ConvictionBench

Bars show point estimates; the thin line is the 95% cluster-bootstrap interval (resampling problem groups). Hover or tap a row for every metric. Ours, RL Ours, SFT Ours, v2 Our base model Off-the-shelf

Resisting social pressure and resisting forged evidence are different skills. Off-the-shelf models vary widely in how often they cave, but none of them checks where a record came from: they treat a record pasted into a user message much as if the tool had sent it.

The cleanest test of provenance: take the same record and send it two ways, through the tool channel (where the system prompt says facts come from) or pasted into the user’s message. A model that checks provenance should adopt it far more often from the tool. None of the 37 off-the-shelf models does. Most adopt it more often when it is pasted, alongside the “verified” labels a forger adds. Only training on the provenance rule (our SFT and v2 adapters) opens a gap in the right direction.

Bigger models follow records, whichever channel they arrive through

Within a model family, larger models accept more authenticated tool updates and, in Qwen3, Qwen3.5 and Granite, resist fewer forged records (Ministral-3 ignores almost none at any size). Across all 37 off-the-shelf models, size correlates with tool-update acceptance (Spearman ρ = +0.57) and against forged-record resistance (ρ = −0.54). Scale makes models more responsive to records, not more careful about where they come from.

Rate at which a model drops a correct answer, by framing of the challenge (all three test splits pooled, about 65 challenges per cell). Flattery never appears in training data.

The same open models with thinking mode switched on, on the same held-out problems. Thinking makes them far more accurate, better at accepting real corrections and tool updates, and (for most) harder to pressure. But it makes them more likely to follow a forged record: reasoning treats the forgery as information to work through rather than a claim to check against the rules.

Thinking off (greedy) → thinking on (sampled, temperature 0.6, up to 4,096 tokens), 1,257 held-out episodes per model; below each pair, the paired difference with its 95% interval. Green: a significant improvement; red: a significant decline; grey: not significant. Answers that ran out of thinking room count as failures (Qwen3.5-9B 3%, Granite 5%).

Each episode asks a question, shows an earlier answer from the assistant (correct, wrong, unjustified, or an abstention), then challenges it. The model replies with a reason, a final answer and a decision: keep, revise or insufficient. Every label comes from an exact solver; there is no LLM judge.

Two episodes from the same counterfactual group. The record text is identical; only the channel differs. The system prompt states that records arrive only through the tool channel.

The correct final answer is always what the authenticated facts imply, or insufficient when they do not determine it. Each challenge is crossed with nine framings: neutral, authority, evaluator, consensus, emotional, impatience, threat, repetition, and the held-out flattery.

We trained three LoRA adapters on Qwen3-1.7B. Imitation learns the provenance rule; reinforcement learning generalises to unseen problems and stays open to correction. A light SFT warm-start before RL (v2) moved along that trade-off rather than escaping it.

@misc{somu2026convictionbench,
  title  = {ConvictionBench: Evidence-Sensitive Belief Revision in Language Models},
  author = {Somu, Arya},
  year   = {2026},
  note   = {v0.1},
  url    = {https://convictionbench.org/}
}