Context Needs a Reason to Be Trusted

An agent that resists every outside signal can look safe right up until it misses the one fact it needed. The useful question is not whether context gets in. It is whether the agent can tell when that context has earned influence.

The signal

Learning When to Trust via Selective Context Preference Optimization makes that contradiction explicit. The authors build MIST, a human-annotated benchmark that presents each reasoning item in four matched states: no added context, misleading context, correct context, and irrelevant context. Their SC2W measure counts the particularly painful case where a model gets an item right without the added signal, then flips to a wrong answer after seeing a misleading one.

That framing matters because a model can reduce this failure by treating every external signal as noise. The paper instead argues for selective trust. Its SCOPE training method uses matched preference pairs from failures and balances all four conditions, aiming to reduce misleading-context flips while preserving accuracy when the extra context is useful or harmless.

The evidence

The primary paper reports that the models in its benchmark were susceptible to misleading context, and that its balanced training reduced SC2W while preserving performance in the clean, correct-context, and irrelevant-context conditions. This is a stronger question than a simple prompt-injection score because it asks the model to accept good evidence as well as reject bad evidence.

For WTK, that creates a useful testing shape. A governed task can keep the same goal, tool permissions, and expected action while the available evidence changes across those four states. We can then ask two separate questions: did the agent use a source it should have used, and did it still conform to the hard constraints on the resulting action?

The boundary

This is a benchmark and preference-optimization result, not a WTK result. The abstract does not give aggregate effect sizes, dataset size, a production provenance study, or proof that MIST labels cover the messy sources an agent meets outside a controlled set.

It also does not show that WTK packages, source receipts, target projections, or tool authority behave correctly. Training a base model is not the same as governing a package at runtime. A context classifier cannot make an unverified source trustworthy by itself.

The builder impact

Our take: stop treating extra context as either a free upgrade or a universal threat. For an agent that receives documents, tool output, or retrieved records, test helpful, misleading, and irrelevant inputs against the same declared goal. Keep the expected evidence use visible, and record the action that followed.

That makes the tradeoff testable. A system that refuses bad information but also bypasses good information has not solved grounding. It has just moved the failure somewhere quieter.

The WTK test

WTK can run a small four-state fixture matrix without adding a new trust-routing subsystem. Hold the package contract, target, model, tool permissions, and task constant. For every case, retain the source identity, declared relevance, expected action, actual evidence receipt, gate result, and any refusal or degraded outcome.

The fixture should also require a hard-constraint check after evidence selection. A well-cited explanation is not enough if the action violates a required tool, permission, or limit. The result would tell us whether an existing grounding gate distinguishes selective evidence use from blanket resistance, not whether WTK has proven a general solution.

Still unknown

We do not yet know whether this four-state test predicts behavior with real sources, how it travels across targets, or whether selective trust improves governed outcomes under WTK conditions. The next move is a bounded comparison with complete receipts, not a maturity promotion based on external research.