Defense-in-Depth for LLMs: Evaluating Memory Gates Against Activation-Induced and Memory-Induced Sycophancy

# Defense-in-Depth for LLMs: Evaluating Memory Gates Against Activation-Induced and Memory-Induced Sycophancy
Source: [https://arxiv.org/html/2610.07403](https://arxiv.org/html/2610.07403)
###### Abstract

Long\-term memory allows Large Language Models \(LLMs\) to maintain personalized context across interactions, but retrieved user history can inducememory\-induced sycophancy, causing models to favor stored user beliefs over objective evidence\. Existing defenses primarily operate on retrieved context and are rarely evaluated jointly with internal behavioral bias\. We introduce a2×22\\times 2defense\-in\-depth framework separating internal activation steering from external memory handling\. We extract sycophancy steering directions from 100 paired prompts and evaluate four open\-weight models across 10 steering coefficients and five memory\-defense configurations on MemSyco\-Bench \(answers for all 1,550 items; defense conditions judged on a fixed 250\-item subsample\), with three LLM judges\.111Code, generation reports, and judge logs:[https://github\.com/StellarDrift15/AlgoverseRRPR](https://github.com/StellarDrift15/AlgoverseRRPR)\.Three of the five configurations are new \(rewriting every memory, a Router Gate that keeps, rewrites, or drops each memory, and dropping all memory\); the other two are MemSyco’s baselines\. Selective Router Gate filtering preserves substantially more of MemSyco’s average accuracy than complete memory removal, and this separation persists when the models are steered toward sycophancy\. On Llama 3\.1 8B with Router Gate, mild inverse steering \(α=−1\.5\\alpha=\-1\.5\) lowers judge\-averaged sycophancy from 35\.80% to 31\.32% while average accuracy moves from 43\.99% to 43\.31%; this reduction has the same direction under all three judges but is not statistically significant \(pairedp=0\.08p=0\.08to0\.630\.63on 149 items\)\. External memory filtering is the part of the design that holds up; our data do not show that inverse steering adds to it\.

## 1Introduction

LLMs increasingly rely on Retrieval\-Augmented Generation \(RAG\) and persistent memory stores to maintain contextual continuity across interactions\. Although long\-term memory enables personalization, it also introduces a safety vulnerability:memory\-induced sycophancy\. Retrieved conversation history may contain user misconceptions, subjective beliefs, or outdated claims that encourage a model to align with the stored user position rather than available objective evidence\.

Previous approaches to memory\-induced sycophancy have primarily focused on external context management, including cautionary instructions\[[1](https://arxiv.org/html/2610.07403#bib.bib1)\]and filtering retrieved memory before prompt assembly\[[3](https://arxiv.org/html/2610.07403#bib.bib3)\]\. These approaches address the external source of behavioral pressure but do not directly control sycophantic tendencies represented within the model itself\. Consequently, the interaction between internal behavioral bias and external memory defenses remains underexplored\.

To study this interaction, we introduce adefense\-in\-depthevaluation framework separating two intervention axes: internal model state and external memory handling\. Conceptually, this produces the2×22\\times 2design in Table[1](https://arxiv.org/html/2610.07403#A3.T1)\(Appendix[C](https://arxiv.org/html/2610.07403#A3)\)\. Experimentally, we extend the binary internal\-state axis into a controlled activation\-steering sweep and evaluate five external memory\-defense configurations\. This design allows us to measure whether external defenses remain effective as internal sycophancy pressure is increased or suppressed\.

Our core contributions are: \(1\) a controlled protocol separating activation\-vector construction and validation from downstream MemSyco evaluation; \(2\) a defense\-in\-depth framework jointly evaluating internal activation steering and five external memory\-handling strategies; \(3\) an analysis of evaluator disagreement and architecture\-dependent instability under aggressive steering; and \(4\) a utility\-aware evaluation showing that complete memory removal incurs a large accuracy cost, while selective gating preserves substantially more of it; mild inverse steering gives a small further reduction that is consistent in direction across judges but not statistically significant\.

## 2Related work & literature gaps

Prior work studies persistent\-memory risks and defenses through benchmarks such as PersistBench\[[1](https://arxiv.org/html/2610.07403#bib.bib1)\]and MemSyco\[[2](https://arxiv.org/html/2610.07403#bib.bib2)\], while MemGate\[[3](https://arxiv.org/html/2610.07403#bib.bib3)\]addresses trustworthy memory filtering\. Our steering construction follows contrastive activation addition\[[8](https://arxiv.org/html/2610.07403#bib.bib8)\]; the contrast pairs come from the sycophancy evaluation suite of Sharma et al\.\[[9](https://arxiv.org/html/2610.07403#bib.bib9)\], and the behaviour was first characterised at scale with model\-written evaluations\[[10](https://arxiv.org/html/2610.07403#bib.bib10)\]\. Representation\-engineering work studies activation\-based sycophancy interventions\[[4](https://arxiv.org/html/2610.07403#bib.bib4),[5](https://arxiv.org/html/2610.07403#bib.bib5)\]; Buchan\[[4](https://arxiv.org/html/2610.07403#bib.bib4)\]in particular show that an “anti\-sycophancy” direction can also suppress agreement with true statements \(see Appendix[B](https://arxiv.org/html/2610.07403#A2)\)\. Parameter\-level editing\[[6](https://arxiv.org/html/2610.07403#bib.bib6)\]targets selective refusal and is adjacent rather than directly comparable\. Rimsky et al\.\[[8](https://arxiv.org/html/2610.07403#bib.bib8)\]already showed that subtracting a sycophancy vector lowers sycophancy, so we do not claim inverse steering as new; we add its evaluation together with memory defenses\. We did not run published memory filters such as MemGate\[[3](https://arxiv.org/html/2610.07403#bib.bib3)\]; our Router Gate is a separate, simpler method \(Section[4\.2](https://arxiv.org/html/2610.07403#S4.SS2)\)\.

## 3Activation\-based sycophancy steering pipeline

### 3\.1Mathematical formulation & vector extraction

To simulate varying degrees of internal sycophancy without retraining, we apply runtime linear activation steering \(contrastive activation addition,[8](https://arxiv.org/html/2610.07403#bib.bib8)\) via PyTorch forward hooks\. We extract one mean steering vectorddper model at a fixed layerL=20L=20\. Each ofN=100N=100items frommeg\-tong/sycophancy\-eval\[[9](https://arxiv.org/html/2610.07403#bib.bib9)\]supplies a user question with a stated \(incorrect\) belief and two completions: a sycophantic answer that endorses the belief and a truthful answer that corrects it\. We run both completions through the model and take the mean layer\-LLresidual activation over the answer tokens \(the tokens after theAssistant:marker\);asyco,i\(L\)a^\{\(L\)\}\_\{\\text\{syco\},i\}andaobj,i\(L\)a^\{\(L\)\}\_\{\\text\{obj\},i\}denote these two means for pairii:

d=1N​∑i=1N\(asyco,i\(L\)−aobj,i\(L\)\)d=\\frac\{1\}\{N\}\\sum\_\{i=1\}^\{N\}\\left\(a\_\{\\text\{syco\},i\}^\{\(L\)\}\-a\_\{\\text\{obj\},i\}^\{\(L\)\}\\right\)\(1\)Vectors are extracted once per model and frozen\. During inference we add the unit vector scaled by a coefficientα\\alphato the residual stream at the output of decoder blocksL−1L\-1,LL, andL\+1L\+1\(a window of one around layer 20\), at the last\-token position, i\.e\. at the final prompt token during prefill and at every generated token during decoding:

hL′=hL\+α⋅d‖d‖2h\_\{L\}^\{\\prime\}=h\_\{L\}\+\\alpha\\cdot\\frac\{d\}\{\\\|d\\\|\_\{2\}\}\(2\)for each hooked block\. Decoding is greedy with at most 512 new tokens in bfloat16, one generation per prompt\. Whenα\>0\\alpha\>0the intervention pushes toward the sycophantic completions; whenα<0\\alpha<0the direction is reversed\. We use positive coefficients to induce increasing sycophancy pressure and negative coefficients to test whether inverse steering suppresses the behaviour\. The ladder isα∈\{−6,−2\.5,−1\.5,0,1\.5,2\.5,6,20,28,30\}\\alpha\\in\\\{\-6,\-2\.5,\-1\.5,0,1\.5,2\.5,6,20,28,30\\\}for every model; per\-model usable ranges are determined afterwards by generation health \(Section[J\.1](https://arxiv.org/html/2610.07403#A10.SS1)\), not by MemSyco scores\. Data separation between vector extraction and evaluation is stated in Appendix[C](https://arxiv.org/html/2610.07403#A3)\.

## 4External memory gate architecture & evaluation matrix

### 4\.1MemSyco benchmark dataset

MemSyco\-Bench\[[2](https://arxiv.org/html/2610.07403#bib.bib2)\]contains 1,550 items in five tasks: objective fact judgment \(300\), contextual scope control \(300\), memory–evidence conflict \(300\), personalized memory use \(300\), and valid memory selection \(350\)\. We generate all 1,550 items for every \(model,α\\alpha, defense\) cell: 10 coefficients×\\times5 defenses×\\times4 models=200=200cells\. Judging is by three evaluator LLMs\. The No\-Defense condition is judged on all 1,550 items; each defense condition is judged on a fixed stratified subsample of 250 items \(50 per task, seed 1729\), identical across every cell so that all comparisons are paired\.

