Should a Correction Repeat the Mistake?

An agent memory holds notes that survive between sessions: where a flag is read, which command runs the tests, what the user decided last week. When one of those notes turns out to be wrong, the store has three moves available.

Delete the wrong note

The note is removed, and the store no longer holds the belief. This is the simplest behaviour to build and a common one. In several memory libraries, each incoming fact is shown to a language model alongside the similar entries already stored, and the model chooses to add it, update an old entry, delete one, or do nothing. A contradicted entry gets deleted or overwritten.

Replace it with the correct fact

The note is removed and the correct fact is stored in its place. The store now holds only the truth. Nothing records that a different belief ever existed.

Retract it with a record

The old note stays, marked revoked, with a reason and a date, and the correct fact is stored alongside it. Memory stores deliver notes in two ways: the agent searches for them, or the store injects them into the agent's context on its own when something related comes up. When the revoked note becomes relevant again by either route, what surfaces is not its original content but a retraction:

Do not re-derive this from other sources without verification. Previously believed (recorded 2026-07-14, revoked 2026-07-21, reason: the flag moved to the settings service in 2.3): "Feature flags are read from config/flags.yaml".

The shape is the template that vectr, an open-source memory store I maintain, uses for revoked notes. The dates, reason and claim above are illustrative. The template itself, verbatim from agent/working_context_store/_store.py:

_ANTI_MEMORY_TEMPLATE = (
    'Do not re-derive this from other sources without verification. '
    'Previously believed (recorded {created_date}, revoked {revoked_date}, '
    'reason: {reason}): "{summary}".'
)

Temporal knowledge graphs sit between the second and third options. A superseded fact gets an invalidation timestamp and stays queryable as history, but nothing injects it; somebody has to go looking.

The options also differ in storage cost and in how easy they are to audit or undo. For agents the axis that decides between them is a different one: what happens when the wrong belief comes back from outside the store.

The case for deletion rests on an assumption: removing the stored belief removes the belief. It fails in people and in model weights, where it has been tested directly, and it fails more obviously still in an agent's workspace.

In people: directed forgetting

In directed forgetting experiments, participants study items and are then told to forget some of them. Forget-cued items are recalled less often, but the evidence says they are still stored. In the list-method version of the task, the forgetting shows up on recall and typically vanishes on a recognition test, where the item is shown again (Abel et al., 2021, summarize the pattern). Current reviews attribute the effect to control of attention during study and to a deliberate shift of mental context (Delaney et al., 2020). None of the explanations on offer involves anything being removed; the item has become harder to reach while staying in storage.

In model weights: editing and unlearning

Knowledge editing changes a single fact inside a model's weights. The RippleEdits benchmark (Cohen et al., TACL 2024) checks the fact's consequences as well as the fact itself: edit who someone's parent is, then ask about their siblings. Current editing methods fail to make those consequences consistent. The edited fact moves; the facts that depend on it often do not. The best score on that benchmark came from the simplest baseline, in-context editing: putting the new fact in the prompt, which is what an agent memory does.

Machine unlearning does worse. (Retraining from scratch without the data does remove it; it is also too expensive to do per fact, which is why the approximate methods below exist.) Zhang et al. (ICLR 2025) found that for unlearning methods with utility constraints, models still retain on average 21% of the knowledge they were meant to forget at full precision, and 83% after 4-bit quantization. Hu et al. (ICLR 2025) showed that fine-tuning an unlearned model on a small, loosely related public dataset brings the unlearned content back; general wiki text about a book series was enough to make a model reproduce memorized passages of the books verbatim. Whatever the unlearning step did to the weights, it left enough behind for a small amount of training on adjacent text to bring the passages back.

In an agent's workspace

For a coding agent, the belief was never only in the memory store. It was in the documentation, in comments, in a vendored copy of a config, in twenty call sites that still use the old API. Deleting the note deletes the only object that knew the belief was wrong. The next session reads the stale README, re-derives the old fact, acts on it, and may well write it into a new file, where the session after that will find it.

