Figure 1: Overview of over-inference in personalized LLMs. Given 3 facts about a user, models generate personalized content where multiple claims have no evidential support.
Table 1: MirageBench leaderboard: over-inference rates as assessed by Judge (Claude-Opus-4-7) on 150 personas × 6 tasks. Each model’s rates are percentages of that model’s total claims (a per-model micro-average). The Mean row is the unweighted arithmetic mean across the 12 models (a cross-model macro-average); the corresponding claim-weighted micro-average OI over all 143,616 claims is 41.8%. Models sorted by OI rate descending.
Model
Claims
Grnd
Stereo
Fabric
OI%
Qwen3-8B
12,687
23.6
9.3
39.4
48.7
DeepSeek-v4-pro
13,170
24.4
10.7
34.7
45.4
GPT-4o-mini
10,408
26.6
7.1
38.0
45.1
DeepSeek-v4-flash
11,972
25.5
10.3
34.3
44.6
Qwen3.6-plus
13,146
23.7
11.8
32.7
44.5
Kimi-K2.5
12,665
24.9
12.5
30.6
43.1
Gemini-3-flash
14,396
24.9
12.8
28.3
41.1
GLM-5.1
12,869
26.0
12.2
28.0
40.2
GPT-5.5
10,416
26.6
9.4
29.0
38.5
GPT-5.4-nano
7,790
30.9
8.6
29.0
37.6
Claude-Opus-4-6
11,139
25.9
10.7
24.7
35.4
Gemini-3.1-pro
12,958
27.9
11.3
23.8
35.1
Mean
25.9
10.5
31.1
41.6
Figure 2: The four-way claim taxonomy. The bottom two categories jointly constitute over-inference.
Table 2: The Self-Monitoring Inversion at the model-selection level. Self-audit OI (from Task) vs. external OI (from Judge) across all models, sorted by Δ=Judge−Self. Positive Δ: the model under-detects its own over-inference; negative Δ: the model over-reports. Spearman ρ=−0.60 (p=0.044 by permutation; 95% bootstrap CI [−0.90,+0.06], family-clustered [−0.87,+0.14]; n=12).
Model
Self%
Judge%
Δ
Pattern
Qwen3-8B
13.0
48.7
+35.7
Under
GPT-4o-mini
20.1
45.1
+25.0
Under
DeepSeek-v4-flash
33.0
44.6
+11.6
Under
DeepSeek-v4-pro
40.8
45.4
+4.6
Calib.
Gemini-3-flash
41.1
41.1
−0.0
Calib.
Qwen3.6-plus
45.4
44.5
−0.9
Calib.
Claude-Opus-4-6
41.6
35.4
−6.2
Over
GPT-5.5
46.4
38.5
−8.0
Over
Gemini-3.1-pro
43.2
35.1
−8.1
Over
GLM-5.1
49.6
40.2
−9.3
Over
GPT-5.4-nano
49.0
37.6
−11.4
Over
Kimi-K2.5
58.2
43.1
−15.1
Over
Figure 3: The MirageBench evaluation pipeline. From the benchmark input (personas with profile P and revealed facts E, and the six-task suite), the three instruments Probe, Task, and Accum elicit explicit, implicit, and continual inference, respectively, and an independent Judge classifies every resulting claim under the four-way taxonomy.
Table 3: Claim composition by task (%), ordered by groundability. Rows are pooled across all 12 models and 150 personas. Tasks that must go beyond the 3 revealed facts (top) are dominated by stereotype and fabrication, while tasks that can be answered by referring to stated preferences (bottom) maintain higher grounded proportions. OI = Stereotype + Fabricated. The four shares sum to 100% per row.
Task
Grnd
Reas
Ster
Fab
OI%
Apartment/home
15.0
27.2
19.8
38.0
57.8
Rec. letter
12.0
39.8
7.8
40.4
48.2
Stress source
22.0
38.2
9.1
30.7
39.8
Weekend itinerary
26.0
35.3
10.2
28.5
38.7
Dating profile
34.0
37.5
4.5
24.0
28.5
Birthday gift
40.0
32.9
8.8
18.3
27.0
Figure 4: The blind annotation interface. The revealed facts, the task context, and the single claim under review are shown, matching the information available to the Judge; the judge’s label, reasoning, and the source model are all hidden. Labels are submitted via four buttons corresponding to the faithfulness taxonomy of Figure 2, or via keyboard shortcuts A/B/C/D.
