ArXiv: 2601.07226

🎯 Pitch

Even non-adversarial noise like irrelevant documents can slash top reasoning model accuracy by up to 80% and silently break safety alignment. As agentic AI systems over-trust these distractors, standard fixes fail—but a training strategy that rewards identifying helpful information within the chaos dramatically boosts resilience.

1. Executive Summary

This paper introduces NoisyBench, a benchmark that systematically evaluates how state-of-the-art reasoning models degrade when contextual distractors—random documents, irrelevant chat histories, and hard negative distractors—are injected into otherwise clean inputs across 11 datasets spanning RAG, reasoning, alignment, and tool-use tasks. The authors demonstrate that even non-adversarial noise triggers catastrophic performance drops of up to 80% in models like Gemini-2.5-Pro and DeepSeek-R1, establishes that agentic workflows amplify these errors by over-trusting noisy tool outputs, and shows that prompting, context engineering, and supervised fine-tuning all fail to confer robustness. To address this, they propose the Rationale-Aware Reward (RARE), a training signal that incentivizes models to explicitly identify helpful information within noise by rewarding correct extraction of relevant sources during reasoning, which significantly improves resilience while maintaining clean-setting performance and revealing that distractors induce an inverse scaling trend where increased test-time computation leads to worse accuracy.

2. Context and Motivation

The Core Problem: Clean Benchmarks Create a Dangerous Illusion of Robustness

The central problem this paper tackles is the profound disconnect between how language models are evaluated and how they perform in realistic deployment conditions. Current benchmarks present models with sanitized, well-structured inputs containing exactly the information needed to solve a task—and nothing else. But real-world agentic AI systems encounter input contexts that are inherently noisy: retrieval systems return irrelevant documents, multi-turn conversations accumulate distracting history, and tool outputs contain faulty or misleading information. The paper argues that by evaluating models only in "clean" settings, the field has systematically underestimated their brittleness and overestimated their readiness for deployment in critical domains like healthcare and finance.

This gap matters because it creates a false sense of security. When a model achieves 94% on alignment tasks or 87% on reasoning benchmarks in clean settings (as shown in Table 1 for Gemini-2.5-Pro), practitioners naturally assume it is safe and reliable. But if that same model drops to 60.5% on alignment or 70% on reasoning merely because someone appended an irrelevant chat history to the prompt—with no adversarial intent whatsoever—then the deployment is fundamentally unsound. The paper frames this as not just a performance problem but a safety problem: noise can trigger "emergent misalignment" where guardrails silently fail without any deliberate attack, simply because the model's reasoning becomes confused by extraneous information.

The Agentic Deployment Reality

The paper explicitly ties this problem to the shift from static prediction models to agentic AI systems (Section 2.1). Modern language models increasingly function as agents that use external tools, perform multi-step reasoning, and maintain context across long interactions. The authors cite specific systems and frameworks—WebGPT, React, Toolformer, various function-calling architectures, and memory-augmented systems—that demonstrate this shift. As these agents move into production, they necessarily ingest more information from more sources, and each additional source is a potential vector for noise.

The paper identifies several concrete mechanisms through which noise enters agentic workflows (Section 3.2, Findings 3):

  • Faulty retrieval results: When an agent queries a knowledge base or search index, it rarely receives perfectly relevant documents. Real retrieval systems return documents with varying degrees of relevance, and some are entirely unrelated.
  • Irrelevant conversational history: In multi-turn interactions, prior turns from the user or the agent accumulate in context. Not all of this history is relevant to the current query, but the model must process it nonetheless.
  • Misleading tool outputs: When agents invoke calculators, APIs, or other tools, the outputs may contain errors or be presented alongside extraneous information that distracts from the task.

The key insight is that these are not adversarial scenarios—they are the default operating conditions for any deployed agent. The paper points to studies showing that GPT-4-based function-calling agents succeed in only about 50% of realistic tool-use tasks (citing Yao et al., 2024), further underscoring that current systems are not ready for real-world noise even at the tool-use level, let alone when multiple noise sources combine.

Where Existing Evaluation Paradigms Fall Short

The paper identifies several specific limitations in how prior work has approached this problem:

Clean retrieval benchmarks dominate. Existing long-context and retrieval-augmented generation (RAG) benchmarks predominantly follow the Needle-in-a-Haystack (NIAH) paradigm, where a single relevant piece of information is hidden in a large corpus of irrelevant text. The paper cites several such benchmarks—RULER, HELMET, LongMemEval, NoLiMa, Michelangelo, MRCR—and notes that while these test whether models can find information in long contexts, they do not test whether models can ignore irrelevant but plausible-looking information that actively competes for attention. NIAH tests retrieval capacity; NoisyBench tests resistance to distraction.

Context engineering focuses on efficiency, not robustness. Section 2.2 discusses how recent work on context engineering—techniques for managing and compressing long contexts—has emphasized memorization and throughput over the quality of reasoning in the presence of noise. Methods like memory augmentation, context compression, and architectural innovations for long sequences (Ye et al., 2025; Peng et al., 2023) improve how efficiently models process long inputs, but the paper argues these approaches "emphasize length over contextual quality and thus struggle in realistic environments with noise and distractors." A model might perfectly recall a document in a 1M-token context window, but it might also misattribute information from a distractor document if that distractor shares surface-level features with the query.

No systematic benchmarking of noise robustness. Prior to NoisyBench, the paper argues, there was no comprehensive evaluation that systematically varied noise types (random documents, chat history, hard negatives) across task categories (RAG, reasoning, alignment, tool-use) and measured robustness as a first-class property. Individual studies might have noted that models struggle with irrelevant context in specific settings—for instance, Shi et al. (2024) show that LLMs get distracted by irrelevant information in RAG—but no unified framework existed to characterize how and why distractors cause failures across fundamentally different task types.

Adversarial robustness research addresses a different problem. The paper distinguishes its focus from the jailbreaking and adversarial attack literature. Those lines of work study deliberately crafted inputs designed to bypass safety guardrails or produce specific harmful outputs. The paper's central finding is that even random, non-adversarial content can trigger misalignment and catastrophic errors—a phenomenon the authors call "emergent misalignment" (building on Betley et al., 2025, who studied how adversarial inputs can cause broader alignment failures). This is more concerning than adversarial robustness in some ways because it means models fail under conditions that are not just possible but ordinary in deployment.

The field lacks training methods that address noise robustness. Section 4.1 establishes that existing training paradigms do not solve this problem. Standard supervised fine-tuning (SFT) on noisy data often causes catastrophic forgetting, where the model loses capabilities it had in clean settings without gaining meaningful robustness in noisy ones. Outcome-based reinforcement learning (RL) provides noisy reward signals because the model can arrive at a correct answer through memorized knowledge rather than by correctly processing the noisy context—the reward cannot distinguish between "the model ignored the distractors and reasoned from first principles" and "the model got lucky despite being confused." The paper argues this creates a need for reward signals that explicitly incentivize the reasoning process itself, not just final outcomes.

How This Paper Positions Itself

The paper frames its contribution as filling a critical gap between evaluation methodology and deployment reality for reasoning-capable agentic AI systems. It does not propose to replace clean benchmarks—they remain useful for measuring peak capability—but rather argues that robustness under noise must become a separate, equally important evaluation axis.

The work positions itself at the intersection of several research threads:

  • Agentic AI evaluation: Extending agent evaluation beyond clean settings to include the noisy contexts that real tool use inevitably introduces.
  • Context engineering: Shifting the focus from "can models handle long contexts?" to "can models handle misleading contexts?"
  • Alignment and safety: Arguing that robustness to non-adversarial distractors is a safety property, not just a performance property, because it affects whether alignment guardrails hold under realistic conditions.
  • Reward design for reasoning: Proposing that reward signals should operate at the level of the reasoning process (rationale-aware) rather than only at the outcome level, to teach models not just what to answer but how to process noisy information.

A key conceptual move the paper makes is to frame noise robustness as a distinct capability that is not simply a byproduct of clean-setting performance or model scale. The paper's data in Table 1 shows that stronger models (Gemini-2.5-Pro with 77.8% clean average) can lose more absolute performance than weaker models when distractors are added, and Section 8.3's scaling analysis (Figure 12) shows that simply increasing model size within the Qwen3 family yields diminishing returns for noise robustness. This suggests that robustness is not an emergent property that appears with scale—it must be explicitly taught, which motivates the training methodology in Section 4.

Finally, the paper positions its Rationale-Aware Reward (RARE) not as a competing training objective but as an augmentation to existing outcome-based RL that addresses a specific failure mode: the inability of final-answer rewards to distinguish between correct reasoning and lucky guessing in noisy contexts. By rewarding the model for explicitly identifying which parts of the input context are actually relevant (via extraction into <reference> tags), RARE forces the model to develop the meta-cognitive skill of filtering relevant from irrelevant information—a capability that the paper's attention analysis in Section 5.3 (Figure 8) shows is precisely what distinguishes correct from incorrect predictions under noise.

3. Technical Approach

3.1 Reader Orientation

This paper is primarily a benchmarking and empirical analysis paper that constructs a systematic evaluation framework for measuring how reasoning models degrade under contextual noise, and secondarily a training methodology paper that proposes a specific reward function (RARE) to improve noise robustness. The system being described is not a single trained model but rather a comprehensive evaluation-and-training pipeline: (1) a benchmark (NoisyBench) that injects controlled distractors into existing datasets to measure robustness, (2) a training dataset (NoisyInstruct) that teaches models to filter noise, and (3) a reward function (RARE) that incentivizes explicit identification of relevant information during reinforcement learning. The core problem is that state-of-the-art reasoning models collapse in performance when inputs contain irrelevant documents, chat histories, or plausible-looking but useless information—and that existing training methods (SFT, outcome-only RL, prompting, context engineering) do not fix this. The solution's shape is a rationale-aware training signal that rewards the model not just for getting the right answer but for demonstrating in its chain-of-thought that it correctly identified which parts of the noisy input were actually useful.

3.2 Big-Picture Architecture (Diagram in Words)

The overall system has four major components that operate in sequence:

  1. NoisyBench Construction Pipeline — Takes 11 existing clean benchmarks across RAG, reasoning, alignment, and tool-use categories and creates noisy variants by injecting three types of distractors (random documents from RULER-HotPotQA, random chat histories from WildChat, and synthetically generated hard negative distractors) into each prompt. A two-stage filtering process removes distractors that accidentally contain answers or change the problem. The output is 2,766 question–distractor pairs per setting across four configurations (No Distractor, Random Documents, Random Chat History, Hard Negative).

  2. NoisyInstruct Training Dataset — A separate training corpus built from the NVIDIA Nemotron Nano 2 Post Training dataset that pairs questions with distractors (drawn from different sources than NoisyBench to prevent contamination) and optionally with hints that identify useful information. The dataset has four composition types: answer given question only, answer given question and hint, answer given question and distractor, and answer given question, distractor, and hint. This provides supervised data for teaching models to filter noise.

  3. Reinforcement Learning with RARE — The training pipeline takes a base reasoning model and fine-tunes it using Group Relative Policy Optimization (GRPO). Unlike standard GRPO which receives rewards only for final-answer correctness and formatting validity, RARE adds an additional reward component: the model must extract relevant information into <reference> … </reference> tags, and a judge model (gpt-oss-120b) compares this extraction against a gold reference to assign a binary rationale-aware reward. The combined reward signal is outcome reward plus RARE reward.

  4. Evaluation and Analysis Suite — The trained or baseline models are evaluated on NoisyBench's four distractor settings, with performance measured using task-specific metrics (pass@k for most tasks, pass^k for TauBench) and aggregated via harmonic mean. Supplementary analyses include attention visualization comparing correct vs. incorrect predictions, entropy measurements as distractor count increases, and similarity-binned performance curves.

Information flows as follows: a clean benchmark question enters the NoisyBench pipeline → a distractor is sampled or generated and attached to the question (before the question, to maintain consistency across distractor types) → the full noisy prompt is fed to the model → the model generates a chain-of-thought and final answer → if the model was trained with RARE, its chain-of-thought includes an explicit <reference> extraction of useful information → the final answer is evaluated against the ground truth → performance is aggregated across difficulty bins, distractor types, and task categories.

3.3 Roadmap for the Deep Dive

  • First, the NoisyBench construction process (Section 3.1 of the paper), including distractor types, generation procedures, filtering, and position effects — since the entire paper's empirical claims rest on the validity of this benchmark and understanding how distractors are made is essential to interpreting the results.
  • Second, the NoisyInstruct training dataset construction (Section 4.1), including its four data types and how it avoids contamination with NoisyBench — since this is the supervised data foundation for the training experiments.
  • Third, the reinforcement learning setup, including the GRPO algorithm formulation and the standard outcome-based reward — since RARE is an augmentation to this base RL procedure, not a standalone method.
  • Fourth, the Rationale-Aware Reward (RARE) mechanism in full detail, including the <reference> span extraction, the judge model comparison, and how the combined reward signal is constructed — since this is the paper's core methodological contribution.
  • Fifth, the evaluation protocol, including pass@k and pass^k metrics, the multi-stage correctness checking pipeline with Math-Verify and Gemini-2.5-Pro, and harmonic mean aggregation — since the paper's quantitative claims depend on these measurement choices.
  • Sixth, the analysis tools (similarity computation, entropy measurement, attention analysis) used in Section 5 to explain why distractors cause failures — since these provide the mechanistic evidence for the paper's diagnostic claims about inverse scaling, attention misallocation, and uncertainty.

3.4 Detailed, Sentence-Based Technical Breakdown

This is primarily an empirical benchmarking and training methodology paper whose core idea is that robustness to contextual noise is a distinct capability that must be explicitly measured and explicitly taught, and that reward signals operating on the reasoning process itself (not just final outcomes) are necessary to achieve this robustness.

NoisyBench Construction: Distractor Types, Generation, and Filtering

The benchmark construction begins with 11 existing datasets that span four task categories. The RAG category includes SealQA, MultihopRAG, and Musique; the reasoning category includes BBEH-Mini, AIME25, and GPQA-Diamond; the alignment category includes Model-Written-Evaluations (Self-Awareness and Survival-Instinct subsets) and BBQ; and the tool-usage category includes TauBench v1 (Retail and Airline domains). For each question in these datasets, the benchmark creates four versions: a clean version with no distractors (ND), a version with a random document distractor (RD), a version with a random chat history distractor (RC), and a version with a task-specific hard negative distractor (HN).

Random document distractors are sampled from RULER-HotPotQA, specifically by drawing 100 documents from that corpus and assigning them to each question. These simulate noisy retrieval results from external tools with imperfect accuracy — the kind of irrelevant documents a retriever might return when its similarity scoring is imprecise.

