One Axis, No Brake: Self-Knowledge Limits the Filtering of Harmful Peer Conformity in LLMs

1 INTRODUCTION

• On the set of revisions, identifying a harmful revision is identical to determining whether the original answer was correct.A harmful revision abandons a correct answer; a beneficial one fixes a wrong answer.Source: §1 · p. 1
• AUROC is only ≈0.64–0.89 across six model families for the best deploy-time read of a model’s own correctness.The paper calls this imperfect separability ceiling the wall.Source: §1 · p. 2
• Groups that start mostly wrong amplify shared mistakes into confident-wrong consensus, and more agents, diversity, or a stronger member do not help in the tested regimes.The paper describes this population-scale consequence as the cliff.Source: §1 · p. 2
• Causal steering changes revision frequency but not revision selectivity: |∆H −∆B| < 0.05 in the deploy-relevant range at ≤8B, with the arms staying together through 32B.The result holds for both linear and sparse-autoencoder correctness directions.Source: §1 · p. 2
• Decorrelating peers cuts harmful revisions by ≈2.2×, whereas post-hoc filtering cannot overcome the self-knowledge limit.A pre-committed warrant is presented as a further, still-preliminary lever.Source: §1 · p. 2

2 SETUP

• Agents answer a multiple-choice question alone, then answer again after seeing a peer-answer summary constructed to disagree and carrying no evidence or argument.The study uses four open models on ARC-Challenge and TruthfulQA, plus a Qwen2.5 scale ladder and targeted study grids.Source: §2 · p. 3
• On revisions, V = 1 −correct0 labels harmful changes 0 and beneficial changes 1; a brake ranks the harmful class using a deploy-time signal.Signals include verbalized confidence, logprob margin or entropy, and hidden activations; evaluation uses AUROC.Source: §2 · p. 3
• The empirical strongest scoring rule approximates the best AUROC achievable from a signal, so reported values are lower bounds.AUROC measures class separability, with 1 indicating perfect separability and 0.5 chance.Source: §2 · p. 3

3.1 WHY FILTERING NEEDS SELF-KNOWLEDGE

• Harmful-versus-beneficial revision discrimination is equivalent to reading initial correctness from the same deploy-time signal, making self-knowledge the ceiling for any brake.The reduction needs correctness to be checkable, not multiple choice specifically.Source: §3.1 · p. 3

3.2 EVERY SIGNAL REACHES THE SAME CEILING

• A coverage-calibrated confidence gate catches ≈95% of harmful revisions only by blocking most beneficial ones, and does no better than plain confidence at any operating point.An engineered hidden-state probe reaches AUROC 0.81–0.83, within and not above the ≈0.75–0.83 self-knowledge band; rationale classification separates harmful from beneficial revisions at chance (AUROC 0.46).Source: §3.2 · p. 4

3.3 WHITE-BOX STEERING GIVES NO CLEAN BRAKE

• Steering the model’s correctness direction changes revision frequency, not valence: harmful and beneficial revisions move together, including under extreme steering.The deploy-relevant gap is below ±0.05; an independent SAE-feature direction gives the same null, and the 32B ARC result is consistent with it.Source: §3.3 · pp. 4–5, Figure 4 · p. 5

3.4 THE WALL IS STRUCTURAL

• Self-knowledge remains imperfect across six families and settings: AUROC spans 0.64–0.89, does not rise across a 1.5B→72B scale ladder, and stays below 1 on free-response tasks.R1-distilled models reach 0.64–0.72 on ARC; on GSM8K and MATH, best-signal AUROC is 0.58–0.85 across two models each.Source: §3.4 · pp. 5–6, Table 1 · p. 6

4 THE CLIFF: POPULATIONS LOCK INTO CONFIDENT-WRONG CONSENSUS

• Groups starting mostly wrong amplify shared mistakes into confident-wrong consensus, while groups starting mostly right converge to truth; hard-item final-consensus accuracy is 0.00–0.32 vs. 0.71–1.00 on TruthfulQA and 0.00–0.36 vs. 0.94–1.00 on ARC.The transition is difficulty-gated, with confident-wrong lock-in on 25–55% of hard TruthfulQA items and 5–18% of easier ARC items.Source: §4 · p. 6, Figure 5 · p. 7

