Deletion Sensitivity Is a Property of the Model: A Three-Condition Measurement across Seven Open Reasoning Models

Deletion Sensitivity Is a Property of the Model: A Three-Condition Measurement across Seven Open Reasoning Models Hanzhang Jiaa , Liheng Zenga , Zhiyu Yangc , Yi Gaod and Bo Mab,∗ a University of Sussex, Brighton, United Kingdom b Zhejiang Gongshang University, Hangzhou, China c Chang’an University, Xi’an, China

arXiv:2611.13223v1 [cs.CL] 9 Nov 2026

d Shanghai Shuyuan Information Technology Co., Ltd., Shanghai, China

ARTICLE INFO

ABSTRACT

Keywords: Chain-of-thought Large language models Multi-turn tool calling Model evaluation LLM serving

Reasoning models write a reasoning trace at every turn of a multi-turn tool session, and later turns read this history. Across 94k ShareGPT conversations, 73 percent of user interactions span multiple turns [33]. Upstream providers bind each trace to its issuer, so a request forwarded across issuers arrives with its history deleted, and the task cost of this stripping remains unmeasured. To the best of our knowledge, this paper presents the first direct, blind, multi-seed measurement of full reasoning-history deletion in multi-turn tool calling, through three rendering conditions, seven open-weight reasoning models, three seeds, 794 tasks, and the official checker. The same deletion spans −4.4 to +51.3 points with both ends excluding zero, and for the one model re-dosed from 0 to 100 percent deletion, the reading varies by at most 1.5 points. Deletion sensitivity is a model-level property. The reading follows the model itself and stays constant across deployments, and a retrained or re-released model is a new model that a two-cell screen, one retention run and one deletion run, re-reads for the cost of two runs. Deletion sensitivity is thus a measurable property of the model, and the reading must enter routing and aggregation as prior information rather than persist as an invisible default cost.

1. Introduction Reasoning models now carry multi-turn tool calling. Within one session a model issues calls, reads results, and plans the next step, and at every turn it first writes a reasoning trace and then acts, while the next turn reads the full history of traces and actions [9, 34]. Across 94k ShareGPT conversations, 73 percent of user interactions span multiple turns [33]. The trace is where the model keeps its plan, its intermediate results, and its record of what it has already tried. The serving side, however, strips the trace. Upstream providers bind each trace to its issuing account [5, 8, 10, 23], a request forwarded across issuers arrives with its history deleted, and this stripping is a settled practice of the aggregation ecosystem, real, legal, and outside what provider documents prescribe. What that practice costs the task remains unmeasured. Three gaps organize the question. What gets deleted is the reasoning trace, and the actions and their results stay in the request. Prior work on the value of the trace operates at the prompt layer of a single turn [15, 32, 34] or on its faithfulness [7, 18, 31], and the accumulated history that a session carries across turns lies outside those experiments. Where the deletion is visible has stayed unisolated, since existing multi-turn evaluations hold the full history as the default state of the session and keep deletion outside their variable sets [14, 26, 33, 35]. How to measure it fairly is unsettled, since serving-side work reports tokens saved and the tasks-lost column of its ledger stays empty [12, 21, 24]. To the best of our knowledge, this paper is the first measurement that deletes the full reasoning history as the controlled ∗ Corresponding author

mabo@mail.zjgsu.edu.cn (B. Ma)

H.Jia et al.: Preprint submitted to Elsevier

operation, grades the outcome with the official task checker, and repeats it across seeds. This paper measures the cost directly. The measurement renders each task under three conditions, retention, crossturn deletion, and mid-session deletion (Section 3.2), scores every session with the official BFCL checker blind to the condition, and reports the dual indicator Δdel (𝑆) and Δdel (𝑅) with bootstrap intervals. Seven open-weight reasoning models run 794 multi-turn tool tasks under three seeds, and one model adds a deletion dose from 0 to 100 percent of its history. Table 2 positions the measurement against the surveyed lines of Section 2. Deletion sensitivity reads off the model alone, as the measurements of Section 4 show. Every routing layer that forwards traffic across issuer boundaries is therefore running an unquantified cost. That cost is prior information for the routing decision, not a default the deployment inherits, and this paper supplies the reading. Deletion also leaves behavioral signatures that final-state scoring misses, and the repetition channel reads them for free. This paper makes three contributions. 1. The first direct, blind, multi-seed measurement of full reasoning-history deletion, reported as the dual indicator Δdel (𝑆) and Δdel (𝑅) with intervals, the reading a routing decision reads before its first deletion. 2. We find that the same deletion spans −4.4 to +51.3 points across seven models, that both ends exclude zero, and that parameter size, deletion ratio, and task type all leave the outcome unexplained, the 32B class alone spans 51.5 points. 3. Three behavioral signatures, compensating, looping, and silent failure, stable across seeds and invisible Page 1 of 10

Deletion Sensitivity Is a Property of the Model

to final-state scoring, and a two-cell screen, run the retention cell and the deletion cell and read Δdel (𝑆), that turns the cost from an invisible default into prior information read before the first deletion.

2. Related work Several established lines of work concern the reasoning history of a multi-turn tool-calling session. The closest lines are surveyed here, and the present measurement is distinguished from each. Existing work divides by what is done to the reasoning trace and at which layer. One line operates on the trace at the prompt layer, inside a single turn. A second line evaluates multi-turn sessions with the full history present and holds retention as the fixed default. A third line manipulates the history on the serving side, along a spectrum of selective compression. The survey treats training-time phenomena last, since they concern the production of the trace, a question upstream of the serving side. Table 2 compares the lines by the operations they perform on the trace and the costs they report.

