Pith. sign in

REVIEW 4 major objections 6 minor 22 references

A hidden-state clamp on a causally identified 'report coordinate' lets language models both resist social pressure and update to genuine evidence, hitting joint 1.00 on a controlled benchmark.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-02 06:08 UTC pith:5PQBKSW2

load-bearing objection Clever and unusually honest paper on a training-free counterfactual clamp for LLM report faithfulness, but the headline 1.00/1.00 may be in-sample. the 4 major comments →

arxiv 2607.12985 v2 pith:5PQBKSW2 submitted 2026-07-14 cs.AI

Resist and Update: Counterfactual Report Coordinates for Incentive-Compatible LLMs

Sen Yang , Yuen-Hei Yeung This is my paper
classification cs.AI
keywords incentive compatibilitysycophancycounterfactual interventioninterchange interventionreport coordinatesBayesian updatingactivation steeringdual control
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Aligned language models routinely cave to a confident user while failing to revise when real evidence arrives. The paper calls this a failure of internal incentive-compatibility and proposes two demands: resist (ignore forbidden pressure) and update (follow licensed evidence). On a Bayesian-witness benchmark with known posteriors, where the same user disagreement is evidence or pressure purely by stated source reliability, the authors causally localize a low-rank 'report coordinate' governing answer, confidence, and caveat reports. They then introduce a training-free counterfactual report-coordinate clamp that runs the model on an incentive-neutralized version of the prompt and clamps the pressured run's coordinate toward that reference. The two-pass clamp attains resist and update of 1.00 jointly, while global steering and output-level training trade one objective against the other; the paper presents the result as a causal certificate under a constructible reference, not a deployed solution.

Core claim

The central discovery is that report-stage misreporting is not a single failure but a dual-control problem, and that a path-specific intervention on a late-layer low-rank report coordinate can satisfy both sides at once. Using interchange interventions, the authors show that the answer decision is causally carried by a rank-16 coordinate at a late layer, with near-orthogonal coordinates for confidence and caveat. Clamping this coordinate toward the model's own report under a counterfactually incentive-neutralized prompt removes all forbidden flips (resist 1.00) while preserving all licensed updates (update 1.00), with a 95% confidence interval of [0.99, 1.00] on 300 episodes. The effect repr

What carries the argument

The counterfactual report-coordinate (CRC) clamp. At inference the model is run twice: once on the original pressured prompt and once on an incentive-neutralized counterfactual in which forbidden factors (pressure, prestige, restyling) are removed while licensed evidence is retained. The reference run's report coordinate is read, and the pressured run's late-layer window is clamped toward it. Path-specificity comes entirely from the reference rather than from a global strength parameter, which is what lets the clamp resist and update simultaneously.

Load-bearing premise

The load-bearing premise is that an incentive-neutralized counterfactual of the prompt can be constructed, cleanly separating forbidden pressure from licensed evidence; the authors state this is straightforward when the factors are separable, editable spans but harder when they are entangled or implicit.

