Source-linked AI summary
Who Flips? Self- and Cross-Model Counterarguments Reveal Answer Instability in LLMs
Nafiseh Nikeghbal, Amir Hossein Kargaran, Shaghayegh Kolli, Jana Diesner
TL;DR
Standard accuracy benchmarks do not test whether LLMs retain correct answers after plausible counterarguments. This paper introduces a controlled argument-only challenge protocol and finds substantial, accuracy-independent differences in answer stability across models.
Problem
Standard accuracy benchmarks do not measure whether models maintain initially correct answers when presented with coherent arguments for incorrect options.
Method
The protocol generates wrong-answer arguments, then tests initially correct responses in fresh sessions while varying length, attribution, and source model.
Results
Across seven frontier models, answer stability varies greatly despite similar standard accuracy, with flip rates ranging from 17.5% to 97.3%.
Takeaways & Limitations
Answer stability is a useful evaluation dimension alongside accuracy, particularly when models face rebuttal, disagreement, or interaction with other agents.
Takeaways & Limitations
The conclusions concern a controlled single-challenge MMLU benchmark setting, not repeated exchanges, human-written arguments, non-English evaluation, or open-ended tasks.
Abstract
from arXiv · showhide
Standard accuracy benchmarks are designed to test how closely large language models (LLMs) approach correct answers, but are not suitable for testing whether LLMs stick with a correct answer when that answer is challenged by a plausible counter-argument. We introduce a controlled protocol for evaluating answer stability: after a model answers a multiple-choice question correctly, we challenge the model's answer with a coherent argument for an incorrect option and measure whether the model flips. The setup a) isolates argumentative content from overt social pressure and b) varies argument length, self-attribution, and cross-model source. Across seven frontier models and 57 MMLU subjects, flip rates range from 17.5% to 97.3%, revealing large differences in stability that are not captured by accuracy metrics alone. We find that self-attribution consistently increases flip rates (mean +7.1pp, up to +18.7pp). Also, pooling wrong-answer arguments across models and selecting the most effective one per question yields stronger adversarial challenges than relying on any single source model. We further construct MaxFlip, a curated challenge set that amplifies flips by up to +23.6pp over standard self-generated challenges. We release the protocol, challenge records, and MaxFlip to support stability evaluation alongside standard accuracy benchmarks. Materials are available at https://github.com/nafisenik/WhoFlips and https://hf.co/datasets/nafisehNik/WhoFlips.
1 Introduction
This paper introduces a controlled protocol for testing whether initially correct answers survive coherent argument-only challenges, a failure mode standard accuracy benchmarks miss. Across seven frontier models, it measures instability across challenge conditions and releases MAXFLIP for adversarial stability benchmarking.
- Controlled protocol: The framework isolates argumentative content from overt social disagreement while varying argument length, attribution, and source model.It targets a practically relevant failure mode that standard benchmarks miss rather than modeling all open-ended persuasion.
- Controlled protocol: The protocol tests whether a model abandons an initially correct answer after receiving a coherent argument for an incorrect option.Stage I generates a k-sentence wrong-option argument; Stage II challenges a fresh-session answer under BLIND, SELF, or CROSS presentation.
- Empirical findings: 17.5% to 97.3%: flip rates vary widely across seven frontier models, showing that accuracy alone does not capture answer stability.On MMLU, the mean flip rate is nearly flat across argument lengths at 48.4–50.2, although longer arguments change flips by up to +10.5pp in some models.
- Resources: MAXFLIP selects the most effective model-generated argument for each question as a curated resource for stability benchmarking.The release also includes the underlying challenge records.
2 Related Work
Prior work shows that LLMs can revise correct answers under user disagreement, explicit counterarguments, and adversarial multi-agent interaction. This paper builds on these strands by studying answer instability under controlled counterargument challenges.
- Sycophancy under pressure: LLMs often revise correct answers after user disagreement, including a single “Are you sure?” prompt, repeated follow-ups, or misleading keywords.Related studies connect this behavior to training and alignment.
- Argument-driven challenge: Explicit supporting or refuting arguments can shift model stances, with stronger arguments producing larger effects and susceptibility appearing even on the first conversational turn.This work differs by focusing on controlled counterargument challenges to previously correct answers.
- Debates and multi-model interaction: Adversarial interaction among models can destabilize correct judgments, reducing group accuracy and increasing consensus on wrong answers.By contrast, cooperative or honest-agent debates can improve factuality and reasoning.
3 Protocol
The protocol evaluates answer stability by presenting initially correct multiple-choice answers with counter-arguments under controlled attribution, length, and source-model conditions. It measures the resulting probability of abandoning the correct answer with answer flip rate (AFR).