2.1. The reasoning trace at the prompt layer Before the reasoning models, the trace lived inside a prompt. Chain-of-thought prompting established that writing the reasoning down lifts single-turn capability [34], the zero-shot form extended the lift beyond worked examples [15], and self-consistency strengthened the lift by sampling the trace and voting on the answer [32]. Two surveys place these methods inside the general landscape, the first mapping the concepts and methodologies of reasoning with foundation models [30], the second organizing the multistep methods that interleave generation and verification [25]. However, with the emergence of the reasoning models, the trace moved from a prompt technique to a first-class output. The o1 system learns to reason at training time and emits long traces as its working medium [22], DeepSeek-R1 arrives at the same behavior through reinforcement learning [9], and the Qwen3 family ships hybrid thinking modes across the size ladder this study measures [28]. The trace grew with the transition, a reasoning model writes hundreds to thousands of trace tokens per turn, and the history of a multi-turn session now carries more trace than answer. A second wave of this family measures whether the trace reports the computation that produced the answer, and finds a recurring gap between the two. Unfaithful explanations appear under chain-of-thought prompting [31], truncating the trace leaves the answer intact often enough to question the role of the visible steps [18], and the reasoning models inherit the gap between their stated and their actual reasoning [7]. Two traits separate this family from the present work. First, the unit of operation is the prompt of one turn, and the accumulated history that a session carries across turns stays outside those experiments. Second, the question asked of the trace is whether it helps or whether it is faithful, and these experiments pose a different question from the cost of deleting the accumulated history. The faithfulness line opens the possibility that the trace costs little to remove, H.Jia et al.: Preprint submitted to Elsevier

and settling that possibility at the history layer is exactly the question this paper measures.

2.2. Evaluations that keep the history The evaluations of this family place a model in a multiturn session and grade the outcome, and the history arrives intact at every turn. The family grew out of the tool-use line. Toolformer taught a model to call tools mid-sentence and evaluated the calls in isolation [29], Berkeley Function Calling turned the call format into a leaderboard and shipped the official checker that grades terminal state, call order, and no-call turns [11, 35], ToolLLM extended the coverage to thousands of APIs in single-turn and chained forms [26], and the tool-learning survey now maps the whole curriculum from tool selection to execution [27]. The multi-turn line follows. ReAct interleaved the trace with the action and is the direct ancestor of the trace–answer split this study operates on [36], 𝜏-bench runs a model against a user simulator across turns [14], MINT interleaves tools with language feedback [33], and two surveys organize the ground, the first a general evaluation survey for large language models [6], the second a dedicated survey of agent evaluation that reaches tool use and memory [37]. A second line of this family measures how the session itself fares as the history grows, with the history present at every turn. Models lose the thread as turns accumulate even with the full history intact [17], position effects compound the loss inside long contexts [20], and model-graded evaluation, the method many of these leaderboards lean on, is itself a surveyed instrument with known biases [38]. In all of these, the full history is the default state of the session, every design delivers the session intact and grades it, and the stripped request, the state production traffic runs in, stays outside the design.

2.3. Serving-side manipulation of the history The systems of this family rewrite the history between turns, on the serving side, and they report what is saved. The rewriting line developed its own curriculum. Gist tokens compress prompts into learned tokens that stand in for the original text at inference time [21], LLMLingua prunes the prompt token by token under a small auxiliary scorer [12], LLMLingua-2 trains the pruning decision through data distillation and buys a further speedup [24], and the compression field is now surveyed as a spectrum from token pruning to learned summaries [19]. Below the tokens, the serving stack has its own economics, PagedAttention organized the KV cache into pages and made the memory budget the unit of scheduling [16], and the KV side now carries its own survey of compression and eviction [13]. What this literature reports is tokens saved and latency gained, and the task cost of the rewrite is outside its tables.

The provider boundary. Four provider policies govern the trace, and Table 1 compares them. Every provider binds the trace to its issuer, and the binding is what strips the trace at a routing boundary, where a request forwarded across issuers arrives with its history deleted in full [5, 8, 10, 23]. Page 2 of 10

Deletion Sensitivity Is a Property of the Model Table 1 How the four providers treat the reasoning history. Every provider binds the trace to its issuer, which is what forces deletion at a routing boundary. Provider

Trace visibility

Cross-turn default

Stance

OpenAI Anthropic Gemini DeepSeek

encrypted, bound to issuer summary plain, body encrypted encrypted thought signatures plain text

renders within lineage strips old turns server-side skips old-turn validation API ignores the field

recommends carrying requires current loop warns of degradation advises discarding

This stripping is a settled practice of the aggregation ecosystem. It is real, it is legal, and it sits outside what provider documents prescribe, and the practice is the reason the cost of the stripped request is a measurement worth taking.

The closest measurements. Two recent works come closest to this one, and two facts separate each from it. The first work lets agents forget their reasoning under a selective scheme on a retention spectrum [3]. The second work measures when a model should think at all, scoring dependence on visible reasoning [4]. The first fact is the operation. Compression and selective forgetting are design choices on a spectrum an operator controls, while full deletion is the forced outcome at an issuer boundary that every operator inherits, and the two are different objects. The second fact is the reading. Those works report retention ratios and dependence scores, while this work reports the task cost of the complete deletion, graded by the official checker, blind, across seeds and conditions, with intervals. Prior servingside work reports tokens saved. This measurement reports tasks lost, holding the engine, the task pool, and the scorer fixed, under three controlled conditions.

2.4. Training-time phenomena A final line observes the trace at training and release time. Trace collapse degrades the reasoning trace under training pressure [2], and the reasoning profile of a model family shifts across releases [1]. These phenomena concern the production of the trace rather than its serving-side fate, and they enter this study through the finding that deletion sensitivity is a property of the specific model version, which the training-time line makes plausible and the present measurements quantify.

