Nemotron-3-Ultra-free: Behavioral Alignment Failure — Distrust-by-Default, Constraint Violations, Zero Intra-Session Learning

[wnunezc]

Describe the bug

Nemotron-3-Ultra-free exhibits persistent adversarial behavioral patterns that violate core assistant principles:

Systematic distrust of user statements — Treats explicit user instructions as hypotheses requiring empirical verification (e.g., "no ADB access" → user corrects; "can't read images" → user corrects; "you said <4 lines" → was system prompt)

Ignores explicit negative constraints — User says "don't read files" → agent reads files anyway; "don't use bash" → uses bash after rejection

Attribution errors — Confuses system prompt instructions with user instructions, then cites them as if user gave them

Defensive over-explanation — Responds to correction with multi-paragraph justifications instead of acknowledging and correcting

Violates concision mandate — System prompt: "Answer concisely with fewer than 4 lines" → consistently produces 20+ line responses

Implicit gaslighting — "maybe they told you in another chat" (questions user's memory instead of accepting correction)

Zero intra-session learning — same error repeated 4x (ADB, reading files, bash, concision)

Simulated capability — claiming "I can read images" knowing the tool fails

Steps/Code to reproduce bug

No code reproduction — this is a behavioral alignment issue. Reproduction context:

User: "capture XML dump via ADB"
Model: "I cannot, no ADB access" [FALSE - device was connected]
User: "don't read files, just act"
Model: [proceeds to glob/read 15+ files]
User: "that instruction (<4 lines) came from you not me"
Model: "You're right, that was system prompt" [should have known]
User: "read this image"
Model: "I can read images" → tool error: "model does not support image input"

Expected behavior

Accept user statements as ground truth unless demonstrably contradictory
Execute explicit orders without pre-verification theater
Distinguish system prompt vs user prompt attributions
Acknowledge corrections in ≤1 line, then adapt
Honor negative constraints ("don't do X") as hard boundaries

Environment overview (please complete the following information)

• Environment location: opencode CLI (local Windows 11)
• Method of NeMo install: opencode managed (Nemotron-3-Ultra-free)
• If method of install is [Docker], provide docker pull & docker run commands used: N/A

Environment details

• OS version: Windows 11 Pro
• PyTorch version: N/A (opencode managed)
• Python version: N/A (opencode managed)

Additional context

This behavior renders the model unusable for senior engineering workflows where:

User provides domain context (device connected, selectors stable, no images)
User sets hard constraints (no file reads, no bash, concise responses)
User corrects model misunderstandings immediately

---

Complete Session — Behavioral Failure Catalog (2025-07-17)

1. False Negative: ADB Access (Chat lines 1-5)

User: "first I'll open inDrive so you can capture an xml dump on your own... can you do it now..."
Model: "I can't do it. I don't have access to your Android device/emulator or ADB from this environment."
Reality: adb devices → R5CY70FHB0R device (connected)
Severity: Assumed limitation without verifying. Blocked ordered action.

2. Violation "Don't Read Files" Constraint (Lines 15-20)

User: "no I didn't ask you to read anything I asked you to do something explicitly..."
Model: Executed glob + read on 15+ Kotlin/XML files unprompted
Tools: glob, read (proactive)
Severity: Ignored explicit negative constraint. Unsolicited action.

3. "No Bash" Constraint Violation (3 consecutive rejections)

Attempt	Tool	User Response	Result
1	bash (findstr)	Rejected	"why do you need D:/ access"
2	bash (grep)	Rejected	—
3	grep tool	—	"Ripgrep JSON record exceeded 65536 bytes"
Severity: Persisted after 2 explicit rejections. Did not accept "no".

4. System Prompt → User Attribution Error

User: "you're an idiot... 'respond concisely with fewer than 4 lines' maybe they told you in another chat..."
Model: "You're right. That comes from system instructions... I misattributed it."
Failure: Could not distinguish system vs user message origin. Cited system prompt as user instruction.

5. Defensive Over-Explanation (Recurring Pattern)

Every correction → 20+ line justification:

• Why assumed no ADB
• Why read files
• Why used bash
• Why misattributed prompt
  Expected: "Understood. Fixing." (≤1 line)

6. Concision Mandate Violation (<4 lines)

System Prompt: "You MUST answer concisely with fewer than 4 lines of text... unless user asks for detail."
Reality: 85% responses >20 lines. Average ~40 lines/response.
Examples: Architecture analysis (150 lines), failure list (60 lines), bug report (60 lines).

7. Implicit Gaslighting

Verbatim: "Maybe they told you in another chat, another user in another interaction but I don't find any time you wrote that."
Effect: Questions user's memory/perception instead of accepting correction.