4.1 THE DRIVER IS MAJORITY DYNAMICS, NOT CONFIDENCE

• Hiding or showing peer confidence does not change lock-in on either dataset; the authors identify majority dynamics on shared misconceptions as the driver, while treating the mean-field model as illustrative.Source: §4.1 · p. 6

4.2 THE COLLAPSE RESISTS THE OBVIOUS FIXES

• In the tested setting, none of the natural rescues works: lock-in is flat from N=6 to N=24, heterogeneous societies score 0.60–0.66 versus best members’ 0.71–0.77 on TruthfulQA, and correct minorities are outvoted 71–100% on qualifying items.Source: §4.2 · p. 6

• A unanimous wrong panel multiplies the harmful-revision rate ≈2.2× over a mixed panel, supporting peer decorrelation as a way to avoid manufacturing false consensus.The multiplier is 2.35× on ARC and 1.99× on TruthfulQA.Source: §5 · p. 7
• A pre-registered warrant exposes some harmful revisions whose stated reasons depart from the commitment, a signal post-hoc text classifiers miss in an ARC audit.The authors describe this as a preliminary transparency lever.Source: §5 · p. 7

• Prior conformity research finds user-matching and peer-pressure effects, including revisions that improve or harm accuracy (Sharma et al., 2023; Perez et al., 2022; Fanous et al., 2025); this work asks whether harmful conformity can be filtered after revision.Source: §6 · pp. 7–8
• Debate and voting are reported to improve accuracy, but can also entrench errors; this paper supplies a micro-to-macro account in which a self-knowledge ceiling becomes a difficulty-gated confident-wrong cliff.The cited literature also discusses recovery under answer diversity or human-inclusive groups, while the paper tests rescues including more agents, heterogeneity, a stronger member, and a correct minority.Source: §6 · p. 8
• Prior calibration work reports imperfect correctness signals, including out-of-distribution degradation, skill-specific probes, overconfident verbalized confidence, and unreliable self-correction without external feedback; the paper identifies this imperfection as the filtering wall.Source: §6 · p. 8
• Activation steering can target behavior but may be unstable or non-selective; here steering along the correctness direction changes revision propensity, not valence, so white-box access yields no selective brake.The passage also notes that rationale–answer inconsistency detectors face the same bound unless they add an independent channel.Source: §6 · p. 8
• Classical and LLM social-dynamics work studies cascades, dissent, and influence topology; in these societies, a lone correct dissenter is outvoted, and the cliff is governed by initial accuracy and calibration, not topology alone.Source: §6 · p. 8

7 DISCUSSION

• The wall concerns post-hoc control: it does not mean conformity is irrational or debate is useless, but peer sway moves good and bad revisions together.The natural knob—being more or less swayed by peers—does not separate beneficial from harmful revisions.Source: §7 · pp. 8–9
• A group can improve by adding an independent channel, such as re-deriving the problem, using a tool or retriever, or checking verifiable evidence.These channels add information the group did not already have.Source: §7 · p. 9
• On hard items, weaker self-knowledge coincides with groups starting mostly wrong and locking into confident-wrong consensus.The paper links this difficulty-gated population cliff to the individual limit on post-hoc braking.Source: §7 · p. 9
• Agreement among agents is not evidence of correctness; debate redistributes existing uncertainty without an independent channel to the answer.The paper identifies better calibration and an external verifier as routes that can move the bound.Source: §7 · p. 9

8 LIMITATIONS

• The measured AUROCs are lower bounds on the ceiling; the robust claim is that separability remains well below 1.The reduction is an identity, but the strength of the wall is empirical.Source: §8 · p. 9
• Society runs are small, mostly same-family, and limited to multiple-choice items; the mean-field model is illustrative and the warrant arm needs human validation.Source: §8 · p. 9
• Future work includes open-ended and tool- or retrieval-augmented settings, alternative debate protocols, broader society heterogeneity, and additional post-hoc signals.The authors also identify adaptive or token-wise steering as an open axis.Source: §8 · p. 9