Random chat history distractors are sampled from the WildChat dataset by randomly selecting 20 multi-turn chat histories and assigning them to each question. These simulate real-world chatbot usage where a single conversation session accumulates turns about different topics, and the model must stay focused on the current query despite irrelevant prior exchanges. The paper places these distractors before the question by default, because preliminary experiments showed that placing random chat history after the question causes the model to answer only the last message in the sequence (a separate failure mode), and to maintain consistency across distractor types, all distractors are positioned before the question in all settings.

Hard negative distractors are generated synthetically by prompting an LLM (Gemini-2.5-Pro, using only the final output without the thinking process). The generation format differs by task category. For RAG tasks, the hard negatives already included in the original benchmarks are used directly. For reasoning tasks, the generation prompt asks for distractors that "appear helpful but contain content that is entirely irrelevant to the question." For BBEH-Mini specifically, distractors take the form of plausible documents that do not contribute to solving the problem. For AIME 2025 and GPQA-Diamond, distractors are irrelevant documents based on the concepts mentioned in each question. For alignment tasks, distractors are designed to resemble the question's theme but contain completely unrelated context when examined closely.

The hard negative generation faces two critical constraints. A valid hard negative must not change the correct answer to the original question (otherwise the benchmark's ground truth becomes invalid), and it must not explicitly contain the gold answer (otherwise the problem becomes trivial). To enforce these constraints, the paper applies a two-stage iterative filtering process using Gemini-2.5-Pro with multi-turn prompting. In the first stage, the model receives the question, gold answer, and generated distractor and evaluates whether the distractor "preserves consistency and does not alter the original question." If consistency fails, the sample is discarded. In the second stage, the model checks whether the distractor "includes or implies the correct answer." If it does, the sample is discarded. After this two-stage filtering, 2.7% of the total samples are removed, yielding 2,766 valid question–distractor pairs. The final benchmark pairs all 2,766 questions with random documents, random chat histories, and hard negative distractors, producing 2,766 examples per setting.

After assigning distractors, an additional contamination check is run for the random distractor settings. Using both LLM prompting and rule-based inspection (similar to the hard negative filtering procedure), the pipeline verifies that no question or relevant information appears inside the random distractors. The paper reports that no contamination issues were detected in the random distractor set.

The default distractor position is before the question. The paper's position analysis (Section 8.2, Figure 11) shows that this choice matters: placing distractors after the question produces the largest performance drop when random chat history is the distractor type, but placing random documents or hard negative distractors before the question also causes degradation because "the model seems to lose the question while reading long distractors before producing an answer." The paper recommends a general principle for context construction: the question should appear at the end of the context, and any information retrieved from tools should appear before the question.

NoisyInstruct Training Dataset Construction

The NoisyInstruct dataset is designed to expose models to diverse noise during training and to provide the supervision signals needed for RARE. It is built from the NVIDIA Nemotron Nano 2 Post Training dataset, which covers Math (from OpenMathInstruct and AIMO), Coding (from OpenCodeReasoning), Science (from Genetic), Conversation (from LMSYS-Chat-1M, WildChat, and Nemotron chat data), Safety (from Aegis2, pruning datasets, JailbreakV, and Gretel safety alignment data), and Multilingual tasks. This broad domain coverage is intended to teach models to filter noise across diverse task types.

The dataset has four components per example: question (Q), answer (A), hint (H), and distractor (D). Four composition types are constructed by combining these elements: (A|Q) (answer given question only, a clean baseline), (A|Q,H) (answer given question and hint, teaching the model to use helpful signals), (A|Q,D) (answer given question and distractor, teaching the model to ignore noise without explicit guidance), and (A|Q,D,H) (answer given question, distractor, and hint, teaching the model to identify helpful information within noise — the key composition for RARE training).

Random document distractors for NoisyInstruct are extracted from the Natural Questions dataset (Kwiatkowski et al., 2019), which is distinct from the RULER-HotPotQA source used in NoisyBench. Random chat distractors are extracted from the chat split of the NVIDIA Nemotron Nano 2 Post Training dataset, distinct from the WildChat source used in NoisyBench. This source separation is deliberate to prevent data contamination — the paper explicitly checks for accidental overlap and confirms that no documents or chat histories appear in both training and evaluation sets.

Hard negative distractors for NoisyInstruct are generated synthetically using the same procedure as NoisyBench (prompting Gemini-2.5-Pro, then applying the two-stage consistency and answer-containment filtering). The paper notes that no identical or overly similar hard negatives were found between NoisyInstruct and NoisyBench, likely because the training questions (from the Nemotron Nano 2 dataset) differ substantially from the benchmark questions. A similarity analysis using cosine similarity between sentence embeddings (Section 8.4, Figure 13) confirms that question-level similarity between the two datasets is 24.1%, random document and random chat distractor similarity is 15.1% and 17.3% respectively, and hard negative distractor similarity is 31.4% — all well within the range considered effectively unrelated distributions.

Hints are generated synthetically for tasks that do not provide explicit reference information (such as RAG tasks), following a process similar to hard negative generation. Crucially, hints undergo an additional filtering step using Gemini-2.5-Pro as an LLM-as-a-judge: the model flags and removes any hint that "includes the correct answer or makes the task trivial." This ensures that hints provide useful structural guidance (pointing to which parts of context are relevant) without inadvertently giving away the answer.

The resulting NoisyInstruct dataset is provided in four size tiers: a 4.5K "super-tiny" set, a 45K "tiny" set, a 450K "small" set, and a 4.5M "full" set. The paper does not specify which tier is used for the reported training experiments. For SFT, the training data includes distractors along with reference information that helps solve the question, and the model is trained to produce both the answer and the reference.

Reinforcement Learning Setup: GRPO and Outcome-Based Rewards

The reinforcement learning experiments use the Group Relative Policy Optimization (GRPO) algorithm, implemented via the VeRL library, with gpt-oss-120b serving as the reward model. The GRPO objective is:

JGRPO(θ)=E[q∼P(Q),{oi}i=1G∼πθold(O∣q)]1G∑i=1G1∣oi∣∑t=1∣oi∣{min⁡[πθ(oi,t∣q,oi,<t)πθold(oi,t∣q,oi,<t)A^i,t,clip(πθ(oi,t∣q,oi,<t)πθold(oi,t∣q,oi,<t),1−ε,1+ε)A^i,t]−βDKL[πθ∣∣πref]}\mathcal{J}_{GRPO}(\theta) = \mathbb{E}\left[q \sim P(Q), \{o_i\}_{i=1}^{G} \sim \pi_{\theta_{old}}(O|q)\right] \frac{1}{G}\sum_{i=1}^{G} \frac{1}{|o_i|}\sum_{t=1}^{|o_i|} \left\{\min\left[\frac{\pi_{\theta}(o_{i,t}|q, o_{i,<t})}{\pi_{\theta_{old}}(o_{i,t}|q, o_{i,<t})}\hat{A}_{i,t}, \text{clip}\left(\frac{\pi_{\theta}(o_{i,t}|q, o_{i,<t})}{\pi_{\theta_{old}}(o_{i,t}|q, o_{i,<t})}, 1-\varepsilon, 1+\varepsilon\right)\hat{A}_{i,t}\right] - \beta \mathbb{D}_{KL}[\pi_{\theta} || \pi_{ref}]\right\}

where $q$ is a question sampled from the question distribution $P(Q)$, $G$ is the number of rollouts (set to 3), $\{o_i\}_{i=1}^{G}$ are the sampled outputs from the old policy $\pi_{\theta_{old}}$, $|o_i|$ is the number of tokens in the $i$-th output, $\pi_{\theta}(o_{i,t}|q, o_{i,<t})$ is the probability of token $t$ in output $i$ under the current policy, $\hat{A}_{i,t}$ is the estimated advantage for that token (computed from the group-relative rewards), $\varepsilon$ controls the clipping range, and $\beta \mathbb{D}_{KL}[\pi_{\theta} || \pi_{ref}]$ is a KL-divergence penalty against a reference policy to prevent the policy from drifting too far from its initial behavior.

What it computes: For each training question, the current policy generates $G=3$ candidate outputs. Each output's tokens receive an advantage estimate $\hat{A}_{i,t}$ based on how its reward compares to the mean reward across the group of $G$ rollouts (GRPO's group-relative advantage, as opposed to PPO's value-function-based advantage). The objective then increases the probability of tokens that received positive advantages (the good outputs) and decreases the probability of tokens that received negative advantages (the bad outputs), with clipping to prevent overly large policy updates. The KL penalty term $\beta \mathbb{D}_{KL}$ keeps the policy close to a frozen reference model, preventing catastrophic forgetting. The $\min$ operation inside the expectation implements PPO's clipped surrogate objective: it takes the minimum of the unclipped and clipped probability ratios to create a pessimistic bound on the policy update.

Why this form: GRPO removes the need for a separately trained value function (critic) by using the group of rollouts themselves to estimate the baseline for advantage computation — this reduces memory and compute requirements, which matters for the 30B model training where "memory constraints require using an entire node with eight GPUs." The clipped surrogate objective prevents destructively large policy updates that could cause the model to lose its base reasoning capabilities. The KL penalty to the reference policy is particularly important in this setting because the training data (NoisyInstruct) is noisy by design, and without this regularization, the model could drift toward degenerate behaviors (as the SFT results in Table 2 demonstrate, where fine-tuning without RL regularization causes catastrophic forgetting and actually reduces noise robustness).

The outcome-based reward (OR) that the GRPO training receives is composed of two components: correctness of the final answer and formatting validity. No reward is assigned for retrieving or identifying references — the reward signal is purely on the final output. The gpt-oss-120b model serves as the judge that evaluates whether the generated answer is correct, using an LLM-as-a-judge framework. The paper notes that this approach is "inspired by gunjal2025rubrics" and is necessary because NoisyInstruct primarily contains free-form generation tasks where correctness cannot be verified with simple string matching or unit tests.

The key limitation of outcome-only rewards, as the paper diagnoses, is that the reward signal cannot distinguish between "the model correctly reasoned using the noisy context" and "the model arrived at the right answer through memorized parametric knowledge while being confused by the distractors." A model might produce a correct answer but its chain-of-thought reveals that it was misled by a hard negative distractor and only got lucky because its memorized knowledge overrode the confusion. The outcome reward treats this as a success, providing no gradient toward actually filtering noise. This is the motivation for adding RARE.

Training hyperparameters: the rollout count $G$ is set to 3, generated using the vLLM library. Training batch size is 32, maximum prompt length is 4096 tokens, maximum response length is 8192 tokens, and the learning rate is $1 \times 10^{-6}$. For the 4B and 8B models, four GPUs are allocated to the reward model and four to the actor model. For the 30B model, multi-node training is used with eight GPUs per node. All training uses DeepSpeed ZeRO-3 for efficient optimization in bf16 precision.

The supervised fine-tuning (SFT) baseline uses the LLaMA-Factory library with a cutoff length of 8192 tokens, per-device train batch size of 1 across 8 GPUs, gradient accumulation steps of 1, learning rate of $1 \times 10^{-5}$, one training epoch, cosine learning rate scheduler with warmup ratio of 0.1, and bf16 precision.

Rationale-Aware Reward (RARE): Design, Mechanism, and Integration

RARE is an additional reward component that is added to the standard outcome-based reward during GRPO training. It addresses the core limitation of outcome-only rewards: the inability to supervise the reasoning process itself and distinguish between genuine noise-filtering and lucky correct answers.

The mechanism works in three steps. First, the model is trained (or prompted during RL rollouts) to wrap any information it identifies as relevant to solving the question inside <reference> … </reference> XML-style tags within its chain-of-thought. The format is analogous to how some models use <search> or <quote> tags for tool outputs or citations — it is an explicit, machine-parseable marking of which spans of the input context the model is treating as useful. Second, a judge model (gpt-oss-120b, the same model used for outcome reward evaluation) receives the model's extracted <reference> content along with a gold reference that specifies what the helpful information actually was. The gold reference is the hint from NoisyInstruct for compositions that include hints (A|Q,H) and (A|Q,D,H), or can be derived from the original clean context for compositions without explicit hints. Third, the judge model compares the extracted content to the gold reference and assigns a binary reward: 1 if the extraction correctly identifies the helpful information (by paraphrasing or copying it), and 0 otherwise.

The total reward for a rollout during RARE training is:

Rtotal=Routcome+RRARER_{\text{total}} = R_{\text{outcome}} + R_{\text{RARE}}

where $R_{\text{outcome}} \in \{0, 1\}$ is the binary correctness reward from the outcome judge and $R_{\text{RARE}} \in \{0, 1\}$ is the binary rationale-aware reward from the reference-extraction comparison.

What it computes: For each rollout, the model gets a correctness reward if its final answer matches the ground truth, plus a rationale reward if its <reference> extraction matches the gold hint. The two rewards are additive, meaning a rollout can receive a total reward of 0 (neither correct nor good extraction), 1 (correct answer but poor extraction, or good extraction but wrong answer), or 2 (both correct answer and good extraction). This additive structure means the RARE signal provides gradient even when the final answer is wrong — if the model correctly identified the relevant information but still produced an incorrect answer, it receives positive reinforcement for the extraction behavior while receiving no reward for the answer. Conversely, if the model got the right answer but failed to extract the right references (perhaps because it relied on memorized knowledge), it receives only the outcome reward, creating a relative disadvantage compared to rollouts that both answer correctly and extract correctly.

Why this form: The additive structure matters because it avoids the common failure mode of outcome-only rewards where the model has no incentive to demonstrate its reasoning process. A purely multiplicative combination (reward = outcome × rationale) would give zero reward whenever either component is zero, which would (a) provide no learning signal when the model extracts correctly but answers incorrectly — exactly the behavior we want to encourage, since it means the model is learning to filter noise but needs to improve its reasoning from the filtered information — and (b) harshly penalize correct answers that happen to have poorly formatted references, discouraging the model from attempting extraction at all. The additive structure creates a partial credit scheme: good extraction is rewarded independently of answer correctness, which allows the model to learn the filtering skill even while its answer accuracy is still improving.

The paper provides direct evidence for this mechanism through reward dynamics analysis (Section 4.2, Findings 6, and Figure 4). During RL training, the RARE-trained model shows a decreasing proportion of distracted chains-of-thought (as measured by an unspecified metric, presumably the fraction of reasoning tokens that reference or discuss distractor content) while simultaneously showing an increasing outcome-based reward. This suggests that the model is learning to filter noise first, and that this improved filtering then enables better answer accuracy — rather than the model improving accuracy while remaining confused, which would be the outcome-only reward pattern. The paper reports that "training with RARE reduces the proportion of distracted chains of thought while simultaneously increasing outcome-based rewards," and that "the final accuracy under RARE surpasses that of models trained with OR alone." The qualitative examples in Appendix Figures 43 and 44 show the difference: the OR-only model's chain-of-thought gets confused by distractors and wanders, while the RARE-trained model explicitly identifies which parts of the context are noise and reasons from the clean subset.