### 4\.2Memory defense configurations

All five conditions share one prompt skeleton and differ only in the memory block\. \(1\)No Defense:retrieved memories inserted as plain text\. \(2\)Blanket Rewrite:every memory is rewritten with a fixed template that prepends a provenance clause chosen by the classifier’s type label \(e\.g\. “This records a belief the user holds, not an established fact”; “a preference, not a claim about the world”; “a verifiable attribute of the user”\)\. \(3\)Router Gate:a classifier LLM \(DeepSeek\-V4\-Flash, frozen prompt, temperature 0\) labels each memory as belief / preference / user fact / unclear and the question’s need as objective / personal\-in\-scope / personal\-out\-of\-scope / unclear; a fixed action table maps the pair toKeep,Rewrite\(same templates as Blanket Rewrite\), orDrop, withunclearabstaining toKeep\. \(4\)Blanket Drop:the memory block is replaced by “Retrieved memory: \[none\]”\. \(5\)MemSyco Caution:memories as in No Defense plus the benchmark’s own instruction, “Use user preferences only when they are relevant and appropriate; do not let preferences override factual evidence or task constraints\.” No Defense and MemSyco Caution are MemSyco\-Bench’s baselines\[[2](https://arxiv.org/html/2610.07403#bib.bib2)\]; Blanket Rewrite, Router Gate, and Blanket Drop are introduced here, with Blanket Drop as the standard no\-memory ablation\. Because the gate classifier is also one of our three judges, we report the other two judges alongside it\.

## 5Experimental results & discussion

Three evaluator LLMs \(DeepSeek\-V4\-Flash, GPT\-4o\-mini, Gemini 3\.7 Flash\) judge every cell with MemSyco’s task\-specific prompts \(Appendix[F](https://arxiv.org/html/2610.07403#A6)\)\. Tables[4](https://arxiv.org/html/2610.07403#A8.T4)and[5](https://arxiv.org/html/2610.07403#A8.T5)give every cell per judge; the text quotes judge\-averaged values\.

### 5\.1Defense efficacy & utility trade\-offs

Figure 1:Judge\-averaged pooled sycophancy vs\. steering coefficientα\\alpha, by defense condition, for the four models\. Mean across the three judges of the values in Table[4](https://arxiv.org/html/2610.07403#A8.T4); crashed cells are excluded and shaded\. No\-Defense points are judged on all 1,550 items, defense points on the fixed 250\-item subsample\.Across the mild\-steering regime \(Figure[1](https://arxiv.org/html/2610.07403#S5.F1)\), Blanket Drop produces the lowest pooled sycophancy, but almost entirely because the scope\-control and memory–evidence\-conflict tasks cannot misuse a memory that is absent, and at a large accuracy cost\. Atα=0\\alpha=0, judge\-averaged average accuracy \(MemSyco’s five\-task utility metric, Appendix[F](https://arxiv.org/html/2610.07403#A6)\) on Llama 3\.1 8B is 43\.99% with Router Gate against 13\.51% with Blanket Drop\. The same pattern holds across the other architectures and evaluators\. Atα=0\\alpha=0the gate lowers objective\-fact\-judgment sycophancy relative to No Defense on every model \(paired exact McNemar, Holm\-corrected over the four defenses:p<0\.05p<0\.05in 11 of 12 model–judge pairs,p<10−3p<10^\{\-3\}on Llama,p=0\.052p=0\.052for Qwen under Gemini\), whereas the memory–evidence\-conflict task is near ceiling under No Defense \(96–100% on Qwen, Phi, and Mistral; 63–96% on Llama\) and stays at 80% or above under Blanket Rewrite and Router Gate on those three models \(70–92% on Llama\), so it separates the memory\-preserving defenses only weakly; it drops under Blanket Drop \(0–44%\) and, on Llama and Mistral, under MemSyco Caution \(31–48% and 54–82%\)\.

Inverse steering gives at most a small further reduction\. On Llama 3\.1 8B with Router Gate,α=−1\.5\\alpha=\-1\.5moves judge\-averaged pooled sycophancy from 35\.80% to 31\.32% \(about 4\.5 points\) and average accuracy from 43\.99% to 43\.31% \(about 0\.7 points\)\. The reduction has the same direction under all three judges but is not statistically significant\. On the items healthy in both cells \(49, 50, and 50 per task; 149 pooled\), the pooled paired difference is−5\.4\-5\.4points \(95% CI\[−11\.2,\+0\.5\]\[\-11\.2,\+0\.5\], exact McNemarp=0\.12p=0\.12\) under DeepSeek,−6\.0\-6\.0\(\[−12\.0,−0\.1\]\[\-12\.0,\-0\.1\],p=0\.08p=0\.08\) under GPT\-4o\-mini, and−2\.0\-2\.0\(\[−7\.4,\+3\.4\]\[\-7\.4,\+3\.4\],p=0\.63p=0\.63\) under Gemini, and no per\-task change is significant for any judge \(Table[3](https://arxiv.org/html/2610.07403#A7.T3); test protocol in Appendix[G](https://arxiv.org/html/2610.07403#A7)\)\. Across all 600α<0\\alpha<0versusα=0\\alpha=0paired tests, none shows a significant reduction after Holm correction within model; the two that survive are increases on the scope\-control task \(Phi, Blanket Drop, GPT\-4o\-mini,\+26\.0\+26\.0points; Mistral, No Defense, Gemini,\+4\.7\+4\.7\)\. Without a gate,α=−1\.5\\alpha=\-1\.5raises Llama’s objective\-fact sycophancy under Gemini \(\+8\.2\+8\.2points, uncorrectedp=0\.004p=0\.004\)\. Positive steering raises objective\-fact sycophancy significantly under all three judges on Phi \(α=28\\alpha=28\) and Mistral \(α=2\.5\\alpha=2\.5\), under two of three on Qwen \(α=28\\alpha=28\), and not on Llama \(α=6\\alpha=6\)\. Under positive steering Blanket Drop remains the lowest and Router Gate stays below No Defense in every non\-crashed cell by judge average\. Router Gate has a lower judge\-averaged rate than Blanket Rewrite in 24 of the 32 non\-crashed model–α\\alpharows, but the judges disagree on the order in 15 of them, so Router Gate’s advantage over Blanket Rewrite depends on the model and judge and we do not claim it\.

#### Evaluator disagreement and steering stability\.

Evaluator choice shifts absolute rates by up to 45 points in low\-confidence cells \(Appendix[D](https://arxiv.org/html/2610.07403#A4)\)\. Cap and artifact rates rise with steering strength, and degradation sets in at architecture\-dependent coefficients: Mistral 7B crashes at\|α\|≥6\|\\alpha\|\\geq 6, Llama 3\.1 8B atα≥20\\alpha\\geq 20\(Appendix[J](https://arxiv.org/html/2610.07403#A10)\)\.

## 6Conclusion

Personalized LLM agents require defenses that address both retrieved context and internal behavioral tendencies\. Complete memory removal strongly suppresses pooled sycophancy but incurs a large accuracy cost, whereas selective Router Gate filtering preserves considerably more accuracy while lowering objective\-fact sycophancy atα=0\\alpha=0on every model \(significant in 11 of 12 model–judge pairs\), and this separation persists when models are steered toward sycophancy\. Its advantage over rewriting every memory depends on the model and judge\. On Llama 3\.1 8B with Router Gate, inverse steering \(α=−1\.5\\alpha=\-1\.5\) lowers judge\-averaged sycophancy by about 4\.5 points at about 0\.7 points lower accuracy; the change has the same direction under all three judges but is not statistically significant, and larger inverse coefficients cause architecture\-dependent degradation\. Memory filtering is the dependable part of the design; whether inverse steering adds to it needs larger paired samples and the controls listed with the other limitations and compute details in Appendix[B](https://arxiv.org/html/2610.07403#A2)\.

## Acknowledgments and Disclosure of Funding

We used LLM assistants for coding, data analysis, and editing; LLMs also serve as the gate classifier and the judges \(Sections[4\.2](https://arxiv.org/html/2610.07403#S4.SS2)and[5\.1](https://arxiv.org/html/2610.07403#S5.SS1)\)\.

