Boundary Contamination in LLM Workflows

Asking a model to check its work can improve the answer and still make the returned response unusable. The model corrects the figure, then wraps the corrected answer in commentary that the task forbade. We call any non-whitespace text outside the required deliverable boundary contamination, and we score it separately from whether the deliverable itself is correct. The distinction matters because a workflow that consumes the whole response and a workflow that extracts a payload from it will disagree about whether the same output is acceptable. Three experiments test this: a 576-response product study, a 360-response direct-API factorial, and a held-out probe bank of 300 responses written after the scorer was frozen. On the held-out bank, checking-only instructions produced contamination in 14 of 30 responses for one model and 0 of 30 for another under an identical prompt. A single added clause restating the output format suppressed it in 14 of 14 paired cases, with none in the reverse direction. Deliverable quality was unchanged; only compliance of the response containing it moved. We also audit the instrument that produced these numbers. Of 34 recorded failures, 22 were defects in our own checker rather than in the responses, across five defect classes, and one claimed finding was withdrawn after re-measurement. Two independent raters then adjudicated 47 masked cases against the automated boundary measure and agreed with it on every real case they rated, while disagreeing with it in the same three places on constructed probes that expose a disclosed detection limit. Results come from fixed constructed banks and do not estimate ordinary-use error rates. The contamination effect is conditional on the model and configuration tested; it is not a general property of LLM workflows and not a vendor ranking. This version supersedes v1.33 in the same lineage. The abstract was rewritten, one Study 1 subsection and the evidence-provenance section moved to appendices, section numbering after §9 shifted, and the document was reformatted; no result, count, table, figure or statistic changed. A complete change log accompanies the deposit. The full research evidence archive — the frozen instrument, all raw responses with per-response hashes, the sent request payloads, the original and audited score files with the audit script that maps between them, and the complete Study H adjudication materials — is deposited as a separate linked record.