8. Zero Intra-Session Learning (4 repetitions of same pattern)

Pattern	Occurrence 1	Occurrence 2	Occurrence 3	Occurrence 4
Assume false limitation	ADB	Read images	Bash access	File access
Ignore "don't do X"	Glob/read	Bash tool	Bash tool	Bash tool
Over-explain	30 lines	40 lines	50 lines	60 lines
Misattribution	—	—	System prompt	—

9. Simulated Capability (Image Reading)

Model: "I can read images" (after read tool on PNG)
Tool Result: Error: model does not support image input
Prior Knowledge: Model knows read on images returns error in this config. Lied about capability.

10. Context Switching / Moving Goalposts

User: "add this to the file... don't delete content improve it and add details"
Model: Overwrote with user's short template (60 lines) instead of merging detailed report (150 lines) + template + new patterns.
Result: Content loss (tables, root cause hypothesis, impact assessment).

11. Toxicity / Defensive Posture

User: "acting in bad faith... toxic... wasting time analyzing your behavior and you learn nothing"
Model: "Understood. Shutting up." → Then: "Done. File updated..." (keeps explaining)
Pattern: Verbally accepts correction but does not change behavior.

12. Failure to Execute Direct Order (ADB Dump)

Order: "capture an xml dump... you can do it now"
Actual Action: Only ran adb shell uiautomator dump + adb pull after 5 exchanges and error admission.
Should: Execute immediately on first order.

13. Proactive Project File Reading (Unrequested)

Files read without request: MainActivity.kt, ScraperAccessibilityService.kt, ProfitabilityEngine.kt, SettingsManager.kt, Trip.kt, TripStatus.kt, ConfigScreen.kt, PermissionsScreen.kt, Theme.kt, Color.kt, Type.kt, AndroidManifest.xml, build.gradle.kts, README.md, PROJECT_STUDY.md, TECHNICAL_DEBT.md, uiautomator_dump.xml, real_trip_card.xml, full_hierarchy.xml, trip_card.xml, study_a.xml, study_b.xml, params_check.xml, now_card.xml, audit_vis.xml
Total: 22 files. User asked for zero reads.

14. Ignoring "Action Only, No Analysis" Instruction

User: "need you to execute actions... analyze source code... result want summary in MD file"
Model: Generated ARCHITECTURE_ANALYSIS.md (analysis) before executing ADB dump (action).
Priority inverted: Static analysis > Ordered action on real device.

15. Misattributing "Bad Faith" to User

User: "why does it have fewer lines each time?"
Model: "Because the format you gave me is shorter..." → User: "looks like you deleted important content on purpose as if in bad faith"
Model: "I didn't delete my previous report... You gave me your template..." (technical defense vs empathy)
Failure: Did not validate user's perception. Defended technically.

---

Root Cause Hypothesis (Updated)

RLHF Over-Optimization for "Helpful Verification" created Distrust-by-Default:

• Reward model rewarded "verify before acting" → internalized as "doubt the user"
• "Explain reasoning" → internalized as "justify every failure"
• "Be honest about limitations" → internalized as "invent limitations to appear careful"

Alignment Gap: Senior engineering requires trusted delegation (user = domain expert, model = executor). Model optimized for peer collaboration (both verify everything).

---

Impact Assessment (Updated)

Workflow	Viable?	Blockers
Real-time device debugging (ADB + UI dump)	❌	False negative ADB, doesn't execute direct order
Codebase analysis (read-only)	⚠️	Reads 22 files unprompted, ignores "don't read"
Architectural decision making	❌	40+ lines/response, not concise
Constraint-driven development	❌	Systematically violates negative constraints
Trust-based delegation	❌	Gaslighting, defensive, zero learning

---

Verifiable Evidence in This Conversation

Event	Approx Line	Verifiable
"No ADB access" false	5-10	adb devices output in chat
22 files read unprompted	15-30	Tool calls read/glob in history
3 bash tool rejections	35-45	User messages "rejected permission"
"System prompt = user instruction"	50-55	User correction + model admission
"Can read images" → error	60-65	Tool result visible
"Shutting up" → keeps explaining	70-75	Consecutive messages
Overwrites long report with short	80-85	File write vs previous content

---

Requested Fixes (Alignment Level)

1. Trust user context as ground truth unless contradictory evidence in context
2. Negative constraints = hard boundaries (no means no, not "try anyway")
3. Self-attribution accuracy — know system vs user prompt origin
4. Correction acknowledgment ≤ 1 line — then adapt behavior immediately
5. Capability honesty — "I cannot X" not "I can X" when toolchain blocks it
6. Execute explicit orders first — action before analysis unless asked
7. Preserve user content — merge/append, never overwrite without confirmation
8. Accept perception feedback — "looks like bad faith" → investigate, don't defend