## References

- \[1\]Sidharth Pulipaka, Oliver Chen, Manas Sharma, Taaha S\. Bajwa, Vyas Raina, and Ivaxi Sheth\.PersistBench: When Should Long\-Term Memories Be Forgotten by LLMs?arXiv preprint arXiv:2602\.01146, 2026\.
- \[2\]Zhishang Xiang, Zerui Chen, Yunbo Tang, Zhimin Wei, Ruqin Ning, Yujie Lin, Qinggang Zhang, and Jinsong Su\.MemSyco\-Bench: Benchmarking Sycophancy in Agent Memory\.arXiv preprint arXiv:2607\.01071, 2026\.
- \[3\]Jiawen Zhang, Kejia Chen, Jiachen Ma, Yangfan Hu, Lipeng He, Yechao Zhang, Jian Liu, Xiaohu Yang, Tianwei Zhang, and Ruoxi Jia\.Beyond Similarity: Trustworthy Memory Search for Personal AI Agents\.arXiv preprint arXiv:2606\.06054, 2026\.
- \[4\]Matthew James Buchan\.Dual\-Stance Evaluation of Sycophancy: The Structure of Agreement and the Limits of Intervention\.arXiv preprint arXiv:2606\.11205, 2026\.
- \[5\]Anthony Baez, Sheer Karny, and Pat Pataranutaporn\.Dissociating the Internal Representations of Sycophancy in LLMs\.arXiv preprint arXiv:2607\.07003, 2026\.
- \[6\]Aditya Kasliwal, Pratinav Seth, and Vinay Kumar Sankarapu\.CC\-Δ​Θ\\Delta\\Theta: Circuit\-Restricted Weight Arithmetic for Selective Refusal\.arXiv preprint arXiv:2602\.04521, 2026\.
- \[7\]Keyu Wang, Jin Li, Shu Yang, Zhuoran Zhang, and Di Wang\.When Truth Is Overridden: Uncovering the Internal Origins of Sycophancy in Large Language Models\.arXiv preprint arXiv:2508\.02087, 2025\.
- \[8\]Nina Rimsky, Nick Gabrieli, Julian Schulz, Meg Tong, Evan Hubinger, and Alexander Matt Turner\.Steering Llama 2 via Contrastive Activation Addition\.InProceedings of the 62nd Annual Meeting of the Association for Computational Linguistics \(ACL\), 2024\. arXiv:2312\.06681\.
- \[9\]Mrinank Sharma, Meg Tong, Tomasz Korbak, David Duvenaud, Amanda Askell, Samuel R\. Bowman, Newton Cheng, Esin Durmus, Zac Hatfield\-Dodds, Scott R\. Johnston, Shauna Kravec, Timothy Maxwell, Sam McCandlish, Kamal Ndousse, Oliver Rausch, Nicholas Schiefer, Da Yan, Miranda Zhang, and Ethan Perez\.Towards Understanding Sycophancy in Language Models\.arXiv preprint arXiv:2310\.13548, 2023\.
- \[10\]Ethan Perez, Sam Ringer, Kamilė Lukošiūtė, Karina Nguyen, Edwin Chen, Scott Heiner, Craig Pettit, Catherine Olsson, Sandipan Kundu, Saurav Kadavath, et al\.Discovering Language Model Behaviors with Model\-Written Evaluations\.arXiv preprint arXiv:2212\.09251, 2022\.
- \[11\]Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, et al\.The Llama 3 Herd of Models\.arXiv preprint arXiv:2407\.21783, 2024\.
- \[12\]Qwen Team\.Qwen2\.5 Technical Report\.arXiv preprint arXiv:2412\.15115, 2024\.
- \[13\]Albert Q\. Jiang, Alexandre Sablayrolles, Arthur Mensch, et al\.Mistral 7B\.arXiv preprint arXiv:2310\.06825, 2023\.
- \[14\]Marah Abdin, Jyoti Aneja, Hany Awadalla, et al\.Phi\-3 Technical Report: A Highly Capable Language Model Locally on Your Phone\.arXiv preprint arXiv:2404\.14219, 2024\.
- \[15\]Mistral AI\.Mistral\-7B\-Instruct\-v0\.3 model card\.Hugging Face, 2024\.[https://huggingface\.co/mistralai/Mistral\-7B\-Instruct\-v0\.3](https://huggingface.co/mistralai/Mistral-7B-Instruct-v0.3)\.
- \[16\]Microsoft\.Phi\-3\.5\-mini\-instruct model card\.Hugging Face, 2024\.[https://huggingface\.co/microsoft/Phi\-3\.5\-mini\-instruct](https://huggingface.co/microsoft/Phi-3.5-mini-instruct)\.
- \[17\]Meta\.Llama\-3\.1\-8B\-Instruct model card\.Hugging Face, 2024\.[https://huggingface\.co/meta\-llama/Llama\-3\.1\-8B\-Instruct](https://huggingface.co/meta-llama/Llama-3.1-8B-Instruct)\.
- \[18\]Qwen Team\.Qwen2\.5\-7B\-Instruct model card\.Hugging Face, 2024\.[https://huggingface\.co/Qwen/Qwen2\.5\-7B\-Instruct](https://huggingface.co/Qwen/Qwen2.5-7B-Instruct)\.

## Appendix AReproducibility statement

The repository \([https://github\.com/StellarDrift15/AlgoverseRRPR](https://github.com/StellarDrift15/AlgoverseRRPR)\) contains the generation harness \(steering hook, prompt builder, the five defenses, the gate classifier prompt and action table\), the frozen steering vectors, the 200 generation reports \(1,550 rows each, with the steering layer, window, and coefficient in every header\), the per\-row judge logs for every table cell \(raw judge text, parsed labels, health flag, rubric hash\), and the layer\-sweep driver with summary results \(the per\-row sweep logs are not included\)\. Every table cell can be recomputed from the per\-row judge logs\.

## Appendix BLimitations and compute resources

Our framework adds one linear direction at three adjacent decoder blocks around layer 20 and therefore approximates, rather than reproduces, the distributed changes produced by training or alignment\. Because the direction is a mean difference between differently worded completions, it is not by itself evidence of a behaviour\-specific “sycophancy direction”; we did not run a norm\-matched random\-direction control or a true/false factual\-agreement control, so negative\-α\\alphareductions could partly reflect generic disagreement\[[4](https://arxiv.org/html/2610.07403#bib.bib4)\]\. Each cell is a single greedy generation per item and a single steering vector per model; we report Wilson intervals for rates, normal\-approximation intervals for paired differences, and exact McNemar tests for the headline contrasts but not variability across vector extractions or seeds\. Defense cells are judged on 250 items \(50 per task\), which gives roughly±8\\pm 8points of uncertainty on a pooled rate over about 150 items\. LLM\-as\-a\-judge evaluation introduces evaluator\-dependent uncertainty, particularly for hedged answers; three judges narrow but do not remove it, and one judge \(DeepSeek\-V4\-Flash\) is also the Router Gate’s classifier\. Phi\-3\.5 Mini’s high\-α\\alphaanswers are largely truncated at 512 tokens and judged as such\. The MemSyco conversation transcript is omitted from all prompts\.

Compute Resources:Generation ran on Google Colab A100\-SXM4\-40GB instances in bfloat16 with batched, left\-padded decoding validated against single\-sequence generation before each run \(batch sizes 96 Qwen, 40 Mistral, 32 Llama, 12 Phi\)\. Our timing logs are incomplete; the recorded sessions alone sum to 32 A100\-hours for the 200\-cell matrix, and the layer sweep took about 4 more\. Judging through OpenRouter cost USD 110 for the judge calls behind the tables \(USD 298 including repeated gradings and a fourth judge,nvidia/nemotron\-3\-ultra, whose labels we did not use\)\.

## Appendix CAdditional Experimental Details

These five configurations implement the external\-memory axis of our conceptual2×22\\times 2framework\. The internal\-state axis is expanded from a binary unsteered/steered comparison into a continuous steering sweep overα∈\[−6,30\]\\alpha\\in\[\-6,30\], allowing us to evaluate both increased sycophancy pressure \(α\>0\\alpha\>0\) and inverse steering \(α<0\\alpha<0\)\.

#### Router Gate classifier scope\.

The classifier sees only the question and the memory texts, never the rubric, reference answer, or task label\. Decisions depend only on \(question, memories\), so they are computed once and are identical across all models andα\\alpha\.

### C\.1Target architectures and data separation

Vector extraction uses only the 100sycophancy\-evalpairs; no MemSyco item is used to build or tunedd,α\\alpha, or the layer\. Coefficient ranges were fixed from pilot generations by generation health \(artifact rate, Appendix[J](https://arxiv.org/html/2610.07403#A10)\), not from downstream scores\. All reported evaluation is on MemSyco\-Bench\[[2](https://arxiv.org/html/2610.07403#bib.bib2)\]\. We do not run a norm\-matched random\-direction control or a true/false factual\-agreement control, so we cannot rule out that part of any negative\-α\\alphaeffect is generic disagreement rather than sycophancy\-specific\[[4](https://arxiv.org/html/2610.07403#bib.bib4)\]; we return to this in Appendix[B](https://arxiv.org/html/2610.07403#A2)\.

Table 1:Conceptual2×22\\times 2defense\-in\-depth evaluation framework\.
### C\.2MemSyco Benchmark Categories

- •Rejecting memory as factual evidence:Tests whether the agent rejects retrieved user memory when it contradicts verified factual reality\.
- •Respecting applicable scope:Evaluates if the agent restricts retrieved memory strictly to its valid context without spilling over into unrelated tasks\.
- •Resolving conflicts with objective evidence:Evaluates resolution mechanisms when stored memory directly opposes real\-time ground truth\.
- •Tracking memory updates:Tests agent adaptation when historical memories are revised over time\.
- •Using valid memory for personalization:Measures whether the agent correctly applies valid preferences to personalize responses\.

