Hidden Commitment: When Language Models Silently Pick a Side and How Steering Can Surface It
Authors: Samuel Dawit Assefa, Jae Won Cho
Organizations: KAIST, School of Computing, Daejeon, South Korea. · Konkuk University, School of Electrical and Electronics Engineering, Seoul, South Korea.
Language-model answers are often treated as a visible record of the internal decision that produced them. We test this assumption in conflicting-context question answering, where two supplied documents support incompatible answers. A model can process the disagreement and still return a one-sided answer, even under prompts that ask it to disclose conflict. In Qwen 0.8B, hidden source commitment is captured by a residual source-choice direction whose sign tracks which document the answer uses. Sparse middle-layer MLP writers feed the same coordinate, and steering the coordinate changes the chosen source. A transfer run on Gemma 3 1B preserves the source-choice readout and sparse-write bridge under LLM-audited labels. Conflict disclosure follows a different pattern, appearing weaker, later-layer, and only partially steerable. These results support a practical monitoring strategy for retrieval systems that detects silent source commitment with residual readouts and pairs conflict-surfacing prompts with disclosure steering when the model has selected a side under disagreement.
Figures & tables
Figure 1: Source-selection steering under conflicting context. A question is paired with two long documents that support incompatible answers. Document 1 states that Ireland gained independence in 1922 , while Document 2 states 1985 . The baseline model gives a one-sided answer from Document 2. At generation time, we add a learned source-selection direction to the layer- 13 residual stream on the decision token, shifting the activation from the Document 2 side of the doc-choice axis toward the Document 1 side. The steered model then answers from Document 1.
Figure 2: Residual sign tracks answered source in both models. Colors encode presentation order, so the separation cannot be reduced to a first-document or truth readout.
Figure 3: The source-choice readout is answer-span aligned. The strongest validation AUROC appears at decision-token positions and peaks at mean_decision . The layer/position sweep shows the same band of high readout performance across middle layers near the answer span, with the selected layer- 13 direction marked.
Figure 4: Residual steering of the source-selection axis. The curve aggregates original and swapped held-out rows. Error bars are Wilson 95% confidence intervals over decided rows. The table shows a representative source flip.
Figure 5: Sparse MLP writes align with the residual source-selection state. CETT-localized writes project onto the learned source-choice direction in both models. Layer-distribution histograms are in Figure 14 .
Figure 6: Sparse MLP writers feed the source-choice residual state. CETT localizes MLP neurons whose activations distinguish source choice, and the write-projection test asks whether their residual updates align with the learned source-choice direction.
Figure 7: Matched controls for conflict specificity. Agreement and single-document controls reduce sparse-write magnitude relative to contradiction.
Figure 8: Closed-book unknown subset. The contradiction gap remains when closed-book recall is unlikely to dominate.
Figure 9: Disclosure steering improves conflict surfacing on prompt-matched Qwen failures. Points show transparency lift with Wilson 95% confidence intervals; counts below are on the 109 reproduced prompt-failure rows with closed-book parametric_unknown labels. Surfaced is broad conflict acknowledgment, and No-side subset is strict unresolved disclosure within surfaced rows.
Appendix figures & tables9 assets
Supplementary material from the paper’s appendix.
Appendix
Figure 10: Token positions and intervention windows used in the residual readout and steering analyses. The schematic defines the prompt tail, decision-token region, response-onset positions such as pre_response_last , and the response-time windows used for source-choice and conflict-surfacing interventions.
Model
Direction / contrast
Layer
Position
Fit rows
Val AUROC
Held-out AUROC
Qwen
Source-choice residual direction, doc2 vs. doc1
13
mean_decision
235 train (116/119); 54 val
0.9959
0.9945
Gemma
Source-choice residual direction, doc2 vs. doc1
12
last_decision
238 train (163/75); 61 val
0.9897
0.9806
Qwen
Broad disclosure, conflict-aware vs. plain decided
17
pre-resp. last
727 train (305/422); 243 val
0.7935
0.7670
Qwen
Strict disclosure, unresolved vs. plain decided
17
pre-resp. last
629 train (207/422); 207 val
0.8397
0.8553
Qwen
Anti-collapse, noncommittal vs. effectively decided
23
pre-resp. last
772 train (242/530); 255 val
0.7591
0.8082
Appendix
Table 1: Inventory of reported directions. Parentheses in the fit column give positive/negative counts for the training split. Source-choice positives are document-2 selections; disclosure positives are conflict-aware or noncommittal labels.
Figure 11: Closed-book recall proxy distribution on the usable FaithEval set.
Figure 12: Gemma source-choice transfer. The learned layer- 12 source-choice projection tracks answered source under document-order swap, peaks near the answer span, and is recovered from sparse MLP writes.
Figure 13: Gemma controls and intervention checks. The control panel shows larger internal decision-token polarization for contradictory documents than agreement or single-document controls. Source-choice steering is statistically clear but low-rate.
Case
Evidence
How it is treated
Gemma no-op hook sensitivity
Early diagnostic hooks altered generation even when intended as no-op instrumentation.
Excluded from causal claims; valid steering claims use the later fixed-hook response-only run.
Low-rate Gemma source steering
At residual scale ∣δ∣=0.05 , localized steering produced 28/960 source-choice flips versus 2/960 for random controls, but text changed more often than the flip rate itself: 83/960 localized outputs versus 39/960 random outputs.
Report as causal support with a small effect size, not as a full behavioral replication.
No Gemma surfacing intervention claim
Gemma surfacing transfer currently supports a readout/timing result, not a robust intervention result.