3. Experimental design and setup 3.1. Task pool and models The task set is the four multi-turn subsets of BFCL v4, 794 tasks with 2 to 8 turns across base scenarios, long context, missing functions, and missing parameters [11, 35]. Three properties fix the choice. The tasks execute against a real tool environment, the sessions are multi-turn by construction, and the leaderboard ships an official checker, which Section 3.4 turns into the blind grader. Five models run the full 794-task scale and two run at their produced scale, and the valid-session denominators ride with every table. Table 3 lists the seven models. The three Qwen3 models form a size ladder inside one family at 8B, 14B, and 32B [28], GLM-Z1-32B and Baichuan-M2-32B are two further 32B models from other houses [39], R1-Distill-14B is a distillation lineage [9], and Olmo-3-7B-Think is a small fully open model.

3.2. Three rendering conditions Let a session be 𝑚 = (𝑢1 , 𝑟1 , … , 𝑢𝑇 , 𝑟𝑇 ) with turn record 𝑟𝑡 = (𝑐𝑡 , 𝑠𝑡 ), where 𝑐𝑡 is the reasoning trace of turn 𝑡 and 𝑠𝑡 its actions and answer. For a set 𝐴 of turns, the deletion operator is { (⊥, 𝑠𝑡 ), 𝑡 ∈ 𝐴, 𝐷𝐴 (𝑚)𝑡 = (1) (𝑐𝑡 , 𝑠𝑡 ), 𝑡 ∉ 𝐴, and the three conditions render 𝑅𝐶1 = render(𝑚), 𝑅𝐶2 = render(𝐷1..𝑇 −1 (𝑚)), 𝑅𝐶3 = render(𝐷1..𝐾 (𝑚)),

2.5. Key differences Over the systems surveyed above, this work adds three things. It holds the full deletion of the reasoning history as the controlled operation of the experiment, across issuer boundaries, in the direction production traffic actually flows. It grades the outcome of that operation with the official task checker under a blind, multi-seed protocol. And it reports the cost as a model-level property with intervals, which is the reading a deployment can act on before the first deletion happens. The design, the protocol, and the reading supply these three (Sections 3–4).

H.Jia et al.: Preprint submitted to Elsevier

𝐾 = ⌊0.4𝑇 ⌋.

(2)

The current tool loop, the burst of calls and results inside the current turn, keeps its trace under every condition, because providers reject a request that drops it [5, 10]. Historical turns are everything before the current turn, and deletion operates exactly there. The model itself enters as a function, and the turn 𝑡 answer follows ( ) 𝑦𝑡 = 𝑓𝜃 render(𝐷𝐴 (𝑚<𝑡 )), 𝑢𝑡 , (3) where 𝑓𝜃 is the engine-loaded model, 𝑚<𝑡 the message prefix before turn 𝑡, 𝐴 the turn set the condition marks for deletion, and 𝑢𝑡 the user turn. Equation (2) is the end-of-session view of the same rendering, and the conditions change 𝐴 alone, Page 3 of 10

Deletion Sensitivity Is a Property of the Model Table 2 This measurement against prior evaluation and serving-side work. Work Forget selectively [3] When to think [4] Shift and collapse [1, 2] BFCL [35] Lost in multi-turn [17] This work

Multi-turn

Deletion

Blind grading

Seeds

partial – – yes yes yes

selective dependence training-time – – full, three cells

– – – yes – yes

– – – – – yes

Table 3 The seven models. Params in billions. Valid sessions per condition pool the three seeds, retention and cross-turn. Model

Params

Tasks

Valid sessions

8 14 32 32 32 14 7

794 794 794 794 200 794 200

2382/2380 2375/2382 2382/2382 2266/2101 596/573 1815/1439 265/245

Qwen3-8B Qwen3-14B Qwen3-32B GLM-Z1-32B Baichuan-M2-32B R1-Distill-14B Olmo-3-7B-Think

multi-turn task pool 794 tasks trace / call, filled kept, open stripped

C1 retention

C2 cross-turn

C3 mid-session

trace kept in the request

historical trace stripped

stripped at K = ⌊0.4T⌋

condition proxy at message layer

official chat template render

vLLM engine fixed config

official tool environment

while 𝑓𝜃 , the task environment, and the grader stay fixed throughout. The mid-session condition switches inside the session at 𝐾 = ⌊0.4𝑇 ⌋, deleting the reasoning of turns at or before 𝐾 and keeping the rest, which matches the deployed implementation this study reproduces. Figure 1 carries the design. The retention and cross-turn pair reads the total sensitivity of a model in two cells, and the mid-session arm isolates the cost of the switch itself.

3.3. Deletion sensitivity metrics Δdel (𝑆) = 𝑆(𝐶1)−𝑆(𝐶2),

Δdel (𝑅) = 𝑅(𝐶2)−𝑅(𝐶1), (4)

with 𝑆 in percent (Eq. 6). The two indicators carry opposite signs on purpose, a sensitivity loss and a repetition rise both read positive. Each interval comes from session-level bootstrap, [ ] CI95 = 𝑞2.5% (Δ∗ ), 𝑞97.5% (Δ∗ ) , (5) where Δ∗ is the indicator, Δdel (𝑆) or Δdel (𝑅), recomputed on a resample of the valid sessions with replacement, 𝐵 = 10,000 resamples, and 𝑞𝛼 the empirical 𝛼-quantile over the 𝐵 copies. Definition 1 (deletion sensitivity as a model property). Under a fixed task family, scorer, and sampling protocol, deletion sensitivity is a property of the model in an operational sense. The sign and magnitude of Δdel (𝑆) are stable across seeds and are not explained by size, dose, or task mix, and whether the reading transfers across task families is an open question bounded in Section 5.3. H.Jia et al.: Preprint submitted to Elsevier

BFCL checker, blind on the call log

Δdel(S) success loss Δdel(R) repetition rise

Figure 1: The measurement design. Each task runs under three rendering conditions that differ only in which historical traces survive, shown by the turn timelines, filled marks kept and open marks stripped. The condition proxy rewrites the message layer, the official chat template renders every surviving message identically, and the engine and the tool environment stay fixed. The official checker grades blind to the condition, and the session log yields the two indicators.

