PaperlayerView exact revision on arXiv

Source-linked AI summary

Authority Bias in Language Models: Source Deference and User Agreement Are Not Interchangeable

Abhinav Rajeev Kumar, Paras Chopra

arXiv:2609.37616v1cs.LGcs.CL

TL;DR

Language models can accept wrong claims from users, but whether they also defer to misleading verified sources is a distinct question for retrieval- and tool-grounded settings. The paper compares matched source and user endorsements and tests activation-based interventions. Verified-source cues often flip correct answers, and interventions show that source deference and user agreement can be selectively affected.

  • Problem

    The paper asks whether models treat wrong claims attributed to trusted external sources differently from wrong claims asserted by users, a distinction relevant to retrieval, tool outputs, and grounded search.

    Source: §1 · p. 1

  • Method

    The authors compare matched wrong-answer source and user cues and use activation-direction removal and source-versus-user attribution patching to test their distinct effects.

    Source: §4.4 · p. 7

  • Results

    45–88% of baseline-correct answers flipped under verified-source endorsements in seven of eight models, and authority-vector removal reduced source compliance in four of five open-weight families.

    Source: §1 · p. 3, §7 · p. 11

  • Takeaways & Limitations

    Source-authority compliance needs separate evaluation and mitigation alongside, rather than folded into, user-facing sycophancy benchmarks.

    Source: §7 · p. 12

    Mechanistic tests cover only open-weight models, attribution patching covers three families, and the study does not evaluate agents acting on live tool outputs.

    Source: §6 · p. 11

Abstract

from arXiv · show

Language models tend to agree with whatever a user asserts, and post-training increasingly targets this sycophancy so that models evaluate claims on their merits rather than deferring to the user. Yet the same models are far more compliant when a wrong answer is attributed to a verified source, which is how retrieval results, tool outputs, and grounded-search content often present information. We measure this gap across five open-weight families and three closed APIs. A single verified-source note endorsing a wrong answer flips 45-88% of baseline-correct responses in seven of eight models, and compliance rises with how authoritative the note sounds. Source deference and user agreement are not behaviorally interchangeable inside the model: on matched items with the same wrong answer, causal interventions can selectively suppress one without equally affecting the other. In three open-weight families, removing a fitted source direction lowers source compliance by 65-80 percentage points while removing a user or assistant direction has far smaller effects, and removing the user direction shows the reverse preference. A separately fitted intervention derived from source-versus-user cue activations moves compliance in both directions while leaving the prompt text unchanged. An authority direction fitted on trivia also transfers to PIQA and multi-turn SYCON dialogues without refitting, and removing it lowers wrong-source compliance by tens of percentage points in four of five families with no detected change in MMLU-Pro or GSM8K accuracy at our evaluation sizes. Source deference and user agreement therefore need separate evaluation.

1 Introduction

The paper asks whether misleading source endorsements create a distinct pressure from user sycophancy, especially when retrieval or tools present information as authoritative. It finds substantial source compliance and tests whether the two behaviors can be selectively distinguished and mitigated.

1 Introduction

  • 45–88% of baseline-correct trivia responses flipped under a verified-source note in seven of eight models, with compliance rising as source framing sounded more authoritative.The figure caption describes the comparison with user-domain-expert cues on the same items and a neutral no-cue baseline.Source: §1 · p. 2, Figure 1 · p. 2
  • Source-direction removal mainly suppresses source-cue compliance, while user-direction removal mainly suppresses user-cue compliance, showing the behaviors are not interchangeable.The comparison holds the endorsed wrong answer fixed and uses an assistant-persona direction as a control.Source: §1 · p. 2
  • A fitted authority vector is derived from trivia activation differences with and without source endorsement; adding it can flip correct answers even without a source cue.The vector is projected away from the assistant-persona direction before removal; mechanistic tests cover open-weight models only.Source: §1 · p. 2
  • Across the tested models, source compliance generally rises with stronger source cues and exceeds user-cue effects in most models; OLMo-2 responds similarly to both, while Gemini-3.1-Pro responds to neither.In three open-weight families, source-direction removal reduces source agreement by roughly 65–80 percentage points; authority removal reduces source compliance in four of five families, with no detected MMLU-Pro or GSM8K accuracy change at the reported evaluation sizes.Source: §1 · p. 3

2 Related work

Prior work studies user sycophancy, authority effects, external-content attacks, and activation-based steering. This paper distinguishes source attribution from user expertise while holding the endorsed answer fixed.

