When an AI remembers the details but loses sight of the plan

A small inventory tracker sounds like a reasonable beginner programming project. Then come barcode scanning, payment-system integration, real-time stock updates across several locations, automated supplier emails and demand forecasting. Each addition can sound manageable in isolation. Together, they change the project.

In an illustrative conversation from the TurnFlow paper, an assistant recognizes that an Excel-based tracker has grown into enterprise-level software. Yet when the simulated user asks whether the whole system can be built in a couple of months, it supplies an encouraging timeline. Recognizing the problem did not translate into enforcing the constraint.

That distinction motivates TurnFlow, a benchmark introduced by Zhixun Chen and colleagues in an arXiv preprint. It tests whether large language models preserve, update and act on requirements over a conversation. The results concern a controlled stress test, not a measurement of how often everyday chatbot conversations go wrong.

A conversation with a controlled destination

TurnFlow contains 490 scenarios across nine domains, including food, travel, finance, education and technical support. Each scenario specifies a user persona, information to disclose gradually, a sequence of conversational aims, and criteria for judging the final response.

The five challenge types probe different abilities. Models must track changing constraints, reconcile conflicting requirements, distinguish preferences from hard rules, recognize expanding scope, or revisit an unresolved strategic decision when the user starts asking about execution.

For example, a preference for spreadsheets should not automatically dictate the tool for every deliverable. Likewise, a request for help pitching a business should not erase unresolved concerns about whether its pricing and workload are feasible.

The simulated user is not simply reading a fixed script. A system called BRIDGE examines the assistant’s latest reply, uses explicit rules to select the next conversational action, and generates the user’s wording. This allows responses to adapt while keeping the intended facts and challenges under control. The tested assistant sees the conversation, not the hidden scenario specification.

Scoring also separates two jobs. A language model extracts evidence from the assistant’s final answer; deterministic rules then apply the scenario’s required and forbidden elements. The rules make the verdict inspectable, but interpreting the answer still depends on a model.

Remembering is easier than reconsidering

Across the nine evaluated models, overall pass rates ranged from 42.86% to 59.59%. Kimi-K3 recorded the highest observed result, passing 292 of 490 scenarios; ANTH-O-4.6 followed with 288. These are benchmark scores, not general measures of assistant quality.

The category differences were more revealing than the overall ranking. All nine models passed 87%–96% of the stateful constraint-following scenarios. Average performance was roughly 57% for both constraint collisions and preference overrides, but only about 25% for scope creep and goal shift.

No model led every category. More importantly, strong tracking of explicit information coexisted with weak decisions about what that information should prevent. An assistant could acknowledge a capacity problem and later continue planning as though it had been resolved.

Retained diagnostic experiments, conducted with earlier scenario subsets and model settings, suggest that the conversation’s path matters. Consolidating information into a single prompt repaired many failures, although not uniformly across challenge types. Simple interventions—state-tracking instructions, visible summaries and final-answer self-correction—produced model-specific gains rather than a general solution.

How much should the test be trusted?

The benchmark’s own machinery is imperfect. In a human audit of 100 scenarios, 87% satisfied all three assessed validity criteria. Evidence extractors agreed with human judgments in 88%–90% of a separate 50-case audit. Stable scoring therefore does not guarantee correct scoring.

The authors also acknowledge that scenario authoring relies on one model family and that controlled simulated users cannot represent the full variety of human behavior. The required responses encode authored conversational policies, not externally executable proof that a real-world plan is impossible. Unnecessary refusal can also fail the test: the intended ability is reconciliation, not blanket caution.

The preprint’s central finding is consequently narrower than “AI cannot hold a conversation.” These models often handled changing details well. Their harder problem was letting those details overturn an increasingly inappropriate plan.