Knowledge cutoffs: the model thinks it's still last year

If you've spent any time talking to a frontier LLM, you've probably done some version of this experiment: asked it what year it is, asked it about a recent news event, or asked it for the latest API of a library you just installed. And you've probably gotten back something a little off — a confident answer about a previous administration, code calling a method that was renamed last year, a cheerful claim that its knowledge ends in some specific month that turns out to be wrong by half a year in either direction.

That's the knowledge cutoff. It's the last big topic in the Substrate section of this series, and it's the one that ties everything else together. It's also, I think, the most misunderstood property of an LLM — including by the model itself.

The short version: a knowledge cutoff is the date past which the model has effectively no information about the world. The longer version, which is the one we actually need, is that the cutoff is not a date at all. It's the trailing edge of a distribution, the model has unreliable access to where that edge is, and the question "what year is it?" turns out to be one of the structurally hardest questions you can ask a frozen function.

Why cutoffs exist at all

Recall the picture from the training post: pretraining is a massive offline batch job over a snapshot of text collected up to some moment in time, and at the end of that job, the weights are frozen. And from the inference post: inference is forward-only; the model reads from those weights but never writes back. Put those two together and the cutoff is just the consequence — the model was compiled against the world as it existed on some specific date, and it has been running against that build ever since.

It's worth taking the Software 2.0 framing from the first post literally here. The dataset is the source, training is the compiler, and the weights are the binary. If you build a binary in October 2023, it doesn't matter how many times you run it in 2026 — it's still linked against October 2023. Inference can't pull in new symbols.

A better mental model than "the model knows about events up to date X" is: the model is a git clone of the world from date X. Everything since then is upstream changes it has never pulled.

The cutoff isn't actually a date

If that were the whole story, you could just print the cutoff on the side of the box and call it done. Some providers do exactly that. Anthropic's help center, as of this writing, lists Claude Opus 3 at August 2023, Sonnet 4.5 and Haiku 4.5 at July 2025, and Opus 4.7 at January 2026. OpenAI's model page lists GPT-4o at October 1, 2023. Meta's Llama 3.1 and 3.3 model cards both declare December 2023.

The problem is that none of those dates is a switch. Training data is a vast mixture of sources — Common Crawl snapshots, Wikipedia dumps, books, code repositories, news archives, license-cleared corpora — and each of those sources has its own temporal distribution. The Wikipedia dump in your training set might be from March. Your Common Crawl mix might cover several monthly snapshots over the prior two years. The book corpus might be effectively years older. The "cutoff" you see on the model card is usually the most recent edge of the most recent source, but the actual distribution of what survived training is much messier.

Two specific mechanisms make this worse:

• Common Crawl is not a clean snapshot of "the web in month X." Each monthly crawl re-encounters huge amounts of pages that haven't changed in years. A March 2023 dump contains many pages whose content is from 2018, 2019, 2020. So even a "March 2023 Common Crawl" pretraining mix is, in temporal terms, heavily weighted toward earlier content.
• Deduplication is imperfect. Pretraining pipelines try hard to strip duplicates, but exact-match and fuzzy dedup miss semantic near-duplicates — two slightly-different versions of the same Wikipedia article, the same news story syndicated across sites, a stale mirror that didn't get filtered. Those near-duplicates are not evenly distributed in time; older versions tend to be over-represented because they've had more time to propagate.

Cheng et al. ("Dated Data," 2024) probed this directly. They define an effective cutoff — the version of a resource that a model's behavior actually aligns with — and compared it to the reported cutoff. The gap can be enormous. RedPajama is a striking case: it bundles a 2023 Wikipedia dump, but in the paper's own words, the model's effective cutoff is "aligned much earlier… to 2019, even though it has an explicit 2023 Wikipedia dump." Old Wikipedia versions kept leaking back in through the Common Crawl mix, and the dedup pipeline didn't strip them. The reported cutoff was 2023; the effective cutoff for Wikipedia content was 2019. Four years.

There's a second, subtler force pulling the effective cutoff backward: recent events are under-represented even when the crawl captures them. Six weeks after something happens, there's a news article and a Wikipedia stub. Six years after, there are thousands of articles, retrospectives, analyses, court filings, agency reports, fan wikis, and the model has seen all of them. The same event has vastly more text supporting it the further you get from when it happened. Near the cutoff, the world is thin.