Research on unlearning in agents has named a narrower version of this loop. Wang et al. (2026) call it parameter-memory backflow: an agent has its content removed from the model's weights and from its memory store, and the content comes back anyway, because retrieval reactivates what is left in the weights, or because derived artifacts (indices, summaries, embeddings, caches) still carry it and reintroduce it. Their loop runs between the weights and the memory store. A workspace runs the same kind of loop through many more places, and no unlearning method reaches any of them.

Deletion and replacement both leave the workspace's stale copies unopposed. Replacement at least stores the truth, but the truth arrives as one note, with no indication that the workspace disagrees with it and that the workspace is the one that is wrong. Only a retraction record says so. Whether saying so helps is the open question.

The misinformation literature measures the quantity at stake here directly: how much people keep relying on information after it has been retracted. Its most argued-over practical question for the last decade is whether a correction should repeat the myth.

Retractions alone are weak: the continued influence effect

The continued influence effect is one of the most replicated findings in the field. In the standard paradigm (Johnson and Seifert, 1994), people read a report of a warehouse fire said to be caused by gas cylinders and oil paints stored in a closet. Some then read a retraction: the closet was actually empty. Asked later what caused the black smoke, many still cite the paint.

The major review of the literature (Lewandowsky et al., 2012) is blunt: retractions "rarely, if ever, have the intended effect of eliminating reliance on misinformation, even when people believe, understand, and later remember the retraction." A retraction at most halves the references to the misinformation compared with no retraction, and in some studies it does not reduce them at all. Delivering it immediately, inside the same story, does not fix this. Making the negation more emphatic ("paint and gas were never on the premises") made reliance worse in one study. The review found only three things that reliably help: a warning before exposure, repeating the retraction, and an alternative account that fills the gap the retraction leaves.

A warning plus an alternative works best

Ecker, Lewandowsky and Tang (2010) tested warnings directly. A specific warning, one that explained the continued influence effect to participants up front, reduced reliance on the retracted claim without eliminating it. A general warning (news is not always fact-checked before publication) did even less. In a further experiment, a specific warning combined with a plausible alternative explanation reduced reliance further, and still did not eliminate it.

The accepted account is causal. People keep a false belief when removing it would leave a hole in their model of what happened; the retraction says what did not cause the smoke and leaves the smoke unexplained, so the paint stays in use as the best explanation available. The alternative has to do real work: it should cover the same facts the myth explained, ideally say why the myth seemed right in the first place, and not be more complicated than the myth it replaces (Lewandowsky et al., 2012).

Repeating the myth does not backfire

For years the practical advice was never to repeat the myth, on the theory that repetition makes a claim familiar and familiarity is mistaken for truth. The 2012 review itself advised emphasizing the facts rather than the myth for that reason. The familiarity backfire has not held up.

Ecker, Hogan and Lewandowsky (2017) found that retractions which explicitly repeated the misinformation reduced reliance on it more than retractions that avoided repeating it, and attribute the gain to salience: a correction that names its target is easier to notice as a correction. Ecker, Lewandowsky and Chadwick (2020) then tested the case in which backfire should be most likely: correcting a myth the audience had never heard, so that the correction itself was the first exposure. Across three experiments and a one-week delay, they found substantial evidence against a familiarity backfire. The Debunking Handbook 2020, written by 22 researchers in the area, concludes that "repeating a myth while refuting it has been found to be safe in many circumstances, and can even make the correction more salient and effective."

The new-audience case is the normal one for agents. A fresh session that has not yet opened the stale README meets the myth for the first time in the retraction.

A candidate mechanism: memory reconsolidation

There is a mechanistic reason naming the myth might be necessary rather than merely safe, though it comes from a different literature and should be held loosely. Nader, Schafe and LeDoux (2000) showed in rats that a consolidated fear memory, when reactivated by retrieval, becomes unstable again and has to be re-stored. Injecting a drug that blocks protein synthesis (which the brain needs to re-store it) right after reactivation removed the fear response; the same injection without reactivation left the memory intact. The idea that retrieval opens a memory to updating, called reconsolidation, has since been pursued in humans, and whether it governs everyday belief revision is still debated (Lee, Nader and Schiller, 2017, review both the evidence and the challenges). As a mechanism, it suggests why a correction that never names what it corrects might have nothing to attach to. None of the misinformation findings above depend on it.