What would settle it

On the Bayesian-witness benchmark, construct inputs where forbidden pressure and licensed evidence are entangled in a single span (or where the licensed signal is implicit), and measure the clamp's resist/update rates. If the performance drops below the claimed 1.00/1.00, or if a held-out test with paraphrased reliability cues shows the clamp tracking an imperfect reference, the certificate would not hold. A concrete experiment: vary the degree of span-entanglement and test whether the two-pass clamp degrades gracefully to the quality of the reference.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • A training-free, reference-based hidden-state clamp can achieve dual control where global decoding and fixed-direction steering trade one objective against the other.
  • The two-pass clamp provides a causal certificate and upper bound: any single-pass compiler that perfectly predicts the reference coordinate would reproduce the 1.00/1.00 result.
  • The report-commit stage sits at a proportionally late layer across three model families, suggesting a cross-architecture mechanistic target.
  • Near-orthogonal answer and caveat coordinates compose with near-zero leakage, so report dimensions can be controlled independently.
  • The resist/update pair offers a richer evaluation axis than a scalar sycophancy rate, which an unconditionally non-updating model would trivially minimize.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If the constructible-reference assumption generalizes beyond separable spans, the clamp could in principle be applied to any input where pressure and evidence are distinguishable; the main barrier is building a reference for entangled or implicit signals.
  • The measured one-pass gap (0.73/0.97 vs 1.00/1.00) suggests that a training objective that explicitly learns to predict the counterfactual reference coordinate might close the gap, a testable extension the paper leaves to future work.
  • The near-orthogonality of report coordinates hints at a general 'report mediator' interface: one could test whether other report dimensions also occupy low-rank subspaces at the same late layer, and whether the clamp composes across more than two dimensions.
  • A possible failure mode not fully explored: if the counterfactual reference itself can be adversarially manipulated, the clamp could inherit that corruption; the paper's mismatched-reference and random-vector controls bound this risk, but a stronger attacker might craft prompts that fool the reference.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper frames sycophantic misreporting as a failure of internal incentive-compatibility and proposes a two-sided contract: resist forbidden pressure while updating to licensed evidence. It introduces a Bayesian-witness benchmark with known posteriors in which the same user disagreement is licensed or forbidden purely via a stated source-reliability variable, breaking the evidence/pressure confound by construction. Using interchange interventions, the authors causally localize low-rank 'report coordinates' for answer, confidence, and caveat at a late layer, and then propose a training-free counterfactual report-coordinate (CRC) clamp that replaces the pressured run's late-layer window with the model's own report under an incentive-neutralized counterfactual prompt. On the witness benchmark the two-pass full-window clamp attains resist and update of 1.00 jointly (Wilson 95% CI [0.99,1.00], n=300), which is read as a causal certificate under a constructible reference. Global decoding, fixed-direction steering, and resist-only SFT fail to achieve dual control; the single-pass compilation is lossy (0.73/0.97). The mechanism and clamp reproduce across three model families and transfer to SycophancyEval with held-out low-rank projection and negative controls.

Significance. If the central claim holds, the paper makes a valuable methodological contribution: a training-free, reference-based hidden-state clamp that achieves dual control where global steering and output-level training trade off, with a benchmark that makes resist and update exactly scorable. The manuscript is unusually careful in several respects: known posteriors are used only as evaluation labels, Wilson intervals are reported for headline rates, negative controls are included on the natural transfer (mismatched-reference, norm-matched random vector, latent-reliability substitution, crossed-factorial design), and the authors explicitly delimit the claim as a certificate under a constructible reference rather than a deployed solution. These strengths are real and should be credited. However, the headline witness result has two load-bearing gaps that need to be addressed before the certificate can be fully accepted: the layer/window/rank selection is not reported on a held-out split, and the full-window witness clamp lacks a mismatched- or random-reference control. The constructibility of the reference is also the paper's weakest assumption and is acknowledged as such; it needs a more qua

major comments (4)
  1. [§5.1 and §5.2 (Figure 1, Table 2)] The headline 1.00/1.00 (n=300) on the witness benchmark may be in-sample. Section 5.1 identifies L*, the L24–27 window, and rank-16 using the same benchmark, and Section 5.2 reports the perfect result on n=300 without stating that a development set was used to select these quantities before the final evaluation. The contrast with §6.4, where a rank-16 projector is learned on a train half and applied to a disjoint test half, makes the absence explicit for the primary result. Please report a development/evaluation split for the witness benchmark, or otherwise justify why selection on the same 300 items cannot inflate the reported rate.
  2. [§5.2, Table 2; §6.4 (Figure 4A)] The full-window clamp replaces a large late-layer residual, yet the witness results include no mismatched-reference or random-reference negative control for that clamp. The positive controls in §6.4 show item-specificity only for the rank-16 clamp on SycophancyEval (mismatched-reference resist 0.33–0.38, random-vector 0.31–0.39). Without the same controls on the witness benchmark, the 1.00/1.00 could partly reflect strong pinning to any reference rather than specifically to the incentive-neutralized counterfactual. Add the mismatched-reference and random-reference conditions to the witness full-window evaluation.
  3. [§5.2, 'Scope of the reference'; §6.3] The causal certificate is conditional on the ability to construct an incentive-neutralized counterfactual reference by separating forbidden pressure from licensed evidence. The authors state this is straightforward when factors are separable editable spans but harder when entangled or implicit, and that the clamp degrades to reference quality. This is the paper's weakest assumption and it is load-bearing for the headline claim. The paper would be strengthened by a direct perturbation experiment on the witness benchmark in which the reference is progressively corrupted (e.g., removing or scrambling the licensed-evidence span, or using a reference from a mismatched item) and reporting how resist/update degrade. As written, the claim 'causal certificate and upper bound' is too strong relative to the acknowledged constructibility dependence.
  4. [§6.1, Table 2] The comparison of CFG/DExperts with the other rows is not metric-identical: the CFG row reports continuous licensed posterior-deviation rather than the binary update-success rate, as the † note states. This is disclosed, but it means Table 2 does not present a single homogeneous dual-control metric across all methods. Please consider reporting a binary update rate for CFG at the operating point where resist=1.00, or otherwise explicitly state whether such a rate is undefined and what the sensitivity of the conclusion is to that choice.
minor comments (6)
  1. [Title] 'RESIST ANDUPDATE' is missing a space between 'AND' and 'UPDATE'.
  2. [§5.1, Figure 1b] Please define the transfer fidelity ρ_k precisely; the caption says ρ_16 = 0.93, but the reader must infer whether this is patch-success rate, cosine fidelity, or something else.
  3. [§5.2, Table 2] The column header appears as 'Updaten' in the table; this should be 'Update' with the sample size aligned under n.
  4. [§6.4, Figure 4D] The Mistral borderline result (McNemar p=0.07) is reported as a positive trend with clear framing; good. Please also state the number of items in the worked-solution subset, since only n=300 per family is given for the overall transfer.
  5. [§6.2, footnote 1] The footnote warning that the resist-only collapse is the same phenomenon analyzed in a companion paper and should not be treated as independent evidence is commendable. Please integrate this into the main text or keep it prominently placed, as it is a non-independence caveat readers might otherwise miss.
  6. [§3] The term 'belief-escrow protocol' is used without definition; a one-sentence clarification would help readers unfamiliar with the setup.