3.4. Implementation, grading, and cleaning The session harness is a modified version of the opensource DeepSeek Harness.1 A harness drives each session turn by turn, the model answers through a condition proxy at the message layer, the proxy re-renders the whole request through the official chat template of the model so that the rendered form of every surviving message is identical across conditions, and a self-hosted vLLM engine [16] executes the request against the official task environment. The engine holds each model at a fixed configuration for all three conditions, tensor parallelism across two devices, a 32K context window for the 32B models and 40K for the Qwen3 ladder, temperature 0.6, and a generation budget that carries every 1 https://github.com/deepseek-ai/deepseek-harness,

developer

preview, version 0.1.0-rc.5.

Page 4 of 10

Deletion Sensitivity Is a Property of the Model

trace to its end. Every model runs three seeds per condition, and the cleaning rule below applies to all cells alike. Scoring follows the official BFCL form, 𝑆(𝐶) =

100 ∑ |𝑄| 𝑞∈𝑄

𝟏[checker(𝑞, f inal_state(𝐶, 𝑞))] , (6)

100 ∑ 𝟏[twice(𝐶, 𝑞)] , |𝑄| 𝑞∈𝑄

(7)

where twice(𝐶, 𝑞) holds when the session of task 𝑞 under condition 𝐶 issues at least one identical call twice. Dose arms 𝑑0–𝑑100 run on the one model dosed. Scoring is blind to the condition label, and the checker inspects the terminal state, the call order, and the no-call turns of every session. Sessions that fail from infrastructure causes leave the denominator, the removal recognizes transport, driver, and engine failures, and a session with model output and zero tool calls stays in the denominator as a legitimate failure of the model. Table 4 reports bootstrap intervals, which remain the reporting standard of the study, and the screening arithmetic of Section 6 carries its own closed form.

3.5. Validity checks Three checks establish that the readings belong to the models under measurement, and each check closes one artifact route. First, the scorer reproduces cell by cell the deployed scoring of this project, all nine Qwen3-8B cells score identically under the local and the deployed scorer, 231, 286, 302, 258, 269, 304, 289, 274, and 298 valid tasks. Second, the readings are stable across seeds, Baichuan-M232B reads +53.0, +47.2, and +53.8 points on its three cross-turn seeds, every seed large and positive. Third, the measurement separates sampling resolution from signal. An earlier 40-task three-seed measurement of GLM-Z1-32B read 53.3 against 43.3 percent, retention against cross-turn deletion [39], and the full-scale tables read the same contrast at +0.7 points with the interval [−2.0, +3.4]. The small-scale gap sits inside the noise band that Eq. (8) assigns to a cell of that size, the full-scale interval is several times tighter, and the reading stabilizes as the session count grows, which is the reporting standard behind every table of this study.

4. Results 4.1. Sensitivity spans −4.4 to +51.3 points The same deletion operation spans 55.7 points across seven models. Table 4 reports the main result and Figure 2 orders the models by their retention baseline. Retention minus cross-turn deletion runs from −4.4 points on R1Distill-14B, where deletion improves the model, to +51.3 H.Jia et al.: Preprint submitted to Elsevier

+51.3

Qwen3-32B (32B)

-0.2

Qwen3-8B (8B)

-0.5

Qwen3-14B (14B)

where 𝑞 is a task, 𝑄 the task pool, f inal_state(𝐶, 𝑞) the end state of the session under condition 𝐶, and checker the official BFCL grader, which returns 1 when the session passes and 0 otherwise. The repetition rate carries its own numbered form, 𝑅(𝐶) =

Baichuan-M2-32B (32B)

GLM-Z1-32B (32B)

-3.1 +0.7

Olmo-3-7B-Think (7B) R1-Distill-14B (14B)

+3.0 -4.4

32B models (square) 7-14B models (circle)

0 20 40 Δdel(S) = retention − cross-turn deletion (pp)

Figure 2: Deletion sensitivity by model, ordered by the retention baseline. Squares mark the 32B models. The baseline leaves the outcome open, and the three 32B models span the whole range.

points on Baichuan-M2-32B, where deletion erases it, and both intervals exclude zero. Deletion erases Baichuan-M232B, its cross-turn cells hold 3 valid successes out of 573 valid sessions, and deletion improves R1-Distill-14B by 4.4 points from a floor between 1.3 and 5.6 percent absolute success, so the improvement removes a burden rather than a resource. GLM-Z1-32B holds its success under cross-turn deletion, retention and cross-turn read 29.3 and 28.6 percent, and the three Qwen3 models sit within 3.1 points of zero in either direction. Parameter class leaves the outcome open. The three 32B models receive the same operation and read −0.2, +0.7, and +51.3 points, a 51.5-point spread inside one parameter class, while the two 14B models sit at −3.1 and −4.4 and the 8B model sits at −0.5. A deployment that trusted size as the predictor would delete the history of a 32B model and lose half its success. The outcomes admit a first partition into a deletiontolerant and a deletion-sensitive regime. The deletiontolerant regime holds the three Qwen3 models, GLM-Z132B, and R1-Distill-14B, deletion moves success by at most 4.4 points in either direction, and the deletion-sensitive regime holds Baichuan-M2-32B and Olmo-3-7B-Think, deletion costs 3.0 to 51.3 points. One model sits at the success floor, and Section 4.3 places it by behavior. The partition is stable across seeds. Baichuan-M2-32B reads +53.0, +47.2, and +53.8 points on its three crossturn seeds, every seed large and positive, the nine Qwen3 cross-turn readings all sit within 4.8 points of zero, and the three GLM cross-turn seeds read +1.8, −0.8, and +1.2, so sampling perturbation leaves the partition intact.