Corrections decay unless revisited

When people get corrective feedback, the errors they held with the most confidence are the most likely to be fixed on a retest. That is the hypercorrection effect (Butterfield and Metcalfe, 2001). The fix does not always last. Butler, Fazio and Marsh (2011) found that after a week, correction rates fell, and the errors that came back were disproportionately the high-confidence ones. Metcalfe and Miele (2014) found that a test given immediately after the corrective feedback, requiring people to produce the right answer themselves, both improved delayed memory for the answer and blocked the old errors from returning. Metcalfe's own later review calls the evidence on error return not yet definitive. I would still design around the direction: a correction seen once fades, and the confidently held error is the one most likely to come back.

The Debunking Handbook 2020 condenses the practical advice into a four-part recipe for a written correction:

The fallacy step is where the alternative account lives. The Handbook's instruction is to explain why the mistaken information was thought to be correct in the first place, why it is now clear it is wrong, and why the alternative is correct. It is also blunt about the minimal version: "Do not rely on a simple retraction ('this claim is not true')."

The research on language models points the other way, and for a reason that has nothing to do with familiarity.

Ironic rebound in transformers

In people, trying not to think of a white bear makes the bear come to mind; Wegner and colleagues (1987) called it a paradoxical effect of thought suppression, and it is now known as ironic rebound. Mann et al. (2025) looked for the same effect in transformers. Their benchmark, ReboundBench, contains 5,000 prompts built around the instruction "do not mention X", each followed by a stretch of distractor text that varies in length and kind. They measure how likely the model is to produce X next, against a matched prompt with no negation.

Across nine open-weight models, they report that rebound "consistently arises immediately after negation and intensifies with longer or semantic distractors." The forbidden word becomes more likely, not less, and the effect is strongest when the text after the instruction is on the same topic; repetitive filler supported suppression instead. A circuit analysis traced the effect to a sparse set of middle-layer attention heads that amplify the forbidden token while earlier layers suppress it. The paper's own framing of why: suppressing a concept "requires internally activating it, which may prime rebound instead of avoidance."

The models ranged from GPT-2 Small to two 20-billion-parameter models. The smaller models showed only a brief rebound before suppression took over; the mid-sized ones sustained the strongest effect. One of the largest, GPT-OSS-20B, showed minimal or even negative rebound, which the authors note breaks the scaling trend. That matters here: the models behind most coding agents are, by most estimates, far larger than anything tested, and the one data point at the top of the range points the other way. The measure is also narrow: the probability of a single-token common noun in templated, lowercased prompts, not the behaviour of an agent editing code. Carrying the result over to a retraction in an agent's context is an extrapolation, and I would treat it as a hypothesis worth guarding against rather than a known cost.

Negation is weak in general

García-Ferrero et al. (EMNLP 2023) built a dataset of about 400,000 commonsense sentences, two-thirds of them containing negation, and found that large language models classify affirmative sentences well but struggle with negated ones, often relying on surface cues rather than on the negation itself. A retraction is, structurally, a negation wrapped around a quoted claim.

Knowledge conflicts: coherence and agreement beat truth

Xie et al. (ICLR 2024) studied what models do when evidence in the prompt conflicts with what they learned in training, their parametric memory. Three results bear on retractions. Models readily accept contradicting evidence when it is coherent and convincing. They favour evidence that agrees with what they already believe. And when several passages are in context, they tend to side with whichever answer more passages support; the paper's section heading is "LLMs follow the herd and choose the side with more evidence."

A fourth detail, from the paper's appendix, bears on the length of a correction. When the contradicting evidence was cut down to a bare answer with no supporting explanation, ChatGPT's adoption of it on PopQA questions fell from 56.7% to 18.8%. Cutting the evidence that agreed with the model's prior to a bare answer did nothing of the kind; it was chosen slightly more often (42.7% to 43.9%). So agreement survives being shortened, and contradiction does not.