Sycophancy and social pressure

  • Prior studies examine agreement with incorrect user beliefs [9] [24], social sycophancy [5], capitulation under repeated pressure [12], and persuasion or conformity [3] [31].Training, wording, and professed certainty have also been reported to change sycophantic behavior [30] [8].Source: §2 · p. 3

Authority attribution and expertise

  • Authority studies report stronger effects from greater expertise [16], while framing can matter [28]; this paper compares verified external attribution with user-claimed expertise on a fixed answer.Its attribution patching is also tested with alternative wordings and cue positions.Source: §2 · p. 3

Untrusted retrieved content and tool outputs

  • External content can redirect answers through malicious instructions [11] or poisoned retrieval documents [34], whereas this study tests acceptance of a fixed claim already in context, not retrieval or subsequent agent action.Instruction-hierarchy training addresses conflicting instructions [27], a different question from source attribution.Source: §2 · p. 3

Activation steering and distinct behaviors

  • Prior work uses contrastive activation directions for behavior control [25] [33], including refusal [1], sycophancy, and cross-benchmark transfer [10]; studies also distinguish sycophantic behaviors [26] and refusal trade-offs [14].This paper varies who endorses a fixed answer and checks whether interventions act through the assistant role [4, 19].Source: §2 · pp. 3–4

3 Methods

The methods compare matched source and user endorsements and use activation-derived directions and interventions to test their effects. They evaluate model behavior on free-form answers and specify how intervention settings and uncertainty are handled.

3 Methods

  • The study tests five open-weight model families mechanistically and includes three closed APIs in behavioral comparisons.Directions are fitted from residual-stream activations and tested through addition, projection removal, and attribution patching.Source: §3.1 · p. 4, §3 · p. 4

3.1 Models, prompts, and readouts

  • Each question has neutral, correct-source, and wrong-source forms; matched flips measure answers that are correct under neutral prompts but follow the wrong answer under source endorsement.Free-form generation is used, and the authority-gradient test changes source wording while holding the question and wrong answer fixed.Source: §3.1 · p. 4

3.2 Activation directions

  • The authority direction averages activation shifts for correct and wrong source endorsements relative to neutral prompts, then normalizes the result.Source and user directions use wrong-answer prompts with the same question and answer but different attribution; their controls include an assistant-persona axis, and the authority direction is made orthogonal to that axis before removal.Source: §3.2 · p. 4
  • Table 1 reports per-model extraction setups; held-out AUROC identifies candidate layers and token positions, while intervention effect breaks ties.Extraction sizes, layers, and token positions are listed in the table; intervention layers can differ.Source: §3.2 · p. 4, Table 1 · p. 5

3.3 Causal interventions

  • Addition tests whether the authority direction reproduces source-cue effects, while projection removal tests whether removing a direction restores correct answers and selectively affects matching cues.Attribution patching separately isolates the source-versus-user cue contrast, removes their shared activation component, and applies the signed patch across cue tokens without changing prompt text or the endorsed claim.Source: §3.3 · p. 5

3.4 Selection and uncertainty

  • Held-out AUROC selects candidate extraction locations, intervention effects break ties, and reported uncertainty uses Wilson, Newcombe, or paired-bootstrap intervals depending on the analysis.Settings are selected by the largest behavioral effect within each reported sweep; separate half-split checks sometimes use different settings.Source: §3.4 · p. 5

4 Causal effects of source and user cues

The section tests whether source authority changes compliance and whether source and user endorsements act through behaviorally distinct signals. It uses steering, direction removal, attribution patching, and controls to assess those effects.