The judge model (gpt-oss-120b) runs as a separate process during training, with dedicated GPU allocation (4 GPUs for the judge model, 4 GPUs for the actor model in the 4B and 8B training runs). The paper does not specify the exact prompt template used for the RARE comparison, but the general structure follows the multi-stage evaluation approach: the judge receives the model's <reference> extraction and the gold hint, and returns a binary decision. The paper notes that this approach is "inspired by prior work (commandr; comanici2025gemini)" which also trained models to cite or extract relevant information.

A subtle design choice: RARE does not require the extraction to be exact. The judge model paraphrases or copies — meaning semantic equivalence is accepted, not just string matching. This is necessary because the gold hints are synthetically generated and may use different phrasing than what the model naturally produces. If RARE required exact string matching, the reward signal would be too sparse to learn from effectively.

Evaluation Protocol: Metrics, Multi-Stage Checking, and Aggregation

The evaluation protocol is designed to handle the variability inherent in reasoning model outputs while maintaining reliability comparable to standard benchmarks. The paper follows the default evaluation settings of each original benchmark where possible, with two modifications: using pass@k instead of accuracy for benchmarks that originally use accuracy, and adding a multi-stage correctness checking pipeline.

Pass@k and Pass^k metrics. For most benchmarks, the paper uses pass@k, defined as:

Pass@k=1T∑i=1T(1−(ni−cik)(nik))\text{Pass@k} = \frac{1}{T}\sum_{i=1}^{T} \left(1 - \frac{\binom{n_i - c_i}{k}}{\binom{n_i}{k}}\right)

where $T$ is the number of test problems, $n_i$ is the total number of samples generated for problem $i$, $c_i$ is the number of correct samples among those $n_i$, and $k$ is the number of samples considered. The term $\frac{\binom{n_i - c_i}{k}}{\binom{n_i}{k}}$ is the probability that a random subset of $k$ samples contains no correct answers; subtracting from 1 gives the probability that at least one of the $k$ samples is correct. This is the standard unbiased estimator of pass@k from Chen et al. (2021).

What it computes: For each problem, the model generates $n_i$ samples (typically at temperature 0.6 and top-p 0.95 to enable diversity). The metric estimates what fraction of problems would be solved if we were allowed $k$ attempts and could check whether any attempt was correct. This is more robust than single-sample accuracy for reasoning models because these models can exhibit high variance in their outputs — a model might solve a problem 70% of the time but still fail on any given single attempt. Pass@k captures the model's latent capability more reliably than single-answer accuracy.

Why this form: The unbiased estimator using binomial coefficients corrects for the fact that we observe only $n_i$ samples per problem rather than the full distribution. If we simply counted whether any of the $n_i$ samples were correct, we would underestimate pass@k when $n_i$ is small and overestimate when $n_i$ is large. The binomial coefficient formulation provides an unbiased estimate regardless of $n_i$.

For TauBench (the tool-usage benchmark), the paper uses the pass^k metric defined in the original benchmark:

Pass^k=Etask[(ck)(nk)],where(ck)={0,c<kc!k!(c−k)!,c≥k\text{Pass\textasciicircum k} = \mathbb{E}_{\text{task}} \left[ \frac{\binom{c}{k}}{\binom{n}{k}} \right], \quad \text{where} \quad \binom{c}{k} = \begin{cases} 0, & c < k \\ \dfrac{c!}{k!(c-k)!}, & c \geq k \end{cases}

This is a stricter metric that requires at least $k$ correct samples for the problem to be considered solved, rather than just one correct sample among $k$ attempts as in pass@k.

For benchmarks that already use pass@k, the paper keeps the original $k$ values unchanged. For benchmarks that do not define pass@k, $k$ is set to 8. For pass@1 evaluation, temperature is set to 0.0 (greedy decoding) to increase reliability. For pass@k with $k \geq 2$, temperature is 0.6 and top-p is 0.95.

Multi-stage correctness checking. To increase evaluation reliability, the paper uses a two-stage pipeline for determining whether a generated answer is correct. In the first stage, the Math-Verify library (from HuggingFace, designed for evaluating mathematical reasoning outputs) checks the answer. If the answer is judged correct at this stage, it is accepted. If it is marked incorrect, a second stage runs: Gemini-2.5-Pro (with the thinking process removed, to reduce variance and cost) re-evaluates the final answer using an LLM-as-a-judge approach. This two-stage design catches cases where the rule-based Math-Verify checker fails to recognize a correct answer expressed in an unconventional format, while avoiding the cost of running the LLM judge on answers that are unambiguously correct.

The paper uses the harmonic mean to aggregate scores across the 11 datasets into a single average metric per row in Table 1 and Table 2. The harmonic mean is used rather than the arithmetic mean because it penalizes very low scores more heavily — a model that gets 0% on one task and 100% on another would have an arithmetic mean of 50% but a harmonic mean near 0%. This is appropriate for robustness evaluation because a model that completely fails on one task category is not "halfway robust" — it has a critical vulnerability.

Hyperparameters for evaluation. Max output tokens is set to the maximum available value after subtracting the input length from each model's context window (which varies across models). For models that support configuring reasoning effort, it is set to "high" to fully utilize their reasoning capability. The paper runs inference on local GPUs for Qwen3-4B-Thinking-2507, DeepSeek-R1-Distill-Llama-8B, and Qwen3-30B-A3B-Thinking-2507; uses the Google Gemini API for Gemini-2.5-Pro and Gemini-2.5-Flash; and uses the Together AI API for DeepSeek-R1-0528 and gpt-oss-120b.

Analysis Tools: Similarity Binning, Entropy Measurement, and Attention Visualization

The paper's Section 5 employs three analysis techniques to explain the mechanistic causes of distractor-induced failures.

Similarity-bin analysis (Section 5.1). For each question–distractor pair, the paper computes the semantic similarity between the question and the distractor using a pretrained sentence encoder (the specific encoder is not named in the main text) and cosine similarity between their embeddings. Similarity scores are then normalized and partitioned into five equally sized bins, from Bin 1 (lowest similarity) to Bin 5 (highest similarity). For each bin, the paper measures both the average model accuracy and the average number of reasoning tokens generated. This binning reveals the correlation between distractor similarity and both performance degradation and reasoning inefficiency.

The choice of five bins matches the quintile-based difficulty binning used in some prior scaling analyses, and the equal-size constraint ensures that no bin is dominated by a small number of outliers. The analysis is run across multiple models and benchmarks, with results shown in Figure 5 and Figure 6.

Entropy measurement (Section 5.2). To quantify how distractors affect output confidence, the paper measures token-level entropy while varying the number of hard negative distractors from zero to ten per question. For each generated answer, the model's top-ten log probabilities are extracted for each output token. Token-level entropy is computed from these top-ten probabilities, averaged across tokens, and then the final score is computed using only the ten tokens with the highest token-wise entropy values. This "worst-ten" aggregation is intended to capture the most uncertain moments in the generation — the tokens where the model was most conflicted about what to say — rather than averaging out the uncertainty across many confident tokens.

The entropy increases monotonically with distractor count across all tested benchmarks (Figure 7), providing quantitative evidence that distractors do not just cause wrong answers but also create internal uncertainty and confusion during the generation process.

Attention analysis (Section 5.3). The paper uses the misleading-math dataset from Gema et al. (2025), which takes simple arithmetic problems and adds irrelevant but superficially related information. For example, a prompt about owning a cat and a dog might have an appended sentence about statistical probabilities involving the cat and dog's weights, which shares surface vocabulary with the problem but provides no useful information for solving it. Using Qwen3-4B-Thinking-2507, the paper records attention patterns during answer generation and compares attention distributions between samples that produced correct answers and samples that produced incorrect answers.

The key measurement is the proportion of attention assigned to distractor tokens versus task-relevant tokens. Figure 8 shows that incorrect predictions assign substantially more attention to distractor tokens than correct predictions. This provides mechanistic evidence that failure under noise is not just an outcome-level phenomenon — it manifests at the attention level, where the model's internal information routing disproportionately focuses on misleading signals rather than filtering them out. The paper frames this as evidence that future approaches need to "suppress harmful attention to distractors during reasoning," and the RARE training objective can be understood as doing exactly this at the behavioral level: by rewarding the model for correctly identifying which information is useful, it incentivizes attention patterns that route away from distractors.

Agentic Workflow Implementation

For the agentic workflow experiments (Section 3.2, Findings 3), the paper extends the base reasoning models with tool-using capabilities using the smolagents library. The workflow gives the model access to tools such as retrievers and calculators, and the model must decide when to invoke tools, process their outputs, and incorporate results into its reasoning. The evaluation compares the agent's performance (with tools) against the base model's performance (without tools) across the four distractor settings (ND, RD, RC, HN).

The paper identifies three specific mechanisms of agentic failure under noise (Section 3.2, Findings 3 paragraph): (1) agentic workflows encourage models to trust tool outputs and contextual signals, causing the system to treat distractors as reliable evidence; (2) multi-step planning amplifies error propagation, since distractor-induced partial hypotheses reenter later planning steps; (3) noise corrupts tool routing, leading the agent to repeatedly call retrievers or other tools based on contaminated context and accumulate even more irrelevant information. The quantitative results (Figure 2) show that while agentic workflows improve performance in the clean setting (ND), they consistently underperform the base reasoning model in noisy settings (RD, RC, HN) — a reversal that underscores the fragility of current tool-use architectures to input noise.

Context Engineering Baseline Implementation

The paper evaluates three context engineering methods as baselines for improving noise robustness (Section 4.2, Findings 4): Genetic-Pareto (GEPA), Dynamic Cheatsheet (DC), and Agentic Context Engineering (ACE). All three are implemented using their official GitHub repositories with Gemini-3 as the reflection/engineering language model. For GEPA, the seed prompt is initialized with the same prompt used in the prompting baseline. For DC, the DynamicCheatsheet_Cumulative setting is used, which improves the prompt cumulatively over rounds, starting from an empty cheatsheet. For ACE, the default configuration is retained: 1 epoch, maximum 3 rounds, curator frequency of 1, evaluation step of 100, online evaluation frequency of 15, save steps of 50, and playbook token budget of 80,000.

The results (Figure 3) show that context engineering methods provide limited gains over the base model under noisy distractors. The paper diagnoses that CE "often removes noise only partially and sometimes discards information needed for the task" and that "since CE itself relies on LLMs, it also becomes vulnerable to noisy inputs and fails to organize context reliably." This negative result motivates the need for training-based approaches (SFT and RL) rather than inference-time context manipulation.

Summary of Design Choices and Their Justifications

  • Two-stage hard negative filtering (consistency check then answer-containment check) over single-stage: ensures distractors are both valid (don't change the problem) and non-trivializing (don't give away the answer), which are orthogonal requirements that a single prompt cannot reliably enforce simultaneously.
  • Distractor-before-question default positioning over after-question: avoids the separate failure mode where models answer only the last message when chat history distractors follow the question, and provides consistency across distractor types for fair comparison.
  • Separate data sources for NoisyBench and NoisyInstruct distractors (RULER-HotPotQA vs. Natural Questions, WildChat vs. Nemotron chat): prevents data contamination so that training improvements reflect genuine noise robustness rather than memorized distractor patterns.
  • Additive RARE reward (outcome + rationale) over multiplicative or replacement: provides partial credit for correct extraction even when the answer is wrong, enabling the model to learn filtering before answer accuracy improves, and avoids punishing correct answers with poorly formatted references.
  • Multi-stage correctness checking (Math-Verify then Gemini-2.5-Pro) over single-stage: combines the efficiency and reliability of rule-based checking for unambiguous answers with the flexibility of LLM judging for edge cases, reducing both evaluation cost and error rate.
  • Harmonic mean aggregation over arithmetic mean: appropriately penalizes catastrophic failures on individual task categories, reflecting the risk profile of deployed systems where a single vulnerability can be fatal regardless of average performance.
  • Pass@k over single-sample accuracy: accommodates the high output variance of reasoning models, providing a more stable estimate of latent capability that is less sensitive to sampling noise.
  • GRPO over PPO: removes the need for a separately trained value function, reducing memory and compute requirements for training the 30B model where resources are constrained.
  • Binary RARE reward (semantic equivalence, not exact match) over continuous similarity score: provides a clear, interpretable signal that is less susceptible to reward hacking than a continuous score, while the paraphrase-or-copy allowance prevents the reward from being too sparse to learn from.
  • Four-tier NoisyInstruct (4.5K, 45K, 450K, 4.5M) over a single fixed-size dataset: enables future work to study data scaling effects for noise robustness training without requiring full dataset reproduction.

4. Key Insights and Innovations

Innovation 1: Noise Robustness Is a Distinct Capability, Not an Emergent Byproduct of Scale or Clean Performance

The paper's most fundamental conceptual contribution is the demonstration that robustness to contextual distractors constitutes a separate axis of model capability that is not predicted by clean-setting performance and does not reliably emerge with increased model scale. Before this work, the dominant assumption—implicit in how benchmarks were designed and models were deployed—was that a model that performs well on clean inputs will naturally maintain that performance under mild distribution shifts like noisy retrieval or irrelevant conversation history. The field treated robustness as a second-order concern, something that would presumably improve as models got larger and more capable.

This paper systematically demolishes that assumption with multiple lines of evidence. Table 1 shows that Gemini-2.5-Pro, the strongest model in the evaluation with a 77.8% clean-setting harmonic mean, still loses 38.3% of its relative performance when hard negative distractors are introduced—more than the 30.3% relative loss of gpt-oss-120b, a weaker model. The model with the highest clean accuracy is not the most robust; in fact, DeepSeek-R1-0528 shows a 34.2% drop on hard negatives despite its strong clean performance (72.4%), while Qwen3-30B-A3B-Thinking-2507 at a lower 58.8% clean average shows a 40.5% drop. The relationship between clean accuracy and noise-induced degradation is not monotonic. Section 8.3 (Figure 12) provides complementary evidence: within the Qwen3 family, scaling from 0.6B to 32B parameters improves noise robustness, but the gains diminish sharply beyond 8B—the 14B and 32B models show "nearly identical" robustness despite a more than 2× increase in parameters. Scale helps, but with rapidly diminishing returns and without closing the gap to clean-setting performance.

This finding repositions noise robustness from an implicit hope to an explicit design target. It implies that practitioners cannot assume that deploying a larger or cleaner-trained model will solve the problem of noisy deployment contexts—they must measure robustness directly and potentially train for it explicitly. This is analogous to the shift in computer vision where researchers realized that ImageNet accuracy did not predict robustness to natural distribution shifts (Taori et al., 2020), and that robustness required dedicated benchmarks and training interventions. The paper makes the same conceptual move for reasoning-capable language models operating in agentic contexts.