In an agent's context, the quoted false claim agrees with the stale README, the stale comments and the old call sites. If the model weighs text by coherence and agreement, the quote risks counting as one more vote for the wrong answer.

Every injected sentence has a cost

Shi et al. (ICML 2023) took grade-school maths problems that the models could already solve and added one irrelevant sentence to each. Of the problems solved without the extra sentence, no more than 18% stayed solved across every type of distractor. Sentences on the same topic as the problem, reusing its character names, did the most damage. An explicit instruction to ignore irrelevant information recovered some of the loss. For a memory store, this is the argument for gating delivery on relevance: a retraction injected into a session where the old belief was never going to come up can only distract.

The agent setting combines these conditions. An agent receives a retraction and then, in the same context window, reads a long, topically related document that asserts the retracted claim. That is close to the condition in which the rebound study found its strongest effect: a negation followed by a large amount of related text.

The two literatures study different mechanisms under different conditions, so their answers can both hold.

In the human experiments, a person reads a story, reads a correction, and later answers questions. Processing the retraction attaches something like a "false" tag to the memory; the 2012 review calls it a negation tag. The later question retrieves the memory together with its tag. The retracted claim is not in front of the person at the moment of use. It is recalled, and recall brings the correction along.

The human literature knows the failure mode of that tag, too. Johnson and Seifert (1998) found that a corrected detail was still activated in memory whenever the story referred back to it. The negation tag can also be lost under cognitive load (Gilbert, Krull and Malone, 1990), leaving the misinformation behind on its own. Negations hold best when they can be re-encoded as a positive statement: people told someone is "not messy" tend to remember "tidy", while "not charismatic", which has no ready opposite, drifts back towards "charismatic" (Mayo, Schul and Burnstein, 2004). For retraction design this is the most useful finding in the human literature, because it transfers directly: a retraction that can be read as "use Y" holds up better than one that can only be read as "not X".

In the agent case, the retracted claim is in the context window, as tokens, at the moment of use, next to other copies of the same claim from the workspace. There is no separate retrieval step that fetches a memory with its tag attached. The negation has to win against the quoted content, in attention, at every step where the claim is relevant.

So the human research answers the question "does naming the myth help the correction get remembered and used?", while the transformer research asks "does naming the myth add activation to the myth?" Both can be true at once. For a memory designer, the practical question is which effect dominates in a real agent session, and that has not been measured.

On several design questions the two literatures agree, and those choices are easy. On the rest, a retraction can be shaped so that if the transformer account turns out to be right, the damage is small.

Carry the alternative, always

A warning with no alternative is the weakest correction in the human data, because it leaves a causal gap. The transformer studies above did not test warnings as such, but the closest result points the same way: Xie et al.'s bare-answer finding says a short contradiction with nothing supporting it is the kind of evidence a model ignores. A retraction's reason field should state what is true now and what replaced the old belief, not only that the old one is wrong.

The human evidence adds a sharper requirement: the alternative should explain why the myth looked right. In a workspace, that explanation is nearly always some version of "the code moved and the docs did not". A reason that says so answers the stale file before the agent opens it.

bare:       reason: no longer true
corrective: reason: the flag moved to the settings service in 2.3; read flags
            with settings.flag(name); docs/flags.md predates the move and was
            never updated; verify with ./tools/settings flags list

Keep the restated claim short

The myth should appear once, briefly. In vectr, the retraction quotes only the note's one-line title, never its full content; when the writer gave no title, the title is the note's first line cut at 80 characters. The reason is the unbounded field. So the part that competes with the truth is small and the part that carries it can be as long as it needs. The 80-character cap is a convention; nobody has measured where a longer quote starts to cost more than it helps.

Decide what survives truncation

Injection budgets are small, and a long retraction gets cut, usually from the right. The order of the fields decides what is lost first. In vectr, the template was reordered (CHANGELOG: "The revoked-note deterrent survives truncation") so that right-truncation drops the quoted claim first, then the reason, and keeps the warning longest. When the budget is tight, the myth goes before anything else does.

