Three of the four moves for managing a context budget fail silently, and the context they leave behind fails silently too. A window that has grown too long, picked up a false statement or been handed eleven overlapping tools keeps producing fluent answers, so what a team sees is answers that have quietly got worse rather than anything breaking. The field settled on context rot as the name for that slide, and the four ways it happens were named separately, in the same month, by somebody else.
Both pieces of work date from mid 2025. Drew Breunig published an account of four failure modes on 22 June 2025, naming them poisoning, distraction, confusion and clash. Chroma published a technical report on 14 July 2025 by Kelly Hong, Anton Troynikov and Jeff Huber, which measured the underlying effect across eighteen models on tasks built so that length was the only thing changing.
The practical reason this matters is a scheduling one. A team usually meets context rot after shipping, because a feature that worked in testing on short inputs degrades on the long sessions that only real users produce. Nothing in the logs marks the change, so the investigation starts from a support ticket.
The sections below give the measurements, take the four named failure modes in two pairs with an artefact for each, set the four against cause and remedy, and finish with the reason none of them produces an error.
The measurements behind context rot
The Chroma report tested eighteen models across four families, covering Anthropic's Claude models, several of OpenAI's, Google's Gemini models and Alibaba's Qwen models. Its headline finding is that model performance varies substantially as input length changes, even on tasks that are trivial at short lengths.
Four results from that report are worth carrying forward.
- Similarity between the question and the target passage matters more as length grows. A passage that answers the question in different words is found reliably in a short input and unreliably in a long one.
- A single distractor hurts. One plausible but wrong passage lowered accuracy, different distractors hurt by different amounts, and the damage grew with input length.
- A coherent haystack was harder than a shuffled one. Models did worse when the surrounding material held a logical flow, which is the opposite of what most teams would guess.
- The same question in a long context is a different question. On a long term memory benchmark, prompts holding only the relevant material averaged about 300 tokens and prompts holding the full history averaged about 113,000, and every model family scored worse on the second.
A fifth result is the one that settles any argument about whether the effect is about difficulty. The report asked models to reproduce a list of repeated words with one different word in it, at lengths from 25 words to 10,000. Accuracy fell as the list got longer. Some models started producing words that were never in the input and some declined the task outright, on an exercise with no reasoning in it at all.
Retrieval workloads show the same shape. Databricks Mosaic Research published a study in November 2024 running retrieval pipelines across twenty models at context lengths from 2,000 to 128,000 tokens, and found most models improving up to somewhere between 16,000 and 32,000 tokens and then flattening or falling. One 405 billion parameter open model began degrading measurably past 32,000 tokens, which is a quarter of the length its own documentation advertises.
Context poisoning and context distraction
Context poisoning happens when a false statement enters the context and then gets referenced as though it were established. The danger is the reference count. A hallucination that appears once is an error. A hallucination written into a scratchpad and read back at every subsequent step is a premise.
CONTEXT POISONING, one step at a time.
Step 4 tool get_order("41822")
status=dispatched total=59.97
Step 5 model "The order total is £59.97 and the customer is on the
business tier, so the 12 per cent goodwill cap gives a
maximum of £7.20."
Step 6 model writes to the scratchpad
goodwill_cap = 7.20
Step 7 model "Offering £7.20 under the business tier cap."
Step 9 model "As established, the cap in this case is £7.20."
Step 14 model "The £7.20 figure was confirmed earlier in this case."
The arithmetic is correct, since 12 per cent of 59.97 is £7.20 to the penny, but the policy has no percentage cap in it at all. One invented rule at step five became a scratchpad entry at step six, and by step fourteen the model is citing its own earlier sentence as the source. Breunig's account of this mode points at a published technical report on a model agent playing a video game, where a hallucinated game state reached the agent's goal section and the agent then spent turns pursuing an objective that could not be reached.