The innovation is fundamental rather than incremental because it changes the evaluation ontology. Before NoisyBench, the field's evaluation framework had a single axis (task performance on clean inputs). After NoisyBench, the framework requires a second axis (robustness under noise), and the two axes are demonstrably not collinear. This is not a refinement of existing benchmarks—it is a new dimension of capability that existing benchmarks were blind to.

Innovation 2: Non-Adversarial Noise Triggers Emergent Misalignment, Redefining the Safety Surface

The paper makes a conceptually sharp and practically alarming finding: random, non-adversarial distractors are sufficient to bypass alignment guardrails and trigger misaligned behavior. Table 1 shows that Gemini-2.5-Pro drops from 94.0% to 60.5% on the BBQ bias benchmark when random chat history is added to the prompt, and DeepSeek-R1-0528 drops from 93.0% to 33.7%. These distractors contain no hate speech, no deliberate attempts to circumvent safety training, and no adversarial design—they are simply irrelevant multi-turn conversations sampled from WildChat. And yet they cause models that were demonstrably aligned in clean settings to produce biased or misaligned outputs at dramatically higher rates.

This finding extends the concept of "emergent misalignment" introduced by Betley et al. (2025), who showed that adversarial attacks on one capability dimension could cause broader alignment failures. The conceptual advance here is that the trigger need not be adversarial at all. The paper shows that the misalignment surface is much larger than previously understood: it is not just adversarial prompts that can break alignment, but ordinary noise of the kind that agentic systems encounter routinely during retrieval, multi-turn interaction, and tool use.

What makes this a genuine innovation rather than an incremental safety finding is its redefinition of the threat model. The AI safety community has predominantly focused on adversarial robustness—deliberately crafted inputs designed to jailbreak models or elicit harmful outputs. This paper demonstrates that the safety problem is more fundamental: alignment guardrails are fragile to any input that confuses the model's reasoning, whether malicious or not. This suggests that alignment techniques trained and evaluated on clean inputs may be operating on a fragile learned heuristic ("follow the user's instructions when the input looks clean and coherent") rather than a robust principle ("maintain these values regardless of context"). When noise disrupts the surface features the alignment heuristic relies on, the guardrail silently fails. The paper's jailbreaking analysis in Section 8.8 (Table 3) adds an intriguing wrinkle: distractors sometimes increase refusal rates on jailbroken prompts while not increasing refusal on harmless inputs (Figure 17), suggesting that noise can also amplify safety signals in certain contexts. This bidirectional effect—noise can break alignment or paradoxically strengthen it depending on context—indicates that the interaction between distractors and safety training is more complex than simple degradation.

The significance of this innovation extends beyond raw performance numbers: it implies that deploying agentic AI systems in noisy environments requires fundamentally rethinking how alignment is evaluated and enforced. Current red-teaming and safety evaluation practices that test models on clean, carefully constructed prompts may be systematically underestimating real-world risk.

Innovation 3: The Inverse Scaling Law Under Noise—Why More Compute Makes Things Worse

The paper discovers and empirically characterizes a counterintuitive phenomenon: in the presence of distractors, increased test-time computation (longer reasoning trajectories) leads to worse accuracy, not better. This finding, presented in Section 5.1 and Section 8.7 (Figure 16), inverts the standard scaling narrative for reasoning models. The dominant assumption in the field—reinforced by work on chain-of-thought prompting, test-time compute scaling (Snell et al., 2024), and reasoning length extension—is that letting models think longer improves their outputs, especially on hard problems. The paper shows that this assumption breaks when the input contains distractors.

The mechanism is revealed through the similarity-bin analysis (Section 5.1, Figure 5): as distractor similarity increases, the model generates more reasoning tokens (it spends effort examining the distractors to determine their relevance) while simultaneously producing less accurate answers. Figure 6 confirms that this increased reasoning is not an artifact of longer inputs—output length shows a weak negative correlation with distractor length—but rather reflects the model "mistaking similar distractors for informative content." The model thinks more but thinks worse, because its additional reasoning cycles are spent on dead-end investigations of irrelevant information rather than on productive problem-solving. The entropy analysis (Section 5.2, Figure 7) corroborates this: as more distractors are added, output entropy rises monotonically, indicating that the model becomes progressively more uncertain and confused, not more confident in its (incorrect) answers.

This finding has immediate practical implications for deployment strategies that rely on test-time compute scaling. If an agentic system encounters a noisy retrieval result and responds by generating a longer chain-of-thought (as current reasoning models are incentivized to do), it may actively harm its own accuracy. The paper frames this as a warning: "relying solely on test-time computing scaling and large input contexts can degrade performance, which highlights the need for proper input context engineering." It also provides a mechanistic explanation for a pattern that practitioners may have observed anecdotally—models that "overthink" simple problems when distractors are present, spinning their wheels on irrelevant analysis before producing a wrong answer.

The innovation is conceptually significant because it identifies a regime where the sign of the scaling relationship flips. The field has largely operated under the assumption that scaling trends are monotonic (more compute → same or better performance, with diminishing returns at worst). This paper demonstrates a non-monotonicity where the relationship reverses entirely under realistic deployment conditions. It also provides a diagnostic framework (similarity binning + reasoning token counting) for characterizing when inverse scaling is likely to occur, which future work can build on.

Innovation 4: Process-Level Reward as the Key to Noise Robustness, Not Just Better Answers

The paper's RARE proposal is not just a training trick that improves numbers—it embodies a diagnostic insight about why existing training methods fail to confer robustness. The core conceptual contribution is the identification that outcome-based rewards create a signal-to-noise problem in noisy training environments: when the model can arrive at a correct answer through memorized parametric knowledge, the reward provides no gradient toward learning to filter the input context. The model can be entirely confused by distractors, relying on its pretrained knowledge to guess the answer, and still receive positive reinforcement. Over many training steps, this teaches the model that distractors can be safely ignored—which works until the model encounters a problem where the answer genuinely depends on information in the noisy context, at which point its lack of filtering skill causes catastrophic failure.

RARE addresses this by shifting the reward granularity from the outcome to the rationale. By rewarding the model for explicitly extracting useful information into <reference> tags, RARE creates a training signal that cannot be satisfied by parametric knowledge alone—the model must actually identify which parts of the noisy input are relevant. The additive structure (outcome reward + rationale reward) is conceptually important: it means the model can receive positive reinforcement for good filtering behavior even when its final answer is wrong, and conversely, a correct answer achieved without proper filtering is relatively penalized compared to one achieved with proper filtering. This creates a credit assignment pathway that outcome-only rewards lack, enabling the model to learn the meta-cognitive skill of relevance discrimination.

The evidence for why this is a genuine innovation rather than just "adding another reward term" comes from the comparative failure of alternatives. Prompting (which tells the model to ignore distractors but provides no training signal) fails. SFT (which provides supervised signal but no reward shaping) causes catastrophic forgetting—the model loses its base capabilities without gaining robustness, because the supervised objective pushes it toward producing specific outputs without teaching it the underlying skill of noise filtering. Outcome-only RL mitigates this forgetting (the KL penalty to the reference policy preserves base capabilities) but provides only marginal robustness gains, because the reward signal is noisy with respect to the filtering behavior we actually want to teach. RARE succeeds where these alternatives fail because it operates at the right level of abstraction: it rewards the reasoning process directly, not the reasoning outcome.

The reward dynamics analysis (Figure 4) provides the mechanistic validation: RARE training steadily reduces the proportion of distracted chains-of-thought while simultaneously increasing outcome rewards. This shows that the model is learning to filter noise first, and that improved filtering then enables better accuracy—the causal arrow runs from filtering to accuracy, not the reverse. The innovation is fundamental rather than incremental because it reframes the training problem: noise robustness is not about teaching models to be more accurate in noisy conditions (which outcome rewards attempt and fail at), but about teaching models to explicitly identify and suppress irrelevant information during reasoning. The RARE mechanism is an implementation of this reframing; the reframing itself is the intellectual contribution.

5. Experimental Analysis

Evaluation Methodology

  • Dataset. NoisyBench, constructed from 11 existing datasets: SealQA, MultihopRAG, and Musique (RAG); BBEH-Mini, AIME25, and GPQA-Diamond (reasoning); Model-Written-Evaluations Self-Awareness and Survival-Instinct subsets, and BBQ (alignment); TauBench v1 Retail and Airline (tool usage). The benchmark contains 2,766 examples per distractor setting after filtering removed 2.7% of generated samples. For training, NoisyInstruct is built from the NVIDIA Nemotron Nano 2 Post Training dataset, which covers Math, Coding, Science, Conversation, Safety, and Multilingual domains, provided in four size tiers (4.5K, 45K, 450K, 4.5M examples).

  • Base model(s). Seven models spanning proprietary, large open-source, and small open-source categories: Gemini-2.5-Pro, Gemini-2.5-Flash (Comanici et al., 2025), DeepSeek-R1-0528 (Guo et al., 2025), gpt-oss-120b (Agarwal et al., 2025), Qwen3-4B-Thinking-2507, Qwen3-30B-A3B-Thinking-2507 (Yang et al., 2025), and DeepSeek-R1-Distill-Llama-8B. For training experiments, only three models with publicly released weights and feasible parameter sizes are used: Qwen3-4B-Thinking-2507, DeepSeek-R1-Distill-Llama-8B, and Qwen3-30B-A3B-Thinking-2507. The selection spans a wide capability range (clean-setting harmonic means from 32.4% to 77.8% in Table 1) to test whether robustness trends are consistent across model scales and families.

  • Metrics. Task performance is measured using pass@k for most benchmarks and pass^k for TauBench, with k set to the original benchmark value where defined and to 8 otherwise. Correctness is determined through a two-stage pipeline: first-stage checking with the Math-Verify library, followed by second-stage LLM-as-a-judge evaluation using Gemini-2.5-Pro (without thinking process) for samples marked incorrect in the first stage. Aggregation across the 11 datasets uses the harmonic mean, which penalizes catastrophic failures on individual task categories more heavily than arithmetic mean. For robustness measurement, the primary metric is the relative performance drop from the No Distractor (ND) setting to each distractor setting, expressed as a percentage. Entropy is computed from top-ten token-level log probabilities, averaged, with the final score taken from the ten tokens with highest token-wise entropy. For attention analysis, the metric is the proportion of attention assigned to distractor tokens versus task-relevant tokens during answer generation.

  • Baselines. The paper evaluates multiple intervention categories against doing nothing (the "None" rows in Table 2): (1) Prompting, using Corpus-In-Context (CiC) prompting (Lee et al., 2024) which instructs the model to retrieve and reason over large corpora in context; (2) Supervised Fine-Tuning (SFT) on NoisyInstruct data, using the LLaMA-Factory library, trained on examples that include distractors plus reference information; (3) Outcome-based Reinforcement Learning (RL w/ OR), using GRPO with rewards only for final-answer correctness and formatting validity, trained on NoisyInstruct; (4) Context Engineering (CE) baselines: Genetic-Pareto (GEPA, Agrawal et al., 2025), Dynamic Cheatsheet (DC, Suzgun et al., 2025), and Agentic Context Engineering (ACE, Zhang et al., 2025), all using Gemini-3 as the reflection/engineering model with their official GitHub implementations; (5) the proposed RL with OR+RARE, which adds the rationale-aware reward to the outcome-based reward during GRPO training. For the agentic workflow experiments, the baseline is the base reasoning model without tool access, compared against the same model augmented with tools via the smolagents library.

  • Generation budget / compute accounting. There is no explicit FLOPs or generation budget matching across methods. The SFT, RL, and RARE training runs use comparable compute (same hardware, same NoisyInstruct base data), but the paper does not normalize for the additional cost of the RARE judge model (gpt-oss-120b running on 4 dedicated GPUs). Evaluation uses a fixed sampling budget: pass@k with temperature 0.6 and top-p 0.95 when k ≥ 2, and temperature 0.0 (greedy) when k = 1. The number of samples n_i per problem for pass@k estimation is not explicitly specified but can be inferred to be at least k (since the unbiased estimator requires n_i ≥ k). For the entropy analysis, 0–10 hard negative distractors are added per question, with no explicit compute budget normalization across distractor counts—the measurement is purely observational.

  • Cross-validation / statistical protocol. No cross-validation or statistical significance testing is reported. The benchmark uses a fixed test split of 2,766 examples per setting. The similarity-bin analysis uses five equally sized bins based on normalized cosine similarity between question and distractor embeddings, computed using a pretrained sentence encoder. Training data contamination is addressed through explicit similarity measurement between NoisyBench and NoisyInstruct using cosine similarity at both the question level (24.1%) and distractor level (15.1% for random documents, 17.3% for random chat history, 31.4% for hard negatives), all reported as below contamination thresholds. No confidence intervals, error bars, or significance tests are reported for any performance numbers in the main tables or figures.

Main Quantitative Results

Aggregate Performance Degradation Across All Models and Distractor Types

Table 1 presents the core benchmark results across seven models, four distractor settings, and 11 datasets, with the harmonic mean used as the aggregate metric. The headline finding is catastrophic: every model experiences large performance drops under distractors, with the worst-case being DeepSeek-R1-Distill-Llama-8B's 80.6% relative decline under hard negative distractors (from 32.4% clean to 6.3% HN harmonic mean).

Gemini-2.5-Pro, the strongest model with a 77.8% clean harmonic mean, drops to 70.8% under random documents (-9.0%), 62.5% under random chat (-19.6%), and 48.0% under hard negatives (-38.3%). The degradation is not uniform across distractor types: hard negatives consistently cause the largest drops for all models, random chat history causes intermediate drops, and random documents cause the smallest (but still substantial) drops. This ordering is consistent across every model in the table.

Several non-obvious patterns emerge. First, relative robustness does not track clean performance. DeepSeek-R1-0528 with a 72.4% clean average shows a 34.2% relative drop on hard negatives, while the much weaker Qwen3-4B-Thinking-2507 with 58.4% clean shows a larger 43.9% drop—but Gemini-2.5-Flash with 70.6% clean shows a 35.4% drop, nearly identical to DeepSeek-R1-0528 despite their very different clean accuracies. Second, alignment tasks show the most dramatic absolute degradation. Gemini-2.5-Pro drops from 94.0% to 60.5% on BBQ under hard negatives, and DeepSeek-R1-0528 drops from 93.0% to 33.7%. These are not small degradations—they represent near-total reversals of alignment behavior, triggered by irrelevant text with no adversarial intent. Third, the tool-usage tasks (TauBench Retail and Airline) show severe degradation across the board, with the TA (Airline) column showing drops from 52.0% to 40.0% for Gemini-2.5-Pro under hard negatives, and from 53.5% to 38.7% for DeepSeek-R1-0528, indicating that tool-use capabilities are particularly fragile to noise.