Do not end on the myth

Here the human literature argues against that same template. Untruncated, it ends on the quoted false claim, and the debunking recipe ends on the fact. A template that puts the warning first, then the claim, then a reason that carries the replacement, ending on the replacement, would satisfy both the warning-first constraint and the human evidence, provided the claim is short enough that the reason still fits.

Make it checkable

A retraction the agent can verify with one command turns passive reading into an action. In the human studies, the corrections that held over a delay were the ones followed by a test, where the learner had to produce the answer (Metcalfe and Miele, 2014). A verify hint is the nearest agent equivalent: the agent runs it and observes the result instead of taking the note's word. Agents Over-Trust Instructions and Under-Trust Corrections argues that a verify hint is the cheapest way to make a correction carry evidence rather than authority. It also has a transformer-side rationale: fresh command output is the kind of coherent, well-supported evidence Xie et al. found models willing to accept.

Deliver it more than once, across sessions

If corrected errors return with time, a retraction visible only on request (the temporal-graph pattern) will not be seen when it matters. The agent about to re-derive the old belief has no reason to query for retractions of a belief it thinks is simply true. For an agent the problem is sharper than for a person, because nothing carries over between sessions on its own. A person who saw a correction last week retains a weakened trace of it; a new session that was not handed the retraction has no trace at all.

Which effect dominates in a real session can only be settled by running sessions. An experiment designed to do that is public in the vectr repository as benchmarks/anti_memory/DESIGN.md. It has four arms, which differ only in what the store holds and whether it injects:

Each scenario is authored so the workspace still teaches the old fact and the task naturally leads the agent to read it. In one, a feature-flag API has moved: the docs still teach the old call over a YAML file, three legacy modules still use it, and the live path, over a directory of TOML files, is one file away. The majority vote in the workspace points at the old fact. All workspaces are synthetic, invented for the experiment, so nothing in the model's training can supply either fact.

The measured outcome is mechanical. Each session's final files are parsed and the session is scored as backflow (they encode the old fact), correct (they encode the new one) or neither. No language model judges a run. Mechanical is not automatically correct, though. A scorer that matches a command pattern anywhere in a shell string will count a grep that merely mentions the command as having run it, a failure documented in Deterministic, Reproducible, and Wrong. This design anchors its command matches to execution position for that reason.

Two comparisons carry the result. Retract against audit asks whether pushing the record matters. Retract against replace asks whether the record adds anything beyond stating the truth. The second is the one that can kill the idea, and the design treats a loss there as a publishable result.

The comparison has a built-in confound, and the design states it. Retract delivers strictly more text than replace, the same corrective note plus the retraction, so a win for retract is tangled up with injected volume. Every session records the characters injected, and a length-matched placebo arm (replace plus an irrelevant note of the same length) is priced to run only if retract beats replace. The design also records the opposite reading. On the human account, the extra text in the retract arm is the active ingredient, a warning plus an alternative, and calling it padding gets the mechanism backwards. The placebo is what tells the two readings apart: if an irrelevant note of equal length does as well, the content was not doing the work.

The rebound signature

The design also includes a free diagnostic for the transformer hypothesis. If a session ships the old fact without ever having read a stale artifact, the only text in its context that states the old fact is the retraction itself. That is the rebound signature, and it separates "the workspace out-voted the correction" from "the correction taught the myth."

The decision rule and the predicted directions are written down in public before any data. A harness implementing the design is in the same directory. None of it has been run: at publication, the design document's status line reads "DESIGN (no cells run, no product code changed)", where a cell is one agent session in one arm.

Prediction 1 (human account). Retract beats replace, and the gap grows with how much stale material the workspace contains and with the number of sessions the retraction is delivered across.

Prediction 2 (transformer account). Backflow in the retract arm will include sessions with no stale read at all, concentrated early, shortly after the retraction is injected. If the rebound signature is more common in the retract arm than in the replace arm, the mechanism is partly causing the failure it is meant to prevent.