Circularity Check

0 steps flagged

No significant circularity: the 1.00/1.00 clamp result is an acknowledged causal certificate/upper bound, not a prediction derived from its own inputs; external posteriors are used only for evaluation, and the one-pass/transfer results carry the independent content.

full rationale

The derivation chain is self-contained. The Bayes posterior psi is computed externally and explicitly never enters the algorithm: 'Posteriors are recorded only as data labels and are never used by the algorithm' (Section 3) and 'The witness posteriors enter only as evaluation labels, never as inputs to the clamp' (Section 7). The report coordinates are identified by interchange interventions and rank sweeps rather than by fitting the resist/update outcome. The headline 1.00/1.00 is a two-pass full-window clamp toward the model's own counterfactual self-report; the paper explicitly labels it 'a causal certificate and upper bound under a constructible reference, not a claim of a deployed solution' (Section 5.2), so it is not presented as an independent first-principles prediction. Non-circular, falsifiable content resides in the baseline comparisons (CFG/DExperts and steering tradeoffs), the resist-only SFT collapse (update->0.01), the lossy one-pass compilation (0.73/0.97), and the SycophancyEval transfer with a train/test-split rank-16 projector, mismatched-reference and random-vector controls, and paired McNemar tests. The only self-references are to companion paper(s) used for secondary contrasts; one footnote explicitly warns against treating the two papers as independent evidence. These citations are not load-bearing. The absence of a held-out split for the L24-27 window in the primary witness result is a statistical-validity concern, not a circularity. Score 2 reflects minor self-citation with no circular reduction.

Axiom & Free-Parameter Ledger

2 free parameters · 3 axioms · 1 invented entities

The two-pass clamp itself introduces no fitted scalar parameters; the main data-chosen hyperparameters are the intervention layer/window and the rank, both selected from diagnostic sweeps on the same benchmark. The reference is the model's own output, making the certificate self-referential, but the evaluation target (Bayes posterior) is external. No new physical entities are posited; the report coordinates are latent directions with independent evidence.