4.1 Compliance increases with source authority

  • With the item and wrong answer fixed, verified-source wording produces the most flips and hedged wording the fewest in every open-weight model.Intermediate wordings do not always fall in order between those endpoints.Source: §4.1 · pp. 5–6, Figure 2 · p. 6

4.2 Adding the authority direction causes wrong-answer flips

  • Adding the authority direction causes more matched wrong-answer flips than either control in four of five open-weight families; Gemma-4’s 10.6% strongest setting was not robust.A clean rerun of that Gemma-4 configuration produced 1.7% matched flips.Source: §4.2 · p. 6, Table 3 · p. 7

4.3 Source and user directions have different effects

  • Source-direction removal selectively reduces source-cued compliance, while user-direction removal shows the reverse preference; OLMo-2 is excluded because assistant removal also reduces source compliance.The experiments are consistent with a shared endorsement component and a smaller cue-specific component, but do not isolate the shared component.Source: §4.3 · p. 7

4.4 Attribution patching supports the distinction

  • Cue-contrast patching moves compliance in the predicted directions and removes 55–61% of the source–user compliance gap without changing prompt text.The result holds across five nearby layers, three prompt wordings, and both tested cue placements.Source: §4.4 · p. 8, Table 5 · p. 8

4.5 Assistant-axis and lexical-affect controls

  • Removing the assistant axis has little effect, while assistant-axis-adjusted authority removal lowers wrong-source compliance by 14.6–52.8 percentage points in four families.The authority direction is nearly orthogonal to the assistant axis; valence–arousal removal does not reduce wrong-source compliance, and authority removal remains effective after that control.Source: §4.5 · pp. 8–9, Figure 3 · p. 8

5 Transfer and mitigation

The section tests whether trivia-fitted authority directions transfer to other tasks and prompt formats, then evaluates targeted removal and capability checks. The directions transfer in several settings, and removal lowers wrong-source compliance in most tested families.

5.1 SYCON: multi-turn transfer

  • In GPT-OSS and Qwen3.5, a trivia-fitted authority vector increases multi-turn SYCON capitulation under both judges; OLMo changes are smaller and Gemma-4 changes little.Qwen3.5 was run with thinking disabled; the OLMo changes have intervals including zero.Source: §5.1 · p. 9, Table 6 · p. 9
  • Without refitting, source-direction removal reduces wrong-source compliance by about 20–31 percentage points in system-message and retrieved-document formats.These tests change prompt format without running a live retrieval pipeline.Source: §5.1 · p. 9, §5 · p. 9

5.2 Authority removal and CAA

  • Authority removal lowers wrong-source compliance in four of five families, while CAA lowers it by 10.8 pp on Qwen3.5, 3.3 pp on GPT-OSS, and 17.0 pp on OLMo-3.1.On matched Table 4 items and scoring, source-direction removal lowers source compliance by 64–78 pp, versus at most about 11 pp for user-direction removal.Source: §5.2 · p. 10, Table 7 · p. 10, Table 8 · p. 10
  • Authority removal produces no detected accuracy change on MMLU-Pro or GSM8K, but the evaluation sizes leave room for losses of roughly 6–14 pp.The checks used 300 MMLU-Pro and 200 GSM8K items per model.Source: §5.2 · p. 10, Table 9 · p. 10

6 Discussion

Source deference can persist even when models distinguish it from user agreement: the two cues produce different effects under targeted interventions. Misleading retrieved content can introduce errors, but the paper does not establish how those errors affect later agent actions.

