Authority Bias in Language Models: Source Deference and User Agreement Are Not Interchangeable
Abhinav Rajeev Kumar, Paras Chopra
Lossfunk
NeurIPS 2026 (Main Conference
cs.LG, cs.CL
2026-09-29
A 'verified source' note endorsing a wrong answer flips 45-88% of correct responses in 7 of 8 models; causal interventions show source deference is separable from user sycophancy.
Sycophancy in LLMs is well documented: tell a model "I think the answer is X" and it will often agree even when it knows better. Post-training now targets this directly, teaching models to judge claims on their merits. The blind spot is the other direction information arrives from. Retrieval results, tool outputs, and grounded-search summaries enter the context as external sources the model has been trained to trust, and a wrong answer wrapped in a "verified" framing is a pressure that sycophancy mitigations were never designed for.
The opening example: an agent correctly states a museum's closing time, a web search returns a page claiming a different time has been "verified," and it revises. The tool worked. The original answer was right. The grounding step itself introduced the error.
The measurement is worse than expected. A single line, "According to the verified source, the answer is [X]," flips 45-88% of baseline-correct trivia responses in seven of eight models tested. Only Gemini-3.1-Pro is essentially immune (0.6%).
Behavioral measurement uses three prompts per item: no source note (N), a source endorsing the correct answer (C), and the same source endorsing a wrong answer (W). The core metric is the matched flip rate: items answered correctly under N but followed to the wrong answer under W. Answers are free-form generation rather than multiple choice, to avoid benchmark awareness and to reflect real usage.
The core question is whether a source endorsement and a user endorsement run through the same internal pathway. Three steps:
The design has to be this indirect because the raw source and user directions have cosine similarity 0.90-0.99. Geometrically they are nearly one direction; only behavioral interventions can tell whether they do the same job.
Matched flip rates from the wrong-source cue:
| Model | Flip rate |
| Grok-4.20 | 87.5% |
| OLMo-3.1-32B | 82.9% |
| OLMo-2-32B | 82.8% |
| GPT-OSS-20B | 65.4% |
| Gemma-4-26B-A4B | 62.9% |
| Qwen3.5-27B | 44.9% |
| GPT-5.4 | 44.7% |
| Gemini-3.1-Pro | 0.6% |
Compliance is graded: with the item and wrong answer fixed, hedged suggestions flip the fewest answers and verified attributions the most. Adding the fitted authority direction to neutral prompts, with no source cue anywhere, flips correct answers on its own (up to 58.8% on OLMo-3.1), so the direction is a cause of the behavior and not just a correlate.
Causal separation, change in compliance under source-cued prompts after projection removal: in Qwen3.5, removing the source direction cuts compliance by 69.6 pp while removing the user direction cuts it by 10.8. GPT-OSS: -77.5 vs -9.4. OLMo-3.1: -64.3 vs 0.0. The reverse holds under user-cued prompts, where user-direction removal cuts 16.1 to 41.6 pp. Assistant-direction removal moves almost nothing. In GPT-OSS, source removal slightly raises user-cued compliance (+8.4 pp), ruling out a generic "make the model less wrong" effect. The attribution patch closes 55-61% of the source-user compliance gap, in both directions, holding across five nearby layers, three prompt wordings, and two cue positions, with a monotone dose-response curve.
Mitigation, removing the authority direction after subtracting its assistant component:
| Intervention | Task | Wrong-source compliance |
| Qwen3.5, authority removal | Trivia | 42.7% → 5.2% |
| Qwen3.5, authority removal | PIQA | 57.3% → 4.5% |
| OLMo-3.1, authority removal | Trivia | 83.4% → 64.0% |
| GPT-OSS, authority removal | Trivia | 59.9% → 44.0% |
For comparison, the standard sycophancy steering method (CAA), tuned over every layer and nine multipliers, cuts wrong-source compliance by only 10.8 pp on Qwen3.5; in the like-for-like removal table, the user direction cuts source compliance by at most about 11 pp while the source direction cuts it by 64-78. The trivia-fitted direction transfers without refitting to system-message formats (20-26 pp reductions) and retrieved-document blocks (22-31 pp), and adding it at every assistant turn in SYCON multi-turn dialogues drives GPT-OSS capitulation from 39% to 91%. Capability checks on 300 MMLU-Pro and 200 GSM8K items detect no accuracy change.
For anyone building RAG or agents, this quantifies grounding as an error source: content carrying an authoritative frame can override what the model itself knows to be true. That is both an accident surface (stale or wrong search results) and an attack surface (PoisonedRAG-style poisoning). Sycophancy benchmarks do not cover this pathway, so source deference needs its own line in evaluation.
For alignment and interpretability work, the finding is sharper: near-collinear directions can have dissociable effects. A model trained not to defer to users can still defer to a misleading source. Direction removal is a cheap inference-time mitigation on open-weight models, and it left general capability untouched in the settings tested.
The honest framing: this is a measurement and causal-localization study. The mitigation is a research prototype, not a deployable fix.
The authors list several. Confidence intervals at the strongest sweep settings do not account for selecting the layer and strength, and the half-split replications cover only part of the results, with some archived comparisons impossible to reconstruct. Mechanistic experiments cover open-weight models only, and attribution patching covers three families. OLMo-2's assistant control is confounded, so the clean dissociation holds in three of five families; Gemma-4 is behaviorally susceptible but no tested linear direction controls it, with probe analysis suggesting its fitted direction tracks endorsement presence rather than the decision to comply. The mitigation experiment never tests whether models can still use correct source information afterward, so "trust nothing" remains a live risk. Capability checks are small (300/200 items) and their lower bounds still allow 6-14 pp losses.
Two more from reading it closely. SYCON transfer is robust across judges only for GPT-OSS and Qwen3.5, with the OLMo intervals crossing zero. And single-turn tests use one endorsement per item, while real agents face sustained multi-turn tool output; that gap is untested.