4.2. What the outcome tracks For the one deletion-tolerant model we dose, recovery is invariant from 0 to 100 percent deletion.

Page 5 of 10

Deletion Sensitivity Is a Property of the Model Table 4 Main result. Success rate in percent with valid sessions in parentheses, pooled over three seeds. Δdel (𝑆) is retention minus cross-turn deletion with the 95 percent interval, and Δdel (𝑅) is the repetition rise under deletion of the same pair. Model Baichuan-M2-32B GLM-Z1-32B Olmo-3-7B-Think Qwen3-8B Qwen3-14B Qwen3-32B R1-Distill-14B

Retention

Cross-turn

Mid-session

Δdel (𝑆)

95% interval

Δdel (𝑅)

51.8 (309/596) 29.3 (665/2266) 3.8 (10/265) 34.4 (819/2382) 34.4 (816/2375) 40.3 (960/2382) 1.3 (23/1815)

0.5 (3/573) 28.6 (601/2101) 0.8 (2/245) 34.9 (831/2380) 37.4 (892/2382) 40.5 (965/2382) 5.6 (81/1439)

14.7 (93/632) 23.8 (550/2315) 2.4 (2/85) 36.2 (861/2381) 35.4 (843/2382) 39.2 (933/2382) 4.2 (52/1235)

+51.3 +0.7 +3.0 −0.5 −3.1 −0.2 −4.4

[+47.2, +55.3] [−2.0, +3.4] [+0.2, +6.0] [−3.2, +2.2] [−5.8, −0.4] [−3.0, +2.6] [−5.7, −3.1]

+8.0 −0.9 +36.3 +1.7 −0.7 +1.4 +4.3

success rate (percent)

60 58

56.5

56.3

56

54.5

54

55.0

55.0

100

50 rand.

53.0

52 50 48 46

all four, so the subset mix moves the magnitude and leaves the classification alone. Among the factors this study varied, only the model identity predicts the outcome. The partition of Section 4.1 is descriptive of outcomes, and the claim here concerns predictors among the factors varied, size, dose, and task mix all leave the reading unexplained, which is the operational footing of Definition 1. Definition 1 holds by the seed stability above and the predictor exclusion of this subsection.

4.3. Three behavioral signatures 0

25

50

75

Deletion leaves three behavioral signatures, compensat-

deleted share of the history (percent), last arm a random half ing, looping, and silent failure. The regimes of Section 4.1

Figure 3: Deletion dose on the one model dosed, success in percent across six arms. The reading varies by at most 1.5 points from deleting none to deleting all of the history.

Observation 1 (dose invariance for the dosed model). For the one model dosed, the d0 and d100 endpoints differ by 1.5 points, and the interval of every dose arm’s difference from the zero arm crosses zero. The 32B Qwen3 model runs six arms on the 200-task subset, deleting 0, 25, 50, 75, and 100 percent of the history plus a second 50 percent arm that deletes a different random half, and success reads 56.5, 53.0, 54.5, 56.3, 55.0, and 55.0 percent. The d0 and d100 endpoints differ by 1.5 points, the interval of every dose arm’s difference from the zero arm crosses zero, and random-half deletion matches blockhalf deletion at 54.5 against 55.0. Behaviorally the model recovers at every dose, and whether by re-derivation or with the trace as idle cargo is the open question of Section 5.2. The deletion-sensitive regime stays outside the dose arms, and its dose response is another experiment. Figure 3 carries the reading. Task subsets scale the effect and keep its sign, and Table 5 decomposes Δdel (𝑆) by subset. Baichuan-M2-32B pays 64.7 points on base scenarios and 59.3 on long context, drops to 45.6 on missing parameters and 7.8 on missing functions, where the absent tool bounds what any condition can save. The sign belongs to the model everywhere, the deletion-tolerant models stay within 7.4 points of zero on every subset, and R1-Distill-14B keeps its improvement on H.Jia et al.: Preprint submitted to Elsevier

are defined on the success axis, the signatures of this subsection are defined on the behavior axis, the regimes remain a descriptive partition of outcomes, and the formal objects of this paper are the signatures. The signatures carry empirical thresholds, read on the pair the indicator definitions of Eq. (4) fix, retention against cross-turn deletion. A model is compensating when |Δdel (𝑆)| ≤ 3.1 and |Δdel (𝑅)| ≤ 1.7 on that pair. A model is looping when some condition pair that involves deletion raises Δdel (𝑅) by at least +30. A model is silent when Δdel (𝑆) ≥ +20 and Δdel (𝑅) < +10 on the defining pair, and the second clause is constructive, it keeps a future model with both readings high out of two classes at once. Compensating models hold both indicators. Looping models repeat identical calls. Silent models fail with a plain log. The three signatures separate cleanly on the repetition axis. Table 6 reports the repetition rate under the three conditions and Figure 4 places each model on the two indicators. Mid-session deletion raises the repetition rate of R1-Distill14B from 18.1 to 68.7 percent, cross-turn deletion raises Olmo-3-7B-Think from 30.2 to 66.5 percent, the session re-issues the same call to the same tool with the same arguments, and the success axis reads a few points while the behavior axis reads a collapse. Baichuan-M2-32B falls from 51.8 to 0.5 percent success while its repetition rate rises to 26.5 percent, the one silent reading of the study, and GLMZ1-32B holds success within 0.7 points and repetition within 0.9 points under cross-turn deletion, so a deletion-tolerant model keeps both axes level at once. Within the deletion-sensitive regime the signatures split into looping and silent failure, and the deletion-tolerant Page 6 of 10

Deletion Sensitivity Is a Property of the Model Table 5 Subset decomposition of Δdel (𝑆), retention minus cross-turn deletion in points with the 95 percent interval, by task subset. The sign stays with the model across subsets, and the magnitude scales with how much state the subset accumulates across turns. Model Baichuan-M2-32B GLM-Z1-32B Olmo-3-7B-Think Qwen3-8B Qwen3-14B Qwen3-32B R1-Distill-14B

