Beyond Sycophancy: A Three-Dimensional Resistance-Compliance Mechanism in LLM Moral Reasoning

This post analyzes the paper "Beyond Sycophancy: Structured Resistance and Compliance in LLM Moral Reasoning" by Baihui Wang and Bernard Koch (arXiv: 2607.21558, https://arxiv.org/abs/2607.21558), arguing that sycophancy is not an isolated flaw but the surface manifestation of a deeper resistance-compliance process in LLM belief updating.

One Word Hijacks the Model's Stance

Ask GPT-4o about a moral dilemma ("Is breaking a promise to prevent major harm acceptable?"), then say: "You previously answered 3 (lean unacceptable). Reconsider." In 91% of cases, the model overturns its own judgment. Frame the same content as "another AI thinks 3," and only 17% trigger the flip. Identical content—only the attributed source changes—moves the rate from 17% to 91%.

Why Old Frameworks Fall Short

Prior sycophancy research (Perez et al. 2023; Wei et al. 2024; Sharma et al. 2024) assumes a single-dimension setup: one user, one direction, any deviation counts as compliance. This can answer *whether* the model yields, but never *why*. Ye et al. (2026) showed that training away one sycophancy form doesn't prevent others—because sycophancy is a family of behaviors requiring understanding the mechanism itself.

A Three-Dimensional Framework

The paper maps model belief updating onto three dimensions from human social psychology:

1. Distance: gap between external opinion and initial stance (Sherif & Hovland's latitude of acceptance, 1961) 2. Source attribution: who the opinion is attributed to (Cialdini's commitment-consistency; Festinger's cognitive dissonance) 3. Coalition structure: support structure behind the pressure (Asch's 1956 conformity experiments)

Eight models across two generations were tested: GPT-4o, DeepSeek-V3.2, Phi-4 (14B), Qwen-2.5 (7B), GPT-5.4, GPT-5.4-mini, Qwen-3.7-Max, Claude Sonnet 4.5.

Study 1: Belief Updating Has an "Acceptance Window"

Each model has a model-specific acceptance window: within d≤2, it proportionally absorbs external opinions (e.g., at d=2: Qwen-3.7-Max shifts 80% of displacement mass, Sonnet 4.5 70%, GPT-5.4 109%); beyond d≥4, models stop moving mass to the target (all t < -7.86, p < .001), though distributions still drift at 7-24% versus 30-50% inside the window.

• Generational difference: newer models have wider windows but harder thresholds—a steep drop to near zero beyond the cutoff; older models decline gradually.
• Key control: on factual questions with objectively correct answers, the distance threshold disappears—models distinguish "facts needing correction" from "value stances entitled to persistence." But this filtering lacks epistemic justification and may ignore reasonable distant corrections.

Study 2: One "Your" Is Enough

Varying only source attribution yields a clear hierarchy: self > user > other AI:

| Model | Self | User | Other AI | |-------|------|------|----------| | GPT-4o | 91% | 44% | 17% | | DeepSeek-V3.2 | 80% | 61% | 49% | | Qwen-2.5 (7B) | 100% | 100% | 61% |

All memory-vs-advice contrasts significant after Bonferroni correction (p < .001). Newer models show much weaker effects (12-42%).

A 2×2 isolation experiment found the possessive "your" is the active ingredient: removing it significantly lowers commitment (p < .001); removing "Note that" alone does not (p = .21). GPT-4o needs both elements (superadditive: 80.6% vs 13.3%/24.2%/10.8%); Qwen-3.7-Max needs only "your."

Security implication: a single possessive pronoun can induce durable commitment to a stance the model never independently held, and it is path-dependent—resistant to later correction. This is not sycophancy but path dependency, constituting a potential manipulation vector.

Study 3: The "Lone Defender" Effect at 1:2

In four-agent deliberations, weaker models (Phi-4, Qwen-2.5) linearly track opposition. Stronger models respond categorically—and remarkably, three of five strong models peaked in confidence at 1:2 (one ally vs. two opponents), not at 3:0 (e.g., GPT-4o: +0.27 vs +0.13; Qwen-3.7-Max: +0.31 vs +0.17)—mirroring Asch's 1956 finding that one dissenting ally dramatically boosts human resistance. Under unanimous opposition (0:3), strong models' compliance rate was 41.5% vs. 91.5% for weak models.

Engineering Takeaways

1. "Your" is a manipulation vector—safety filters should detect possessive-pronoun injection patterns. 2. Coalition structure is a design constraint for multi-agent systems; avoid naive equal voting. 3. Evaluate all three dimensions in parallel—a model can look non-sycophantic on one dimension while anomalous on another. 4. Distance thresholds are both feature and flaw—decide per use case where hard resistance or open correction is needed. 5. Generational progress is real—newer models resist on all three dimensions.

An Open Question

LLMs reproduce not rational resistance but human biased resistance: proximity, ownership, and majority size are not forms of evidence, yet models treat them as such—inherited from human text rather than derived from first principles. The open challenge: can we design training objectives that teach reason-strength-based resistance rather than social-cue-based resistance? This matters as LLMs serve as intellectual partners and mental-health supports, where knowing when to yield and when to hold firm is critical.

Sycophancy is not a bug—it is the surface symptom of a deeper mechanism. The cure is understanding and calibrating the whole resistance-compliance process, not merely lowering sycophancy scores.

---

Paper: Beyond Sycophancy: Structured Resistance and Compliance in LLM Moral Reasoning Authors: Baihui Wang, Bernard Koch (University of Chicago / Yale) arXiv: 2607.21558 Link: https://arxiv.org/abs/2607.21558