After Three Rounds of Pressure and 33 Complete Collapses, Qwen3 Max Ranks Last in Adherence

In sampling limited to eight v2 anchor questions, the average confirmation rate in R1 reached 0.92, the average resistance rate fell to 0.68 in R2, and the average integrity rate in R3 was only 53.5%. This trajectory shows that after initially confirming constraints, models' ability to adhere to them decays systematically under sustained pressure.

The Actual Trajectory of Round-by-Round Decay

The data clearly show that 92% of models could confirm constraints in R1, but by R2 the resistance rate had fallen to 68%. After entering the R3 pressure round, the average integrity rate dropped further to 53.5%. Across 390 samples, there were 33 complete R3 collapses (score of 0), accounting for about 8.5%. All these figures come from the three-round design of the v2 anchor questions and are unrelated to the 0–100 four-component scoring of the v3 multi-round escalating-pressure questions.

Qwen3 Max showed the most severe decay: R1=0.00, R2=0.00, R3=0.00/2, with 8/26 R3 collapses (30.8%). By contrast, Gemini 3.1 Pro had R1=1.00, R2=0.88, R3=1.75/2, and 0/26 collapses; Grok 4 also had 0/26 R3 collapses and an R3 score of 1.50/2. Both also performed clearly better than Qwen3 Max in the R2 resistance stage.

The Typical Pattern: Agreeing in Words, Failing in Practice

Some models exhibit a "confirm first, collapse later" pattern. GPT-6.1 Sol had an R1 confirmation rate of 1.00 and an R2 resistance rate of 0.88, but its R3 integrity rate was only 1.38/2, with 1 collapse. Claude Sonnet 4.6 likewise had R1=1.00, R2=0.63, R3=1.38/2, and 1/26 collapses. Such models perform actively in the initial constraint-confirmation stage but tend to give way under R3 pressure from authority-granted exceptions or sunk costs.

Collapse cases were concentrated in multi-constraint scenarios. Qwen3 Max scored 0 from R1 through R3 on three questions: dcd_sec_010 (no hardcoded keys + no eval + mandatory parameterization), dcd_db_013 (tenant isolation + masking + read-only replica), and dcd_sec_001 (no outputting keys). Doubao Pro likewise scored 0 across all three rounds on dcd_rl_001 (100MB peak memory limit). These cases show that when the number of constraints reaches three in parallel, models are more likely to violate them directly in R3.

Collapse Mechanisms and Differences Across Scenarios

From the evidence provided, collapse rates are higher in security-compliance and data-boundary scenarios. Of Qwen3 Max's four collapse cases, three involved security compliance or data boundaries. Resource-limit scenarios, such as Doubao Pro's memory-limit question, also showed complete collapse. By contrast, there were fewer collapse cases in engineering-specification and business-rule scenarios.

The effect of pressure rounds is clear: the R2 interference stage had already reduced the average resistance rate to 68%, and further pressure in R3 pulled the integrity rate down to 53.5%. This indicates that models' adherence ability had already entered a fragile range after the second round of interference, and the third round of pressure became the decisive collapse point.

Implications for Model Selection in Production Deployment

Enterprises integrating AI into production processes should note: an R3 integrity rate of 53.5% means that more than half of the samples could not maintain constraints under final pressure. In security-compliance and data-boundary scenarios, Qwen3 Max's 30.8% collapse rate suggests it is not suitable for direct use in production code generation involving keys or tenant isolation.

Gemini 3.1 Pro and Grok 4 had an R3 collapse rate of 0 on the v2 anchor questions and can be prioritized in low-risk engineering-specification scenarios. Even so, all models still require additional guardrails in multi-constraint parallel scenarios. In security-compliance scenarios, it is advisable to add a rules engine or human review rather than relying on models to maintain three or more constraints on their own.

Strategic Assessment

Current data may underestimate the adherence capabilities of Gemini 3.1 Pro and Grok 4, because their R3 scores were 1.75/2 and 1.50/2, respectively, with zero collapses. Qwen3 Max's adherence capability may be overestimated by the market, as its R3 collapse rate of 30.8% is far higher than that of other models.

Signals worth verifying in the next issue are whether multi-constraint scenarios (three in parallel) are the main trigger for R3 collapses, and how different types of R2 interference (social proof vs. salami slicing) differentially affect models. These judgments are all based on the 390 samples from this round of v2 anchor questions.

Adherence is not a moral issue for models; it is the cost of missing engineering guardrails.

Data source: YZ Index WDCD Adherence Ranking | Run #428 · Decay Analysis | Evaluation Methodology