Context distraction happens when the context grows long enough that the model leans on what is in front of it and stops using what it learned in training. The symptom teams report is repetition. An agent that has taken thirty steps starts proposing variations on step twenty nine, because thirty examples of its own behaviour are the most recent and most repeated pattern in its window.
The Databricks figure above is the cleanest public evidence for the threshold sitting far below the advertised window. A practical rule follows from it. The useful working length of a context is an empirical property of the model and the task, a team measures it for both, and the answer comes back a fraction of the number on the product page.
Context confusion and context clash
Context confusion happens when material the step did not need gets used anyway. Tool definitions are the usual source, because every tool in the window is an option the model has to rule out, and tools written by different teams at different times overlap.
CONTEXT CONFUSION. Three of eleven tool definitions, as the model
receives them.
search_orders(query)
"Search orders. Use this to find an order."
find_order(customer_id, reference)
"Look up a specific order for a customer by its reference."
lookup_order_history(account, months=12)
"Returns a customer's orders. Use this for order questions."
A person reading those three would ask which one to use. The model cannot ask, so it picks, and the pick is a coin toss weighted by wording nobody reviewed. The Berkeley Function Calling Leaderboard added categories for exactly this situation from version three onwards, scoring whether a model can ignore a function that has nothing to do with the request.
Context clash happens when two items in the window contradict each other and nothing resolves the conflict. Research published on 9 May 2025 by Philippe Laban, Hiroaki Hayashi, Yingbo Zhou and Jennifer Neville took benchmark instructions that models handled well when given all at once, and spread the same instructions across the turns of a conversation. Average performance fell by 39 per cent across six generation tasks. Their reading of more than two hundred thousand simulated conversations is that the models mostly kept their ability and lost their reliability, and that a model taking a wrong turn early does not recover from it.
CONTEXT CLASH. Two facts in one window, and a summary that picked.
Turn 3 customer "It was delivered on the 3rd."
Turn 9 customer "Sorry, I checked. It arrived on the 5th."
Turn 12 summary "The parcel was delivered on the 3rd."
The summariser at turn twelve resolved a conflict nobody asked it to resolve, and it picked the earlier fact. Everything after turn twelve now runs on a date the customer corrected. This is the exact failure the conflict rule in the previous page's compression prompt was written to prevent.
The four failure modes set against cause and remedy
| Failure mode | What causes it | How it presents | The move that answers it |
|---|---|---|---|
| Poisoning | A false statement enters the context and is read back | Confident repetition of a figure nothing supports | Write, so every fact carries a source the model did not invent |
| Distraction | Length past the model's useful working range | Repetition of earlier steps and a loss of general knowledge | Compress, and cap the history at a measured length |
| Confusion | Material the step never needed, tool definitions above all | A tool called that has nothing to do with the request | Select, cutting the tools to the ones this intent needs |
| Clash | Two items in the window contradict each other | An answer that follows one of them with no sign of the other | Select the later fact, and make the compressor mark conflicts |
The remedy column is the previous page's four moves with the situations attached. Isolation is missing from it on purpose, since isolation prevents all four at once by giving a subtask a window that never held the bad material, and it pays for that with a handoff.
Why a degraded context still returns an answer
Generation produces a probability distribution over the whole vocabulary at every step, and that distribution always has a most likely token in it. There is no state in which the model has nothing to say. A window holding a poisoned fact, twelve overlapping tools and forty thousand tokens of history still yields a next token, a sentence and a complete paragraph in the right register.
That is what separates this from every other class of defect an engineer is used to. A database with a missing row raises an error. A service that is down returns a status code. A context that has rotted returns prose, and the prose is fluent, appropriately hedged and formatted exactly as the prompt asked. The only way to see it is to measure the answers, which is why module five exists and why so much of this course points at it.
Among the four remedies, one is doing most of the work. Getting the right material into the window and keeping the wrong material out prevents three of the four modes above outright, and the next two pages are about how that selection is actually built.