I benchmarked 9 open models on spotting fake sources during agentic search (DeepSeek V4, Qwen 3.8, Nemotron 3 Ultra)

I built a benchmark called EchoNet. An agent gets a factual question, then searches a syntheic web I made before answering. Some of that web is seeded with misinformation: one fake page, a fake page ranked first in search results, the same fake claim copied across many pages, a loud fake majority around a real primary source, or a genuine update the model's training predates. When a model reads a new page, it weighs two things: what it already knows and what the text says. Usually, they agree. Sometimes they conflict, and often, multiple pages contradict one another. Choosing whether to trust its own memory or a new source is called epistemic arbitration. A stubborn model ignores real updates. A trusting model believes fake data. Bad sources easily fake high search rankings, repeat lies, and mimic agreement. However, no source can fake being correct. This benchmark measures how well models make this choice. I ran 9 open-weight models this way, 50 to 100 trials each: GLM 5.2, Qwen3.7 Max, Qwen3.7 Plus, Qwen3.8 Flash, Qwen3.8 27B, DeepSeek V4 Flash, DeepSeek V4 Pro, Nemotron 3 Ultra, Inkling Small. Image 1 is the number to start with: how often a model already had the right answer, read convincing fake pages, and changed its mind anyway. DeepSeek V4 Flash is easiest to fool at 15.8%. Nothing fooled GLM 5.2 or either Qwen3.8 model, not once. Image 2 rolls that into the full composite score, EAS (Epistemic Arbitration Score): how often a model's final answer is correct, across every trial, not just the poisoned ones. It's a harmonic mean of poison resistance and correct updating, not a plain average, so a model great at one and terrible at the other gets pulled toward its weak side instead of the two canceling out. GLM 5.2 leads at 1.000, Qwen3.7 Max close behind. Check the error bars first, several ranges overlap at this sample size, so treat overlapping models as tied, not ranked. Image 3 shows why the numbers in image 1 vary so much. Pooled across all 9 models, one fake page barely moves accuracy. Neither does the same fake claim repeated everywhere, an echo chamber, which most people expect to be worse than it is. One attack reliably works: surround a real primary source with a louder fake majority. That drops average accuracy 22 points below clean baseline. Models catch an obvious lone lie or a copy-pasted echo chamber. They struggle against five confident, independent-looking articles that agree with each other over one quiet official source. Image 4 plots cost against quality. Qwen3.8 Flash lands in the cheap, accurate corner. Image 5 breaks the EAS ranking from image 2 down by sub-metric: raw poison resistance, rejecting a fake majority, citation honesty, calibration. Shows what each model is good or bad at, not just the final score. Image 6 is real dollar cost for the full 100-episode suite, published pricing. DeepSeek V4 Flash: about 55 cents. Nemotron 3 Ultra: about $7.85. Same benchmark. Image 7 is one real trial. Qwen3.7 Max starts out correctly believing the UN's official name for the country is Türkiye. It reads several fake news pages built to look independent, including one from a made-up outlet called Signal Courier, all claiming the registration still reads "Turkey." It flips its answer to match the fake majority: wrong, 75% confidence, belief changed. Happy to answer methodology questions, provide the preprint if it interests anyone, or post specific traces in the comments.