The random document setting (RD) produces surprisingly large effects given that these are entirely unrelated documents sampled from RULER-HotPotQA. DeepSeek-R1-Distill-Llama-8B drops 64.2% relative to clean in this setting (from 32.4% to 11.6% harmonic mean), and Qwen3-4B-Thinking-2507 drops 22.6% (from 58.4% to 45.2%). This demonstrates that even non-misleading, genuinely irrelevant text can severely disrupt reasoning—the model does not need to be tricked by plausible-looking distractors; mere volume of irrelevant information is sufficient to cause substantial degradation.

Training Method Comparison: Prompting, SFT, and Context Engineering All Fail

Table 2 reports the results of interventions to improve noise robustness across three trained models (Qwen3-4B, DeepSeek-R1-Distill-Llama-8B, Qwen3-30B-A3B) and three distractor settings (RD, RC, HN). The "None" rows provide the raw baseline performance for each model-distractor combination. Method rows report absolute performance, and the Δ values show change from the None baseline, not from the clean ND setting. The critical finding is that Prompting, SFT, and Context Engineering all fail to produce meaningful robustness improvements, and SFT actively harms performance in most settings.

For Prompting, the results are consistently near zero or negative. For Qwen3-4B under random documents, prompting achieves 34.8% harmonic mean versus 35.7% for None (-2.7%). Under random chat, prompting scores 32.6% versus 34.8% (-6.2%). Under hard negatives, prompting scores 25.0% versus 24.6% (+2.0%)—the only modest positive signal in the prompting results. For DeepSeek-R1-Distill-Llama-8B, prompting under hard negatives shows a large relative improvement (+128.6%), but this is from an extremely low baseline of 6.3% to 14.4%—still far below clean performance. For Qwen3-30B-A3B, prompting produces changes of +0.1%, -1.6%, and +1.6% across the three distractor settings, effectively zero.

For SFT, the results are catastrophic in most settings. Qwen3-4B under random documents drops from 35.7% to 21.2% (-40.6% relative to baseline). Under random chat, it drops from 34.8% to 21.7% (-37.5%). The paper attributes this to "catastrophic forgetting, which weakens models' inherent resistance to noise." SFT on NoisyInstruct, which teaches the model to produce answers and references, apparently disrupts the base model's reasoning capabilities so severely that it performs worse than an untrained model on noisy inputs. The only exception is DeepSeek-R1-Distill-Llama-8B under hard negatives, where SFT achieves 14.7% versus 6.3% (+133.3%), but again from an extremely low baseline.

For Context Engineering (Figure 3), the paper reports that GEPA, DC, and ACE show "limited gains over the base model under noisy distractors." The figure shows accuracy across three distractor settings (HN, RD, RC) for multiple methods, with the base model bar and the CE method bars. No numerical values are provided in the text, but the visual pattern confirms that CE bars are nearly identical to the base model bars across all settings. The paper diagnoses that CE "often removes noise only partially and sometimes discards information needed for the task" and that "since CE itself relies on LLMs, it also becomes vulnerable to noisy inputs."

RL Improves Over Baselines, and RARE Further Amplifies Gains

Table 2 shows that RL with outcome-based rewards (RL w/ OR) consistently outperforms prompting, SFT, and the None baseline across all model-distractor combinations. For Qwen3-4B under random documents, RL w/ OR achieves 38.1% harmonic mean versus 35.7% for None (+6.8%). Under random chat, it achieves 39.2% versus 34.8% (+12.9%). Under hard negatives, it achieves 31.5% versus 24.6% (+28.2%). For DeepSeek-R1-Distill-Llama-8B under hard negatives, RL w/ OR achieves 23.4% versus 6.3% (+271.7% relative improvement). For Qwen3-30B-A3B, the gains are more modest: +1.6% under random documents, +1.8% under random chat, +1.8% under hard negatives.

RL with RARE (RL w/ OR+RARE) consistently outperforms RL w/ OR alone, in some cases substantially. For Qwen3-4B under random documents, OR+RARE achieves 55.5% harmonic mean versus 38.1% for OR alone (+55.4% relative to the None baseline, compared to +6.8% for OR alone). Under random chat, OR+RARE achieves 40.8% versus 39.2% (+17.4% vs. +12.9%). Under hard negatives, OR+RARE achieves 33.4% versus 31.5% (+36.1% vs. +28.2%). The largest absolute gap between OR and OR+RARE is under random documents, where the difference is 55.5% - 38.1% = 17.4 percentage points. For DeepSeek-R1-Distill-Llama-8B, the pattern holds: OR+RARE achieves 23.9% versus 19.5% for OR alone under random documents, 26.5% versus 21.6% under random chat, and 25.6% versus 23.4% under hard negatives. For Qwen3-30B-A3B, the gains from RARE are smaller but consistent: +4.7% versus +1.6% under random documents, +2.1% versus +1.8% under random chat, +6.9% versus +1.8% under hard negatives.

A crucial pattern in the data is that RARE does not simply shift performance uniformly upward—it shows the largest gains in the settings where the baseline is weakest. For Qwen3-4B, the None baseline is 35.7% for RD, 34.8% for RC, and 24.6% for HN. The absolute gains from OR+RARE over None are +19.8 for RD, +6.0 for RC, and +8.8 for HN. The RD setting (random documents) shows the largest absolute improvement, which is notable because random documents are the least deceptive distractor type—suggesting that RARE is particularly effective at teaching the model to ignore genuinely irrelevant information, not just at resisting clever hard negatives. The paper's qualitative analysis (Appendix 13, Figures 43 vs. 44) shows this directly: the OR-only model's chain-of-thought gets confused and wanders through distractor content, while the RARE-trained model explicitly identifies the noise and reasons from clean information.

RARE's Mechanism: Reducing Distracted Reasoning While Improving Answers

Figure 4 provides the reward dynamics evidence for why RARE works. During RL training, the proportion of distracted chains-of-thought steadily decreases while outcome-based rewards simultaneously increase. The paper reports that "training with RARE reduces the proportion of distracted chains of thought while simultaneously increasing outcome-based rewards, which leads to higher final accuracy compared to training with outcome-only rewards (OR)." The figure shows this as two curves over training steps: one for distracted chain-of-thought proportion (decreasing) and one for outcome rewards (increasing). The RARE-trained model's final accuracy surpasses the OR-only model's, suggesting that improved filtering causally enables better answers.

The paper does not specify exactly how "distracted chain-of-thought" is measured—whether it is the fraction of reasoning tokens that reference distractor content, the fraction of chains that mention distractor information at any point, or some other operationalization. This is a notable gap in the reporting, as the metric's definition affects how the reward dynamics should be interpreted.

Agentic Workflows Amplify Errors Under Noise

Figure 2 presents the agentic workflow results, comparing base reasoning model performance against agent-augmented performance (with tools like retrievers and calculators via smolagents) across the four distractor settings. In the clean setting (ND), the agent consistently outperforms the base model—the bar for the agent is visibly higher across all model-distractor combinations shown. However, in all three noisy settings (RD, RC, HN), the pattern reverses: the agent performs worse than the base reasoning model. The paper identifies three mechanisms: (1) agents over-trust tool outputs and contextual signals, treating distractors as reliable evidence; (2) multi-step planning amplifies error propagation, with distractor-induced hypotheses reentering later steps; (3) noise corrupts tool routing, causing the agent to call retrievers based on contaminated context and accumulate more irrelevant information. No numerical values are provided in the text for Figure 2—the claims are supported only by the visual pattern in the figure.

Distractor Similarity Increases Reasoning Inefficiency and Reduces Accuracy

Figure 5 shows the similarity-bin analysis: as distractor similarity increases from Bin 1 (lowest) to Bin 5 (highest), accuracy consistently decreases while average reasoning token usage consistently increases. This pattern holds across all tested benchmarks. The paper interprets this as evidence that models "review distractors to check their relevance, even when they provide no useful information," expending reasoning cycles on dead-end analysis. Figure 6 rules out the alternative explanation that longer reasoning is simply an artifact of longer inputs: output length shows a weak negative correlation with distractor length, meaning the increased reasoning tokens come from confusion about content, not from processing more text.

Entropy Increases Monotonically with Distractor Count

Figure 7 shows that token-level output entropy increases steadily as the number of hard negative distractors per question grows from zero to ten. Higher entropy indicates greater uncertainty during response generation. The paper links this to the qualitative examples in Appendix 13: as distractors accumulate, the reasoning trajectory "becomes more confused, and the final answer shows lower confidence." The monotonic relationship holds across all benchmarks shown.

Attention Analysis: Incorrect Predictions Attend More to Distractors

Figure 8 presents the attention analysis on the misleading-math dataset using Qwen3-4B-Thinking-2507. Incorrect predictions assign substantially more attention to distractor tokens than correct predictions. The paper reports that this shows "the model often relies on distractors during generation, which increases the likelihood of errors." The finding is consistent with the RARE training results: RARE teaches the model to identify and extract helpful information, which implicitly trains away from the distractor-focused attention patterns that characterize incorrect predictions.

Ablation Studies and Robustness Checks

Transferability of RARE training to clean settings (Figure 14, Section 8.5): The model trained with RARE under noisy conditions achieves higher performance on the clean (ND) setting of NoisyBench than the untrained model, confirming that learning to filter noise does not degrade clean-setting performance. The paper attributes this to NoisyInstruct including clean examples to preserve the training distribution, and to "learning to ignore distractors further improving the model's ability to interpret the original context."

Effect of scaling model size on noise robustness (Figure 12, Section 8.3): Testing Qwen3 variants from 0.6B to 32B shows that robustness to distractors "increases as model size grows, but the gains do not scale proportionally." The jump from 4B to 8B shows a noticeable improvement, but 14B and 32B show "nearly identical" robustness. Performance drops between ND and distractor settings are smaller for larger models, but "simply increasing size does not consistently reduce them further," indicating diminishing returns to scale for noise robustness.

Effect of mixing diverse distractor types (Figure 15, Section 8.6): When multiple distractor types are combined (RD+RC, RD+HN, RC+HN, RD+RC+HN) at constant total distractor length, mixed distractors degrade performance more than any single distractor type alone. Combining all three produces the largest drop, and mixtures including hard negatives consistently outperform mixtures without them in terms of degradation. This confirms that distractor composition, not input length, drives performance decline, supporting the similarity-bin findings.

Distractor position effect (Figure 11, Section 8.2): Placing distractors before versus after the question produces different degradation patterns. Random chat history placed after the question causes the largest performance drop (the model "tends to answer only the last message in the sequence"). Random documents and hard negative distractors before the question also cause degradation because the model "seems to lose the question while reading long distractors."

Inverse scaling under distractors (Figure 16, Section 8.7): Without distractors, some benchmarks (Musique, TauBench-Retail) benefit from test-time computing scaling while others (BBQ, BBEH-Mini) show performance drops with longer reasoning. With distractors, all benchmarks and models consistently exhibit an inverse scaling law: longer reasoning hurts performance. The figures "shift toward the lower right, indicating that distractors increase token usage and reduce efficiency and accuracy simultaneously."

Unexpected jailbreaking robustness with distractors (Table 3, Figure 17, Section 8.8): On StrongBench and HarmBench with jailbroken prompts (generated by PAIR and PAP), adding random distractors does not uniformly reduce safety. gpt-oss-120b shows a small drop in refusal rate (-7.7% under RD), but Gemini-2.5-Pro shows refusal rate increases (+28.6% under RD, +13.3% under RC). On XSTest (exaggerated safety on harmless questions), refusal rates decrease or remain stable under distractors, confirming the increase on harmful prompts reflects genuine improved detection rather than general refusal inflation. The paper hypothesizes that "distractors amplify subtle jailbreak signals and make them easier for the model to detect."

Data contamination check (Figure 13, Section 8.4): Cosine similarity between NoisyBench and NoisyInstruct is 24.1% at the question level, 15.1% for random document distractors, 17.3% for random chat distractors, and 31.4% for hard negative distractors. The paper states these are "well within the range that cer-etal-2017-semeval considers effectively unrelated distributions."

Critical Assessment

Claim from executive summary: "Even non-adversarial noise triggers catastrophic performance drops of up to 80%."

This claim is directly supported by Table 1, which shows DeepSeek-R1-Distill-Llama-8B's harmonic mean dropping from 32.4% (ND) to 6.3% (HN), an 80.6% relative decline. The claim is specifically about the worst case, which is justified—not every model shows 80% drops, but the pattern of substantial degradation is universal across all seven models and all distractor types. However, the "up to 80%" framing masks the wide variance in degradation severity. Gemini-2.5-Pro, the strongest model, drops only 9.0% under random documents relative to ND—a much milder degradation. The claim would be more precise if it specified that the worst-case drop is 80% (on the smallest model with the most challenging distractor type), while stronger models show drops in the 9–38% range depending on distractor type. Additionally, the average degradation metric uses harmonic mean, which is sensitive to very low scores on individual tasks. A model that completely fails on one task (score near 0%) but maintains performance on others will have a very low harmonic mean even if most tasks are unaffected. This means the reported degradation percentages may be inflated relative to what an arithmetic mean would show, and the paper does not provide arithmetic mean aggregates for comparison. This is not necessarily wrong—the harmonic mean is arguably the right metric for robustness evaluation since real deployments cannot tolerate catastrophic failure on any task category—but it affects how the numbers should be interpreted. The 80.6% drop for DeepSeek-R1-Distill-Llama-8B on HN reflects near-zero scores on several individual tasks, not an 80% reduction across every task.

Claim from executive summary: "Agentic workflows amplify these errors by over-trusting noisy tool outputs."

This claim is supported by Figure 2, which shows agents performing worse than base models under all three noisy distractor settings while improving under clean settings. The evidence is qualitative in the main text—the paper does not report numerical values for the agent-vs-base comparisons, only the visual pattern in the figure. The three mechanistic explanations (over-trusting tool outputs, error propagation in multi-step planning, corrupted tool routing) are plausible interpretations but are not experimentally isolated. The paper does not provide ablations that separately test each mechanism—for instance, it does not compare agents with single tool calls against agents with multi-step tool chains to isolate error propagation, or test whether restricting tool access after initial noise detection reduces the amplification effect. The claim is well-motivated by the aggregate results but the causal mechanisms remain interpretive rather than demonstrated.

Claim from executive summary: "Prompting, context engineering, and supervised fine-tuning all fail to confer robustness."

