SCOPE Teaches Language Models Selective Trust Instead of Blanket Context Rejection

A model that refuses to follow a bad hint may look robust. But if it also refuses correct retrieval results, that robustness has little practical value. A paper submitted to arXiv on August 6, Learning When to Trust via Selective Context Preference Optimization, reframes the problem from resisting external signals to deciding when those signals deserve trust (paper).

Isolating when context turns a correct answer into a wrong one

The paper introduces MIST, the Misleading Signal Testbed. It contains 1,000 human-reviewed source items: 800 adapted from existing question answering, mathematics, and reasoning benchmarks, plus 200 written by annotators. Each item appears in four tightly matched conditions: a clean prompt with no added context, a misleading context pointing toward a plausible wrong answer, a correct context supporting the gold answer, and an irrelevant context that carries no answer-bearing information. The question, answer space, and gold answer remain fixed.

This design matters because the benchmark does not rely on aggregate accuracy alone. It adds SC2W, a paired metric that counts how often a model answers an item correctly in the clean condition but changes to a wrong answer after receiving a misleading signal. That separates questions the model never knew from questions it knew but allowed context to overturn. The correct and irrelevant controls also expose a deceptive form of robustness: simply ignoring every external signal.

SCOPE changes the organization of preference data, not the loss

SCOPE, or Selective Context Preference Optimization, first mines failures where a base model is correct without a signal and wrong with a misleading one. It then prefers the truth-consistent response over the signal-following response. The method still uses a standard Direct Preference Optimization objective; its central change is to reuse matched preference pairs across all four conditions and balance misleading, clean, correct, and irrelevant contexts equally.

The paper's comparisons explain why balance is essential. Training only on misleading examples can improve resistance while making the model suspicious of useful information. SCOPE is designed to encode two behaviors at the same time: reject bad evidence and retain the ability to benefit from good evidence.

The reported results favor selective trust over blanket defense

Across 23 frontier and open-weight models evaluated in the paper, misleading signals produced correct-to-wrong failures, with an average accuracy loss of 17.1 percentage points. On two trainable bases, SCOPE reduced SC2W from 35.0 to 16.3 on Qwen3-4B and from 31.5 to 20.6 on Llama-3.2-3B. The paper reports no decline in the clean, correct-context, or irrelevant-context controls.

The authors also tested zero-shot transfer on GSM-IC, GSM-Plus, and a set of examples measuring whether models echo an incorrect user belief. Each external dataset contributed 300 items, and none was used for training or model selection. SCOPE was reported as best or tied on all four higher-is-better metrics across both model families.

The most useful contribution here is not another preference-optimization acronym. It is a correction to a common evaluation shortcut: checking whether a model resists bad context without checking whether it can still absorb good context. A useful reasoning model cannot turn caution into blindness.

The paper states clear limits. MIST is a controlled, text-only diagnostic, so its failure rates are not estimates of real deployment prevalence. The mitigation is trained on only two model families. Because most items are adapted from public benchmarks, contamination cannot be completely excluded. The results also do not establish chain-of-thought faithfulness.

The next step in language-model reliability is not merely asking whether a model can refuse. It is asking whether the model knows what deserves to be believed.