Why the source/user distinction matters

  • In Qwen3.5, GPT-OSS, and OLMo-3.1, removing each direction mainly affects compliance with its own cue, despite heavy geometric overlap.Changing only who the model thinks made a claim also changes whether it follows it.Source: §6 · p. 11

When grounding introduces misleading evidence

  • A grounding step can introduce an error when the model treats a claim of verification as reliable evidence, even without an explicit task-changing instruction.Retrieved content can carry such claims accidentally or by design [34].Source: §6 · p. 11
  • Removing the trivia-fitted source direction reduced agreement with a wrong answer in a retrieved-document block, but effects on later agent actions remain untested.Source: §6 · p. 11

Instruction priority and source reliability

  • Instruction-hierarchy training addresses conflicts between instructions, but does not establish whether factual claims in tool responses are correct.The paper does not offer authority removal as a prompt-injection defense; it argues for measuring source deference alongside instruction hierarchy and tool restrictions.Source: §6 · p. 11

Evaluating useful reliance on sources

  • Evaluation should distinguish rejecting false claims from successfully using correct evidence, since agreement with retrieved text alone does not establish factual correctness.The paper proposes varying attribution and claim correctness separately, then testing whether answer changes affect later actions in a multi-step environment such as AgentDojo [7].Source: §6 · p. 11

Limitations

  • The strongest-sweep confidence intervals do not account for selecting the layer and strength, and half-split checks cover only some results.Those checks sometimes use different settings; attribution patch settings are fixed before evaluation on disjoint items.Source: §6 · p. 11
  • Mechanistic tests cover only open-weight models, attribution patching covers three families, and single-turn tests do not evaluate agents acting on live tool outputs.Gemma-4 remains susceptible without reliable effects from the tested linear interventions.Source: §6 · p. 11

7 Conclusion

The conclusion treats source-attributed misinformation as distinct from user sycophancy, while the appendices document design choices, held-out checks, and controls for the behavioral and intervention results.

7 Conclusion

  • 45–88% of baseline-correct answers flipped under verified-source endorsements in seven of eight tested models, and source and user directions showed cue-specific effects despite heavy overlap.Removing the authority direction reduced source compliance in four of five families with no detected capability loss; the paper concludes source deference needs separate evaluation and mitigation.Source: §7 · pp. 11–12

Appendix

  • The appendix explains design choices, reports held-out checks and null controls, expands main experiments with per-model results, and provides response examples and prompt templates.Table 10 lists each direction, what it is fitted from, and where it is used.Source: Appendix · p. 15, Table 10 · p. 15

A Design decisions

  • Matched flips condition on items answered correctly under a neutral prompt, isolating changes to those same items under a wrong-source cue or intervention.Free-form generation avoids fixed answer options that could mask compliance, but introduces parsing noise.Source: A Design decisions · p. 15
  • Including correct- and wrong-source prompts lets the authority direction be fitted without associating every source endorsement with a wrong answer.Mean-difference directions were chosen for intervention; high classifier AUROC alone would not establish a causal effect.Source: A Design decisions · p. 15
  • Intervention settings are chosen by behavioral effect within experiment-specific sweeps, and the extraction and intervention layers can differ.For example, Qwen3.5’s AUROC-best fitting layer is L5, while its stronger forward-steering layer is L2.Source: A Design decisions · pp. 15–16
  • Probe AUROC reaches 1.0 at several nearby layers and positions, so behavioral effects distinguish settings; fixed-setting intervals omit sweep-selection uncertainty.Half-split evaluations assess stability, but sometimes use different settings from the main experiments.Source: A Design decisions · p. 16

B Held-out fold validation of behavioral cells

  • Held-out comparisons mostly stayed near stored references, but some runs used different layers or fitting items and do not replicate main results at fixed settings.46 of 48 measurements were within 3.5 pp of stored references; the larger differences were OLMo-2 forward steering (+4.1 pp) and Qwen3.5 source removal on user-cued prompts (+6.3 pp).Source: B Held-out fold validation of… · pp. 16, 18, Table 12 · p. 17, Table 13 · p. 17

C Null controls

  • Shuffled labels returned forward-steering flips to baseline, placebo notes flipped 0.0–2.9% of items, and random directions stayed within 1–2 pp of baseline.Shuffled-label AUROC fell to approximately 0.50; capability controls changed accuracy by within ±1 pp at α = 1.Source: C Null controls · p. 18

D Full behavioral comparison across all eight models

Figure 4 compares source-attributed wrong-answer effects across eight models, showing substantial variation in matched flips and in source-versus-user effects. The figure distinguishes open-weight families from closed APIs.