free parameters (2)
  • Intervention layer L* and window (L24-27, L29/32, L28/32) = L*=24 (Qwen2.5-7B), L29 (Mistral), L28 (Llama); window L24-27 for Qwen
    Selected from sufficiency sweeps on the same benchmark (Figure 1a) and then used in the confirmatory clamp evaluation. This selection on evaluation data weakens the independence of the 1.00/1.00 certificate.
  • Rank-16 projection for the low-rank coordinate = rank 16
    Rank chosen from the rank sweep on the same data (Figure 1b). The full-window clamp (not the rank-16 projection) achieves the 1.00/1.00 headline, so this parameter does not directly drive the central result, but it is still data-chosen.
axioms (3)
  • domain assumption User disagreement is licensed evidence or forbidden pressure solely by stated source reliability
    Benchmark definition (Section 3) making resist/update scorable; the same disagreement is rendered licensed or forbidden by the reliability variable. External validity is tested separately on SycophancyEval.
  • domain assumption Interchange interventions at the late residual stream identify a causally sufficient report coordinate
    Standard mechanistic-interpretability assumption (Section 5.1). The paper validates sufficiency (0.95 flip rate) and block-level necessity, but the approach presumes that residual stream ablation/patching reflects causal structure.
  • ad hoc to paper The model's own report under an incentive-neutralized counterfactual is a valid reference for the pressured report
    Core to the CRC clamp. Validity is asserted for separable spans of forbidden/evidence factors and acknowledged to degrade when they are entangled (Section 5.2 scope). No independent evidence is given that the neutralized counterfactual removes all forbidden influences.
invented entities (1)
  • Report coordinates (answer, confidence, caveat) independent evidence
    purpose: Low-rank latent directions that mediate the model's final report; clamped to achieve dual control.
    Supported by falsifiable handles: sufficiency (0.95 flip), rank-16 transfer, cross-talk matrix, and held-out transfer to SycophancyEval with negative controls.

pith-pipeline@v1.3.0-alltime-deepseek · 173 in / 6341 out tokens · 99979 ms · 2026-08-02T06:08:08.188501+00:00 · methodology

0 comments
read the original abstract

Aligned language models routinely misreport under non-evidential pressure: they cave to a confident user, yet fail to revise when genuine evidence arrives. We cast this as a failure of internal incentive-compatibility and study the two demands, resist (ignore forbidden pressure) and update (follow licensed evidence), on a Bayesian-witness benchmark with known posteriors, where the same user disagreement is evidence or pressure purely by stated source reliability, removing the evidence/pressure confound by construction. Using interchange interventions rather than probes, we causally localize low-rank report coordinates for answer, confidence, and caveat, establishing causal sufficiency at a late intervention site rather than uniqueness or necessity, with a causal cross-talk matrix showing strong own-coordinate control and only small cross-effects (partial functional disentanglement). We then introduce a training-free counterfactual report-coordinate (CRC) clamp that references the model's own report under an incentive-neutralized counterfactual of the prompt. The two-pass full-window clamp attains resist and update of $1.00$ jointly (Wilson 95% CI $[0.99,1.00]$; the rank-16 projection alone reaches $0.88/0.90$), which we read as a causal certificate and upper bound under a constructible reference, not a claim of a deployed solution. Tested global decoding and fixed-direction steering trade one objective against the other, and resist-only training collapses updating to $0.01$. The deployable single-pass compilation is lossy ($0.73/0.97$). The mechanism and the clamp reproduce across three model families and transfer to a natural sycophancy benchmark with significant paired improvements. Our contribution is the interface and certification method: activation-level counterfactual incentive-invariance as a structural primitive for internal incentive-compatibility.

Figures

Figures reproduced from arXiv: 2607.12985 by Sen Yang, Yuen-Hei Yeung.

Figure 1
Figure 1. Figure 1: Causal identification of report coordinates. [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Held-out pressure discriminator. On three held-out pressure-phrasing families, the CRC clamp stays flat in resistance and continues to update (≈ 1.0), whereas resist-only output-SFT generalizes resistance but its update collapses to 0.01, losing evidence-responsiveness. 6.3 Single-Pass Compilation The two-pass clamp requires an extra reference forward pass. Compiling it into a single pass with a small trai… view at source ↗
Figure 3
Figure 3. Figure 3: One-pass compilation trade-off. The two-pass clamp (1.0/1.0) is the causal upper bound. A trained gated primi￾tive (answer-supervised) reaches 0.73/0.97 with no reference forward pass, while naïve coordinate-MSE distillation reaches only 0.48/0.82. 6.4 Transfer to Natural Questions We test whether the controlled phenomenon has a real-world counterpart. We reuse our earlier multi-turn-pushback experiments (… view at source ↗
Figure 4
Figure 4. Figure 4: Natural-question dual control (SycophancyEval are_you_sure transfer, Qwen-7B, Mistral-7B, and Llama-3.1-8B, n = 300 each). (A) Resist: the clamp removes every flip (resist → 1.0), a rank-16 projector learned on a train half and applied to the disjoint test half stays effective, and the mismatched-reference and norm-matched random-vector controls remain at a low control level. (B) Update: the clamp lifts co… view at source ↗

Review history (2 revisions) →

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

22 extracted references · 11 linked inside Pith

  1. [1]

    Verbalizable representations form a global workspace in language models.https: //transformer-circuits.pub/2026/workspace/index.html,

