Your Prompt-Composed Agent Is Lying to You — Silently

You edited one prompt module. You didn’t touch the others. Somehow, the whole system shifted. You didn’t notice because nothing broke — not exactly. This paper names that phenomenon, measures it, and tells you your QA process can’t catch it.

What happened

Lin and Liu formalize a failure mode they call compositional behavioral leakage (CBL): when you concatenate multiple prompt modules into a single context window, editing one module silently warps the behavior of the others — even when there is zero shared variable or code dependency between them. The mechanism isn’t subtle: transformer self-attention has no formal isolation boundary between concatenated text blocks, so every token can influence every other token. To measure this, the authors built a three-channel perturbation protocol (volume, content, and form) and ran it against a deployed job-evaluation agentic workflow on Claude Sonnet 4.6 across 144 trials. Only the content channel produced a statistically detectable effect — Cohen’s d = 0.63, with a bootstrap 95% CI excluding zero. Critically, no individual recommendation flipped; the interference lived below the threshold that standard QA would ever flag, yet it compounds silently across thousands of automated decisions. The authors explicitly note CBL is orthogonal to the failure modes operators already worry about: prompt injection, multi-agent orchestration faults, privacy leakage — it’s a different beast entirely.

Cold read

144 trials on a single deployed agent running a single model (Claude Sonnet 4.6) is a thin empirical base to be establishing a “system-class characterization.” A Cohen’s d of 0.63 is a medium effect — real, but the fact that zero recommendations flipped means the practical magnitude of the distortion is unknown and possibly trivial for most use cases. The paper’s own framing does the heavy lifting here: “compounding across thousands of decisions” is a plausible story, not a demonstrated one — no longitudinal data is presented. The three-channel protocol is positioned as reusable, but it was designed and validated on one task type (job evaluation); whether it generalizes to, say, a RAG-backed customer support agent or a code-review pipeline is an open question the abstract does not answer. Finally, the authors acknowledge CBL is a “sub-threshold regime” — which is another way of saying: we found it by specifically looking for it with a controlled protocol, not by catching it in the wild.

What it means for you

• Signal maturity: 2/5 — real phenomenon, one model, one task, no flip events observed
• Who gets hurt: Any team running a prompt-engineered multi-module agent in production — HR tech, legal review, finance underwriting; anywhere biased drift at scale is a compliance or liability event
• What breaks if this is true: Your modular prompt architecture isn’t modular. Every A/B test on an individual prompt module is confounded; you cannot isolate changes the way your engineering process assumes you can
• Why it might not land: No recommendation flipped in 144 trials. If the behavioral shift never crosses a decision boundary, “compounding drift” is a theoretical concern, not a business one — and most operators will rationally ignore sub-threshold effects until a regulator forces them not to
• Watch for: A replication of the CBL protocol on a second model family (GPT-4o class or Gemini) with a higher trial count; if the content-channel effect holds and d stays above 0.5, the finding gets serious legs

Forecast as of 2026-06-27

By Q2 2027, at least one major agent evaluation framework (e.g., LangSmith, Braintrust, or a comparable tool) will ship a CBL-style cross-module interference test as a named, documented eval — driven by enterprise compliance demand rather than academic adoption of this specific paper.

Source: Instruction Bleed: Cross-Module Interference in Prompt-Composed Agentic Systems — Ching-Yu Lin, Yifan Liu. https://arxiv.org/abs/2606.26356v1