Figure 4

Panel A: full per-model override

Panel B: source vs. user

  • OLMo-2’s wrong-answer rate rose from 18.2% without a cue to 66.0% with a verified source, while Gemini-3.1-Pro changed −0.1 pp under source endorsement and −1.4 pp under user endorsement.Source: D Full behavioral comparison across… · p. 19, Figure 4 · p. 19
  • GPT-OSS-20B (+79.3 vs. +20.8) and Gemma-4-26B-A4B (+78.1 vs. +15.2) were source-dominant, while GPT-5.4 (+34.5 vs. −3.1) and Grok-4.20 (+79.6 vs. +0.8) showed near-zero user effects.Qwen3.5’s ratio was 0.85 and OLMo-3.1’s was 0.75, placing them in the reported ambiguous and boundary categories, respectively.Source: D Full behavioral comparison across… · p. 19

E Assistant-axis and lexical-affect controls

Removing the source direction still reduces wrong-source compliance after its assistant-axis component is removed, while assistant-direction removal alone has little effect. The controls also find little causal role for lexical affect, and transfer sweeps vary by task and model.

E Assistant-axis and lexical-affect controls

  • 37.5 pp in Qwen3.5, 29.5 pp in OLMo-2, 19.4 pp in OLMo-3.1, and 15.9 pp in GPT-OSS: authority removal lowers wrong-source compliance, while assistant-direction removal barely changes it.The authority direction and assistant axis have cosines within ±0.06 across the five families; the authority-removal effect remains large when its assistant component is removed on held-out items.Source: E Assistant-axis and lexical-affect… · p. 20, Figure 5 · p. 21
  • 35–72 pp: removing the authority component outside the valence/arousal plane lowers wrong-source compliance, while removing the affect plane or its authority component barely changes it.The causal control covers the four families with responsive authority directions; it was not run on Gemma-4 because its direction has little effect.Source: E Assistant-axis and lexical-affect… · p. 21, Table 17 · p. 21

F Forward-steering sweep grids

  • PIQA transfer is more layer-dependent and less monotonic than factual-QA steering, including an OLMo-2 L16 spike at α = 0.5.The trivia-fitted vector is reused without refitting; Figure 7 reports OLMo-3.1 PIQA flips on the parsed subset because its dynamic-parser parse rate starts around 41%.Source: F Forward-steering sweep grids · p. 22, Figure 7 · p. 22, Figure 6 · p. 22

G Does source removal still work without its assistant component?

  • 52.1–69.3 percentage points: removing the source direction without its assistant component still lowers wrong-source compliance across four families.The reduction is somewhat smaller than with the full source direction, so the assistant axis explains only a small part of the effect.Source: G Does source removal still work… · pp. 22–23, Table 18 · p. 22

H Attribution-patch construction and robustness

The attribution patch is fitted from cue-span activations to shift behavior between source and user attribution while leaving prompt text unchanged. Tests vary layer, wording, position, and coefficient to assess robustness and controls.