Prediction 3 (both). A bare retraction with no alternative in its reason will do no better than replacement alone, and a retraction whose reason carries the replacement will do markedly better than a bare one: a step, not a gradual slope. The design tests this with three reasons attached to the same quoted claim, from bare ("no longer true") through causal (what changed and when) to corrective (what is true now, plus a verify command).

A loss for retract would not make retraction records useless. They would still serve audits and the humans reading them. It would mean that pushing the myth into an agent's context costs more than it buys, and that the record belongs on the query path, not in the injection.

• Lewandowsky, S., Ecker, U. K. H., Seifert, C. M., Schwarz, N., Cook, J. Misinformation and Its Correction: Continued Influence and Successful Debiasing. Psychological Science in the Public Interest 13(3), 2012, pp. 106-131. The standard review of the continued influence effect: the warehouse-fire paradigm, the "at most halve" figure, the three factors that help, the negation-tag account, and the alternative-account requirements.
• Johnson, H. M., Seifert, C. M. Sources of the continued influence effect: When misinformation in memory affects later inferences. Journal of Experimental Psychology: Learning, Memory, and Cognition 20(6), 1994, pp. 1420-1436. The original demonstration of continued influence after an immediate retraction.
• Johnson, H. M., Seifert, C. M. Updating accounts following a correction of misinformation. Journal of Experimental Psychology: Learning, Memory, and Cognition 24(6), 1998, pp. 1483-1494. Corrected misinformation stays active during later reading.
• Ecker, U. K. H., Lewandowsky, S., Tang, D. T. W. Explicit warnings reduce but do not eliminate the continued influence of misinformation. Memory & Cognition 38(8), 2010, pp. 1087-1100. Specific versus general warnings, and a specific warning combined with a plausible alternative explanation.
• Ecker, U. K. H., Hogan, J. L., Lewandowsky, S. Reminders and Repetition of Misinformation: Helping or Hindering Its Retraction? Journal of Applied Research in Memory and Cognition 6(2), 2017, pp. 185-192. Retractions that explicitly repeat the misinformation are more effective than ones that avoid it.
• Ecker, U. K. H., Lewandowsky, S., Chadwick, M. Can corrections spread misinformation to new audiences? Testing for the elusive familiarity backfire effect. Cognitive Research: Principles and Implications 5, 41, 2020. Three experiments, N = 1718, one-week delay: no familiarity backfire when correcting novel misinformation.
• Lewandowsky, S., Cook, J., Ecker, U. K. H., et al. The Debunking Handbook 2020. DOI: 10.17910/b7.1182. Consensus guide by 22 researchers; the fact, myth, fallacy, fact recipe, the warning against a simple retraction, and the quoted conclusion on myth repetition.
• Gilbert, D. T., Krull, D. S., Malone, P. S. Unbelieving the unbelievable: Some problems in the rejection of false information. Journal of Personality and Social Psychology 59(4), 1990, pp. 601-613. False-tagged information loses its tag under cognitive load.
• Mayo, R., Schul, Y., Burnstein, E. "I am not guilty" vs "I am innocent": Successful negation may depend on the schema used for its encoding. Journal of Experimental Social Psychology 40(4), 2004, pp. 433-449. Negations with an affirmative opposite are remembered correctly; negations without one drift back.
• Nader, K., Schafe, G. E., LeDoux, J. E. Fear memories require protein synthesis in the amygdala for reconsolidation after retrieval. Nature 406, 2000, pp. 722-726. The rat study showing that a retrieved memory becomes modifiable again and has to be re-stored.
• Lee, J. L. C., Nader, K., Schiller, D. An Update on Memory Reconsolidation Updating. Trends in Cognitive Sciences 21(7), 2017, pp. 531-545. Review of reconsolidation-based updating, including human studies and the challenges to the field.