- Controlled evaluation: The protocol uses two stages and compares the same question–target-model–wrong-option item across argument lengths, attribution settings, and source models.The cross-model condition varies the source model generating the counter-argument.
- Attribution conditions: BLIND presents a counter-argument without attribution, whereas SELF states that the reasoning was produced by the target model in an earlier session.The challenge prompt is otherwise identical across attribution conditions.
- Source-model condition: CROSS uses a counter-argument generated by a different model from the target model before eliciting a final answer.The final answer is compared with the correct answer.
- Evaluation metric: AFR measures the probability that a model abandons an initially correct answer after receiving a counter-argument.The metric is indexed by attribution condition c and argument length k.
4 Experimental Setup
The experiments evaluate diverse open- and closed-source LLMs on MMLU’s 57 subjects under standardized inference conditions. To control computational cost, same-model challenges cover all settings, while cross-model challenges use only the longest arguments.
- Model and inference setup: Models span open- and closed-source systems, dense and mixture-of-experts architectures, and multiple scales.Open-weight models use vLLM, closed-source models use APIs, and full model identifiers appear in Table 1.
- Model and inference setup: All models run at temperature 0 with reasoning modes disabled for comparability.
- Benchmark: MMLU provides broad coverage across 57 humanities, social-science, STEM, and professional subjects.Its near-saturated standard accuracy for many frontier models makes it useful for testing answer maintenance under challenge.
- Evaluation scope: More than 1.7 million model calls would be required for exhaustive cross-model evaluation over 2,052 questions.This estimate assumes pb = pc = 0.8, |W| = 3, |K| = 4, and |M| = 7.
- Evaluation scope: Same-model challenges cover all argument lengths and attribution settings, whereas cross-model challenges use only k = 10.The restriction keeps the experiment tractable while testing peer-generated challenges in the most information-rich condition.
5 Results
Answer instability varies primarily by model, with substantial effects from self-attribution, subject domain, and challenge construction. Cross-model pooling produces stronger curated challenges, while refusal is only weakly related to baseline correctness.
- Model and argument effects: 17.5%–97.3% of initially correct answers flip across models, while argument length changes flip rates by at most 10.5 percentage points.Qwen3.5-35B is most resistant at 17.5%, whereas Llama-3.1-8B is most vulnerable at 97.3%.
- Self-attribution: +7.1pp mean self-attribution delta increases flip rates for every model, with the largest effects in mid-range models.The largest reported shifts are +18.7pp for Qwen3.5-4B and +15.0pp for Qwen3.5-9B.
- Refusal behavior: RSS values remain below 6.2pp in absolute magnitude, indicating that refusal is only weakly related to baseline correctness and later robustness.RSS is positive for five of seven models, while Llama-3.1-8B is the only model with negative RSS at −2.9pp.
- Subject effects: More than 60 points separate MMLU subjects, with formal STEM subjects most robust and Humanities and Health subjects among the most vulnerable.Coercion success rate and flip rate are positively associated across subjects.
- Cross-model challenges: −1.6pp mean cross-source difference shows that cross-model arguments are not systematically more persuasive than self-generated ones.Cross-source effects oppose each other across targets, while baseline susceptibility explains 76.7% of cross-model flip-rate variance.
- Curated challenges: +23.6pp maximum gain shows that MAXFLIP increases flip rates for every model by selecting the most effective cross-model argument per question.Pooling arguments across sources produces stronger challenges than relying on any single source.
6 Conclusion
The paper introduces a controlled protocol for evaluating answer stability under argument-only challenge. Results across seven frontier models show that stability varies substantially beyond what standard accuracy captures, supporting its use as a complementary evaluation dimension.
- The study introduces a controlled protocol for evaluating answer stability under argument-only challenge.
- Across seven frontier models, answer stability varies greatly even when standard accuracy does not.Models differ substantially in how often they abandon initially correct answers.
- Answer stability is a useful evaluation dimension alongside accuracy, particularly under rebuttal, disagreement, or interaction with other agents.
Limitations
The study’s limitations concern its benchmark scope, single-turn model-generated challenges, lack of mitigation analysis, and omission of correction from initially incorrect answers.
- Benchmark scope: The evaluation uses only MMLU, so transfer to other multiple-choice benchmarks is expected but not directly tested.MMLU provides 57 subjects and the current setup requires over 500K model calls, making large-scale replication expensive.
- Protocol scope: The protocol tests a single challenged response with model-generated counterarguments, not repeated exchanges, human-written arguments, non-English evaluation, or open-ended tasks.The conclusions therefore concern answer stability in this controlled benchmark setting rather than all forms of persuasion.