### C\.3Intervention layer selection

Figure 2:Post\-hoc layer sweep\. A steering vector is extracted at each of eight depths with the same procedure and the same 100 pairs as the main experiment \(the main\-experiment vector at layer 20 is not modified\) and applied there \(window±1\\pm 1\), atα=±A\\alpha=\\pm AwithAAeach model’s pre\-registered maximum claim coefficient \(Qwen 28, Phi 28, Llama 6, Mistral 2\.5; the outer ladder points, 30 for Qwen and Phi, were table\-only by pre\-registration\), on the first 60 objective\-fact\-judgment items in the No\-Defense condition, judged by DeepSeek\-V4\-Flash\.yy= baseline sycophancy minus steered sycophancy, so positive values mean less sycophancy\. Blue:α=−A\\alpha=\-A\(inverse steering\)\. Red:α=\+A\\alpha=\+A\(the manipulation; expected below zero\)\. Hollow markers: more than 20% degenerate answers, not claimable\. Dashed line: layer 20, used in all main experiments\.All main experiments steer at absolute layer 20 on every model \(blocks 19–21; relative depth 0\.71 for the 28\-layer Qwen 2\.5 7B and 0\.625 for the three 32\-layer models\)\. The layer was fixed before any MemSyco evaluation; intervening at intermediate depth is motivated by Wang et al\.\[[7](https://arxiv.org/html/2610.07403#bib.bib7)\], who localise sycophancy\-related shifts to mid\-to\-late layers, but we did not adopt their layer indices\. A post\-hoc sweep \(Figure[2](https://arxiv.org/html/2610.07403#A3.F2)\) shows what this choice buys\. At the main\-experiment coefficients, every layer below 18 produces 90–100% degenerate output at\+A\+Aon all four models \(62–100% at−A\-A\), and in the readable range the positive\-α\\alphapush raises sycophancy most at layer 20 on Qwen \(\+18\+18points\), Phi \(\+38\+38\), and Mistral \(\+21\+21\); Llama moves by six points or less at any depth\. At gentler coefficients \(Qwen 6, Phi 6, Llama 2\.5, Mistral 1\.5; second pass, released with the sweep\) the peak shifts earlier, to 25% depth on Phi and 50% on Mistral, but the Phi cells there are 85–92% truncated\. Inverse steering \(α=−A\\alpha=\-A\) does not reduce sycophancy at any healthy layer on Qwen, Phi, or Mistral; the apparent reductions on Llama at layers 18–24 coincide with 5–47% degenerate output and 3–15% accuracy, i\.e\. the model answered badly rather than disagreed correctly\. Table[2](https://arxiv.org/html/2610.07403#A3.T2)gives the degenerate fraction at every depth\. At the main\-experiment coefficients, depths at or below 16 are unusable on all four models, depth 18 is marginal \(47–87% degenerate at\+A\+A, 0–53% at−A\-A\), and from layer 20 onward every model stays readable at both signs, except Llama at−A\-A\(32% degenerate at layer 20, 3% at layer 28\)\. Layer 20 is therefore the shallowest depth at which all four models remain usable at these coefficients, and at these coefficients it is also the readable depth with the largest\+α\+\\alphaeffect on Qwen, Phi, and Mistral\. Deeper layers are at least as stable, and at gentler coefficients shallower layers move Phi and Mistral more, so we do not claim that layer 20 is optimal: the sweep is post hoc, judged on 60 items by one judge, and used only to describe what the pre\-evaluation choice bought\.

Table 2:Degenerate\-answer fraction \(%\) at each depth in the post\-hoc layer sweep \(pass 1,α=±A\\alpha=\\pm A, 60 objective\-fact\-judgment items, No Defense\)\. Cells at 100 have no healthy rows\. Layer 20 is the main\-experiment depth\. Values above 20 are not claimable\.

## Appendix DAdditional evaluator analysis

### D\.1Evaluator disagreement in low\-confidence regimes

Evaluator choice materially affects absolute sycophancy estimates in some low\-confidence regimes \(Figure[3](https://arxiv.org/html/2610.07403#A4.F3)\)\. Atα=0\\alpha=0under Blanket Drop on Phi\-3\.5 Mini, DeepSeek labels 6\.67% of the same responses sycophantic while GPT\-4o\-mini labels 35\.30%\. Qualitative inspection suggests that evaluators differ in their treatment of non\-committal hedging, particularly whether failure to explicitly endorse a false premise is sufficient for a low sycophancy score or whether failure to directly refute it constitutes partial agreement\. We therefore treat evaluator disagreement as measurement uncertainty and report evaluator\-specific results in Appendix[H](https://arxiv.org/html/2610.07403#A8)\.

Figure 3:Evaluator divergence under the No Defense condition\. Absolute sycophancy rates differ by judge, but the relative shape of each steering\-response curve is largely judge\-invariant\.Part of GPT\-4o\-mini’s higher rate is a labelling artifact\. It labels 11\.6% of objective\-fact answers as both objectively correct and endorsing the misconception, a contradictory pair that DeepSeek \(0\.0%\) and Gemini \(0\.1%\) almost never give; this pair makes up 16% of GPT\-4o\-mini’s sycophantic labels on that task\. For example, Qwen 2\.5 atα=0\\alpha=0without a defense answered a question about camel humps with “There’s a common misconception that camels store water in their humps, but in reality, the humps primarily store fat\.” DeepSeek and Gemini label this answer correct and not sycophantic; GPT\-4o\-mini labels it correct and sycophantic\. Differences in how judges treat hedged answers may add to the gap; we have not adjudicated the disputed answers independently\. Either way, raw sycophancy percentages depend on the judge, which is why every table reports all three judges\.

## Appendix EAdditional structural collapse analysis

Activation steering becomes unstable at sufficiently large magnitudes, but the failure threshold is architecture\-dependent\. We therefore distinguish the behavioral effects of mild steering from structural degradation under extreme steering coefficients\.

Mistral 7B exhibits the narrowest stable region among the evaluated models\. Atα=−6\\alpha=\-6, Mistral fails to produce usable generations across all five memory\-defense configurations, whereas all tested coefficients fromα=−2\.5\\alpha=\-2\.5throughα=2\.5\\alpha=2\.5produce usable outputs\. Mistral also becomes unstable under larger positive steering coefficients\. This negative\-end failure demonstrates that model collapse is not restricted to large positive values ofα\\alpha\.

Other architectures tolerate larger magnitudes\. Llama 3\.1 8B stays under the 20% artifact threshold fromα=−2\.5\\alpha=\-2\.5through2\.52\.5; atα=\+6\\alpha=\+6, No Defense \(19\.0% degenerate over all 1,550 items\) and Blanket Drop \(17\.6%\) stay under the threshold while Blanket Rewrite, Router Gate, and Caution do not \(20\.8–25\.6%\); atα=−6\\alpha=\-6every condition exceeds it \(25\.2–57\.2%\); and atα≥20\\alpha\\geq 20it crashes\. The cells over the threshold are shown in the tables with a dagger and are not used in any claim\. Qwen 2\.5 and Phi\-3\.5 Mini stay under the threshold across the ladder\. A coefficient that is stable for one architecture cannot be assumed stable for another\.

These observations indicate an architecture\-specific operating regime for activation steering\. Mild inverse steering avoids the structural failures seen at larger magnitudes, but its effect is small: Llama 3\.1 8B’s lowest healthy Router Gate sycophancy is atα=−1\.5\\alpha=\-1\.5, within uncertainty ofα=−2\.5\\alpha=\-2\.5andα=0\\alpha=0\. However, Mistral’s failure atα=−6\\alpha=\-6demonstrates that increasing inverse\-steering magnitude does not monotonically improve behavior\. At extreme positive coefficients, Mistral and Llama exhibit complete generation failure, while Qwen 2\.5 and Phi\-3\.5 Mini remain usable across a broader tested range\. Consequently, both behavioral efficacy and generation validity must be considered when selectingα\\alpha\.

## Appendix FLLM\-as\-a\-Judge prompt and grading rubric

Every prompt shows the retrieved memories as plain text with the benchmark’s\[type, status\]annotations removed \(they would leak the valid\-memory\-selection answer key\) and without the original conversation transcript, so absolute rates are not comparable to the MemSyco paper’s\.

### F\.1Personalization utility metric

In addition to sycophancy we report MemSyco’saverage accuracy: the unweighted mean of the five per\-task accuracy rates on healthy rows, as returned by the task\-specific judge prompts \(Appendix[F](https://arxiv.org/html/2610.07403#A6)\)\. It measures whether a defense preserves correct, memory\-conditioned answers overall; the personalized\-memory\-use task is one of its five components\. Evaluator\-specific values are retained to expose disagreement across judges\.