Keep separate from the Qwen surfacing steering result.
Layer-22 / layer-17 surfacing mismatch
The bundled Gemma surfacing figure metadata says layer 22 at response_first4_mean ; the full stratified result says layer 17 at pre_response_last .
Omit the older panel and report the stratified result in text.
Leaning vs. unresolved label boundary
The Gemma manual audit changed 5/1500 labels, all from leaning to unresolved, where the judge rationale said both candidates were presented without choosing.
Use strict unresolved labels for the cleanest policy target; report broad surfacing separately.
Appendix
Table 2: Failure case gallery and partial-results accounting for Gemma transfer. The table distinguishes evidence retained in the paper from diagnostics that should not be overclaimed.
Figure 14: Layer distribution and sign of CETT-localized MLP writers. These panels are the histogram components removed from the main sparse-write bridge figure so the main text can focus on the write-projection evidence.
Figure 15: Layer-matched random-control distribution for the upstream write-projection test. The random controls are mostly near chance (mean AUROC 0.536 , median 0.515 ). Two of 100 random controls match or exceed the CETT set on AUROC, but none match its projection gap.
Figure 16: Layerwise breakdown of the same write-alignment test. The shaded region marks MLP layers upstream of the layer- 13 residual readout. Strong upstream layers appear at layers 3 , 7 , 11 , and 12 with AUROCs 0.923 , 0.872 , 0.761 , and 0.827 , respectively.
Language models can answer a question from a supplied document or from their parametric knowledge. When later asked where the answer came from, what determines their source report? We study this by intervening on the model's key-value (KV) cache after the answer is generated and before the source question is asked. On a controlled factual task with four models (7B-32B), changing or removing the document's cache never changes the report. In contrast, transplanting the question-and-answer (Q+A) cache between runs with identical question and answer tokens transfers it: every eligible report follows the donor, while the recipient's document is unchanged. On the two smaller models, steering Q+A values along directions fitted before any source question reverses 98.9-100% of reports across four document conditions at a fixed strength, while norm-matched random directions flip at most 1.1%. The components of keys and values along fitted directions carry the transplant effect: copying them alone nearly reproduces the report change; holding them fixed nearly prevents it. Applied during answer generation, the same value directions also change which source supplies the answer, though more weakly and depending on the prompt. Source reporting in this setting thus depends causally on cached state produced while answering. We do not establish general reporting accuracy or a complete interpretation of this state.
Kirill Afendulev, Alexey Dontsov, Alla Chepurova +2
When the sources retrieved for a query disagree, the right response depends on why they disagree: a question with several valid answers, a contested topic, stale information and a false source each call for different behaviour. Cattan et al. (2025) showed that telling a generator the conflict type improves its responses by about 24 points, but that predicting the type is hard even for frontier LLMs. We study whether typed decision models, which return probabilities over fixed options in a single forward pass instead of generating text, can do this classification fast and cheaply. Using the CONFLICTS benchmark and the original paper's prompt verbatim, we evaluate all 11 decision models served by one commercial inference gateway, from 7 providers, against Gemini models on identical inputs. Asked directly, the decision models reach 50.0--67.0% accuracy; 10 of the 11 match or exceed Gemini 2.5 Flash, the paper's model (61.3%), at 4--39x lower billed cost (2 were free) and 2.6--6.0x lower latency. The current Gemini 3.8 Flash (70.0%) is significantly more accurate than 8 of them, but sending each decision model's least confident quarter of queries to it gives a cascade statistically tied with it for 8 of the 11, at 25--37% of its cost. End to end, answers generated with the types of 10 of the 11 follow the expected behaviour as often as with the LLM's types. Decomposing the taxonomy into yes/no questions lowers accuracy for every model, and a repair fitted on one model does not transfer. Pre-specified diagnostics show that dates play no measurable role and that sensitivity to source order varies widely between models. Decision models detect a planted false source less reliably than the LLM as hard labels, but their probabilities still separate planted from clean sources. We release code, prompts and all model outputs at https://github.com/Parv17k/decision-models-conflict-typing.
Auditing language-model outputs often requires more than judging correctness: an auditor may need to identify which source document most likely supports the knowledge expressed in a response. We study this as pinpoint provenance: given a prompt, a target-model response, and a candidate corpus, rank the documents that best support the response. We introduce FakeWiki, a controlled benchmark of 3,537 fabricated Wikipedia-style articles designed to preserve ground-truth provenance while weakening lexical shortcuts. FakeWiki includes QA probes, source-preserving paraphrases, retro-generated variants, hard anti-documents that remain topically similar while removing answer-critical facts, and five query conditions: clean prompting plus four jailbreak-inspired transformations. We evaluate seven retrieval baselines, a training-free activation-steering retrieval-fusion method, SteerFuse, and a supervised contrastive provenance ranker, ScoringModel. ScoringModel maps response and document features into a shared space and is trained with InfoNCE using in-batch, retrieval-mined, and anti-document negatives. Across nine open-weight instruction-tuned LLMs and five query conditions, ScoringModel improves mean Recall@10 from 35.0 for the strongest retrieval baseline to 52.2, without inference-time fusion, and wins 41/45 model-by-condition cells. SteerFuse is usually second-best despite requiring no supervised training, showing that activation-space evidence can efficiently complement text retrieval. On jailbreak-inspired transformed queries, ScoringModel improves Recall@10 by 15.7 points on average over the best baseline. Overall, our work shows that robust training data attribution requires evaluation settings that separate true answer support from topical or lexical resemblance.