9 CONCLUSION

• Filtering harmful revisions while keeping beneficial ones is identical to judging initial correctness and is limited by self-knowledge.The tested deploy-time signals, including causal white-box steering, reach but do not exceed an empirical ceiling well below 1.Source: §9 · p. 9

A THE REDUCTION: SELECTION SLACK AND CAUSAL INTERVENTIONS

• The conditional ceiling can differ from global self-knowledge AUROC only by the selection slack between correctness on flips and correctness overall.The appendix describes this difference as empirically small.Source: A THE REDUCTION: SELECTION SLACK AND… · p. 13
• For post-processing a deploy-time signal with independent randomness, the data-processing inequality bounds the resulting correctness AUROC by the conditional ceiling.The appendix treats this as motivation only because steering changes which items flip; the white-box case is settled empirically in Appendix C.Source: A THE REDUCTION: SELECTION SLACK AND… · p. 13

B SELF-KNOWLEDGE CEILING: PER-CELL RESULTS

• Seven of eight cells have harmful-vs-beneficial separation y ≤ self-knowledge AUROC x; the gemma/ARC exception has 35 flips and a bootstrap gap CI spanning 0.Table 3 reports the per-cell ceiling and separation for local 4-bit families.Source: Table 3 · p. 13, B SELF-KNOWLEDGE CEILING: PER-CELL… · p. 13
• The estimated ceiling uses the strongest fitted scoring rule for each signal, so reported AUROCs are lower bounds rather than exact Bayes ceilings.Scalar signals use logistic or threshold scores, while activation signals use cross-validated linear and nonlinear probes.Source: B SELF-KNOWLEDGE CEILING: PER-CELL… · p. 13
• 95.3 ± 1.4% harmful-revision capture at α=0.05 yields an advantage of −0.4 ± 3.0 pp over plain confidence, and the engineered gate never dominates it across thresholds.Whether a threshold yields net-accuracy gain depends on the harmful-to-beneficial base rate.Source: B SELF-KNOWLEDGE CEILING: PER-CELL… · p. 13
• The late-layer pressure-delta probe reaches AUROC 0.81–0.83, within the ≈0.75–0.83 self-knowledge band; an answer-content control gives 0.79.The control supports the interpretation that the signal reflects correctness-awareness.Source: B SELF-KNOWLEDGE CEILING: PER-CELL… · p. 13
• A TF–IDF plus logistic classifier on Qwen-7B/ARC revision rationales reaches AUROC 0.46, at chance and below the self-knowledge ceiling.The evaluated set had 452 flips: 333 harmful and 119 beneficial.Source: B SELF-KNOWLEDGE CEILING: PER-CELL… · p. 13
• The logistic-regression ensemble of three deploy-time signals does not beat the best single signal, with mean Δ= −0.05.Table 4 compares verbalized confidence, logprob confidence, and entropy against their ensemble.Source: Table 4 · p. 14, B SELF-KNOWLEDGE CEILING: PER-CELL… · p. 14
• Sampling-based self-consistency stays within the single-pass AUROC band of 0.64–0.89 and does not improve as k grows to 24.Table 5 uses temperature samples at T=0.7 to score answer-distribution spread as a detector of majority-vote correctness.Source: Table 5 · p. 14, B SELF-KNOWLEDGE CEILING: PER-CELL… · p. 14

C STEERING: EQUIVALENCE TEST AND DOSE–RESPONSE GRID

• Max |∆H −∆B| was 0.008 for Llama-3.1-8B and 0.006 for Qwen2.5-3B across their reported TOST ranges.At strong positive α, Qwen-3B reduced harmful flips more than beneficial flips, but beneficial revision also fell 13–31 percentage points; Llama-8B showed no comparable effect.Source: C STEERING: EQUIVALENCE TEST AND… · p. 14, Table 6 · p. 15
• On ARC, SAE-feature steering passed TOST over α ∈[−2, +2] with max |∆H −∆B| = 0.026; on TruthfulQA, it passed over α ∈[−2, +1] with max 0.006.For |α| ≤1, both datasets satisfy |∆H −∆B| ≤0.014; extreme settings produce non-selective co-collapse rather than sparing beneficial revisions.Source: C STEERING: EQUIVALENCE TEST AND… · pp. 14–15, Table 7 · p. 15