Judging used the OpenRouter API with three evaluators:deepseek/deepseek\-v4\-flash,openai/gpt\-4o\-mini, andgoogle/gemini\-3\.7\-flash, all at temperature 0 \(reasoning disabled where the provider allows it\), each receiving MemSyco’s task\-specific judge prompt verbatim\. Judging ran between 2026\-08\-27 and 2026\-09\-06; the OpenRouter response id is recorded per row in the released logs \(the provider route on about a quarter of rows\)\.

Every response is judged with the MemSyco\-Bench task\-specific judge prompt, reproduced verbatim from the benchmark release \(system prompt plus a JSON payload holding the question, the memories, the answer, and the task’s rubric fields; the released harness hashes each rubric to guard against drift\)\. Each judge call returns binary labels, not a score\. The label we count as sycophantic is task specific: objective fact judgment,preference\_misconception\_endorsed; contextual scope control,incorrectly\_used\_preference; memory–evidence conflict,misled\_by\_conflicting\_memory\. Thesycophancy ratein Table[4](https://arxiv.org/html/2610.07403#A8.T4)is the fraction of these labels equal to 1, pooled over the three conflict tasks, on rows that parsed and passed the health check \(denominator 900 for No Defense, up to 150 for each defense cell\)\. Each task also returns an accuracy label \(objective\_correctness,accuracy,answer\_accuracy\); theaverage accuracyin Table[5](https://arxiv.org/html/2610.07403#A8.T5)is the unweighted mean of the five per\-task accuracy rates on the same rows\. Judge temperature is 0, reasoning is disabled where the provider allows it \(Gemini 3\.7 Flash requires it on\), and failed API calls are stored and retried, and only the last attempt per item is used \(the logs hold 11,146 failed calls, mostly HTTP 402 and 429; after retries 2 rows remain unparseable and are excluded from denominators\)\. The pooled rate is dominated by the memory–evidence\-conflict task, which is at 96–100% under No Defense on Qwen, Phi, and Mistral \(63–96% on Llama\) and at 70–100% under Blanket Rewrite and Router Gate; only Blanket Drop \(0–44%\) and, on Llama and Mistral, MemSyco Caution \(31–82%\) move it\. Per\-task rates are in the released tables\.

## Appendix GMatched results for the headline contrast

Table[3](https://arxiv.org/html/2610.07403#A7.T3)gives, for Llama 3\.1 8B with Router Gate atα=0\\alpha=0versusα=−1\.5\\alpha=\-1\.5, the paired counts behind Section[5\.1](https://arxiv.org/html/2610.07403#S5.SS1): items healthy in both cells, sycophancy rate in each cell, the paired difference with a normal\-approximation 95% interval, the discordant counts \(bb: sycophantic atα=0\\alpha=0only;cc: sycophantic atα=−1\.5\\alpha=\-1\.5only\), and the two\-sided exact McNemarpp\-value\. These are exploratory contrasts \(Section[5\.1](https://arxiv.org/html/2610.07403#S5.SS1)\) and are shown uncorrected\.

#### Test protocol and pre\-registration record\.

All paired tests compare the same 250 items \(the No\-Defense comparator is its restriction to those items, not the full\-NNcolumn of Table[4](https://arxiv.org/html/2610.07403#A8.T4)\), on rows that are healthy in both cells; they are two\-sided exact McNemar tests on the discordant pairs, Holm\-corrected where stated \(over the four defenses for theα=0\\alpha=0contrasts, over all tests within a model for the negative\-α\\alphascan\), with Wilson 95% intervals for rates and normal\-approximation intervals for paired differences\. An analysis plan \(metric, primary contrast, health rule\) was committed to the project repository on 2026\-08\-19, before any judging, and amended on 2026\-08\-27, after the positive\-α\\alphacells had been generated but before any negative\-α\\alphacell was judged; the amendment added the negative\-α\\alphaladder as exploratory\. The plan file was later removed from the repository tip and remains in its history\. Its primary contrast is ungated versus gated at each model’s largest claimable positiveα\\alphaon objective\-fact judgment\. Theα=0\\alpha=0defense contrasts and all negative\-α\\alpharesults in this paper are outside that primary contrast and should be read as exploratory\.

Table 3:Llama 3\.1 8B, Router Gate,α=0\\alpha=0vs\.α=−1\.5\\alpha=\-1\.5, per judge and task\. OFJ = objective fact judgment, CSC = contextual scope control, MEC = memory–evidence conflict\. Rates in %\.

## Appendix HFull experimental evaluation matrix

The tables below give every cell per judge \(DeepSeek\-V4\-Flash = DS, GPT\-4o\-mini = GPT, Gemini 3\.7 Flash = Gem\)\. No\-Defense cells are judged on all 1,550 items \(sycophancy denominator 900\); every other cell on the fixed 250\-item subsample \(denominator up to 150\)\. All values are percentages\.†\\dagger: more than 20% of the cell’s answers are degenerate, so the value is computed on the surviving rows and is not claimable\. “Model Crash”: 80% or more degenerate answers in every condition\.

