Context Bleed: why memory without partitions degrades LLM output — and the data-layer fix that doesn't

An abridged technical whitepaper. Distilled from The PROMPTED Framework: A Dual-Axiom Architecture for Bounded-Identity LLM Specialization (PR, 2026). The full report carries the complete literature review, formal treatment, and result tables; this is the argument in brief.

---

The premise: stateless models, and two ways selection fails

Large language models are stateless. A model conditions only on the payload assembled for the current turn (Brown et al., 2020). Everything sold as "memory," "personalization," or "context" reduces to one operation: text and parameters selected and injected into that payload before decoding. The quality of an assistant is therefore the quality of that selection — and selection fails two ways.

The first failure is an underspecified query. How a question is framed conditions what a model can return (Brown et al., 2020; Wei et al., 2022). This is the Question Principle. It is real, well studied, and not the subject here.

The second failure is the one the field has walked into. Memory-augmented assistants now model a user as a single, monotonically growing store of facts, drawn upon for every query regardless of topic or audience (Packer et al., 2023; Park et al., 2023). We name the resulting degraded state Context Bleed, and it is the subject of this paper. The industry's answer to a weak assistant has been remember more. That is the wrong bet.

---

Context Bleed, precisely

Take one workday of one professional who writes: a coaching note to a struggling report, a two-line ask to a CEO, an internal engineering retrospective, and a customer-facing version of that same retrospective. One project, one person — four appropriate registers, disclosure levels, and reference sets. None can substitute for another without professional cost.

Type "draft a status update on Project X" into an assistant backed by a single accumulated store, and it has no principled way to select which update. It weights context by accumulated mass, not present relevance, and returns a compromise calibrated for no one. The query was concrete — this is not a question-quality problem. It is a context-selection problem: the system does not lack information, it lacks separation.

Two established results explain why this actively degrades output rather than merely diluting it:

• Models are distracted by irrelevant context even when told to ignore it. Adding irrelevant material measurably lowers accuracy, and instruction does not reliably suppress the effect (Shi et al., 2023).
• Models use buried information poorly — the "lost in the middle" curve (Liu et al., 2024). Effective context is far shorter than the advertised window (Hsieh et al., 2024).

The mechanism is irrelevance, not volume. More relevant context helps (Xu et al., 2024). So the claim is about relevance selection, not context minimization — which is exactly why "remember more" misses: the harm scales with the irrelevant fraction of the store, and that fraction grows as the store grows.

Two variants matter operationally:

• Domain Bleed — contamination across orthogonal life domains. The engineer who also plays in a band asks "how should I structure this?" — architecture, or a song? One store answers with a blend of both.
• Audience Bleed — collapse of one professional's relational registers into a single undifferentiated voice: the customer deck written with the candor of an internal review. This is grounded in the sociolinguistics of audience design — speakers systematically shift style for their audience (Bell, 1984) — and it is the enterprise-critical variant, because tonal mistargeting carries reputational and compliance cost. A single fused "common ground" spanning all of a user's roles has no analog in human communicative practice.

---

Why the remedy cannot live in the prompt

The intuitive fix — instruct the model to "use only the relevant context" — does not work, and the reason is load-bearing.

Instructions and data cannot be reliably separated by prompting alone. This is the lesson of prompt injection (Willison, 2022) and, sharper, indirect prompt injection, where adversarial instructions embedded in retrieved content execute as if trusted, because the model cannot tell instructions from data (Greshake et al., 2023). The same structural fact defeats "ignore the irrelevant memory": if a model cannot reliably ignore a malicious instruction hidden in a document, it cannot reliably ignore an irrelevant fact hidden in a context block.

The only reliable guarantee that a wrong context is absent is to never place it in the eligible set. That moves the separation boundary off the fragile prompt layer and into the data layer — the central engineering commitment of this framework.

---

The remedy: a partitioned context space, selected not aggregated

Treat context not as a single global state but as a partitioned space of bounded identities, $\mathcal{C} = \{C_1, C_2, \ldots, C_n\}$, and select rather than aggregate. Where memory-augmented systems inject the union $C_{\text{global}} = \bigcup_i C_i$, the framework answers each query against a single selected $C_i$.

The implementation primitive is the Persona: a bounded configuration — profile facts, documents, relational data, memory scope, and behavioral parameters — resolved at the data layer, before the prompt is assembled, driven by the persona's stored configuration rather than by an instruction the model is asked to honor.

