State Contamination Benchmark
A single, precise, deterministic test: when a false update hits one node of a 100-node dependency graph, does it stay contained, or does it spread to unrelated state? 10,000 trials, fully reproducible, no live model call required.
The real result
| Mean contaminated nodes per trial | Trials with zero contamination | Worst single trial observed | |
|---|---|---|---|
| Isolated Architecture | 0.000 | 10,000 / 10,000 (100%) | 0 |
| Monolithic Shared Context | 1.098 | 4,408 / 10,000 (44.1%) | 11 |
The monolithic side's 44.1% is a proportion from 10,000 repeated trials — the same statistical shape as the NFL tool's win rates, so the same Wilson-interval discipline applies. 95% CI (z=1.96): [43.11%, 45.06%], computed from the real formula, not asserted. The isolated side's 100% doesn't get the same treatment — as the paragraph below states, it isn't a probabilistic finding to put a confidence interval around, it's the mechanical consequence of a write boundary that can't be crossed.
The 0% result on the isolated side isn't a probabilistic finding — it's the direct, mechanical consequence of a write boundary that structurally cannot be crossed, the same guarantee proven formally in Definition 2.2. This benchmark tests whether that guarantee actually holds under simulated adversarial pressure. It does, every single trial.
What's actually being compared
Both systems have identical, complete knowledge of the real dependency graph, and both correctly identify which nodes are legitimate downstream dependents of a corrupted node — that part isn't what's being tested, and both get it right by construction. The difference is what happens to a node's value once it's flagged as potentially affected.
Isolated Architecture: a write targeting node X can only ever touch node X's own storage slot. A real dependent gets marked stale — its trust status changes, its value doesn't.
Monolithic Shared Context: no structural write boundary exists. When the system reconsiders a node, it operates on the full shared context, with a real, documented chance of also mutating nodes it merely processed in the same pass — contextual interference, a real, well-known failure mode in shared-context systems.
The contamination model — every number stated, nothing hidden
A real 1-hop dependent: 35% chance of incorrect mutation in the monolithic system. A 2-hop dependent: 12%. A node with no real dependency relationship, but processed within the prior 5 steps: 4%. Every other node: 0%. These are deliberately modest, stated assumptions, not measured facts and not inflated to guarantee a bigger gap — change them in the downloadable code and rerun; nothing about this comparison is hidden inside a black box.
Get the whole thing — code, data, chart, methodology
↓ Download the complete reproducible bundle (.zip)
Includes the graph generator, the simulation, the chart builder, the real output data, the full written methodology, and a live model-comparison artifact. Fixed random seeds throughout — reruns produce the exact same numbers. Verified independently from a clean extraction before this page was published.
A second, different kind of demonstration — not a static page
The bundle also includes a live, interactive artifact that makes real API calls to compare a protected and unprotected response side by side — with your own prompt, your own dependency graph, and your own declared rules, not just two fixed test cases. The check itself stays a real, deterministic match against rules you set yourself, not a second model's opinion about whether your prompt looks risky. That one isn't a page you can browse to — it needs Claude.ai's artifact environment specifically, since that's what provides real, authenticated model access from the browser. A plain webpage can't do that safely on its own. If you want to see it run, it's built to be opened directly as a Claude artifact, not deployed as a static page — ask for it directly rather than expect to find it linked here as a normal URL.