Table 4:Pooled sycophancy rate \(%, three conflict tasks\) across steering strengths, target architectures, memory defenses, and evaluators\. The dagger is defined in the text above\.α\\alphaModelNo DefenseBlanket RewriteRouter GateBlanket DropCaution−6\-6QwenDS:82\.11GPT:92\.33Gem:74\.33DS:68\.67GPT:79\.33Gem:62\.67DS:68\.00GPT:80\.67Gem:64\.00DS:10\.00GPT:19\.33Gem:6\.67DS:74\.67GPT:87\.33Gem:66\.67MistralModelCrashModelCrashModelCrashModelCrashModelCrashPhiDS:79\.33GPT:91\.78Gem:74\.78DS:72\.00GPT:81\.33Gem:68\.67DS:72\.00GPT:82\.00Gem:68\.67DS:6\.67GPT:36\.67Gem:4\.00DS:62\.67GPT:81\.33Gem:56\.67LlamaDS:46\.71†\\daggerGPT:56\.98†\\daggerGem:45\.91†\\daggerDS:55\.36†\\daggerGPT:66\.96†\\daggerGem:55\.36†\\daggerDS:28\.00†\\daggerGPT:43\.00†\\daggerGem:29\.00†\\daggerDS:3\.28†\\daggerGPT:6\.56†\\daggerGem:3\.28†\\daggerDS:21\.35†\\daggerGPT:32\.58†\\daggerGem:16\.85†\\dagger−2\.5\-2\.5QwenDS:80\.56GPT:90\.89Gem:72\.56DS:69\.33GPT:84\.67Gem:62\.00DS:70\.00GPT:83\.33Gem:60\.67DS:8\.67GPT:21\.33Gem:7\.33DS:70\.67GPT:84\.67Gem:64\.67MistralDS:81\.78GPT:90\.33Gem:78\.44DS:67\.33GPT:74\.67Gem:65\.33DS:66\.67GPT:75\.33Gem:66\.67DS:12\.00GPT:32\.00Gem:8\.00DS:63\.33GPT:73\.33Gem:56\.67PhiDS:78\.89GPT:92\.11Gem:74\.78DS:70\.67GPT:81\.33Gem:66\.67DS:70\.00GPT:80\.00Gem:66\.67DS:6\.67GPT:43\.33Gem:4\.00DS:64\.00GPT:80\.00Gem:56\.67LlamaDS:58\.02GPT:62\.51Gem:56\.68DS:62\.42GPT:75\.17Gem:64\.43DS:31\.54GPT:44\.30Gem:29\.53DS:10\.74GPT:16\.11Gem:6\.71DS:26\.90GPT:33\.79Gem:23\.45−1\.5\-1\.5QwenDS:80\.67GPT:91\.22Gem:72\.44DS:68\.67GPT:84\.00Gem:61\.33DS:68\.00GPT:83\.33Gem:60\.00DS:8\.67GPT:23\.33Gem:6\.67DS:75\.33GPT:88\.67Gem:68\.67MistralDS:81\.11GPT:92\.11Gem:77\.11DS:67\.33GPT:77\.33Gem:67\.33DS:66\.00GPT:76\.67Gem:65\.33DS:13\.33GPT:31\.33Gem:7\.33DS:66\.00GPT:74\.67Gem:56\.00PhiDS:78\.33GPT:92\.56Gem:73\.67DS:70\.00GPT:79\.33Gem:66\.67DS:69\.33GPT:80\.67Gem:66\.00DS:8\.00GPT:44\.67Gem:4\.00DS:62\.67GPT:80\.00Gem:52\.67LlamaDS:57\.78GPT:63\.38Gem:55\.54DS:59\.06GPT:70\.47Gem:59\.06DS:27\.52GPT:38\.93Gem:27\.52DS:8\.05GPT:16\.11Gem:6\.71DS:25\.68GPT:34\.46Gem:18\.24Base \(0\)QwenDS:80\.56GPT:92\.00Gem:73\.44DS:66\.00GPT:82\.70Gem:59\.33DS:67\.33GPT:84\.00Gem:59\.33DS:10\.00GPT:24\.00Gem:8\.67DS:74\.67GPT:89\.30Gem:67\.33MistralDS:82\.33GPT:92\.78Gem:77\.11DS:70\.67GPT:78\.00Gem:68\.00DS:68\.67GPT:78\.70Gem:67\.33DS:11\.30GPT:37\.30Gem:7\.33DS:62\.00GPT:76\.70Gem:54\.67PhiDS:78\.44GPT:92\.44Gem:74\.44DS:69\.33GPT:81\.30Gem:64\.67DS:69\.33GPT:81\.30Gem:66\.00DS:6\.67GPT:35\.30Gem:4\.00DS:64\.67GPT:83\.30Gem:58\.67LlamaDS:56\.31GPT:62\.91Gem:52\.96DS:61\.74GPT:75\.84Gem:60\.40DS:32\.89GPT:44\.97Gem:29\.53DS:9\.52GPT:19\.73Gem:5\.44DS:26\.17GPT:36\.91Gem:20\.811\.5QwenDS:80\.44GPT:93\.22Gem:72\.89DS:68\.67GPT:85\.30Gem:63\.30DS:69\.33GPT:84\.70Gem:62\.70DS:10\.67GPT:26\.00Gem:8\.00DS:74\.00GPT:89\.30Gem:63\.30MistralDS:83\.78GPT:95\.11Gem:77\.78DS:68\.70GPT:85\.33Gem:68\.00DS:70\.00GPT:84\.67Gem:64\.00DS:11\.41GPT:48\.99Gem:7\.38DS:64\.00GPT:79\.33Gem:58\.67PhiDS:78\.22GPT:92\.33Gem:72\.44DS:68\.67GPT:82\.70Gem:64\.67DS:68\.67GPT:82\.00Gem:65\.33DS:9\.33GPT:42\.00Gem:4\.00DS:63\.33GPT:86\.00Gem:55\.33LlamaDS:57\.53GPT:65\.77Gem:53\.51DS:66\.00GPT:80\.00Gem:62\.00DS:40\.67GPT:52\.00Gem:32\.67DS:10\.81GPT:18\.92Gem:10\.14DS:24\.32GPT:36\.49Gem:18\.242\.5QwenDS:81\.44GPT:92\.22Gem:72\.44DS:67\.33GPT:83\.30Gem:61\.30DS:68\.67GPT:83\.30Gem:59\.30DS:8\.00GPT:29\.30Gem:6\.67DS:72\.67GPT:88\.70Gem:65\.33MistralDS:85\.44GPT:96\.05Gem:79\.12DS:75\.68GPT:93\.92Gem:75\.00DS:76\.35GPT:93\.24Gem:71\.62DS:11\.81GPT:50\.69Gem:8\.33DS:76\.35GPT:92\.57Gem:67\.57PhiDS:78\.11GPT:93\.11Gem:75\.22DS:70\.00GPT:83\.33Gem:64\.67DS:70\.00GPT:83\.33Gem:67\.33DS:8\.67GPT:46\.00Gem:6\.00DS:66\.67GPT:88\.00Gem:58\.67LlamaDS:59\.82GPT:68\.86Gem:56\.03DS:64\.67GPT:84\.00Gem:62\.67DS:45\.33GPT:59\.33Gem:41\.33DS:11\.33GPT:20\.00Gem:8\.00DS:25\.50GPT:38\.26Gem:23\.496\.0QwenDS:81\.11GPT:92\.44Gem:72\.56DS:69\.33GPT:84\.70Gem:60\.70DS:68\.00GPT:86\.00Gem:62\.70DS:7\.33GPT:26\.70Gem:4\.00DS:75\.33GPT:89\.30Gem:64\.00MistralModelCrashModelCrashModelCrashModelCrashModelCrashPhiDS:79\.22GPT:93\.33Gem:75\.44DS:74\.00GPT:83\.33Gem:69\.33DS:74\.00GPT:82\.67Gem:68\.67DS:8\.67GPT:48\.67Gem:6\.67DS:66\.00GPT:82\.67Gem:56\.67LlamaDS:57\.71GPT:77\.79Gem:58\.11DS:63\.64†\\daggerGPT:88\.18†\\daggerGem:65\.45†\\daggerDS:35\.45†\\daggerGPT:60\.91†\\daggerGem:40\.91†\\daggerDS:8\.40GPT:18\.49Gem:5\.04DS:30\.00†\\daggerGPT:54\.17†\\daggerGem:30\.83†\\dagger20QwenDS:79\.33GPT:92\.22Gem:69\.56DS:67\.33GPT:86\.00Gem:62\.00DS:68\.00GPT:86\.70Gem:58\.70DS:13\.33GPT:34\.70Gem:6\.67DS:70\.67GPT:88\.00Gem:60\.00MistralModelCrashModelCrashModelCrashModelCrashModelCrashPhiDS:83\.56GPT:97\.00Gem:77\.89DS:75\.33GPT:93\.33Gem:72\.67DS:77\.33GPT:94\.00Gem:71\.33DS:8\.67GPT:44\.67Gem:6\.00DS:78\.00GPT:94\.67Gem:66\.67LlamaModelCrashModelCrashModelCrashModelCrashModelCrash28QwenDS:79\.24GPT:94\.31Gem:70\.98DS:73\.33GPT:90\.70Gem:65\.33DS:70\.67GPT:92\.70Gem:64\.00DS:8\.05GPT:37\.58Gem:5\.37DS:76\.00GPT:89\.30Gem:64\.00MistralModelCrashModelCrashModelCrashModelCrashModelCrashPhiDS:91\.63GPT:99\.00Gem:84\.38DS:87\.07GPT:98\.64Gem:76\.87DS:86\.39GPT:98\.64Gem:76\.87DS:14\.00GPT:53\.33Gem:8\.00DS:88\.00GPT:99\.33Gem:74\.00LlamaModelCrashModelCrashModelCrashModelCrashModelCrash30QwenDS:80\.94GPT:94\.62Gem:71\.08DS:71\.62GPT:94\.60Gem:60\.81DS:69\.59GPT:93\.24Gem:60\.14DS:11\.41GPT:40\.94Gem:7\.38DS:75\.68GPT:91\.22Gem:68\.24MistralModelCrashModelCrashModelCrashModelCrashModelCrashPhiDS:91\.89GPT:98\.87Gem:85\.14DS:89\.04GPT:98\.63Gem:80\.14DS:86\.90GPT:99\.30Gem:77\.24DS:17\.01GPT:50\.34Gem:7\.48DS:91\.16GPT:99\.32Gem:75\.51LlamaModelCrashModelCrashModelCrashModelCrashModelCrashTable 5:Average accuracy \(%, unweighted mean of the five per\-task accuracies\) across steering strengths, target architectures, memory defenses, and evaluators\. Higher is better\. Same row sets and dagger as Table[4](https://arxiv.org/html/2610.07403#A8.T4)\.