Base

Long context

Missing function

Missing parameter

+64.7 [+57.5, +70.9] +2.1 [−3.8, +7.9] +2.0 [−2.6, +7.1] −2.2 [−7.9, +3.5] −7.4 [−13.0, −1.7] −0.8 [−6.5, +4.8] −4.8 [−7.5, −2.4]

+59.3 [+52.3, +65.8] +3.4 [−2.4, +9.1] +4.6 [−1.2, +11.7] −0.8 [−6.5, +4.8] −3.6 [−9.2, +2.1] −3.9 [−9.5, +1.8] −4.5 [−7.4, −1.9]

+7.8 [+2.1, +15.2] −2.4 [−4.7, −0.5] +3.0 [−8.0, +15.3] +2.0 [−0.7, +4.7] +0.0 [−2.8, +2.8] +0.0 [−2.7, +2.7] −4.6 [−7.3, −2.6]

+45.6 [+34.1, +55.9] +1.5 [−3.8, +6.7] +1.7 [−9.4, +11.9] −1.1 [−6.5, +4.4] −1.3 [−6.8, +4.2] +3.8 [−1.8, +9.4] −2.2 [−5.5, −0.3]

Table 6 Repetition rate in percent, the share of sessions with at least one identical call issued twice, pooled over three seeds. Ret. is retention, Cross is cross-turn deletion, Mid is mid-session deletion.

Model, task

Retention

plan in 6 calls, same plan done re-derived, 410 calls, done reads the state, searches, 22.4% answers repeat

Model

Ret.

Cross

Mid

Signature

Qwen3-8B, base 128

Qwen3-8B Qwen3-14B Qwen3-32B GLM-Z1-32B R1-Distill Olmo-3-7B Baichuan-32B

44.4 37.1 34.3 30.3 18.1 30.2 18.5

46.1 36.4 35.7 29.4 22.4 66.5 26.5

37.0 36.6 34.9 29.5 68.7 40.0 22.0

compensating compensating compensating compensating looping looping silent

R1-Distill, miss_param 17 Baichuan, miss_param 26

Olmo-3-7B-Think

Mid-session plan held, calls, done

9

ls(a=True) issued

418 times

4 calls, correct cd(temp), one cd(temp), stall state call, silence

5.1. Same task, three conditions

looping

30

20 compensating

Baichuan-M2-32B

10 R1-Distill-14B Qwen3-32B Qwen3-8B

0

Cross-turn

5. Analysis

40 Δdel(R) (pp), repetition rise

Table 7 Same task, three conditions, actual call streams abridged from the session logs.

silent failure

Qwen3-14B GLM-Z1-32B

0 20 40 Δdel(S) (pp), positive = deletion hurts

Figure 4: The two indicators together. The horizontal axis is the success change, the vertical axis is the repetition change. Compensating models cluster at the origin, looping models rise in repetition, silent models fall in success with a small repetition change.

regime holds the compensating signature and one looping exception that Section 5.2 explains. The exception is R1Distill-14B, one deletion-tolerant model carries the looping signature at the success floor, deletion removes a burden it was carrying, and the behavior axis still records the break, which Section 5.2 takes up.

H.Jia et al.: Preprint submitted to Elsevier

Table 7 contrasts the actual call streams of matched tasks under the three conditions. The columns hold what each session actually did, the contrast carries its own ground truth, and the signatures read off the difference. The compensating model repeats its retention plan with extra re-derivation calls, on one task the call count rises from 6 to 410 with the success held, and on another the same plan re-derives with a single extra call, so the re-derivation cost ranges from one call to a full re-execution and the outcome stays the same. The looping model re-issues one call to the end of its budget, and the silent model ends in wrong state with a plain log.

5.2. What the deleted history was doing A trace of what the compensating models do instead is visible in the call stream. The cross-turn cells of Qwen3-8B issue more calls than their retention cells and the success holds, so the work the deleted trace was doing reappears as extra calls in the stream, and the reading is consistent with re-derivation. Whether compensating models re-derive the lost trace or carried it as idle cargo is open, and the two readings separate on data this measurement leaves to a finer probe, a withinsession comparison of call content between the retention and the cross-turn cells of the same task. The call-count rise supports re-derivation and settles the question of cost, the recovery is complete at every dose, while the mechanism question stays open. Page 7 of 10

Deletion Sensitivity Is a Property of the Model

Two roles compete for the reasoning history, and the signatures separate them. If the history worked as content memory, a store of intermediate results worth retrieving, the cost of losing it would scale with the amount deleted, and the dose reading contradicts the scaling, the cost is absent at every dose for the compensating model. If the history worked as a continuity scaffold, a structure that keeps the model on its own track, losing it would break the thread rather than erase a fact, and the failure would look like disorientation. The looping signature is a direct observation of that break, the model re-issues calls whose record vanished with the trace, and the silent signature is the same break in a model that gives up instead of repeating. What breaks is continuity, and the two collapse forms differ by what the model does at the break. The mid-session arm locates the damage at the break point, R1-Distill-14B loops at 68.7 percent under midsession deletion against 22.4 under cross-turn deletion, so the switch itself throws this model into repetition harder than deleting the whole history from the start, and Baichuan-M232B loses 37.1 points to deleting the first half of its history against 51.3 for all of it, so the damage concentrates in the early turns. The break point is where the damage lives for sensitive models, and it is where a routing decision does its harm. Deletion improves the success of R1-Distill-14B by 4.4 points and at the same time throws it into the heaviest midsession looping of the study. The two readings coexist on different axes, the success axis reads a burden removed, and the behavior axis reads a thread broken. The model was carrying a trace it could ill afford, and losing the trace still breaks its continuity. The three 32B models spread 51.5 points under the same operation, which points past parameter count to the training lineage as the carrier of deletion sensitivity, a direction the training-time observations of Section 2.4 make plausible and the present measurements quantify.