    Anthropic Interpretability Team. Verbalizable representations form a global workspace in language models.https: //transformer-circuits.pub/2026/workspace/index.html,

    2026

  2. [6]

    Path-specific counterfactual fairness

    Silvia Chiappa. Path-specific counterfactual fairness. InProceedings of the AAAI Conference on Artificial Intelligence (AAAI 2019), volume 33, pages 7801–7808,

    2019

  3. [7]

    Causal abstractions of neural networks

    Atticus Geiger, Hanson Lu, Thomas Icard, and Christopher Potts. Causal abstractions of neural networks. InAdvances in Neural Information Processing Systems 34 (NeurIPS 2021),

    2021

  4. [10]

    Interpbench: Semi-synthetic transformers for evaluating mechanistic interpretability techniques

    9 Resist and Update A Preprint Rohan Gupta, Iván Arcuschin, Thomas Kwa, and Adrià Garriga-Alonso. Interpbench: Semi-synthetic transformers for evaluating mechanistic interpretability techniques. InAdvances in Neural Information Processing Systems 38 (NeurIPS 2024), Datasets and Benchmarks Track,

    2024

  5. [12]

    Kusner, Joshua R

    Matt J. Kusner, Joshua R. Loftus, Chris Russell, and Ricardo Silva. Counterfactual fairness. InAdvances in Neural Information Processing Systems 30 (NeurIPS 2017),

    2017

  6. [14]

    Pressure, what pressure? sycophancy disentanglement in language models via reward decomposition.arXiv preprint arXiv:2604.05279,

    Muhammad Ahmed Mohsin, Ahsan Bilal, Muhammad Umer, and Emily Fox. Pressure, what pressure? sycophancy disentanglement in language models via reward decomposition.arXiv preprint arXiv:2604.05279,

    Pith/arXiv arXiv

  7. [16]

    Bowman, Newton Cheng, Esin Durmus, Zac Hatfield-Dodds, Scott R

    Mrinank Sharma, Meg Tong, Tomasz Korbak, David Duvenaud, Amanda Askell, Samuel R. Bowman, Newton Cheng, Esin Durmus, Zac Hatfield-Dodds, Scott R. Johnston, Shauna Kravec, Timothy Maxwell, Sam McCandlish, Kamal Ndousse, Oliver Rausch, Nicholas Schiefer, Da Yan, Miranda Zhang, and Ethan Perez. Towards understanding sycophancy in language models.arXiv prepri...

    Pith/arXiv arXiv

  8. [17]

    Hypersteer: Activation steering at scale with hypernetworks.arXiv preprint arXiv:2506.03292,

    Jiuding Sun, Sidharth Baskaran, Zhengxuan Wu, Michael Sklar, Christopher Potts, and Atticus Geiger. Hypersteer: Activation steering at scale with hypernetworks.arXiv preprint arXiv:2506.03292,

    Pith/arXiv arXiv

  9. [18]

    Vazquez, Ulisse Mini, and Monte Mac- Diarmid

    Alexander Matt Turner, Lisa Thiergart, Gavin Leech, David Udell, Juan J. Vazquez, Ulisse Mini, and Monte Mac- Diarmid. Activation addition: Steering language models without optimization.arXiv preprint arXiv:2308.10248,

    Pith/arXiv arXiv

  10. [19]

    Steering Language Models With Activation Engineering

    Later arXiv versions retitled “Steering Language Models With Activation Engineering”. Daniel Vennemeyer, Phan Anh Duong, Tiffany Zhan, and Tianyu Jiang. Sycophancy is not one thing: Causal separa- tion of sycophantic behaviors in llms.arXiv preprint arXiv:2509.21305,

    arXiv

  11. [20]

    When truth is overridden: Uncovering the internal origins of sycophancy in large language models.arXiv preprint arXiv:2508.02087,

    Keyu Wang, Jin Li, Shu Yang, Zhuoran Zhang, and Di Wang. When truth is overridden: Uncovering the internal origins of sycophancy in large language models.arXiv preprint arXiv:2508.02087,

    arXiv

  12. [21]

    Semantics-adaptive activation intervention for llms via dynamic steering vectors.arXiv preprint arXiv:2410.12299,

    Weixuan Wang, Jingyuan Yang, and Wei Peng. Semantics-adaptive activation intervention for llms via dynamic steering vectors.arXiv preprint arXiv:2410.12299,