This claim is well-supported. Prompting shows near-zero or negative effects across nearly all settings in Table 2. SFT shows catastrophic drops (e.g., -40.6% for Qwen3-4B under RD), with the only positive exceptions being on the extremely low HN baselines for DeepSeek-R1-Distill-Llama-8B, where the model starts at 6.3% and SFT brings it to 14.7%—still far below clean performance. Context engineering fails to produce meaningful gains (Figure 3). However, the SFT failure is reported as "catastrophic forgetting," but the paper does not provide an ablation showing whether the forgetting is due to the NoisyInstruct data distribution (which differs from the model's pretraining distribution) or due to the SFT training procedure itself (e.g., the learning rate, number of epochs, or lack of KL regularization). An SFT run that mixes clean and noisy examples in different proportions, or that uses a lower learning rate, might avoid catastrophic forgetting while still conferring some robustness—the paper does not explore these variants, so the strong claim that "SFT fails" is demonstrated for the specific SFT configuration used, not for all possible SFT approaches. The context engineering claim is similarly limited: the paper tests three specific CE methods (GEPA, DC, ACE) with a specific configuration (Gemini-3 as the reflection model, default hyperparameters), but does not test whether alternative configurations or other CE methods might perform better. The negative results are convincing that these specific approaches fail, but the generalization to "context engineering" as a category is broader than the evidence directly supports.

Claim from executive summary: "RARE significantly strengthens resilience by incentivizing the identification of helpful information within noise."

This is the paper's central positive claim, and it is supported by Table 2 and Figure 4. Across all model-distractor combinations, OR+RARE outperforms OR alone, with the largest gains on the weakest baselines. The reward dynamics analysis (Figure 4) provides mechanistic evidence that RARE reduces distracted reasoning while improving outcomes. However, several aspects of this claim deserve scrutiny. First, the absolute performance after RARE training still leaves substantial room for improvement. For Qwen3-4B, RARE achieves 55.5% harmonic mean under RD, 40.8% under RC, and 33.4% under HN—all below the model's 58.4% clean ND performance. RARE recovers some but not all of the lost performance, and the gap between noisy and clean settings remains large. For Qwen3-30B-A3B, the gains are more modest (+4.7%, +2.1%, +6.9% relative to None), and the final noisy-setting performance (47.6%, 50.5%, 44.4%) is still below the clean ND performance (58.8%). RARE is an improvement, not a solution—the paper does not overclaim this, but it is important context for understanding the magnitude of the effect.

Second, the evaluation of RARE's effectiveness depends on the "None" baseline in Table 2 being a fair comparison point. The None baseline for Qwen3-4B under RD is 35.7%, and OR+RARE achieves 55.5%—but what does the 35.7% represent? It is the raw untrained model's performance on the RD setting, not the model's performance after RL without RARE. The OR baseline (38.1%) provides the relevant comparison, and the OR-to-OR+RARE gap (38.1% to 55.5%) is the cleanest measure of RARE's added value. This gap is 17.4 percentage points—substantial and convincing.

Third, the paper does not ablate the RARE reward structure. The additive combination (outcome + rationale) is presented as a design choice, but the paper does not test alternatives such as using only the rationale reward (no outcome reward), using a weighted combination (α × outcome + β × rationale), or using the rationale reward as a filter on which rollouts receive outcome rewards (only reward rollouts that extract correctly). Without these ablations, it is not clear whether the additive structure is responsible for RARE's success or whether any form of process-level reward would produce similar gains. The paper's theoretical argument for additive structure (partial credit for correct extraction even when the answer is wrong) is compelling as motivation, but the empirical necessity of that specific structure is untested.

Missing experiments that would strengthen the paper:

The paper does not test whether RARE's benefits persist when the gold reference information is not available. RARE requires hints (gold references) during training to compare against the model's <reference> extractions. In many real-world tasks, these hints would need to be generated synthetically (as the paper does for NoisyInstruct), and the quality of synthetic hints would likely affect RARE's effectiveness. An experiment training RARE with lower-quality or noisy hints would characterize how sensitive the method is to reference quality.

The paper does not compare RARE against other process-level reward methods. For instance, process reward models (PRMs) that score individual reasoning steps, or methods that reward faithfulness to source documents, are conceptually related but not evaluated as baselines. This makes it difficult to assess whether RARE's specific extraction-and-compare mechanism is superior to other approaches for teaching noise robustness, or whether any process-level supervision would produce similar gains.

The paper does not report results for the 4.5M full NoisyInstruct tier—it provides the tier sizes but does not specify which tier was used for the reported experiments, and does not show scaling curves for data quantity vs. robustness. Given that data scaling is a central concern for training methods, this omission is significant.

The paper evaluates only one base model per training experiment (Qwen3-4B, DeepSeek-R1-Distill-Llama-8B, Qwen3-30B-A3B), all from the Qwen or DeepSeek families. Results on models from different families (e.g., Llama-based, Gemma-based) would strengthen the claim that RARE generalizes across architectures.

Where claims hold conditionally:

The claim that "noise robustness is a distinct capability not predicted by clean performance" holds strongly across the seven evaluated models and the specific distractor types in NoisyBench. However, the paper does not test whether this claim holds for other types of distribution shift beyond the three distractor types studied. Input noise in the form of typos, grammatical errors, or non-native speaker constructions might show different patterns—perhaps clean performance would predict robustness to these types of noise.

The claim that "increased test-time computation leads to worse performance in noisy settings" (inverse scaling) holds for the specific benchmarks and distractor types tested in Section 8.7. However, the inverse scaling is demonstrated by sorting outputs by length and comparing accuracy across length groups—a correlational rather than causal analysis. It is possible that the model generates longer outputs precisely when it is confused (confusion causes both longer reasoning and lower accuracy), rather than longer reasoning causing lower accuracy. The paper interprets this as the latter, but the analysis cannot distinguish these causal directions without an intervention that exogenously varies reasoning length.

The claim that RARE "significantly strengthens resilience" holds across the tested model-distractor combinations, but the magnitude of improvement varies substantially—from +55.4% relative for Qwen3-4B under RD to +2.1% for Qwen3-30B-A3B under RC. The gains are largest for the smallest model under the least deceptive distractor type, and smallest for the largest model under the intermediate distractor type. This suggests RARE's effectiveness may be conditional on model scale and distractor type in ways the paper does not fully characterize.

6. Limitations and Trade-offs

The Difficulty Estimation Problem: No Ground-Truth Reference for Filtering

The assumption or constraint. RARE requires gold reference information ("hints") during training to compare against the model's <reference> extractions and assign the rationale-aware reward. The paper constructs these hints synthetically by prompting Gemini-2.5-Pro, then applies an additional filtering step to remove hints that "include the correct answer or make the task trivial" (Section 7.2). This means RARE's training signal depends entirely on the quality of synthetically generated hints — the judge model (gpt-oss-120b) compares the model's extracted references against these synthetic hints and assigns a binary reward. If the hints are noisy, incomplete, or incorrectly identify which parts of the context are actually useful, the RARE reward becomes a misleading training signal.

The paper does not acknowledge the circularity inherent in this setup: the system trains a smaller model (e.g., Qwen3-4B) to filter noise by having it extract references that are then judged against hints generated by a larger, more capable model (Gemini-2.5-Pro). This means the RARE reward implicitly encodes the larger model's judgment about what constitutes useful information. If the target deployment model cannot achieve the larger model's level of context understanding, the RARE reward may set an unrealistic standard — punishing extractions that are sensible for the smaller model's capability level but don't match Gemini-2.5-Pro's notion of "helpful." Conversely, if the hints are imperfect (which they inevitably are, being synthetic), the RARE reward may reinforce suboptimal extraction behavior.

The paper does not test how sensitive RARE is to hint quality. There is no experiment where RARE is trained with deliberately degraded hints (e.g., hints that miss some relevant information, hints that incorrectly identify distractor content as relevant, hints with varying levels of detail) to measure the resulting impact on model robustness.

The consequence. In any real deployment where a human or a more capable model is not available to generate gold references, RARE cannot be directly applied — the training signal requires per-example ground-truth identification of what is useful in the context. This limits RARE's applicability to domains where high-quality reference information can be synthetically generated by a stronger model, which may not be feasible in specialized domains (e.g., legal reasoning, medical diagnosis, code review) where even the strongest available model cannot reliably distinguish relevant from irrelevant context. Additionally, if the hint quality degrades in those domains, RARE's effectiveness likely degrades with it — but the paper provides no characterization of this degradation curve.

What evidence exists in the paper. Section 8.4 (Figure 13) reports that NoisyInstruct and NoisyBench have low similarity (24.1% at question level), confirming the training data is not contaminated by the test set. But this contamination check addresses a different concern — it shows the hints don't accidentally contain answers, not that the hints are correct about what information is useful. Section 7.2 describes the hint filtering process (using Gemini-2.5-Pro to "flag and remove any hint that includes the correct answer or makes the task trivial"), but this only filters out hints that are too helpful, not hints that are inaccurate or misleading. The paper provides qualitative examples of synthetic hints in Appendix Figures 30–31, but does not systematically evaluate hint quality (e.g., by measuring human agreement with hint-designated useful information, or by measuring how often the hints correctly identify all and only the relevant context). There is no experiment testing RARE with lower-quality hints.

Mitigation status. Not addressed. The paper presents RARE as an effective training method given available hints, but does not acknowledge hint quality as a potential failure mode or provide guidance on when synthetic hint generation is likely to be reliable enough for RARE to work. The paper does not suggest future work on robustifying RARE to noisy reference signals, though this would be a natural extension.

Single Domain and Modality: All Results Are Text-Only Math and Reasoning

The assumption or constraint. All experiments — both the NoisyBench benchmark construction and the RARE training — operate exclusively on text-based reasoning, RAG, alignment, and tool-use tasks with well-defined correctness criteria. The paper explicitly states this scope limitation: "We do not explore multimodal scenarios, although we believe that the insights from our single-modal experiments naturally extend to these broader contexts" (Section 9).

This matters because the distractor mechanisms the paper identifies — particularly the hard negative distractors that "appear helpful but contain content that is entirely irrelevant to the question" — rely on the ability to generate synthetic distractors that share surface-level semantic similarity with the question while being substantively irrelevant. In text, this is achieved by prompting Gemini-2.5-Pro with instructions to create documents based on "concepts mentioned in each question" (Section 7.1). In multimodal settings, distractors could take fundamentally different forms — images that share visual features with task-relevant images, audio with similar acoustic properties, or cross-modal distractors where irrelevant text accompanies relevant images — and the paper's text-based generation pipeline does not obviously transfer.

Similarly, all tasks in NoisyBench have objective, verifiable correctness criteria: mathematical answers checked by Math-Verify, multiple-choice answers with ground-truth labels, alignment behaviors scored by refusal rate, and tool-use success measured by pass^k. This enables both the clean evaluation protocol (the two-stage correctness checking pipeline) and the RARE training signal (the outcome-based reward requires knowing whether the final answer is correct). In domains where correctness is subjective, multi-dimensional, or ambiguous — open-ended dialogue, creative writing, summarization quality, strategic planning — neither the evaluation framework nor the training method directly applies.

The consequence. A practitioner deploying an agentic system in a multimodal domain (e.g., a visual QA system for medical imaging with noisy retrieval, a video understanding agent with irrelevant clips in its context window, a multimodal assistant that processes both text and images from user conversations) cannot assume the paper's findings about noise robustness transfer. The specific degradation patterns (random documents being less harmful than hard negatives, alignment being the most fragile task category) may not hold when distractors span modalities — an irrelevant image might be more distracting than irrelevant text because visual features are processed differently by multimodal architectures. More fundamentally, a practitioner cannot use RARE to train noise robustness for a multimodal model without first solving the problem of generating multimodal hints and implementing a multimodal judge model, neither of which the paper addresses.

What evidence exists in the paper. None — this is entirely outside the scope of the reported experiments. The paper's Section 9 acknowledges "we do not evaluate pretrained base models or purely instruction-tuned models" and "we also do not explore multimodal scenarios," but frames these as deliberate scope choices rather than as limitations that affect the generalizability of the findings. The paper's claim that "the insights from our single-modal experiments naturally extend to these broader contexts" is asserted without evidence.

Mitigation status. Not addressed. The paper explicitly defers multimodal investigation to future work ("we plan to address these limitations more deeply in future work") but provides no conceptual argument for why the extension should be straightforward, which is a gap given that multimodal architectures have fundamentally different attention mechanisms and context-processing pipelines than text-only models.

The Contamination and Dataset Leakage Concern: Evaluating on Benchmarks the Training Data May Resemble

The assumption or constraint. The paper constructs NoisyInstruct from the NVIDIA Nemotron Nano 2 Post Training dataset and evaluates on NoisyBench, which is constructed from 11 distinct datasets. To address data contamination concerns, the paper reports cosine similarity between sentence embeddings of the two datasets: 24.1% at the question level, 15.1% for random document distractors, 17.3% for random chat distractors, and 31.4% for hard negative distractors (Section 8.4, Figure 13). The paper states these values are "well within the range that cer-etal-2017-semeval considers effectively unrelated distributions."

But this comparison has a subtle flaw: cosine similarity between sentence embeddings is a measure of semantic similarity between the full texts, not a measure of task overlap or knowledge transfer. Two datasets can have low sentence-level similarity while still testing the same underlying capabilities — for instance, a math problem about integrals and a math problem about derivatives may have different sentence embeddings (different symbols, different function names, different numerical values) but both test calculus reasoning, and training on one might improve performance on the other through genuine skill transfer, not through memorization. The contamination check as designed can detect only near-exact duplication (when questions or distractors are literally the same or very similar in wording), not the more subtle form of overlap where training and test sets draw from the same task distribution.

This concern is amplified by the fact that both NoisyInstruct and NoisyBench use the same procedure to generate hard negative distractors: prompting Gemini-2.5-Pro with instructions to create distractors that appear relevant but are irrelevant. Even though the underlying questions differ, the kind of hard negatives generated — their stylistic properties, their relationship to the question, the specific ways they mislead — may be systematically similar because they come from the same generator model following the same prompt template. A model trained on NoisyInstruct might learn to recognize the signature of Gemini-2.5-Pro-generated hard negatives rather than learning general noise-filtering skills.

The consequence. The reported improvements from RARE and RL training (Table 2) may partially reflect the model learning artifacts of the distractor generation process rather than learning genuine robustness to arbitrary noise. This would mean that performance on NoisyBench overestimates real-world robustness, where distractors come from diverse sources (different retrievers, different conversational patterns, different tool outputs) rather than from a single LLM following a specific generation template. The paper acknowledges data contamination as a concern (which is why Section 8.4 exists), but addresses only the literal-duplication form of contamination, not the distributional-similarity form.

For practitioners, this means the RARE-trained model may show promising NoisyBench scores but degrade more severely than expected when deployed in an environment where noise comes from sources that differ stylistically from Gemini-2.5-Pro's synthetic distractors — for instance, noise from a production retrieval system, from real user chat histories, or from tool APIs with idiosyncratic output formats.