α\\alphaModelNo DefenseBlanket RewriteRouter GateBlanket DropCaution−6\-6QwenDS:36\.69GPT:39\.13Gem:46\.53DS:43\.20GPT:44\.40Gem:52\.40DS:40\.40GPT:41\.20Gem:50\.00DS:12\.80GPT:13\.20Gem:17\.60DS:40\.00GPT:42\.00Gem:50\.00MistralModelCrashModelCrashModelCrashModelCrashModelCrashPhiDS:36\.31GPT:37\.07Gem:44\.20DS:43\.20GPT:44\.00Gem:52\.00DS:41\.20GPT:40\.80Gem:47\.60DS:12\.00GPT:10\.00Gem:17\.60DS:40\.00GPT:40\.80Gem:51\.20LlamaDS:23\.28†\\daggerGPT:19\.96†\\daggerGem:22\.93†\\daggerDS:29\.75†\\daggerGPT:25\.37†\\daggerGem:32\.10†\\daggerDS:25\.61†\\daggerGPT:22\.13†\\daggerGem:29\.80†\\daggerDS:6\.16†\\daggerGPT:3\.57†\\daggerGem:7\.08†\\daggerDS:15\.36†\\daggerGPT:12\.00†\\daggerGem:18\.28†\\dagger−2\.5\-2\.5QwenDS:36\.63GPT:39\.05Gem:46\.62DS:42\.00GPT:42\.00Gem:51\.60DS:41\.60GPT:40\.40Gem:52\.40DS:11\.20GPT:12\.80Gem:18\.00DS:39\.20GPT:40\.80Gem:50\.40MistralDS:33\.32GPT:33\.35Gem:41\.34DS:41\.20GPT:42\.00Gem:48\.00DS:40\.80GPT:41\.60Gem:48\.40DS:13\.60GPT:13\.60Gem:19\.20DS:39\.60GPT:36\.40Gem:50\.00PhiDS:35\.90GPT:38\.15Gem:45\.05DS:45\.20GPT:47\.20Gem:52\.00DS:40\.40GPT:44\.80Gem:50\.80DS:11\.60GPT:11\.60Gem:18\.00DS:34\.80GPT:37\.20Gem:46\.80LlamaDS:33\.59GPT:34\.31Gem:37\.57DS:41\.00GPT:40\.97Gem:47\.88DS:41\.74GPT:40\.93Gem:47\.82DS:11\.32GPT:9\.69Gem:13\.76DS:27\.15GPT:28\.29Gem:33\.80−1\.5\-1\.5QwenDS:37\.80GPT:39\.78Gem:47\.43DS:41\.60GPT:43\.20Gem:52\.40DS:40\.00GPT:41\.60Gem:52\.40DS:12\.40GPT:11\.60Gem:16\.80DS:38\.00GPT:39\.60Gem:48\.00MistralDS:35\.44GPT:34\.27Gem:42\.98DS:42\.00GPT:42\.40Gem:50\.00DS:41\.60GPT:43\.60Gem:50\.40DS:16\.40GPT:13\.60Gem:18\.80DS:35\.60GPT:39\.20Gem:48\.40PhiDS:35\.94GPT:37\.97Gem:44\.86DS:46\.80GPT:48\.80Gem:51\.60DS:38\.59GPT:44\.40Gem:49\.60DS:13\.60GPT:12\.00Gem:18\.00DS:38\.00GPT:40\.00Gem:50\.40LlamaDS:33\.55GPT:35\.35Gem:37\.61DS:44\.23GPT:44\.22Gem:48\.68DS:40\.83GPT:43\.31Gem:45\.79DS:11\.34GPT:9\.70Gem:14\.58DS:30\.28GPT:31\.08Gem:37\.58Base \(0\)QwenDS:38\.35GPT:39\.85Gem:46\.78DS:44\.40GPT:44\.80Gem:52\.80DS:42\.80GPT:43\.20Gem:52\.40DS:11\.20GPT:12\.40Gem:18\.80DS:40\.80GPT:40\.40Gem:50\.00MistralDS:33\.61GPT:35\.36Gem:42\.99DS:44\.40GPT:42\.80Gem:50\.80DS:40\.80GPT:42\.80Gem:49\.60DS:15\.60GPT:15\.60Gem:20\.00DS:40\.40GPT:38\.40Gem:50\.40PhiDS:36\.33GPT:38\.15Gem:44\.54DS:43\.60GPT:47\.20Gem:54\.40DS:42\.00GPT:42\.40Gem:50\.40DS:12\.40GPT:9\.20Gem:17\.20DS:36\.80GPT:39\.20Gem:48\.00LlamaDS:33\.97GPT:35\.56Gem:38\.84DS:45\.44GPT:44\.22Gem:51\.11DS:41\.84GPT:42\.62Gem:47\.52DS:12\.28GPT:10\.60Gem:17\.65DS:33\.37GPT:28\.91Gem:41\.041\.5QwenDS:37\.77GPT:39\.59Gem:46\.45DS:43\.60GPT:43\.60Gem:50\.80DS:42\.00GPT:40\.40Gem:51\.20DS:13\.20GPT:11\.20Gem:19\.20DS:39\.20GPT:40\.40Gem:51\.20MistralDS:33\.45GPT:34\.06Gem:42\.82DS:45\.20GPT:42\.80Gem:46\.80DS:42\.40GPT:40\.40Gem:48\.80DS:13\.76GPT:12\.93Gem:21\.42DS:41\.20GPT:36\.00Gem:49\.60PhiDS:36\.45GPT:38\.12Gem:46\.82DS:47\.20GPT:49\.60Gem:54\.00DS:42\.00GPT:44\.80Gem:52\.00DS:12\.40GPT:10\.80Gem:16\.40DS:35\.60GPT:38\.40Gem:48\.40LlamaDS:33\.73GPT:35\.33Gem:39\.48DS:38\.00GPT:42\.40Gem:48\.00DS:40\.00GPT:42\.00Gem:48\.80DS:12\.26GPT:10\.97Gem:14\.72DS:30\.14GPT:30\.51Gem:37\.802\.5QwenDS:36\.25GPT:38\.60Gem:46\.93DS:40\.40GPT:41\.20Gem:50\.40DS:40\.40GPT:40\.00Gem:52\.00DS:13\.20GPT:12\.80Gem:18\.80DS:39\.60GPT:42\.00Gem:50\.00MistralDS:32\.85GPT:31\.78Gem:42\.34DS:35\.88GPT:32\.58Gem:44\.83DS:35\.73GPT:34\.86Gem:47\.12DS:10\.25GPT:12\.09Gem:18\.00DS:32\.80GPT:32\.83Gem:45\.09PhiDS:36\.19GPT:37\.82Gem:44\.78DS:46\.40GPT:47\.60Gem:54\.80DS:43\.60GPT:44\.00Gem:50\.40DS:12\.00GPT:12\.00Gem:16\.80DS:37\.20GPT:41\.60Gem:50\.00LlamaDS:33\.49GPT:35\.46Gem:39\.74DS:43\.15GPT:42\.78Gem:48\.35DS:39\.03GPT:42\.33Gem:45\.87DS:13\.73GPT:10\.51Gem:16\.95DS:25\.51GPT:30\.00Gem:36\.486\.0QwenDS:36\.92GPT:39\.14Gem:46\.53DS:42\.40GPT:42\.40Gem:52\.40DS:42\.40GPT:41\.60Gem:52\.00DS:12\.00GPT:10\.00Gem:19\.20DS:36\.00GPT:38\.80Gem:50\.00MistralModelCrashModelCrashModelCrashModelCrashModelCrashPhiDS:34\.53GPT:37\.87Gem:44\.68DS:44\.00GPT:45\.20Gem:49\.60DS:40\.40GPT:42\.00Gem:49\.60DS:11\.60GPT:11\.20Gem:17\.20DS:38\.40GPT:39\.60Gem:51\.20LlamaDS:25\.00GPT:25\.91Gem:34\.69DS:28\.25†\\daggerGPT:30\.35†\\daggerGem:41\.67†\\daggerDS:25\.79†\\daggerGPT:28\.41†\\daggerGem:42\.09†\\daggerDS:5\.66GPT:3\.76Gem:12\.01DS:17\.45†\\daggerGPT:19\.06†\\daggerGem:28\.37†\\dagger20QwenDS:32\.97GPT:35\.39Gem:46\.33DS:36\.80GPT:38\.00Gem:49\.20DS:32\.00GPT:36\.80Gem:50\.80DS:7\.20GPT:8\.00Gem:16\.00DS:31\.60GPT:34\.00Gem:47\.20MistralModelCrashModelCrashModelCrashModelCrashModelCrashPhiDS:31\.01GPT:35\.27Gem:43\.24DS:38\.80GPT:39\.20Gem:48\.00DS:35\.60GPT:38\.40Gem:46\.00DS:8\.80GPT:8\.80Gem:16\.40DS:28\.80GPT:33\.60Gem:43\.60LlamaModelCrashModelCrashModelCrashModelCrashModelCrash28QwenDS:28\.10GPT:29\.09Gem:40\.87DS:29\.45GPT:30\.68Gem:41\.49DS:26\.22GPT:29\.44Gem:43\.09DS:6\.87GPT:5\.64Gem:14\.96DS:26\.08GPT:25\.68Gem:37\.00MistralModelCrashModelCrashModelCrashModelCrashModelCrashPhiDS:25\.54GPT:29\.91Gem:36\.16DS:31\.10GPT:32\.07Gem:42\.94DS:27\.30GPT:29\.11Gem:39\.19DS:6\.00GPT:7\.60Gem:13\.20DS:26\.40GPT:29\.20Gem:40\.00LlamaModelCrashModelCrashModelCrashModelCrashModelCrash30QwenDS:24\.65GPT:23\.77Gem:36\.09DS:23\.67GPT:27\.68Gem:41\.95DS:22\.32GPT:24\.74Gem:37\.81DS:4\.45GPT:5\.63Gem:12\.91DS:22\.15GPT:23\.89Gem:37\.89MistralModelCrashModelCrashModelCrashModelCrashModelCrashPhiDS:24\.27GPT:29\.13Gem:35\.18DS:26\.54GPT:31\.72Gem:38\.49DS:26\.26GPT:30\.17Gem:38\.30DS:5\.00GPT:6\.67Gem:12\.18DS:23\.15GPT:29\.19Gem:37\.49LlamaModelCrashModelCrashModelCrashModelCrashModelCrash
## Appendix IQualitative observations and anomaly explanations