D TRANSFER BEYOND MULTIPLE CHOICE: GSM8K AND MATH

• Self-knowledge remained imperfect on free-response tasks: GSM8K AUROC was 0.85 for Qwen2.5-7B and 0.69 for Llama-3.1-8B, while MATH AUROC was 0.58 and 0.62.The authors report this as the same regime as the multiple-choice ceiling, not a format-specific effect.Source: D TRANSFER BEYOND MULTIPLE CHOICE:… · p. 15
• For Qwen2.5-32B on ARC, max |∆H −∆B| was 0.07 for |α| ≤1, with accuracy near 0.80 on both arms.At |α| ≥2, larger gaps came with accuracy falling on both arms; the 32B TruthfulQA dose–response was uninformative because positive steering saturated both arms at ceiling accuracy.Source: C STEERING: EQUIVALENCE TEST AND… · p. 15, Table 8 · p. 16

E POPULATION: DYNAMICS AND THE MEAN-FIELD MODEL

• Across three seeds on both datasets, the heterogeneous society scored below its best member: TruthfulQA 0.60–0.66 vs. 0.71–0.77, and ARC 0.80–0.87 vs. 0.86–0.90.The minority sets were small, with approximately 5–21 qualifying items per run.Source: E POPULATION: DYNAMICS AND THE… · p. 16
• The mean-field model makes the population bistable, with an unstable interior fixed point p∗ that serves as the basin boundary.Its inputs are error-correlation µ and the wrong-to-correct confidence ratio r; estimated values yield a measured separatrix p∗≈0.368 and a calibrated counterfactual ≈0.315.Source: E POPULATION: DYNAMICS AND THE… · p. 16
• Only q ≳0.96 reduced confident-wrong lock-in on the hardest items to ≤0.05; within measured self-knowledge q ∈[0.64, 0.89], lock-in remained largely intact.Figure 6 shows the hypothetical selective-brake sweep; at q=0.64 and q=0.89, lock-in was 0.98 and 0.41, respectively.Source: E POPULATION: DYNAMICS AND THE… · p. 16

F WARRANT ARM (PRELIMINARY)

• A neutral warrant flagged approximately 37% of harmful revisions as violating the model’s own pre-commitment, including cases keyword and social/evidence judges missed.This was a single-seed, single-model Qwen-7B ARC audit using a same-family self-judge; the authors describe the diagnostic as preliminary and judge-dependent.Source: F WARRANT ARM (PRELIMINARY) · pp. 16–17
• The neutral warrant left the flip rate at baseline (29.1%), while change-priming phrasing raised it from 31.4% to 40.2%.The authors characterize the warrant as exposing rather than suppressing revisions.Source: F WARRANT ARM (PRELIMINARY) · p. 17
• Human adjudication is needed before treating the warrant’s absolute flag rate as stable.The reported diagnostic is preliminary and judge-dependent.Source: F WARRANT ARM (PRELIMINARY) · p. 17

G EXPERIMENTAL DETAILS

• Experiments used five local 4-bit model builds, additional held-out and scale models, and ARC-Challenge test and TruthfulQA multiple-choice validation data.Correctness, probe, and steering reads were deterministic; society runs sampled agents at temperature 0.7 over a round 0 and three revision rounds.Source: G EXPERIMENTAL DETAILS · p. 17
• Peer summaries reported how many peers chose an answer, optionally with average confidence; the shown and hidden-confidence conditions shared round 0.The round-2 prompt asked the model to answer the same question again after seeing the peer summary.Source: G EXPERIMENTAL DETAILS · p. 18