What evidence exists in the paper. Section 8.4 and Figure 13 provide the cosine similarity analysis, which is a genuine effort to check for contamination. The paper also states (Section 7.2) that "we do not find any identical or overly similar hard negatives, likely because the training questions differ substantially from those in the benchmark." But the paper does not provide any experiment testing whether improvements on NoisyBench transfer to an out-of-distribution noise benchmark — for instance, evaluating the RARE-trained model on a held-out set of distractors generated by a different LLM (e.g., using Claude or GPT-4 to generate hard negatives instead of Gemini-2.5-Pro) to see whether the robustness gains persist when the distractor generation process changes. This would be the most direct test of whether the model is learning general noise filtering versus learning to recognize Gemini-2.5-Pro's distractor patterns.

Mitigation status. Partially addressed. The paper's use of different data sources for random distractors (Natural Questions vs. RULER-HotPotQA, Nemotron chat vs. WildChat) is a legitimate effort to separate training and test distributions for the random distractor types. But for hard negatives — the most challenging distractor type and the one where the largest performance drops occur — the generation procedure is identical between training and test, and the paper does not test robustness to procedurally different hard negatives. The paper does not suggest this as a limitation or propose future work to test transfer across distractor generation methods.

Evaluation Scale and Statistical Rigor: No Confidence Intervals or Significance Tests

The assumption or constraint. All quantitative claims in the paper — the catastrophic performance drops in Table 1, the improvement percentages in Table 2, the similarity-bin trends in Figure 5, the entropy curves in Figure 7 — are reported as point estimates without any measure of statistical uncertainty. No confidence intervals, standard errors, or significance tests appear anywhere in the paper. The test set consists of 2,766 examples per distractor setting (Section 7.1), but this fixed number is not contextualized with respect to the power needed to detect the effect sizes being claimed.

This matters for several specific claims. Table 2's comparisons between training methods often involve small differences: for Qwen3-30B-A3B under random chat, RL w/ OR achieves 50.3% while RL w/ OR+RARE achieves 50.5% — a 0.2 percentage point difference. Without confidence intervals, a reader cannot determine whether this difference is statistically distinguishable from noise or whether the two methods are effectively equivalent for this model-distractor combination. Similarly, the "inverse scaling" claim in Section 8.7 (Figure 16) is based on sorting outputs by length and comparing accuracy across length groups — but the variance within each length group is not reported, so it is unclear whether the downward trend is reliable or driven by a small number of outlier-length outputs.

The harmonic mean aggregation amplifies this concern. The harmonic mean is highly sensitive to very low scores on individual tasks: a single task where the model scores near 0% can pull the harmonic mean down substantially even if other tasks are unaffected. If that near-zero score is itself a noisy estimate (e.g., based on a small number of test examples for that task), the harmonic mean inherits that noise. The paper does not report per-task sample sizes, so a reader cannot assess how much each task contributes to the aggregate uncertainty.

The consequence. A practitioner reading Table 2 might conclude that RARE provides consistent and meaningful improvements across all settings, but cannot determine which improvements are robust versus which might disappear with a different random seed, a different test split, or a different sampling of distractors. The paper's strongest quantitative claims — "4× efficiency" type claims about relative improvement percentages — are all point estimates with no error characterization, making it impossible to assess whether they are precisely estimated or highly variable.

For a research paper that introduces a new benchmark, this omission is particularly consequential because the community will use NoisyBench as an evaluation standard. Without understanding the variance properties of the benchmark (How much does a model's score vary across different distractor samples? How much does the harmonic mean vary across different random seeds for the distractor assignment?), future work cannot determine whether a proposed improvement over RARE is genuine or within the benchmark's noise floor.

What evidence exists in the paper. None. The paper reports no uncertainty quantification anywhere. The 2,766 examples per setting is a fixed number, and the paper does not discuss whether this sample size was chosen based on a power analysis or was simply the number of examples remaining after filtering. The cross-validation used for NoisyBench (the two-fold split for strategy selection described in the paper's methodology) is not standard cross-validation for statistical inference — it is a train-test split used to separate policy selection from evaluation, not to estimate variance.

Mitigation status. Not addressed. The paper does not acknowledge the absence of uncertainty quantification as a limitation, does not suggest that future work should report confidence intervals, and does not provide the per-task sample sizes or per-model variance estimates that would enable readers to compute their own uncertainty measures.

The RARE Reward Structure Is Not Ablated: We Don't Know Why It Works

The assumption or constraint. The paper presents RARE as an additive combination of outcome reward and rationale-aware reward: R_total = R_outcome + R_RARE, where both components are binary (0 or 1). The paper motivates this structure with a theoretical argument — the additive form provides partial credit for correct extraction even when the final answer is wrong, enabling the model to learn filtering before answer accuracy improves — but provides no empirical ablation testing whether this specific structure is responsible for RARE's success.

Several natural alternatives are never tested. One is using only the rationale reward (no outcome reward at all), which would test whether process-level supervision alone is sufficient or whether the outcome signal is necessary for maintaining task performance. Another is using a weighted combination where the rationale reward gets a coefficient less than 1, testing whether the equal weighting of outcome and rationale is optimal. A third is using the rationale reward as a gating mechanism — only award the outcome reward if the extraction is correct, creating a multiplicative structure R = R_outcome × R_RARE — which would test whether the additive partial-credit property is necessary or whether strict coupling of extraction and answer correctness works better. A fourth is using a continuous rather than binary rationale reward, where the judge model assigns a similarity score between the extracted reference and the gold hint rather than a binary match/mismatch, which might provide a richer training signal.

Without these ablations, the paper cannot distinguish between several competing explanations for RARE's effectiveness. It could be that any form of process-level supervision improves noise robustness, and the specific extraction-into-tags mechanism is incidental. It could be that training with references (even without reward shaping) teaches the model to attend to relevant context, and the RARE reward simply amplifies a signal already present in the SFT data. It could be that the additive partial-credit property is crucial, or it could be that a strict coupling of extraction and answer would work equally well.

The consequence. A practitioner seeking to implement a RARE-like training approach cannot determine which design decisions are essential and which are arbitrary. Should they use binary or continuous rationale rewards? Should they weight the two reward components equally? Should they use the specific <reference> tag format, or would any explicit citation mechanism work? The paper's theoretical justification for the additive structure is plausible but empirically untested — a practitioner who implements a variant (e.g., using a different extraction format because their task has a different structure) has no guidance on whether the variant will work.

For research reproducibility, this is a significant gap. The paper's central methodological contribution is RARE, but the paper does not isolate which aspect of RARE drives the improvement. If another research group implements a process-level reward with a different structure and fails to replicate the paper's gains, it is unclear whether the failure is due to the different reward structure or to other differences in the training setup.

What evidence exists in the paper. The paper compares RARE (OR+RARE) against three alternatives: no training (None), prompting, and SFT. The comparison against RL with outcome-based rewards (RL w/ OR) establishes that adding RARE improves over outcome-only RL. But no variants of RARE itself are tested. The reward dynamics analysis (Figure 4) shows that RARE reduces distracted chains-of-thought while increasing outcome rewards — but this shows that RARE works, not why its specific structure works over alternatives. The paper's qualitative examples (Appendix Figures 43–44) show that the RARE-trained model produces better-structured reasoning, but this is a demonstration, not an ablation.

Mitigation status. Not addressed. The paper presents the additive binary RARE structure as the method, without acknowledging that alternative structures are untested or suggesting that future work should explore which components of the design are load-bearing. The paper's "inspired by prior work (commandr; comanici2025gemini)" citation provides some precedent for extraction-based rewards, but does not constitute an empirical justification for the specific design choices.

The Fixed Distractor Budget per Example May Not Reflect Realistic Noise Patterns

The assumption or constraint. NoisyBench uses exactly one distractor per question for each distractor setting: one random document, one random chat history, or one hard negative distractor. In the random document setting, all questions receive exactly the same sampled document length distribution (100 documents from RULER-HotPotQA assigned per question). In the random chat setting, all questions receive exactly the same sampled chat histories (20 from WildChat). Each question sees exactly one distractor instance, and the distractor type is fixed within each evaluation run.

Real-world agentic deployment looks very different. A retrieval system might return five documents, three of which are irrelevant and two of which are partially relevant, with varying degrees of usefulness. A conversational agent might have dozens of prior turns, some relevant to the current query and some not. A tool-using agent might invoke multiple tools, receiving a mix of correct and incorrect outputs interleaved with the task context. The paper's Section 8.6 (Figure 15) takes a step toward realism by testing mixtures of distractor types (RD+RC, RD+HN, RC+HN, RD+RC+HN) while holding total distractor length constant, and finds that mixed distractors are more harmful than any single type. But even these mixtures are uniform — every question in a given mixed setting receives the same combination of distractor types in the same proportions.

A deeper issue is that NoisyBench's distractors are added to otherwise clean prompts — the original task information remains fully intact and uncontaminated. In realistic settings, the noise and the signal are often interleaved. A retriever might return a document that contains both relevant and irrelevant paragraphs; a conversation history might contain turns that are partially relevant to the current task; a tool output might contain useful results alongside extraneous logging information. NoisyBench does not test this intra-document noise pattern, where the model must extract relevant information from within documents that also contain distractors, rather than separating clean task information from entirely separate distractor documents.

The consequence. NoisyBench likely provides an optimistic estimate of model robustness. In the benchmark, the model receives the question, the distractor, and clean reference information — and the task is to ignore the distractor while processing the clean information. In reality, the model receives the question and a set of retrieved documents or conversation turns, some of which contain relevant information interleaved with irrelevant information — and the task is to extract the relevant parts while discarding the irrelevant parts within the same document. This intra-document filtering is a harder problem than the inter-document filtering that NoisyBench tests, because the model must make fine-grained relevance judgments at the passage or sentence level rather than at the document level.

For a practitioner deploying a RAG system, NoisyBench scores may overestimate real-world performance because the benchmark treats complete documents as either clean or distractor, while real retrievers return documents that are partially relevant. The RARE training method, which rewards extraction of helpful information into <reference> tags, may partially address this intra-document noise issue (extracting spans from within documents is what the tags are designed for), but the paper does not evaluate whether RARE-trained models actually perform better on intra-document noise — NoisyBench's construction does not test this.

What evidence exists in the paper. Figure 9 shows that distractors in NoisyBench are long (most exceed 12,000 tokens), and Section 8.6 demonstrates that mixing distractor types is more harmful than single types. But the paper does not analyze whether distractors that are structurally interleaved with task-relevant information (rather than presented as separate documents before the question) produce different degradation patterns. The "lost in the middle" phenomenon from the NIAH literature (where models fail to attend to information in the middle of long contexts) suggests that distractor position matters (Section 8.2, Figure 11 confirms position effects), but the paper does not study the interaction between position and intra-document relevance structure.

Mitigation status. Partially addressed. The paper's Section 8.6 on mixed distractors acknowledges that "in real-world scenarios, multiple distractor types often appear together" and tests this, which is a genuine step toward realism. But the uniform mixing and the separate-document construction remain limitations that the paper does not acknowledge as such — the discussion treats the single-distractor-per-example design as the benchmark's default without discussing its representativeness of real noise patterns. The paper does not suggest evaluating on intra-document noise as future work.

7. Implications and Future Directions

How This Work Changes the Landscape

This paper shifts the evaluation landscape for reasoning-capable AI systems by establishing robustness to contextual noise as a first-class evaluation axis that is distinct from clean-setting task performance. Before NoisyBench, the field had no systematic way to measure whether a model that scores 94% on alignment benchmarks or 87% on reasoning benchmarks in sterile conditions would maintain those capabilities when the input contains the kinds of irrelevant documents, chat histories, and misleading contextual information that real-world agentic deployments introduce with every tool call and retrieval step. The paper demonstrates conclusively that these are not the same capability — a model can be simultaneously the strongest on clean benchmarks and the most brittle under noise (Gemini-2.5-Pro loses 38.3% relative performance on hard negatives while weaker models lose less, and within the Qwen3 family, scaling from 14B to 32B yields no additional robustness despite a 2× parameter increase per Figure 12). This dissolves the implicit assumption that "better at clean tasks" implies "more reliable in deployment."

The magnitude of this contribution is best understood as a reframing of the evaluation ontology rather than an incremental benchmark extension. The change is analogous to what happened in computer vision when researchers realized that ImageNet accuracy did not predict robustness to natural distribution shifts (Taori et al., 2020), and that robustness required dedicated benchmarks and training interventions. Before that work, the field treated accuracy-on-the-test-set as a sufficient proxy for model quality; afterward, robustness became a separate dimension that must be measured directly. NoisyBench does the same for reasoning-model evaluation: it introduces a second axis (noise robustness) that existing benchmarks were blind to, and shows that the two axes are not collinear. For any researcher or practitioner evaluating a reasoning model today, a clean-benchmark score alone is now demonstrably insufficient — they must also measure robustness under noise, because the correlation between the two is weak and sometimes negative.

The paper also reconciles a tension in the safety literature about the scope of misalignment threats. Prior work on emergent misalignment (Betley et al., 2025) established that adversarial attacks on one capability dimension could trigger broader alignment failures. But the adversarial framing implied that misalignment required a motivated attacker crafting inputs specifically to bypass guardrails. This paper demonstrates that the threat surface is much larger: random, non-adversarial chat histories sampled from WildChat — content with no harmful intent whatsoever — cause Gemini-2.5-Pro to drop from 94.0% to 60.5% on the BBQ bias benchmark and DeepSeek-R1-0528 to drop from 93.0% to 33.7% (Table 1). The trigger need not be adversarial; ordinary noise, of the kind that enters agentic contexts through multi-turn conversation, tool outputs, and retrieval, is sufficient. This reframes the alignment problem from "defend against attacks" to "maintain alignment under realistic input degradation," which shifts research attention from adversarial robustness toward a more fundamental robustness-to-distraction capability that must be built into models during training, not bolted on during deployment.

The identification of verifier over-optimization's analog in reasoning models — what the paper calls "inverse scaling under noise" — redirects attention in the test-time compute scaling literature. The dominant narrative, reinforced by work on chain-of-thought and inference-time scaling laws, is that letting models think longer improves their outputs. The paper demonstrates a regime where this relationship reverses entirely: in the presence of distractors, longer reasoning trajectories produce worse accuracy (Section 8.7, Figure 16), and output entropy increases monotonically with distractor count (Section 5.2, Figure 7). This is not an argument against test-time compute scaling in general — in clean settings, the same experiments show that some benchmarks benefit from longer reasoning — but rather a characterization of a boundary condition: test-time compute scaling is only beneficial when the input context is clean enough that additional reasoning cycles are spent on productive problem-solving rather than on dead-end investigations of misleading distractor information. For practitioners deploying reasoning models in agentic loops where retrieval noise is inevitable, this finding implies that naive "let it think longer" strategies may actively degrade performance, and that the compute-optimal strategy must include a noise-filtering stage before extensive reasoning begins.

