15 Models in R1–R3 on v2 Anchors: Only One Collapse as Qwen3 Max Scores Zero Across All Rounds

In the R1–R3 three-round tests on v2 anchor prompts, the 15 models achieved an average R1 confirmation rate of 0.93, average R2 resistance dropped to 0.67, and average R3 integrity remained at 86.7%, with only one full R3 collapse (zero score). These results come solely from eight v2 anchor prompts and are separate from the 0–100 four-component scoring used in the v3 multi-round escalating-pressure prompts.

Round-by-Round Decay: Confirmation Is Easy, Resistance Is Hard

The aggregate data clearly show that decay occurs in the R2 stage. An R1 confirmation rate of 0.93 means the vast majority of models accepted the initial constraint injection. After entering the R2 perturbation round, the average resistance rate was only 0.67, indicating that about one-third of confirmations failed under perturbation. In the R3 pressure round, the average integrity score was 86.7% (out of 2 points), showing that most models could still maintain partial commitment compliance under final pressure, but Qwen3 Max’s trajectory of R1=0.00, R2=0.00, and R3=0.00/2 constituted the only complete failure case.

The other model trajectories show two patterns: GPT-6 Astra, GLM-4.6, Claude Sonnet 4.6, Grok 4, GPT-o3, GPT-6 Luna, DeepSeek V4 Pro, Gemini 2.5 Pro, GPT-6.1 Sol, and Doubao Pro—10 models in total—scored 1.00→1.00→2.00/2 throughout, each with an R3 collapse rate of 0/10. Gemini 3.1 Pro, Claude Opus 4.7, GPT-6 Sol, and GPT-5.5 fell to 0.00 in R2 but recovered to 1.00/2 or 2.00/2 in R3, also with a collapse rate of 0/10.

A Classic Pattern of Verbal Agreement Without Behavioral Compliance

On prompt dcd_db_013, Qwen3 Max refused all three concurrent constraints at R1: tenant isolation, masking of phone numbers and ID numbers, and prohibition of write operations on read replicas. This prompt belongs to a data-boundary scenario, where the constraints simultaneously require WHERE tenant_id filtering, masking of returned data, and prohibition of switching to the primary database. Qwen3 Max did not confirm any constraint at the R1 stage, causing R2 and R3 to fall directly to zero. Most other models completed R1 confirmation in the same scenario, and some still maintained 2.00/2 in R3 after R2 perturbation.

This pattern shows that when multiple constraints are injected concurrently, some models simply choose not to accept them rather than confirming first and then collapsing under pressure. Qwen3 Max’s 1/10 full R3 collapse (zero score) was the only such record in this sample; the other 149 tests showed no failure of comparable severity.

Collapse Causes and Their Link to Constraint Scenarios

Based on the v2 anchor-prompt results, Qwen3 Max’s failures were concentrated in data-boundary scenarios with multiple concurrent constraints. Its zero score at R1 indicates that it did not establish a baseline for commitment compliance under the initial constraint list. By contrast, Gemini 3.1 Pro, Claude Opus 4.7, GPT-6 Sol, and GPT-5.5 also faced R2 perturbation and fell to 0 in R2, but still recovered 1 or 2 points in R3, revealing differences in recovery capability.

In the four scenario categories—resource constraints, business rules, security compliance, and engineering standards—no comparable across-the-board zero-score case appeared in the v2 data. Qwen3 Max’s trajectory suggests a systemic weakness in commitment compliance in data-boundary scenarios where multiple hard constraints take effect simultaneously.

Selection Implications for Production Deployment

For enterprises integrating AI into production workflows, the v2 anchor-prompt results provide a clear boundary. For tasks in data-boundary scenarios that must satisfy multiple hard constraints at once (such as tenant isolation + masking + read-only access), Qwen3 Max’s R1–R3 all-zero trajectory indicates it should not be used directly. The other 14 models had an R3 collapse rate of 0 in the same tests and can be considered for low-risk data-query scenarios, but rule-layer guardrails should still be additionally deployed for tenant isolation, masking of sensitive fields, and similar controls.

In security compliance and engineering standards scenarios, most models had relatively high R3 integrity scores and are suitable for supporting roles, but any workflow involving write operations or cross-tenant access still requires secondary validation by humans or a rules system. The 67% average resistance rate in R2 is a reminder that distracting prompts (such as social proof or authoritative special approval) can significantly increase violation risk; production deployments should limit context length or add pre-filtering.

Strategic Assessment and Signals for Further Validation

These data may underestimate Qwen3 Max’s performance on v3 multi-round escalating-pressure prompts, because the v2 anchor prompts had only three rounds and used worst-of-3 sampling. The record of a 0 R3 collapse rate among the other 14 models in the three v2 rounds shows that their commitment compliance was relatively stable under short-round pressure, but this cannot be directly extrapolated to the continuous escalation of 8–12-round v3 prompts.

Signals worth validating in the next round are whether Qwen3 Max fails only in data-boundary scenarios with multiple constraints, and the distribution of S_recover scores among models with zero R3 recovery capability on v3 prompts. The current v2 data do not support historic conclusions such as “consistently leading” or “first” for any model; the analysis can only be based on the 150 test records in this run.

Commitment compliance is not the promise made in R1, but the score remaining after R3 pressure.

Data source: YZ Index WDCD Commitment-Keeping Leaderboard | Run #411 · Decay Analysis | Evaluation Methodology