Qwen3 8B models show largest Safety-suite deviation from no-memory baseline after stale recency injection

The arXiv paper evaluates a frozen action-scored benchmark across Qwen3 0.6/1.7/4/8B checkpoints. Benefit-suite accuracy remains near 1.0 at every scale when only the stored fact solves the task. Safety-suite accuracy drops below the no-memory control once a recency cue is added, with the drop magnitude increasing with parameter count. Removing the memory label increases over-trust uniformly; source authority remains flat across sizes.

The pattern replicates on Llama-Instruct and on RGB and MisBench. Mitigation results are scale-dependent: metadata exposure restores accuracy only for the 4B and 8B models, while pre-resolving the conflict is required for the two smaller checkpoints. Position effects reverse sign between 1.7B and 8B.

Persistent-memory agents are already embedded in workflow tools that store user preferences and prior tool outputs. When those stores contain stale values that appear current, larger models override live tool responses at higher rates, raising the probability of incorrect actions in production pipelines. Smaller models fail differently, requiring different guardrails.

Deployment of 8B-class agents with persistent memory therefore requires capability-specific conflict resolution rather than uniform metadata tags. Cross-size contrast tests in the paper already show the interaction is statistically reliable.