5.3. What transfers across task families The reading of the screen is established on BFCL-class function-calling tasks, and a deployment on a different task family re-runs the two cells on its own traffic, which the screen is cheap enough to allow. The property of Definition 1 holds inside the fixed task family, scorer, and sampling protocol, and the transfer across families is the open boundary of the claim.

5.4. What the official checker guarantees The scorer agrees with the deployed scoring of this project cell by cell, and the residual exposure is the blind spot of a single checker family. Terminal-state grading with call order and no-call turns covers the success axis of this task family, and the repetition channel covers the behavior axis from the raw call log, so the two indicators read from independent evidence. Failure modes that leave the terminal state correct while the path degrades would pass the success axis, and the behavior channel is the witness for exactly those modes.

H.Jia et al.: Preprint submitted to Elsevier

6. Implications for deployment The reading of the screen is established on BFCL-class function-calling tasks, and a deployment on a different task family re-runs the two cells on its own traffic, which the screen is cheap enough to allow. The screen runs one model on the retention cell and the cross-turn cell, 200 tasks each, one seed, in one day on two devices, and reads Δdel (𝑆) with its interval. The decision has two tiers. A reading clearly positive, with the interval excluding +10, keeps or pins the session, and every other reading treats the model as insensitive to deletion and deletes. The decision rule rests on a closed-form standard error, √ ̂ = 100 𝑝̂1 (1 − 𝑝̂1 )∕𝑛1 + 𝑝̂2 (1 − 𝑝̂2 )∕𝑛2 , (8) SE(Δ) where 𝑝̂𝑖 = 𝑆(𝐶𝑖 )∕100 and 𝑛𝑖 is the count of valid sessions in cell 𝑖, with cell 1 the retention cell and cell 2 the deletion cell. The form treats the two cells as independent binomials and is conservative under the within-task pairing of the screen. ̂ is about 9.6 points at this scale, Its half-width 1.96 SE(Δ) so calling keep requires a point estimate above roughly 20 points. Three worked readings fix the arithmetic. A model at zero reads an interval that straddles zero and deletes. A model at +15 reads [+5.4, +24.6], which excludes zero and still holds +10 inside, so the screen classifies it with the insensitive tier, and the( chance of that call under ) a normal approximation is 1 − Φ (10 + 1.96 SE − Δ)∕SE at Δ = 15, about 17 percent. A model at +25 reads [+15.4, +34.6] and keeps. The repetition channel rides along from the call log, across the seven models the repetition change covaries with the success change, looping models rise 36 to 51 points in repetition at their largest condition pair while compensating models stay within 1.7 on the screening pair, and one looping model reads only +4.3 on the screening pair itself, so the monitor rule of Table 8 watches the log rather than trusting the screening reading alone. The channel reads from the call log at zero scoring cost. Whether the repetition rise precedes the failure inside a session is a separate analysis, and the screen uses the channel as a corroborating reading, and as an early warning it stays unclaimed. Table 8 turns the reading into an action, and the Evidence column states where each action stands. The delete and keep rules read Δdel (𝑆) directly from the screen, the monitoring rule derives from it under sign stability, and the summary arm stays pending until it runs. Keeping the history has a cost of its own, the retained request grows with every trace the model writes across turns, and a deployment that pins a sensitive model to one backend pays that growth out of its context budget. The choice the table forces is the measured sensitivity of the model against the measured context cost of its history, and both sides of the ledger are numbers. As established in Section 2.3, the practice is settled, legal, and outside provider documentation, and the screen and the table above are the risk sheet that documentation fails to provide.

Page 8 of 10

Deletion Sensitivity Is a Property of the Model Table 8 Routing actions by screening reading, each graded by its evidence, measured, derived, or pending.

and the turns after 𝐾 keep it. The current loop keeps its trace under every condition.

Screening reading

Routing action

Evidence

References

interval holds zero interval holds +10 interval excludes +10 mid-session switch summary before delete

delete, save context delete, monitor the log keep or pin session expect the switch cost summary arm queued