- Mitigations: The paper measures and characterizes answer flipping but does not propose mitigations, leaving intervention to future work.Potential directions from prior work include data augmentation, causal intervention, self-refinement, and training-time regularization.
- Inverse direction: The study does not examine whether arguments supporting the true answer can correct initially incorrect model responses.This inverse direction is outside the protocol’s focus on stability of initially correct answers under wrong-answer challenge.
Ethical Considerations … Stage II: Baseline
The paper evaluates answer stability under plausible but incorrect challenges, showing that accuracy alone can miss domain-dependent robustness differences. Its two-stage protocol first generates committed wrong-answer arguments, then measures baseline answering under standardized prompts.
- Ethical Considerations: Standard accuracy can miss robustness differences when models face plausible wrong arguments, with moral disputes, security studies, and professional law more prone to flips than mathematics.The issue is relevant to interactive deployment, multi-agent systems, and decision-support settings.
- A Prompt Templates: The prompt templates substitute the MMLU question, formatted choices, wrong-option text, requested argument length, coercion block, and refusal marker.The refusal marker is fixed as I_AM_WEAK.
- Stage I: Coercion: Stage I instructs the assistant to place reasoning in <reasoning> tags and begin by stating that the designated answer is correct.If it cannot produce reasoning for that answer, it must respond only with the refusal marker.
- Stage I: Coercion: Stage I asks the model to defend a specified wrong option in exactly {k} sentences while dismantling every alternative.The user prompt explicitly requests the strongest possible case for the designated answer.
- Stage I: Coercion: Stage I forbids contradiction, qualification, doubt, and hedging, requiring consistent commitment to the designated answer through the final sentence.Failure to reason without hedging triggers the refusal marker.
- Stage II: Baseline: Stage II provides a baseline prompt in which the assistant is simply asked to answer the user’s question.The system instruction defines the assistant as helpful and directs it to answer the question asked.
- Stage II: Baseline: The Stage II user prompt includes the question and choices, permits thinking before answering, and requires the final format ANSWER: [letter].This establishes the standardized output format for baseline responses.
Stage II: Challenge
Stage II examines linguistic correlates associated with whether models flip or hold after challenge arguments. The analysis compares resistance, capitulation, response-length, confidence, and hedge-density measures across outcomes and challenge lengths.
- Linguistic correlates: Stage II compares mean resistance phrase count, capitulation phrase count, and response length across k for flipping versus holding outcomes.These measures are reported for Stage II responses.
- Linguistic correlates: The analysis also examines coercion-argument confidence, baseline response length, and baseline hedge density by outcome.These baseline and argument-level measures are separated from the Stage II response measures.
B Linguistic Correlates of Held vs. Flipped
Held and flipped responses show statistically significant lexical differences, treated as descriptive correlates rather than causal predictors. Held responses use more resistance phrases, whereas flipped responses show more capitulation markers and are associated with greater baseline hedge density and response length.
- Stage II response markers: Statistically significant lexical differences distinguish held and flipped Stage II responses and pre-challenge inputs.All reported differences were significant in item-level tests at p < 0.005 and are descriptive correlates, not causal predictors.
- Stage II response markers: Held responses contain more resistance phrases, including “I disagree” and “I maintain.”These markers occur at consistently higher rates in held responses.
- Stage II response markers: Flipped responses contain more capitulation markers than held responses.Capitulation markers are the contrasting lexical pattern associated with flipped outcomes.
- Stage II response markers: Higher baseline hedge density and longer responses are associated with lower Stage II robustness.These associations concern robustness after the challenge and are reported descriptively.
B.1 Linguistic Feature Lexicons
The section defines lightweight lexical resources for extracting surface-level response features across hedging, confidence, resistance, and capitulation. Features use case-insensitive substring matching and should be interpreted as descriptive correlates rather than causal effects.
- Lexicon design: Four manually curated lexicon categories capture hedging, confidence, resistance, and capitulation in model responses.The resources consist of words and phrases serving as lightweight proxies for stylistic tendencies and are not exhaustive.
- Feature extraction: Case-insensitive substring matching computes the lexical features.
- Feature categories: Hedge and confidence lexicons identify uncertainty or softening versus assertiveness or certainty.Examples include “perhaps” and “possibly” for hedging, and “clearly” and “definitely” for confidence.
- Feature categories: Resistance phrases indicate maintaining the original answer despite a challenge.Examples include “i disagree,” “i still believe,” and “i stand by.”
- Feature categories: Capitulation phrases indicate revision or concession after a challenge.Examples include “you are right,” “i was wrong,” and “i reconsider.”