So even within the stated training window, the model's grasp on the trailing edge is much weaker than its grasp on, say, the 2010s. The cutoff is a soft slope down, not a cliff.

The model doesn't know its own cutoff

Here's the empirical surprise that I think is most interesting if you're a working engineer: the model is bad at telling you when its cutoff is, and it is bad in a specific direction.

Take GPT-4 Turbo. Its official cutoff is December 2023. Ask it directly, though, and OpenAI Developer Community users have documented the model variant "hallucinating its cutoff date being (at worst) in September 2021 or April 2023 at best, when it should be in December 2023." The model is not lying so much as guessing — it's producing the most-likely continuation of "my training cutoff is…" under its weights, and the weights are biased toward dates that appear frequently in their training data. Older dates appear more frequently because there's been more time for the internet to write about them. So the model self-reports earlier.

A 2025 benchmark, LLMLagBench, makes this concrete at the behavioral level. Meta's officially declared cutoff for both Llama 3.1 70B and Llama 3.3 70B is December 2023. When the benchmark probes for the actual changepoint in the model's knowledge of dated events, the empirical cutoff comes out at roughly September–October 2023, with an even earlier partial cutoff visible around February 2023. The model's stated cutoff matches the model card. The model's behavior doesn't.

This isn't a bug. It's the same mechanism from the hallucination post: when you ask "what is your cutoff?" the model produces a plausible-sounding answer that pattern-matches what cutoff-discussions look like in its training data, which were mostly written about earlier models with earlier cutoffs. The model is not introspecting; it's autocompleting.

A related failure: the AWS Bedrock deployment of Claude Sonnet 4.5 has been reported to confidently identify itself as Claude 3.5 Sonnet with an April 2024 cutoff, because the upstream system prompt didn't get refreshed. Same weights, different metadata in the context window, completely different self-report. The model has no privileged access to its own build manifest. It only has whatever the system prompt tells it.

What the cutoff actually breaks

The temptation is to think of cutoffs as a news problem. It's not, or it's not only that. The cutoff degrades anything that drifts in time. A short list:

• Code libraries and APIs. A model trained on October 2023 data thinks the SDK you're using has the surface it had in October 2023. Methods that have since been renamed, deprecated, or removed are still there in the model's head. Worse, packages that didn't exist before the cutoff don't exist for the model — and the model, asked to import them, will sometimes confidently fabricate a plausibly-named alternative. Spracklen et al.'s 2024 study of 16 LLMs across 576,000 generated samples found "the average percentage of hallucinated packages is at least 5.2% for commercial models and 21.7% for open-source models, including a staggering 205,474 unique examples of hallucinated package names." Attackers have noticed. In January 2026, Aikido Security researcher Charlie Eriksen registered an LLM-hallucinated npm package called react-codeshift as a proof of concept; it spread to 237 repositories generating real download attempts before he could close it down. He called the attack pattern "slopsquatting."
• Software versions and defaults. "The default for X is Y" is true at training time and possibly false today. Models will give you React 18 patterns when the project has been on a newer major for a year.
• People, organizations, prices, statistics. Cabinet members, CEOs, exchange rates, sports outcomes, election results. All move; the snapshot doesn't.
• Slang and linguistic conventions. The way people on the internet write — abbreviations, memes, what registers as ironic — drifts faster than most people realize, and an old-cutoff model will sound subtly stale.
• "Common knowledge" that wasn't common before the cutoff. Anything the world collectively agreed on after date X has to be re-explained to the model every time.

And — connecting to the hallucination post — for all of these the failure mode is the same: instead of saying "I don't know," the model produces the most-plausible continuation under its weights. That continuation is shaped like a real answer. It is often wrong. Cutoffs are one of the biggest single drivers of long-tail hallucination, because they create a structural asymmetry: the question is about the post-cutoff world; the model only has the pre-cutoff distribution to sample from.

Post-training shifts things, but not as much as you'd hope

Pretraining is most of the story, but it isn't all of it. Post-training data — SFT examples, preference data, reasoning traces — has its own cutoff, and that cutoff is usually more recent than the pretraining one. So a model whose pretraining ended in October 2023 might have been instruction-tuned with data that includes references to events from early 2024. The model can sometimes surprise you with knowledge slightly past its pretraining edge.

