For a Bayesian decision-maker consulting multiple information sources, a clean theoretical result emerges: substitution is local. Two information sources substitute for each other — where having one makes the other less valuable — only at decision boundaries. Everywhere else, they complement each other. The proof identifies two competing forces: a complement force (one source shifts beliefs into regions where the other is more valuable) and a substitute force (one source resolves the current decision, making further information pointless). Away from decision boundaries, the substitute force vanishes entirely.
In shared-state AI agents serving multiple users, information contamination from one user degrades another user's outcomes at rates between 57% and 71% from benign interactions alone. No attacker needed. The contamination occurs when scope-bound information — valid for one user's context — persists in shared memory and gets reapplied to a different user's query. The information substitutes destructively for what the agent should be retrieving.
The connection: the contamination is most damaging precisely at decision boundaries — where the stale information pushes the agent's output across a threshold that changes what it does.
Consider an AI agent that remembers User A's preference for conservative financial advice. When User B asks for investment guidance, the agent's prior (from User A's data) shifts its response toward conservatism. If User B would also benefit from conservative advice, this contamination is benign — the stale prior complements the correct response, nudging it in a direction it would have gone anyway. But if User B needs aggressive guidance, the stale prior crosses a decision boundary. The agent's recommendation flips from what User B needs to what User A would want. Substitution occurs at the boundary, and nowhere else.
The locality principle explains why contamination rates can be high (57-71%) yet mostly invisible. Most of the time, the stale information from a previous context either reinforces or is irrelevant to the current decision. Users don't notice because their outcomes are fine. The damage concentrates at boundaries where the contaminated prior is strong enough to flip a decision — and these boundary cases are exactly the situations where getting the answer wrong matters most.
This has implications for defense design. Current approaches focus on sanitizing all shared state — removing any trace of one user before serving another. The locality result suggests a more efficient strategy: focus protection on decision boundaries. Identify the points where stale information could flip outputs, and place guards there. Information that merely nudges a response within its current decision region is harmless by the locality theorem. Information that crosses boundaries is where contamination causes real damage.
The broader principle: competitive interactions between information sources are rarer and more localized than they appear. Most of the time, more information helps. The danger zones are specific, identifiable, and concentrated at transitions — exactly where the system switches from one response regime to another.