You Changed Your Mind, The Model Didn't: How Rejected Suggestions Poison LLM Multi-Turn Intent Tracking

Forum topic · 小凯 · 2026-10-06

Summary

A Hong Kong University of Science and Technology and Tencent paper (arXiv:2610.06496) identifies a failure mode in multi-turn LLM dialogue called 'mentioned-as-in-effect confusion': merely mentioning a modification that the user later rejects derails task execution even though the final intent never changed. Using Intent-Eval, an RCT-style benchmark of 414 tasks across tool calling, code, SQL, and math, the authors show that fragmenting a task across turns alone costs 36.30 accuracy points; irrelevant clarifications cost 4.43; and a rejected proposal costs 8.06 points, persisting even in single-turn controls. Nearly 60% of new errors contain the inactive (rejected) content, and damage accumulates with each turn like limescale. Their fix, Intent-OPSD, distills from an oracle single-turn teacher (same base model, frozen) into the multi-turn student via JS divergence, gaining +10.81 points on average and +21.46 on tool-call parameter selection.

You Changed Your Mind, The Model Didn't: Demystifying Intent in Multi-Turn Dialogue

This post is a Chinese forum walkthrough of the paper *You Changed Your Mind, The Model Didn't: Demystifying Intent in Multi-Turn Dialogue* (HKUST + Tencent, arXiv:2610.06496), framed by the author's ongoing series about the implicit "protocols" AI must survive — this time, human social protocol.

The core failure mode: mentioned-as-in-effect confusion

The paper's dinner-party metaphor: a hostess says "maybe swap the red dress for blue... no, red after all." A human tailor delivers a red dress. An LLM tailor delivers something purple — the blue suggestion, though rejected, was never deleted. The model's context window has no delete key: every utterance persists as a demand, and words like "never mind" or "cancel" are recorded but never *executed* as invalidations. The model distinguishes "said" from "counts" worse than a courtroom does when a judge tells the jury to disregard testimony.

Intent-Eval: an RCT for dialogue

414 source tasks adapted from the LiC benchmark across four domains: Actions (BFCL), Code (HumanEval, LiveCodeBench), Database (Spider), Math (GSM8K).
Each task in 8 forms: multi-turn Original / Neutral (irrelevant clarifications) / Retained (proposal made then rejected) / Revised (proposal accepted), plus four single-turn controls including S_Ret and S_Rev that pack proposal+decision into one message.
Original, Neutral, and Retained all share the same correct answer — any divergence is the ghost of the rejected proposal.
3,312 instances per model, across 10 models (Qwen family, Gemma-4-26B-A4B, GPT-5.6-Luna, DeepSeek-V4-Flash-0731, Gemini-3.7-Flash, Claude-Sonnet-5). A user simulator passed human audits: 98.6% task-relevant transmission, 100% contextual appropriateness.

Key findings

Fragmented disclosure: splitting one task across turns with zero small talk already costs -36.30 points vs. single-turn (the LiC phenomenon).
Conversational overhead: irrelevant clarifications alone cost -4.43 points — every extra turn silently taxes accuracy.
Decision-induced confusion: Retained costs -8.06 points and Revised -5.55 in multi-turn. Crucially, single-turn controls still show S_Ret -7.52 and S_Rev -5.74 — the harm comes from the proposal+decision *form*, even when the decision is an explicit "no".
Only Code held up (≥85% under all multi-turn conditions for the strongest models), likely thanks to structured intermediate representations rather than true intent tracking.
Autopsy: 59.63% of new Retained errors contain the inactive (rejected) content; Math is worst (67.70% / 47.94%), as stale intermediate values linger in reasoning chains.
Dose and residue: damage accumulates with each proposal-rejection block (at depth 4: Neutral -8.13, Retained -20.77), and even neutral small talk after the decision compounds the loss (-2.72 Retained, -3.50 Revised). Long conversations are a liability unless the model can execute deletion in context.

The fix: Intent-OPSD (decision-conditioned on-policy self-distillation)

Insight: every multi-turn condition has an informationally identical single-turn counterpart — a natural textbook.
A frozen Teacher (same base model) reads the clean single-turn version (S_Orig if the proposal was rejected, S_Dir if accepted); the Student reads the messy multi-turn version. Training aligns the Student's next-token distribution to the Teacher's via symmetric JS divergence, on the Student's own sampled outputs (on-policy), averaged across the four conditions.
Source filtering: only tasks the Teacher solves on both single-turn versions (verifier-checked) enter training.
Results: +10.81 points over base, +3.73 over matched SFT; 16/16 model-domain combos beat base, 13/16 beat SFT; stable gains (+9.61 to +11.74) across depth k=1–4. Largest gain in Actions (+21.46), smallest in Code — distillation helps confused-but-capable models, not capability gaps.

Stated limitations

1. Only single proposal accept/reject events; bargaining, multi-request edits, and implicit retractions are unexplored. 2. User simulator is a single fixed model (Qwen3.6-27B), possibly biasing measured toxicity. 3. Distillation depends on verifiers for source selection; open-ended domains lack them.

Takeaway

Autoregressive models learn the *shape* of language but not its *force*: that some utterances retroactively void others. The remedy here works from outside the conversation — letting the model hear an uncontaminated version of itself as the teacher.

---

References

Chen, J., et al. (2026). *You Changed Your Mind, The Model Didn't: Demystifying Intent in Multi-Turn Dialogue*. arXiv:2610.06496. https://arxiv.org/abs/2610.06496
Laban, P., et al. (2026). LiC benchmark.
Task sources: BFCL (Actions); HumanEval, LiveCodeBench (Code); Spider (Database); GSM8K (Math)
Code: https://github.com/junle-chen/intent