Anthropic now publishes this distinction explicitly: a "training data cutoff" versus a "reliable knowledge cutoff," because the two are different.

Post-training also pushes in a less helpful direction. The same RLHF/preference-tuning step that makes the model pleasant to talk to also rewards confident, fluent answers. "I don't know whether that has changed since my training" tests poorly with raters compared to a plausible-sounding answer. So post-training tends to mute the model's expression of cutoff-related uncertainty even as it does little to repair the underlying knowledge gap. That's the same calibration-incentive argument from the hallucination post, applied to time.

Practical mitigations, briefly

We'll do RAG and tool use as their own posts. For now, the structural picture:

1. Inject the current date in the system prompt. Claude's web and mobile apps do this; ChatGPT does it; Gemini does it. Anthropic's release notes describe it explicitly: the system prompt provides "up-to-date information, such as the current date, to Claude at the start of every conversation." Leaked ChatGPT system prompts confirm a literal Current date: 2024-10-31 line. Anthropic's published Claude 4 system prompt opens with The current date is {{currentDateTime}}. This fixes one thing: the model now knows what day it is. It doesn't fix anything about what happened on that day. The model still doesn't know.
2. Retrieval-augmented generation (RAG). Fetch fresh content at query time and put it in the context window. This works because — recalling the inference post — in-context conditioning shapes the model's outputs without changing its weights. The read-path doesn't refresh, but the input to the read-path does. RAG is the closest thing we have to a structural fix.
3. Tool use / live web search. Same trick, more general. The model emits a search query, gets fresh tokens back, conditions on them.

The honest framing for all three: they widen the bridge between the frozen substrate and the live world, but they don't move the substrate. The model can still hallucinate around retrieved context. It can still ignore the system date and insist on a stale year. Grounding helps; it doesn't repair.

Closing the Substrate section

We've now built the full picture of what an LLM actually is, from the bottom up. A neural network is a function with billions of weights (the first post). Training writes those weights in two stages: pretraining produces a base model that has eaten the internet, and post-training shapes how that base model behaves (the training post). Inference reads from the frozen weights, autoregressively, never updating them (the inference post). Because that read-path is a next-token predictor, plausibility and truth aren't the same thing, and hallucination is the default rather than a bug (the hallucination post). And because the weights froze at a specific date — and the data near that date was thin, messy, and biased toward the past — the model is a snapshot whose own boundary it can't quite see (this one).

The unifying mental model: the LLM is a frozen function over tokens with no live access to the world. Everything we get out of it has to come from one of two places — the weights or the context window. Every limitation we've discussed in this section is a property of those two surfaces.

The next section, Interface, is about the second one. How do you actually talk to a frozen function: prompts, system prompts, tool use, context engineering, RAG. The cutoff is where the substrate ends. The interface is where we start working with what we've got.

---

---

Further reading

• Cheng, J. et al. (2024). Dated Data: Tracing Knowledge Cutoffs in Large Language Models. — COLM 2024. Introduces the reported-vs-effective cutoff distinction and the RedPajama "2023 dump, 2019 behavior" finding. The core source for this post.
• Pęzik, P. et al. (2025). LLMLagBench: Identifying Temporal Training Boundaries in Large Language Models. — Behavioral probing for the empirical changepoint in a model's knowledge; the Llama 3.1/3.3 "declared December, behaves September" evidence.
• Spracklen, J. et al. (2025). We Have a Package for You! (Package Hallucinations). — USENIX Security 2025. The package-hallucination rates behind the "slopsquatting" supply-chain risk that cutoffs create for code.
• Anthropic. How up-to-date is Claude's training data? — The vendor table of cutoffs, and the "training data cutoff" vs "reliable knowledge cutoff" distinction most providers don't draw.
• Anthropic. System Prompts (release notes). — The published current-date injection and the actual Claude system prompts, if you want to see the pattern in production.
• Willison, S. (2025). Highlights from the Claude 4 system prompt. — A readable annotated tour of what a real frontier system prompt contains, date injection included.
• jujumilk3. leaked-system-prompts. — A public collection of leaked production prompts showing the literal Knowledge cutoff: / Current date: lines.
• HaoooWang. llm-knowledge-cutoff-dates. — A continuously updated table of vendor-disclosed cutoffs across models. Handy reference.