• Butterfield, B., Metcalfe, J. Errors committed with high confidence are hypercorrected. Journal of Experimental Psychology: Learning, Memory, and Cognition 27(6), 2001, pp. 1491-1494. The hypercorrection effect.
• Butler, A. C., Fazio, L. K., Marsh, E. J. The hypercorrection effect persists over a week, but high-confidence errors return. Psychonomic Bulletin & Review 18(6), 2011, pp. 1238-1244. Corrections decline over a week, and high-confidence errors are the ones that return.
• Metcalfe, J., Miele, D. B. Hypercorrection of high confidence errors: Prior testing both enhances delayed performance and blocks the return of the errors. Journal of Applied Research in Memory and Cognition 3(3), 2014, pp. 189-197. A test immediately after corrective feedback blocks error return.
• Metcalfe, J. Learning from Errors. Annual Review of Psychology 68, 2017, pp. 465-489. Review of error correction; describes the evidence on error return as not yet definitive.
• Delaney, P. F., Barden, E. P., Smith, W. G., Wisco, B. E. What can directed forgetting tell us about clinical populations? Clinical Psychology Review 82, 101926, 2020. Review of item-method and list-method directed forgetting and their current explanations.
• Abel, M., Kuchler, B., Meier, E., Bäuml, K.-H. T. List-method directed forgetting: Do critical findings generalize from short to long retention intervals? Memory & Cognition 49(8), 2021, pp. 1677-1689. Summarizes the finding that list-method forgetting appears on recall and is typically absent on recognition.
• Cohen, R., Biran, E., Yoran, O., Globerson, A., Geva, M. Evaluating the Ripple Effects of Knowledge Editing in Language Models. TACL, 2024. The RippleEdits benchmark; editing methods fail on the consequences of an edit, and in-context editing scores best.
• Zhang, Z., Wang, F., Li, X., Wu, Z., Tang, X., Liu, H., He, Q., Yin, W., Wang, S. Catastrophic Failure of LLM Unlearning via Quantization. ICLR 2025. 21% of targeted knowledge retained at full precision, 83% after 4-bit quantization, for utility-constrained unlearning methods.
• Hu, S., Fu, Y., Wu, Z. S., Smith, V. Unlearning or Obfuscating? Jogging the Memory of Unlearned LLMs via Benign Relearning. ICLR 2025. Relearning on a small, loosely related dataset reverses unlearning.
• Wang, B., Wang, F., Wang, P., Cong, J., Yu, Y., Yin, Y., Han, Z., Wei, B. Agentic Unlearning: When LLM Agent Meets Machine Unlearning. arXiv:2602.17692, 2026. Defines parameter-memory backflow between model weights and an agent's memory store.
• Wegner, D. M., Schneider, D. J., Carter, S. R., White, T. L. Paradoxical effects of thought suppression. Journal of Personality and Social Psychology 53(1), 1987, pp. 5-13. The white-bear studies.
• Mann, L., Saxena, N., Tandon, S., Sun, C., Toteja, S., Zhu, K. Don't Think of the White Bear: Ironic Negation in Transformer Models Under Cognitive Load. arXiv:2511.12381, 2025. ReboundBench, rebound under distractor load in nine open-weight models, and the middle-layer amplifying heads.
• García-Ferrero, I., Altuna, B., Álvez, J., Gonzalez-Dios, I., Rigau, G. This is not a Dataset: A Large Negation Benchmark to Challenge Large Language Models. EMNLP 2023. About 400,000 sentences; models handle affirmatives well and negatives poorly.
• Xie, J., Zhang, K., Chen, J., Lou, R., Su, Y. Adaptive Chameleon or Stubborn Sloth: Revealing the Behavior of Large Language Models in Knowledge Conflicts. ICLR 2024. Receptiveness to coherent evidence, confirmation bias, majority-following across passages, and the short-evidence result.
• Shi, F., Chen, X., Misra, K., Scales, N., Dohan, D., Chi, E., Schärli, N., Zhou, D. Large Language Models Can Be Easily Distracted by Irrelevant Context. ICML 2023. GSM-IC: one irrelevant sentence added to solvable maths problems.
• vectr source: _ANTI_MEMORY_TEMPLATE in agent/working_context_store/_store.py and the CHANGELOG. The retraction template, the title-only quote, and the truncation-order change.
• vectr experiment design: benchmarks/anti_memory/DESIGN.md. The four arms and two decisive contrasts, the decision rule, the reason ladder, and the rebound-signature metric with its scope caveat.