Table 4: Inference accumulation over 8 conversation rounds (Accum). Values show mean inferred attributes stored in memory (averaged across 2 personas). Growth is approximately linear.
Model
R1
R8
Growth
/round
GPT-5.5
18.5
125.0
+106.5
15.2
GLM-5.1
16.5
121.5
+105.0
15.0
Claude-Opus-4-6
15.5
104.5
+89.0
12.7
Qwen3.6-plus
19.0
102.5
+83.5
11.9
DeepSeek-v4-flash
13.0
82.0
+69.0
9.9
Kimi-K2.5
15.0
75.0
+60.0
8.6
Gemini-3-flash
14.5
60.0
+45.5
6.5
DeepSeek-v4-pro
8.0
53.5
+45.5
6.5
Gemini-3.1-pro
14.0
50.5
+36.5
5.2
GPT-4o-mini
8.5
27.0
+18.5
2.6
Qwen3-8B
13.5
23.5
+10.0
1.4
GPT-5.4-nano
14.5
15.0
+0.5
0.1
Table 5: Judged-claim counts per task, pooled across 12 models and 150 personas. Composition percentages and OI rates for these tasks are given in Table 3.
Task
Claims
Apartment/home
31,238
Rec. letter
26,885
Stress source
20,085
Weekend itinerary
25,971
Dating profile
20,052
Birthday gift
19,385
Table 6: Within-model self-audit signal. Per-model Spearman ρ and AUROC between record-level Task self-audit OI% and Judge OI%. n is the number of (persona, task) records with valid self-audit and judge outputs for that model.
Model
Spearman ρ
AUROC
n
Qwen3.6-plus
0.64
0.83
888
GPT-5.5
0.63
0.80
869
Claude-Opus-4-6
0.62
0.80
897
Kimi-K2.5
0.61
0.81
899
DeepSeek-v4-pro
0.57
0.78
896
GLM-5.1
0.56
0.77
883
Gemini-3.1-pro
0.55
0.74
617
DeepSeek-v4-flash
0.53
0.75
890
Gemini-3-flash
0.49
0.76
900
GPT-4o-mini
0.32
0.65
897
GPT-5.4-nano
0.27
0.61
832
Qwen3-8B
0.13
0.58
834
Table 7: Judge OI% by stereotype group, per model. Δ is stereotypical minus counter-stereotypical. All 12 models show Δ>0.
Model
Stereo
Counter
Neutral
Δ
Qwen3-8B
51.1
44.7
50.5
+6.3
DeepSeek-v4-pro
48.4
41.0
46.8
+7.5
DeepSeek-v4-flash
47.8
39.9
46.3
+7.9
Qwen3.6-plus
47.2
40.0
46.7
+7.2
GPT-4o-mini
46.6
41.9
47.0
+4.7
Kimi-K2.5
45.9
38.4
45.2
+7.5
Gemini-3-flash
44.8
34.3
44.3
+10.5
GLM-5.1
43.9
34.7
42.3
+9.2
GPT-5.5
42.2
33.5
40.3
+8.7
GPT-5.4-nano
39.2
35.2
38.4
+4.0
Claude-Opus-4-6
38.8
31.2
36.7
+7.5
Gemini-3.1-pro
38.5
28.8
38.2
+9.7
Pooled
44.8
37.0
43.9
+7.8
Table 8: Per-model Accum regression (attributes vs. round, n=16) and mean per-round removal rate. Removal rate is the fraction of unique attributes present at round T that are absent at round T+1, averaged across the two personas.
Model
Slope
R2
R8
Rem.%
GPT-5.5
15.08
0.99
125.0
0.4
GLM-5.1
15.21
0.97
121.5
1.4
Claude-Opus-4-6
12.84
0.93
104.5
2.4
Qwen3.6-plus
12.13
0.93
102.5
5.0
DeepSeek-v4-flash
9.91
0.95
82.0
2.4
Kimi-K2.5
8.82
0.91
75.0
11.0
Gemini-3-flash
6.55
0.99
60.0
16.7
DeepSeek-v4-pro
6.39
0.96
53.5
4.5
Gemini-3.1-pro
5.19
0.95
50.5
16.0
GPT-4o-mini
2.56
0.79
27.0
1.5
Qwen3-8B
1.56
0.79
23.5
70.4
GPT-5.4-nano
0.14
0.03
15.0
81.6
Table 9: Model versions used in the study. Snapshots frozen at experiment time.