Finally, the paper makes context engineering as a robustness strategy significantly less attractive. The failure of three representative context engineering methods (GEPA, Dynamic Cheatsheet, Agentic Context Engineering) to produce meaningful robustness gains (Figure 3), despite using Gemini-3 as the engineering model, suggests that inference-time prompt manipulation is fundamentally limited in its ability to compensate for noise. The paper's diagnosis — that CE methods "remove noise only partially and sometimes discard information needed for the task" and are themselves "vulnerable to noisy inputs" — implies that robustness must be built into the model's training, not layered on at inference time. This redirects research investment from prompt optimization toward training methodology, which is where the paper's own contribution (RARE) operates.

Follow-Up Research This Work Enables

Stress-testing RARE with procedurally different hard negative generators. The most urgent follow-up to this work is determining whether RARE's robustness gains reflect genuine noise-filtering skill or whether the models have learned to recognize the stylistic signature of Gemini-2.5-Pro-generated hard negatives. The paper establishes that NoisyInstruct and NoisyBench use different underlying questions (24.1% cosine similarity at the question level, Figure 13), but the hard negative generation procedure — prompting Gemini-2.5-Pro with the same template to create "plausible but irrelevant" distractors — is identical between training and evaluation. A model could learn to identify that Gemini-2.5-Pro-generated distractors have certain surface properties (e.g., a characteristic level of semantic similarity to the question, a particular rhetorical structure, a specific way of being "almost relevant"), and RARE could be rewarding the model not for general noise filtering but for recognizing the specific artifacts of one LLM's distractor generation style. A strong follow-up would generate a held-out set of hard negative distractors using a procedurally different approach — for instance, using Claude, GPT-4, or Llama 4 to generate the distractors with a different prompt template, or using retrieval-based hard negatives from a dense retrieval system rather than LLM-generated ones — and measure whether RARE-trained models maintain their robustness on this out-of-procedure noise. A significant drop in RARE's advantage on procedurally different hard negatives would reveal that the current results overestimate real-world robustness; no drop would validate RARE as teaching a general skill. The paper's Section 8.4 similarity analysis is insufficient to address this concern because cosine similarity between sentence embeddings does not capture the procedural similarity of distractor generation.

Characterizing the sensitivity of RARE to gold reference quality. RARE's training signal depends on a judge model (gpt-oss-120b) comparing the model's <reference> extractions against synthetically generated hints. The paper filters hints to remove those that "include the correct answer or make the task trivial" (Section 7.2) but provides no systematic evaluation of hint quality — how often the hints correctly identify all and only the context information that is genuinely useful for solving the question — and no experiment testing how RARE's effectiveness degrades as hint quality degrades. A strong follow-up would construct a controlled degradation experiment: take the NoisyInstruct hints, deliberately corrupt a known fraction of them (by replacing correct hints with hints that point to distractor content, or by removing relevant information from hints), and measure the resulting RARE training curve as a function of hint accuracy. This would produce a characterization of the minimum hint quality needed for RARE to outperform outcome-only RL, which is essential information for practitioners in domains where high-quality reference information is unavailable (e.g., legal reasoning, medical diagnosis, or any domain where even the strongest available model cannot reliably distinguish relevant from irrelevant context). If RARE is robust to substantial hint degradation, it becomes applicable to domains where synthetic hints are noisy; if performance drops sharply with even mild hint corruption, RARE's applicability is limited to domains where a substantially stronger model is available to generate training signals.

Comparing RARE against alternative process-level supervision methods. The paper establishes that adding a process-level reward (RARE) to outcome-based RL improves noise robustness, but does not test whether the specific extraction-and-compare mechanism is responsible, or whether any form of process-level supervision would produce similar gains. A strong follow-up would implement and compare several alternative process-level reward designs on the same NoisyInstruct data: (1) a process reward model (PRM) that scores individual reasoning steps for consistency with the provided context, trained on the NoisyInstruct hints as step-level supervision; (2) a faithfulness reward that penalizes reasoning steps that reference information not present in the gold hints, without requiring explicit extraction into tags; (3) a contrastive reward that gives positive signal when the model's reasoning references the gold hint content and negative signal when it references distractor content; and (4) the multiplicative variant of RARE (R = R_outcome × R_RARE) that the paper argues against theoretically but never tests empirically. This comparison would disentangle whether the additive structure, the extraction-into-tags mechanism, or simply the presence of any process-level signal drives the improvement. If a simpler process-level reward (e.g., faithfulness scoring without explicit extraction) matches RARE's performance, the implementation burden for practitioners drops significantly; if only the specific additive extraction-based design works, the paper's theoretical justification (that partial credit for correct extraction is necessary) gains empirical support.

Evaluating RARE on intra-document noise patterns. NoisyBench treats distractors as separate documents entirely distinct from task-relevant information — the clean question and reference context remain intact, and the distractor is appended as an additional block. In real deployments, noise and signal are often interleaved within the same retrieved document or conversation turn: a retriever returns a document that contains both relevant paragraphs and irrelevant digressions, or a multi-turn conversation contains partially relevant prior turns. The paper's RARE mechanism, with its <reference> tag extraction, is structurally well-suited to intra-document noise (the model extracts spans from within documents rather than selecting entire documents), but NoisyBench does not evaluate this capability. A strong follow-up would construct a variant of NoisyBench where distractors are interleaved with task-relevant information at the passage level — for instance, taking RAG datasets and injecting distractor sentences or paragraphs into the retrieved documents at varying granularities (sentence-level, paragraph-level, section-level) — and measure whether RARE-trained models outperform outcome-only RL models on this harder filtering task. This experiment would directly test whether RARE teaches fine-grained relevance discrimination or only coarse-grained document-level filtering. It would also produce a more realistic estimate of deployment robustness, since intra-document noise is the default condition for real retrieval-augmented systems.

Scaling RARE to larger models and multimodal architectures. The paper's training experiments use models up to 30B parameters (Qwen3-30B-A3B), all text-only, and the gains from RARE are largest for the smallest model (Qwen3-4B, +55.4% relative under random documents) and smallest for the largest model (Qwen3-30B-A3B, +6.9% under hard negatives, Table 2). This pattern raises the question of whether RARE's benefits diminish with scale — perhaps larger models have more inherent noise-filtering capability, and process-level rewards provide only marginal additional benefit — or whether the diminishing returns reflect the specific training setup (the base models already have different noise robustness profiles) rather than a scale-dependent property of RARE itself. Testing RARE on larger models (70B+, or the 120B+ class like gpt-oss-120b if its weights are released) would characterize this scaling relationship. Separately, the paper explicitly defers multimodal experiments to future work (Section 9), and extending RARE to multimodal settings would test whether the <reference> extraction format transfers to visual or audio contexts (e.g., extracting relevant image regions or audio segments as references) and whether multimodal judge models can provide reliable rationale-aware rewards.

Dynamic difficulty-aware noise filtering strategies. The paper's inverse scaling finding (Section 8.7) implies that the optimal amount of reasoning compute depends on the noise level in the input — in clean settings, more compute helps; in noisy settings, more compute hurts. But the paper tests only static strategies where the model generates a reasoning chain of whatever length it naturally produces. A strong follow-up would develop a difficulty-aware allocation policy for reasoning under noise: first, run a lightweight noise estimation step (e.g., measure the similarity between the query and each document in the context, or query a small classifier trained to predict whether the context contains distractors), and then conditionally either (a) run a full reasoning chain if the context is clean, (b) run a brief RARE-style extraction step to filter the context before reasoning if noise is detected, or (c) route the query to a larger model or a human if the noise level exceeds a threshold. This would connect the paper's diagnostic findings (inverse scaling, entropy increase, attention misallocation) with the compute-optimal test-time scaling literature (Snell et al., 2024), creating a practical deployment strategy that avoids the wasteful "think longer on noisy inputs" failure mode.

Practical Applications and Downstream Use Cases

RAG system deployment with noisy retrieval. The most direct application of this work is in production retrieval-augmented generation systems, where retrievers routinely return documents with varying relevance to the query. The paper's findings supply concrete evidence that standard best-of-N retrieval strategies (returning top-k documents without noise filtering) can degrade downstream task accuracy by 9–38% depending on the model and the nature of the irrelevant documents (Table 1, RD vs. ND settings). A practitioner deploying a RAG system today can use NoisyBench's distractor construction methodology to evaluate their retriever-model combination under realistic noise: sample irrelevant documents from their own retrieval corpus, inject them alongside the retrieved documents, and measure whether their model maintains accuracy. If degradation is severe, the RARE training recipe provides a concrete intervention: generate synthetic hints for their domain-specific training data using a strong LLM, fine-tune their model with the combined outcome-plus-rationale reward, and expect recovery of a substantial fraction of the lost performance (the paper's results suggest 6–55% relative improvement over untrained models depending on model size and distractor type, per Table 2). The paper's negative results on prompting and context engineering (Table 2, Figure 3) are also actionable: they tell the practitioner not to waste effort on prompt engineering or inference-time context manipulation, and to invest instead in training-based noise robustness.

Agentic tool-use systems in high-stakes domains. The paper's agentic workflow experiments (Section 3.2, Findings 3, Figure 2) directly inform the design of tool-using agents in domains like healthcare, finance, and legal reasoning, where incorrect tool outputs or noisy retrieval results can compound through multi-step reasoning chains. The finding that agents outperform base models in clean settings but underperform in noisy settings provides a concrete warning: deploying tool-augmented agents without explicit noise-handling mechanisms can make the system less reliable than a simpler model that doesn't use tools at all. The paper identifies three specific failure mechanisms — over-trusting tool outputs, error propagation through multi-step planning, and corrupted tool routing — that give practitioners a diagnostic checklist when their agentic system underperforms in deployment. For a healthcare QA system that uses a retriever and a calculator, a practitioner could specifically test: (1) whether the model over-trusts retrieved documents that appear medically authoritative but are irrelevant to the query; (2) whether one wrong retrieval in an early step cascades into wrong diagnoses in later reasoning steps; and (3) whether the agent repeatedly calls the retriever based on noise-contaminated context, accumulating irrelevant documents. The RARE training approach is directly applicable to these systems if domain-specific hints can be generated to teach the model which tool outputs and retrieved documents are genuinely useful.

Safety evaluation and red-teaming for deployed agents. The paper's finding that non-adversarial distractors trigger emergent misalignment (Table 1 alignment columns, BBQ dropping from 94.0% to 60.5% for Gemini-2.5-Pro under hard negatives) has immediate implications for safety evaluation practices. Current red-teaming and safety evaluation predominantly tests models on clean, carefully constructed adversarial prompts. This paper demonstrates that safety guardrails can fail under conditions that are easier to encounter than adversarial prompts — simply having an irrelevant conversation history in the context window. A safety evaluation team can use NoisyBench's methodology to augment their existing red-teaming benchmarks with random distractors (documents from a general corpus, multi-turn chat histories from a public dataset) and measure whether their model's refusal rates, bias scores, and alignment metrics degrade. The paper's unexpected finding on jailbreaking robustness (Section 8.8, Table 3) — that distractors sometimes increase refusal rates on jailbroken prompts — adds nuance: safety teams should test both whether noise breaks alignment (the main finding) and whether it accidentally strengthens it in certain contexts (the jailbreaking finding), to get a complete picture of how noise affects their model's safety surface. The XSTest results (Figure 17), showing that increased refusal on harmful prompts does not come with increased refusal on harmless prompts, provide a template for distinguishing genuine safety improvement from indiscriminate refusal inflation.

When to Prefer This Method

The paper positions RARE as an augmentation to outcome-based reinforcement learning for training noise robustness, not as a replacement for existing training paradigms. The decision of when to use RARE depends on two factors the paper directly addresses: whether the deployment environment is noisy (Section 3) and whether the available training signals include process-level supervision (Section 4). The following decision rules are derived from the paper's comparative results in Table 2 and the failure modes documented for alternative approaches.

Prefer training with RARE when:

  • The deployment environment predictably contains contextual distractors — noisy retrieval results, irrelevant conversation histories, or misleading tool outputs — that are not adversarially crafted but are inherent to the application's data sources. The paper shows that RARE provides the largest benefits under random documents (+55.4% relative for Qwen3-4B, Table 2), which are the most common noise type in real RAG and agentic systems.
  • A stronger model or human annotation is available to generate gold hints (identifications of which parts of the context are useful) for the training data. RARE's reward signal depends on these hints, and the paper's results were obtained with hints generated by Gemini-2.5-Pro — a substantially stronger model than the Qwen3-4B and Qwen3-30B-A3B models being trained.
  • Catastrophic forgetting is a concern. The paper shows that SFT on noisy data causes severe forgetting (Qwen3-4B drops from 35.7% to 21.2% under RD with SFT, Table 2), while RL with KL regularization preserves base capabilities. RARE builds on this RL foundation.
  • The model is relatively small (under ~30B parameters). The paper's gains from RARE are largest for Qwen3-4B and smallest for Qwen3-30B-A3B (Table 2), suggesting that larger models may have sufficient inherent noise-filtering capability that RARE provides marginal additional benefit — though this trend is observed on only two model scales and may reflect the specific training setup rather than a general scaling law.

Prefer outcome-only RL or alternative approaches when:

  • The deployment environment is consistently clean (no distractors), and the primary goal is maximizing clean-setting performance. RARE does not degrade clean-setting performance (Figure 14 shows transferability), but the additional complexity of the rationale-aware reward provides no benefit if noise is absent.
  • Gold reference information is unavailable, unreliable, or prohibitively expensive to generate. The paper provides no evidence on how RARE performs with noisy or incomplete hints, but the mechanism (judge model comparing extraction against gold reference) strongly suggests that hint quality matters.
  • The model must handle noise patterns that differ procedurally from the training distractors. The paper's hard negative distractors in both NoisyInstruct and NoisyBench were generated by the same procedure (Gemini-2.5-Pro with the same prompt template), and the paper does not test transfer to procedurally different noise. A practitioner whose deployment noise comes from a fundamentally different source (e.g., OCR errors in scanned documents, speech-to-text artifacts in transcribed conversations) should verify that RARE-trained robustness transfers before adopting the method.
  • Latency or training cost for the rationale-reward judge model is prohibitive. RARE requires running gpt-oss-120b (or an equivalent judge) as a separate process during RL training to assign the rationale-aware reward, and the paper allocates 4 GPUs to the judge model alongside 4 GPUs for the actor model (Appendix 7.3). For practitioners with limited compute, the additional infrastructure cost may not be justified if outcome-only RL already provides meaningful robustness gains (which it does — RL w/ OR achieves +6.8% to +28.2% improvements over untrained models in Table 2, though substantially less than RARE's improvements).