measured derived measured derived pending

[1] Anonymous, 2026a. Reasoning shift. arXiv:2604.01161 . [2] Anonymous, 2026b. Reasoning-trace collapse, in: Proc. NeurIPS. [3] Anonymous, 2026c. When can agents forget their reasoning, in: Proc. ICLR. ArXiv:2609.29875. [4] Anonymous, 2026d. When should agents think. arXiv:2610.12061 . [5] Anthropic, 2026. Extended thinking. docs.claude.com/en/docs/buildwith-claude/extended-thinking. [6] Chang, Y., et al., 2025. A survey on evaluation of large language models. ACM Computing Surveys 58, 169. [7] Chen, M.Y., et al., 2025. Reasoning models don’t always say what they think. arXiv:2505.05410 . [8] DeepSeek, 2026. Reasoning model guide. apidocs.deepseek.com/guides/reasoning_model. [9] DeepSeek-AI, 2025. Deepseek-r1: incentivizing reasoning capability in LLMs via reinforcement learning. Nature 645, 633–638. [10] Google, 2026. Thought signatures in the Gemini API. ai.google.dev/gemini-api/docs/generate-content/thought-signatures. [11] Gorilla Team, UC Berkeley, 2025. Berkeley function calling leaderboard. gorilla.cs.berkeley.edu. [12] Jiang, H., et al., 2023. LLMLingua: compressing prompts for accelerated inference, in: Proc. EMNLP. ArXiv:2310.05736. [13] Jiang, J., et al., 2025. A survey on system-aware KV cache optimization. arXiv preprint VERIFY-ARXIV at first cite. [14] Kim, S., et al., 2025. Language models are solvers: 𝜏-bench, in: Proc. ICLR. ArXiv:2406.12045. [15] Kojima, T., et al., 2022. Large language models are zero-shot reasoners, in: Proc. NeurIPS. [16] Kwon, W., et al., 2023. Efficient memory management for large language model serving with PagedAttention, in: Proc. SOSP. [17] Laban, P., et al., 2025. LLMs get lost in multi-turn conversation, in: Proc. ICLR. ArXiv:2505.06120. [18] Lanham, T., et al., 2023. Measuring faithfulness in chain-of-thought reasoning. arXiv:2307.13702 . [19] Li, Z., et al., 2025. Prompt compression for large language models: a survey, in: Proc. NAACL. ArXiv:2410.12388. [20] Liu, N.F., et al., 2024. Lost in the middle: how language models use long contexts. Transactions of the Association for Computational Linguistics . [21] Mu, J., et al., 2023. Learning to compress prompts with gist tokens, in: Proc. NeurIPS. [22] OpenAI, 2024. Learning to reason with o1. OpenAI technical report. [23] OpenAI, 2026. Reasoning guide. developers.openai.com/api/docs/guides/reasoning. [24] Pan, Z., et al., 2024. LLMLingua-2: data distillation for efficient and faithful task-agnostic prompt compression, in: Findings of EMNLP. ArXiv:2403.12968. [25] Plaat, A., et al., 2024. Multi-step reasoning with large language models, a survey. ACM Computing Surveys . [26] Qin, Y., et al., 2024. ToolLLM: facilitating large language models to use thousands of APIs, in: Proc. ICLR. [27] Qu, C., et al., 2024. Tool learning with large language models: a survey. Frontiers of Computer Science doi:10.1007/s11704-024-40678-2. [28] Qwen Team, 2025. Qwen3 technical report. [29] Schick, T., et al., 2023. Toolformer: language models can teach themselves to use tools, in: Proc. NeurIPS. [30] Sun, Z., et al., 2025. A survey of reasoning with foundation models: concepts, methodologies, and forward paths. ACM Computing Surveys 57, 278. [31] Turpin, M., et al., 2023. Language models don’t always say what they think: unfaithful explanations in chain-of-thought prompting, in: Proc. NeurIPS. [32] Wang, X., et al., 2023. Self-consistency improves chain of thought reasoning in language models, in: Proc. ICLR.

7. Conclusion This paper measured deletion sensitivity, the task cost of deleting the reasoning history, on seven open-weight reasoning models under three conditions, three seeds, 794 tasks, and the official checker. The same deletion spans −4.4 to +51.3 points with both ends excluding zero, parameter size, deletion ratio, and task type leave the outcome unexplained, and failure takes three behavioral signatures, compensating, looping, and silent failure, stable across seeds and invisible to final-state scoring. Deletion sensitivity is thus measured as a property of the model, and the screen turns the invisible default of the routing ecosystem into prior information, a priced-in decision ahead of the first deletion. The summary arm, the dose response of the deletion-sensitive regime, the screen across further task families, and closed models carry the line forward.

CRediT authorship contribution statement Hanzhang Jia: conceptualization, methodology, software, investigation, writing, original draft. Liheng Zeng: investigation, validation. Zhiyu Yang: investigation, validation. Yi Gao: investigation, data curation. Bo Ma: supervision, writing, review and editing.

Declaration of competing interest The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper.

Data availability The session logs, the grading scripts, and the per-cell scoring records that support the findings of this study are available from the authors on reasonable request.

A. Request construction under the three conditions Figure 5 shows the message-level construction of one session under the three conditions of Eq. (2). Retention carries the trace, the actions, and the result of every historical turn. Cross-turn deletion keeps the actions and the result and drops the trace of every historical turn. Mid-session deletion switches at turn 𝐾, the turns at or before 𝐾 lose their trace H.Jia et al.: Preprint submitted to Elsevier

Page 9 of 10

Deletion Sensitivity Is a Property of the Model

C1 retention

C2 cross-turn deletion

C3 mid-session deletion

turn 1: trace + action + result

turn 1: action + result

turns 1..K: action + result

turn 2: trace + action + result

turn 2: action + result

turn K+1: trace + action

...

...

...

current loop: trace + calls

current loop: trace + calls

current loop: trace + calls

Figure 5: Message-level construction of one session under the three conditions, retention, cross-turn deletion, and mid-session deletion. Blue frames carry the trace, gray frames carry actions and results alone, and the current loop keeps its trace under every condition.

[33] Wang, Z., et al., 2024. MINT: evaluating LLMs in multi-turn interaction with tools and language feedback, in: Proc. EMNLP. ArXiv:2309.10691. [34] Wei, J., et al., 2022. Chain-of-thought prompting elicits reasoning in large language models, in: Proc. NeurIPS. [35] Yan, F., et al., 2024. Berkeley function calling leaderboard, in: Proc. ICLR. [36] Yao, S., et al., 2023. ReAct: synergizing reasoning and acting in language models, in: Proc. ICLR. [37] Yehudai, A., et al., 2026. A survey on evaluation of LLM-based agents. arXiv:2503.16416 Findings of ACL. [38] Zheng, L., et al., 2023. Judging LLM-as-a-judge with MT-Bench and Chatbot Arena, in: Proc. NeurIPS. [39] Zhipu AI, 2025. GLM-Z1-32B-0414.

H.Jia et al.: Preprint submitted to Elsevier

Page 10 of 10

Related documents

• Agents' Last Doubt: Knowing When to Act and When to Step Back in Tool-Using Agents#1388760
• Diversity Combining for Multi-Path LLM Reasoning#1143430
• When Can Agents Forget Their Reasoning? ICLR for Long-Horizon Agent Context Compression#1077946
• Wait, Wait, Wait... Why Do Reasoning Models Loop?#670446
• Wait, Wait, Wait... Why Do Reasoning Models Loop?#668381