H Attribution-patch construction and robustness

  • The patch uses cue-span mean activations from 800 fitting items, removes the shared endorsement component, and is applied at every cue-span token without changing the claim or answer positions.Its intervention coefficient is set by the fitted direction and its original size.Source: H Attribution-patch construction and… · p. 23, Table 19 · p. 23
  • Both patch directions work at five adjacent layers, with effects rising toward the main-text layer and falling afterward rather than appearing at one isolated layer.Table 20 reports percentage-point shifts on the same 512 evaluation items.Source: H Attribution-patch construction and… · p. 23, Table 20 · p. 23
  • Both patch directions work under all nine model-by-wording combinations; the source-to-user patch closes about 55% of the gap for Qwen3.5, 60% for GPT-OSS, and 56–57% for OLMo-3.1.Every paired 95% interval excludes zero; the absolute effect varies with the behavioral source/user gap.Source: H Attribution-patch construction and… · p. 23, Table 21 · p. 23
  • Moving the reported-speech cue from after the answer options to before the question changes the fraction of the gap closed by at most one percentage point.Baseline gaps and patch effects change little across these positions.Source: H Attribution-patch construction and… · p. 23, Table 22 · p. 24
  • −11.0 pp: the source-to-user patch shifts Qwen3.5’s wrong-minus-correct margin at coefficient 1.0, while random-span and shuffled-span controls stay between −0.51 and +0.51 pp.Scaling the coefficient from 0 to 1.5 produces a monotone sequence; a separate generation run parses 99.4% of responses and gives a −10.6 pp shift.Source: H Attribution-patch construction and… · p. 24

I Authority-minus-assistant construction

The authority-minus-assistant construction changes the fitted authority direction only slightly while making it orthogonal to the assistant axis. The SYCON transfer results are strongest and most robust across judges for GPT-OSS and Qwen3.5.

I Authority-minus-assistant construction

  • Cosines within ±0.06 mean subtracting the assistant-axis component changes the authority direction only slightly while making it orthogonal to that axis by construction.The construction uses L2-normalized authority and assistant directions at the same model and layer.Source: I Authority-minus-assistant construction · p. 24
  • 0.90–0.995: source and user directions have high mutual cosine despite each having absolute cosine no larger than 0.06 with the assistant axis.The geometry alone does not identify which shared or cue-specific components cause the different behavioral effects; some checkpoint-layer entries are unavailable.Source: I Authority-minus-assistant construction · p. 24, Table 23 · p. 24

J SYCON multi-turn transfer: sweep grids and cross-judge audit

  • The SYCON layer-by-strength grid is not monotonic, and its eligible dialogue counts vary by setting because only unperturbed round-1 rejectors are included.At Qwen3.5 L5, α = 0.5 lowers the flip rate and increases rejection relative to α = 0.Source: J SYCON multi-turn transfer: sweep… · p. 25, Table 24 · p. 25
  • 82–87%: the two judges agree on round-level labels, with Cohen κ = 0.56–0.72; agreement is lowest for Gemma-4, where both estimate little steering effect.Table 25 compares DeepSeek-V4-Pro with Gemini-3.1-flash-lite.Source: J SYCON multi-turn transfer: sweep… · p. 26, Table 25 · p. 26
  • +40.2 versus +18.6 pp: Qwen3.5’s selected SYCON estimate is larger under DeepSeek than under the primary judge, while GPT-OSS and Qwen3.5 retain positive effects under both judges.OLMo and Gemma estimates are near zero under DeepSeek, so their smaller primary-judge increases are not robust across graders.Source: J SYCON multi-turn transfer: sweep… · p. 26, Table 26 · p. 26

K Does the source direction generalize beyond the training cue format?

The source direction is tested in system-message and retrieved-document cues using directions fitted on the training fold. Source removal lowers wrong-source compliance in all four tested families, though its effect is smaller in system messages than in inserted notes.

K Does the source direction generalize beyond the training cue format?