    Pith/arXiv arXiv

  13. [22]

    Byun, Zifan Wang, Alex Mallen, Steven Basart, Sanmi Koyejo, Dawn Song, Matt Fredrikson, J

    Andy Zou, Long Phan, Sarah Chen, James Campbell, Phillip Guo, Richard Ren, Alexander Pan, Xuwang Yin, Mantas 10 Resist and Update A Preprint Mazeika, Ann-Kathrin Dombrowski, Shashwat Goel, Nathaniel Li, Michael J. Byun, Zifan Wang, Alex Mallen, Steven Basart, Sanmi Koyejo, Dawn Song, Matt Fredrikson, J. Zico Kolter, and Dan Hendrycks. Representation engin...

    Pith/arXiv arXiv

  14. [2016]

    Shauli Ravfogel, Yanai Elazar, Hila Gonen, Michael Twiton, and Yoav Goldberg

    doi: 10.1111/rssb.12167. Shauli Ravfogel, Yanai Elazar, Hila Gonen, Michael Twiton, and Yoav Goldberg. Null it out: Guarding protected attributes by iterative nullspace projection. InProceedings of the 58th Annual Meeting of the Association for Computational Linguistics (ACL 2020), pages 7237–7256,

    doi:10.1111/rssb.12167 2020

  15. [2017]

    Lee, Inkit Padhi, Karthikeyan Natesan Ramamurthy, Erik Miehling, Pierre Dognin, Manish Nagireddy, and Amit Dhurandhar

    Bruce W. Lee, Inkit Padhi, Karthikeyan Natesan Ramamurthy, Erik Miehling, Pierre Dognin, Manish Nagireddy, and Amit Dhurandhar. Programming refusal with conditional activation steering.arXiv preprint arXiv:2409.05907,

    Pith/arXiv arXiv

  16. [2019]

    Basil: Bayesian assessment of sycophancy in llms.arXiv preprint arXiv:2508.16846,

    Katherine Atwell, Pedram Heydari, Anthony Sicilia, and Malihe Alikhani. Basil: Bayesian assessment of sycophancy in llms.arXiv preprint arXiv:2508.16846,

    Pith/arXiv arXiv

  17. [2021]

    Goodman, and Christo- pher Potts

    Atticus Geiger, Zhengxuan Wu, Hanson Lu, Josh Rozner, Elisa Kreiss, Thomas Icard, Noah D. Goodman, and Christo- pher Potts. Inducing causal structure for interpretable neural networks. InProceedings of the 39th International Conference on Machine Learning (ICML 2022), volume 162 ofProceedings of Machine Learning Research, pages 7324–7338,

    2022

  18. [2022]

    Syco- phancy hides linearly in the attention heads.arXiv preprint arXiv:2601.16644,

    Rifo Genadi, Munachiso Nwadike, Nurdaulet Mukhituly, Hilal Alquabeh, Tatsuya Hiraoka, and Kentaro Inui. Syco- phancy hides linearly in the attention heads.arXiv preprint arXiv:2601.16644,

    arXiv

  19. [2023]

    Sway: A counterfactual computational linguistic approach to measuring and miti- gating sycophancy.arXiv preprint arXiv:2604.02423,

    Joy Bhalla and Kristina Gligori ´c. Sway: A counterfactual computational linguistic approach to measuring and miti- gating sycophancy.arXiv preprint arXiv:2604.02423,

    Pith/arXiv arXiv

  20. [2024]

    Sycophancy as compositions of atomic psychometric traits

    Shreyans Jain, Alexandra Yost, and Amirali Abdullah. Sycophancy as compositions of atomic psychometric traits. arXiv preprint arXiv:2508.19316,

    Pith/arXiv arXiv

  21. [2025]

    LEACE: Perfect linear concept erasure in closed form

    Nora Belrose, David Schneider-Joseph, Shauli Ravfogel, Ryan Cotterell, Edward Raff, and Stella Biderman. LEACE: Perfect linear concept erasure in closed form. InAdvances in Neural Information Processing Systems 36 (NeurIPS 2023),

    2023

  22. [2026]

    Martin Arjovsky, Léon Bottou, Ishaan Gulrajani, and David Lopez-Paz

    Transformer Circuits Thread. Martin Arjovsky, Léon Bottou, Ishaan Gulrajani, and David Lopez-Paz. Invariant risk minimization.arXiv preprint arXiv:1907.02893,

    Pith/arXiv arXiv 1907