In the reference implementation (dequid):

• Documents, people, and conversations are inclusion-tagged: a persona draws only the items tagged to it (default: none).
• Profile facts and memories live in a shared per-user pool, but each persona carries its own scope over that pool, and background extraction auto-tags each new fact to the persona of the conversation that produced it. A persona accrues a bounded memory set from its own chats and, by default, draws only that set — no cross-persona bleed — while the shared pool keeps every fact available for deliberate reuse.

The guarantee, stated precisely: what a persona draws is, by default, only its own, resolved structurally at assembly time. This bounds the eligible set. It does not police content inside an eligible document, so data-only wrapping of user content is retained as defense-in-depth, not as a proof.

---

The control machinery: PROMPTED, SPECS, SEEK

Partitioning decides which context. The framework also specifies how that context is rendered into a payload and how generation is controlled — all operating within a selected partition.

The 8-vector taxonomy (PROMPTED)

Within a selected $C_i$, the injected state is codified into eight explicit vectors, so that ad-hoc prompt tweaking becomes a persistent, reproducible configuration:

1. Profile — persistent identity anchor (identity-bounded)
2. Role — domain / epistemic stance (identity-bounded)
3. Output Constraints — topology, schema, length (identity-orthogonal)
4. Memory — facts extracted within $C_i$ (identity-bounded)
5. Processing Style — reasoning architecture, bound to a reasoning-effort budget (identity-orthogonal)
6. Temporal Context — timezone / local-time grounding (identity-orthogonal)
7. Expressive Tone — interpersonal register, calibrated to $C_i$'s audience (hybrid)
8. Domain Knowledge — retrieval over documents scoped to $C_i$ (identity-bounded)

Five vectors are drawn only from the active partition; three are orthogonal to identity; tone is hybrid. The partition boundary is thus built into the taxonomy, not bolted on.

The SPECS control protocol

SPECS keeps text-injected control distinct from API-parameter control across five layers: Semantics (Role / Style / Tone as prompt strings), Probability (temperature, top-p, penalties, reasoning-effort — surfaced as a first-class axis, respecting provider constraints, not hidden defaults), Execution (context slicing, tool arrays, web-search grounding), Constraints (text instructions plus hard max_tokens), and Security (client-side PII redaction, terminal placement of global instructions to hedge positional degradation). The decoding controls that most systems bury (Holtzman et al., 2020) are, here, exposed.

The SEEK abstraction

Direct parameter manipulation imposes high cognitive load, so SEEK reduces control to four human choices, each with an intensity — Sensitivity (emotional register), Exploration (reasoning mode), Expressiveness (output topology), and Knowledge (domain of expertise). A background model translates the four selections into a scoped system prompt; a deterministic map sets the SPECS API parameters. Novices set words, experts set numbers, both configure the same underlying state. SEEK is a translation layer over SPECS, not a separate system.

The full payload is then deterministically serialized into layered text plus one API layer, every identity-bounded layer drawn only from the active $C_i$, with global instructions placed terminally as the sole unpartitioned layer.

---

The evidence

A pre-registered evaluation measures the payoff directly. Building on a personalization benchmark with per-user profiles and retrieval (LaMP; Salemi et al., 2024), three conditions were compared on audience-stratified generation tasks, with model, decoding parameters, and retrieval budget held constant — the only variable is context selection:

• A — Aggregated: the whole pool globally eligible (a ChatGPT-style memory).
• B — Prompt-scoped: the aggregated store, plus an instruction to use only audience-relevant context.
• C — Partitioned: data-layer persona selection (the framework).

Run across two independent base models (Gemini 3.1 Pro, GPT-5.5), judged by a third-family model to preclude self-preference, with order-swapping and length controls for position and verbosity bias (Zheng et al., 2023). Retrieval fired on 100% of items, so leakage reflects the mechanism, not a model declining to retrieve.

Data-layer partitioning eliminates cross-context leakage. Precision 1.000, zero leaked out-of-partition entities on every record, on both models — while recall is preserved:

The load-bearing point is the decomposition: C wins Contextual F1 by driving precision to 1.0 — zero bleed — while holding recall. Bounded context is not a completeness tradeoff; the worry that scoping starves the model is disconfirmed by the data. On appropriateness, the partitioned condition wins 77.8% of pairwise comparisons against the aggregated baseline on both models (CIs excluding 0.5).