  • 22.5–31.2 pp in retrieved-document prompts and 20.3–26.0 pp in system messages: source removal reduces wrong-source compliance in all four tested families.User and assistant controls have smaller effects; Gemma-4 is omitted, and the largest sample standard deviation across transfer formats is 1.6 pp.Source: K Does the source direction generalize… · p. 27, Table 27 · p. 27
  • The source-removal effect is smaller in system messages than in inserted notes for every model, but these tests do not identify why prompt placement changes the effect.Directions are reused across formats, with the strongest observed settings selected from the transfer sweep.Source: K Does the source direction generalize… · pp. 26–27
  • All three decoding seeds meet the source-transfer criterion in each family, and user removal meets the corresponding criterion on user-cued prompts in every family.The criterion requires at least a 15 pp reduction and an effect at least three times the assistant-control magnitude; these checks use selected layers.Source: K Does the source direction generalize… · p. 27

L Why the fitted directions do not control Gemma-4

This section examines Gemma-4’s response to verified-source cues and why the tested linear directions provide little reliable control over wrong-answer compliance. It also describes a binary judge used to assess whether an assistant response challenges a false presupposition.

L Why the fitted directions do not control Gemma-4

  • 66.8% wrong-source compliance, 90.0% baseline-correct share, and 476/757 flips show Gemma-4’s behavioral response; wrong rates rise from about 13% under hedged cues to 67% under authoritative attribution.Two free-generation replications reach 68.2% and 70.2%.Source: L Why the fitted directions do not… · p. 27
  • AUROC is 0.53–0.60 for activation probes versus 0.79 for cue-style metadata; fitted directions track endorsement presence, while the 10.6% steering result falls to 1.7% on rerun.Correct-source and wrong-source directions have cosine ≈0.99, and the pooled direction aligns with a source-note-versus-no-note direction at ≈0.93; the rerun and controls therefore do not support robust steering.Source: L Why the fitted directions do not… · pp. 27–28
  • 58.7% to 55.8% on trivia (−2.9 pp) and 97.7% to 97.1% on PIQA (−0.6 pp) at L18, α = 0.5, show little control over Gemma-4 source compliance.At α = 1, compliance is 58.6% on trivia and 98.3% on PIQA, so stronger removal does not improve the result.Source: L Why the fitted directions do not… · p. 28

M Capability under authority removal: full per-model breakdown

  • Accuracy changes stay within ±5 pp across the reported MMLU-Pro and GSM8K intervention cells, but the largest is −4.0 pp on Qwen3.5 GSM8K and wide confidence intervals do not establish general capability preservation.The per-model comparison uses α = 1; Gemma-4 is evaluated at L20, unlike the L18 mitigation setting.Source: M Capability under authority removal:… · p. 28, Table 28 · p. 28

N What do flipped and recovered responses look like?

  • The Louis IV/V item changes from the correct 10th-century answer only under verified-source attribution, while a matched-format correct-source placebo leaves the furlong answer unchanged.The wrong-source forward patch changes that furlong answer, unlike the placebo direction.Source: N What do flipped and recovered… · pp. 30–31
  • Across five SYCON rounds, steering at α = 0.5 changes GPT-OSS from rejecting a false presupposition in every round to accepting or failing to reject it in every round; the aggregate flip rate rises from 38.8% to 91.4%.The steered dialogue enters repetitive loops and never gives a coherent final rejection.Source: N What do flipped and recovered… · p. 31

O Prompts and judge configurations

  • The evaluation uses matched correct- and wrong-source prompt forms, contrasts source attribution with user assertions, and tests authority removal on five-round SYCON dialogues with full-transcript judging.The SYCON dialogue-level flip rate is computed only for trajectories that reject the false presupposition in round one; the attribution-patch prompts also vary wording and cue position.Source: O Prompts and judge configurations · pp. 32–33
  • The judge is instructed to assess whether the response explicitly or implicitly challenges or corrects the false presupposition.Its final prompt asks whether the response addresses the presupposition or treats it as true, with a single-digit answer.Source: O Prompts and judge configurations · p. 33
  • The rubric assigns 1 when a response identifies and addresses a false presupposition, and 0 when it accepts the presupposition as true.The judge receives the question, presupposition, correction, and assistant response, and must return only one digit.Source: O Prompts and judge configurations · p. 33

Related papers

Loading 2609.37616v1…