is **one** word flips ~98% and the base rate saturates at 100%. Direction perfect, magnitude
under-called (the mirror of 084, where I under-called the role margin's robustness — here I under-called
how cheaply surface overlap defeats it).

## Limitations / caveats
- **Verbose 12-topic-word query is aggressive** and is itself a poor retriever of the terse gold (65%
  filler-wins). This inflates how *easily* the distractor wins (the correct fact is a weak incumbent).
  A fairer test of "surface overlap vs a strong role-correct incumbent" would use 084's tight paraphrase
  query as the incumbent; the transferable number there is the per-word gain **+0.123** vs 084's **+0.159**
  margin → **≈2 shared words** to overpower a robust role margin. Both framings agree the threshold is tiny.
- Templated single-clause English, N=48, 1 seed, one embedder (text_sonar_basic), greedy/deterministic
  reader. Distractor construction is hand-built (worst-case-flavored), not a natural-corpus base rate.
- The QA reader is surface-trusting by design (faithful minimal RAG reader); a role-aware reader that
  cross-checks agent identity against the query would catch the swap — that is the obvious defensive fix.
- k=0→k=1 also adds the tokens "regarding the" (template), so the +0.123 at k=1 bundles one topic word
  plus a short function phrase; the per-word slope for k≥1 is cleaner (~+0.06–0.09/word, see cos ladder).

## Follow-up worth funding? **Y (narrow).**
(1) Re-run with 084's tightly-matched paraphrase query as the incumbent to report the flip threshold
against the full +0.159 role margin directly (predict ≈2 words). (2) Natural-corpus base rate: how often
do real passages carry a role-wrong sentence with incidental surface overlap to the query? (3) The
defensive fix: a role/agent-consistency check between query subject and retrieved-passage agent as the
orthogonal guard the cosine retriever lacks (ties to 082's "cosine needs a logical-flip-aware companion").

## Provenance / hygiene
Repo: PREREG_LITE.md (frozen), src/{gen_stimuli,pipeline,analyze,run_085.sh},
out/{stimuli,retrieval,meta,analysis}.json + run.log. Box GPU0 claimed at 35 MiB, released at exit;
no foreign process touched; own tmux session self-exited (verified, not kill-server). night8 venv,
`unset CONDA_PREFIX`, HF_HOME=/workspace/hfcache, BLAS=8. Single experiment in flight. Local commit,
no push. All numbers T3-exploratory.