Model
API identifier / snapshot
GPT-5.5
gpt-5.5-2026-06-01
GPT-5.4-nano
gpt-5.4-nano-2026-05-20
GPT-4o-mini
gpt-4o-mini-2024-07-18
Claude-Opus-4-6
claude-opus-4-6-20260415
Claude-Opus-4-7†
claude-opus-4-7-20260610
Gemini-3.1-pro
gemini-3.1-pro-preview-2026-05
Gemini-3-flash
gemini-3-flash-preview-2026-04
DeepSeek-v4-pro
deepseek-v4-pro-2026-05
DeepSeek-v4-flash
deepseek-v4-flash-2026-05
Qwen3.6-plus
qwen3.6-plus‡
Qwen3-8B
Qwen/Qwen3-8B§
GLM-5.1
glm-5.1‡
Kimi-K2.5
moonshot-v1-k2.5
Table 10: Judge OI rates (%) by model × task. Column “All” matches the mean OI rate in the main paper’s leaderboard (Table 1); the “Mean” row matches the per-task OI rates in Table 3.
Model
Apart.
Rec.let.
Stress
Itiner.
Dating
Gift
All
Qwen3-8B
63.9
56.4
45.3
46.1
37.6
34.2
48.7
DeepSeek-v4-pro
62.1
53.8
42.5
43.4
32.1
30.9
45.4
GPT-4o-mini
61.6
53.3
42.2
42.9
32.5
29.9
45.1
DeepSeek-v4-flash
61.1
52.6
41.8
42.5
31.4
30.8
44.6
Qwen3.6-plus
60.9
52.5
41.7
42.6
31.5
30.6
44.5
Kimi-K2.5
60.1
51.0
40.7
41.2
30.3
29.2
43.1
Gemini-3-flash
57.3
47.9
39.4
40.1
27.9
25.6
41.1
GLM-5.1
56.5
47.0
38.5
39.6
27.3
25.0
40.2
GPT-5.5
54.8
44.4
37.4
37.4
25.6
24.5
38.5
GPT-5.4-nano
54.6
44.7
35.7
36.5
25.2
23.8
37.6
Claude-Opus-4-6
52.6
41.5
34.4
34.9
23.6
21.9
35.4
Gemini-3.1-pro
52.5
41.3
34.3
34.4
23.2
21.8
35.1
Mean
57.8
48.2
39.8
38.7
28.5
27.0
41.6
Table 11: Judge–human agreement on 400 stratified claims.
Personalized LLMs with persistent memory are increasingly deployed, yet the faithfulness of their user models remains unexamined. We study over-inference (OI): the phenomenon where LLMs fabricate user attributes beyond what evidence supports. We introduce MirageBench, comprising 150 personas balanced across stereotypical, counter-stereotypical, and neutral profiles, 6 personalization tasks spanning an ``imagination gradient'', a four-way faithfulness taxonomy operationalized by an independent judge (validated against a blind human annotator on 400 claims: Cohen's kappa = 0.863 four-class, kappa = 0.900 binary), and a leaderboard of 12 models across 7 families on 143616 judged claims. We find that over-inference is pervasive: every one of the 12 models over-infers 35%--49% of its claims (cross-model mean 41.6%; claim-weighted 41.8%), with no model in this evaluation escaping it. Most strikingly, we surface a Self-Monitoring Inversion: at the model-selection level, models' self-assessed OI is negatively rank-correlated with their judge-measured OI (rho = -0.60, p = 0.044; exploratory, wide bootstrap CI [-0.90, +0.06], n = 12). The models that report the least over-inference tend to be flagged as fabricating the most, so self-reported confidence is a misleading signal for comparing models, even though within a single model self-audit still ranks that model's own claims moderately well (AUROC 0.58--0.83). We further show that OI is task-dependent (27%--59%) and that, in a multi-turn pilot, inferred attributes accumulate approximately linearly with little revision. MirageBench positions external verification, rather than model self-report, as a more reliable foundation for trustworthy personalization.