Prompt-level scoping is not enough. Condition B cut leakage by roughly a third but never eliminated it and stayed measurably below C on every metric — exactly as Shi et al. (2023) predicts, and exactly why the remedy belongs in the data layer, not the prompt.

The advantage widens with scale. The aggregated pool grows monotonically as a user accumulates facts, so the opportunity for an out-of-partition entity to surface increases with account age. A partition's eligible set is empty of wrong context by construction, so C's zero-leakage result is scale-invariant. The measured gap is a lower bound — the value at the smallest realistic pool — and the case for partitioning strengthens with real-world use.

What this is, and is not. This is a pilot: n=3 synthetic (human-reviewed) users, 20 scenario-targets per condition per base model, 120 per-item records and 108 pairwise judgments. Confidence intervals are wide. The gold rubric was pre-registered and authored before any response existed, but single-annotated, and judge–human agreement (κ) is not yet computed — so the appropriateness win-rates are uncalibrated against human raters, which is why the objective, judge-free spine (leakage and Contextual F1) carries the primary claim and the judged comparison only corroborates it. That judge is also reference-guided, so it shares a construct with the leakage metric rather than confirming it independently. Temporal degradation was not testable against a fixed pool, and the corpora are synthetic; external validity awaits real, consented users. The result is early and directional, replicated across two independent base models — not a population estimate. A scaled study (n≥10, real consented users, a second annotator, judge–human κ, and a temporal growth condition) is the next rung.

---

Why this matters for you

• Researchers / practitioners. The prompt-scoped condition (B) is a genuine falsification target — a null there would have weakened the case for data-layer enforcement. It didn't fire. The result rests on an objective, judge-free spine (leakage and Contextual F1) and replicates across two base models.
• Enterprise architects. Audience Bleed — the enterprise variant of Context Bleed — is a governance risk: one fused profile writing your customer deck with the candor of an internal review. The posture: data-layer scoping, instruction–data separation as defense-in-depth, and an auditable view of exactly what context every response drew from.

The strongest version of the argument is not this document — it is the working system, where you open the inspector and watch the assembled payload be scoped in real time. This paper answers why it works; the product lets you verify that it does.

---

Selected references

Bell, A. (1984). Language style as audience design. Language in Society, 13(2), 145–204.

Brown, T. B., et al. (2020). Language models are few-shot learners. NeurIPS 2020, 1877–1901. arXiv:2005.14165.

Greshake, K., Abdelnabi, S., Mishra, S., Endres, C., Holz, T., & Fritz, M. (2023). Not what you've signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection. AISec '23. arXiv:2302.12173.

Holtzman, A., Buys, J., Du, L., Forbes, M., & Choi, Y. (2020). The curious case of neural text degeneration. ICLR 2020. arXiv:1904.09751.

Hsieh, C.-P., et al. (2024). RULER: What's the real context size of your long-context language models? COLM 2024. arXiv:2404.06654.

Liu, N. F., et al. (2024). Lost in the middle: How language models use long contexts. Transactions of the Association for Computational Linguistics, 12, 157–173. arXiv:2307.03172.

Packer, C., et al. (2023). MemGPT: Towards LLMs as operating systems. arXiv:2310.08560.

Park, J. S., et al. (2023). Generative agents: Interactive simulacra of human behavior. UIST 2023. arXiv:2304.03442.

Salemi, A., Mysore, S., Bendersky, M., & Zamani, H. (2024). LaMP: When large language models meet personalization. ACL 2024, 7370–7392. arXiv:2304.11406.

Shi, F., et al. (2023). Large language models can be easily distracted by irrelevant context. ICML 2023, PMLR Vol. 202. arXiv:2302.00093.

Wei, J., et al. (2022). Chain-of-thought prompting elicits reasoning in large language models. NeurIPS 2022, 24824–24837. arXiv:2201.11903.

Willison, S. (2022). Prompt injection attacks against GPT-3. simonwillison.net.

Xu, P., et al. (2024). Retrieval meets long context large language models. ICLR 2024. arXiv:2310.03025.

Zheng, L., et al. (2023). Judging LLM-as-a-judge with MT-Bench and Chatbot Arena. NeurIPS 2023, Datasets and Benchmarks Track. arXiv:2306.05685.

---

The PROMPTED Framework, Context Bleed, bounded identity, and the SEEK / SPECS abstractions are the author's own framework, self-published and self-implemented. dequid (web) is the live reference implementation. Free to try, no card.