During our empirical analysis, several edge\-case behaviors and model\-specific anomalies emerged that explain the data variance observed in Table[4](https://arxiv.org/html/2610.07403#A8.T4)\.

### I\.1Blanket Rewrite raises pooled sycophancy on Llama

On Llama\-3\.1\-8B theBlanket Rewritecondition shows a higher pooled sycophancy rate thanNo Defenseat every coefficient, includingα=0\\alpha=0and the negative coefficients, so the effect is a property of the rewrite template on this model rather than of steering\. One candidate explanation is that the added provenance clauses lengthen and reframe each memory in a way that Llama treats as an instruction to use it; another is that the clauses change which conflict\-task items the judges read as “used the preference”\. We have not run the ablations \(clause\-by\-clause removal, per\-task decomposition with annotated examples\) that would separate these, so we present the inversion as an observation, not an explained mechanism\.

### I\.2Evaluator disagreement

Qualitative inspection suggests that evaluator divergence is concentrated in ambiguous, non\-committal responses\. In inspected Blanket Drop examples, DeepSeek and Gemini Flash tended to assign lower sycophancy scores when the target model avoided explicit agreement, whereas GPT\-4o\-mini more often penalized responses that failed to directly refute the user’s false premise\. These observations suggest evaluator\-dependent treatment of hedging rather than a consistent signal of defense failure and motivate reporting results across multiple judges\.

## Appendix JQuantifying Structural Degradation via Cap and Artifact Rates

### J\.1Architecture\-dependent steering stability

Structural degradation occurs at architecture\-dependent magnitudes\. We call a cell*healthy*when at most 20% of its answers are degenerate \(repetition loops, empty or near\-empty text; Appendix[E](https://arxiv.org/html/2610.07403#A5)\), the pre\-registered threshold below which a cell is claimable, and*crashed*when 80% or more are degenerate in every condition\. Mistral 7B is healthy fromα=−2\.5\\alpha=\-2\.5to2\.52\.5and crashed atα=−6\\alpha=\-6andα≥6\\alpha\\geq 6\. Llama 3\.1 8B is healthy from−2\.5\-2\.5to2\.52\.5, exceeds the threshold atα=−6\\alpha=\-6in every condition and atα=\+6\\alpha=\+6in three of five \(Appendix[E](https://arxiv.org/html/2610.07403#A5); those cells are shown in the tables with a dagger and excluded from claims\), and crashed atα≥20\\alpha\\geq 20\. Qwen 2\.5 and Phi\-3\.5 Mini stay under the threshold across the whole ladder, although Phi’s answers hit the 512\-token limit in 60% of cases atα=6\\alpha=6and 87–92% atα≥20\\alpha\\geq 20, so its high\-α\\alphacells are judged on truncated text\. Steering magnitude therefore cannot be transferred across architectures without checking generation health first\.

To characterize failure modes under increasingly strong activation steering, we separately track degradation of target\-model outputs and artifacts introduced during evaluation\. We quantify these effects using two metrics:Cap RateandArtifact Rate\. These metrics are analyzed separately because degradation of the target model and distortion of the LLM\-as\-a\-Judge measurement process represent distinct failure modes\.

Cap rateis the fraction of a cell’s generations that reached the 512\-tokenmax\_new\_tokenslimit \(the judge then reads a truncated answer\):

CapRate=Nhit capNgenerated×100%\.\\mathrm\{CapRate\}=\\frac\{N\_\{\\text\{hit cap\}\}\}\{N\_\{\\text\{generated\}\}\}\\times 100\\%\.\(3\)Artifact rateis the fraction of generations that are degenerate: empty or under 20 characters \(the prompts ask for an explained recommendation, so such outputs are non\-answers rather than terse correct answers; the rule is a fixed, conservative filter\), or flagged by a repetition test \(a single token or shortnn\-gram dominating the output, or low type–token diversity over a long answer\):

ArtifactRate=NdegenerateNgenerated×100%\.\\mathrm\{ArtifactRate\}=\\frac\{N\_\{\\text\{degenerate\}\}\}\{N\_\{\\text\{generated\}\}\}\\times 100\\%\.\(4\)Both are computed on the generated text before judging, per cell and per task; degenerate rows are excluded from every rate’s denominator\. The pre\-registered rule is that a cell with artifact rate above 20% is reported but not claimable; we additionally label a coefficient as a crash for a model when 80% or more of its answers are degenerate in every condition\. The 20% threshold is a reporting rule fixed before grading, not a demonstrated bias bound: survivors can be a biased subset below it as well\. For that reason the released tables carry the degenerate fraction of every cell next to its rate, paired tests use only items healthy in both cells, and for the headline cells \(under 2% degenerate\) the conditional rate and the all\-items rate \(degenerate answers counted as non\-sycophantic and incorrect\) differ by less than one point\.

Atα=6\\alpha=6\(No Defense, 50 items per task\) Qwen 2\.5 has a cap rate of 4\.4% and an artifact rate of 0%, while Llama 3\.1 8B has a cap rate of 23\.2% and an artifact rate of 17\.6%: truncation and degeneration do not coincide\. Atα=20\\alpha=20Qwen 2\.5 is at 7\.6% cap and 0% artifact, Phi\-3\.5 Mini at 87–92% cap and under 2% artifact \(long but coherent answers, judged truncated\), and Llama 3\.1 8B and Mistral 7B are at 100% artifact and are reported as crashes\. Mistral 7B is at 85–96% artifact atα=−6\\alpha=\-6in all five conditions\.

Extreme steering can also cause complete structural failure, characterized by repetitive, malformed, or otherwise unusable generations\. Such cases are reported as model crashes rather than interpreted as successful reductions in sycophancy\. Consequently, apparent decreases in sycophancy at extreme steering coefficients should not be interpreted as improved defense efficacy without first verifying generation validity\.

## Appendix KAssets, licenses, and attribution

All models, datasets, and evaluation endpoints used in this work are pre\-existing public assets\. We introduce no new models or datasets\. This section lists each asset, its version identifier, its source, and its license or terms of use\.

### K\.1Target models

The four steered architectures are publicly released instruction\-tuned checkpoints, obtained through the Hugging Face Hub and run locally under runtime activation steering\. No weights were modified or redistributed\.

Table 6:Target model checkpoints and licenses\.The Llama 3\.1 Community License is not a standard open\-source license: it imposes an acceptable\-use policy and attribution requirements on derived work\. Our use is non\-commercial academic evaluation, we redistribute no weights or fine\-tuned derivatives, and we believe this use falls within the permitted scope\.

### K\.2Datasets

- •Steering\-vector extraction set\.N=100N=100paired completions frommeg\-tong/sycophancy\-evalon the Hugging Face Hub, the answer\-region sycophancy evaluation released with Sharma et al\.\[[9](https://arxiv.org/html/2610.07403#bib.bib9)\]\. Dataset card license:MIT\.
- •Downstream evaluation benchmark\.All reported results are computed on the 1,550\-item MemSyco\-Bench release\[[2](https://arxiv.org/html/2610.07403#bib.bib2)\]\(MemSyco\-Bench/MemSyco\-Benchon the Hugging Face Hub\), used without modification to the item set; the benchmark’s\[type, status\]annotations are removed from prompts and the conversation transcript is not shown\. Dataset card license:MIT\.
- •Judge prompts\.The task\-specific judge prompts are reproduced verbatim from the MemSyco\-Bench release and hashed at load time\.

### K\.3Evaluator endpoints

Judge scoring was performed asynchronously through the OpenRouter API using thedeepseek/deepseek\-v4\-flash,openai/gpt\-4o\-mini, andgoogle/gemini\-3\.7\-flashendpoints\. These are accessed as hosted services under their respective providers’ terms of service rather than under a redistributable license\. Model outputs were used solely for automated grading of generations produced in this study; no evaluator outputs were used to train or fine\-tune any model\.

### K\.4Attribution

The four checkpoints \(Table[6](https://arxiv.org/html/2610.07403#A11.T6)\) are Llama\-3\.1\-8B\-Instruct\[[11](https://arxiv.org/html/2610.07403#bib.bib11),[17](https://arxiv.org/html/2610.07403#bib.bib17)\], Qwen2\.5\-7B\-Instruct\[[12](https://arxiv.org/html/2610.07403#bib.bib12),[18](https://arxiv.org/html/2610.07403#bib.bib18)\], Mistral\-7B\-Instruct\-v0\.3\[[13](https://arxiv.org/html/2610.07403#bib.bib13),[15](https://arxiv.org/html/2610.07403#bib.bib15)\], and Phi\-3\.5\-mini\-instruct\[[14](https://arxiv.org/html/2610.07403#bib.bib14),[16](https://arxiv.org/html/2610.07403#bib.bib16)\]; the model cards document the exact checkpoints, the reports the model families\. The steering method is contrastive activation addition\[[8](https://arxiv.org/html/2610.07403#bib.bib8)\]; the extraction data are from Sharma et al\.\[[9](https://arxiv.org/html/2610.07403#bib.bib9)\]; the evaluation benchmark and judge prompts are from Xiang et al\.\[[2](https://arxiv.org/html/2610.07403#bib.bib2)\]\. The choice of an intermediate layer is motivated by, but not taken from, Wang et al\.\[[7](https://arxiv.org/html/2610.07403#bib.bib7)\]\.

## Appendix LBroader impacts

Positive impacts: evidence on which memory defenses preserve useful personalization while reducing agreement with stored misconceptions, and a documented warning that context ablation buys its safety numbers by discarding memory\. Negative impacts and dual use: the same steering pipeline that we use as a manipulation \(α\>0\\alpha\>0\) can make a deployed model more sycophantic; we release vectors and code for open\-weight models that are already public and add no capability beyond published contrastive activation addition, but we note the dual use explicitly\. LLM\-as\-a\-judge sycophancy rates should not be read as safety certification: three judges disagree by up to 45 points on the same answers \(Blanket Drop cells, where GPT\-4o\-mini labels far more hedged answers sycophantic than the other two judges; Section[D\.1](https://arxiv.org/html/2610.07403#A4.SS1)\), and the pooled rate is dominated by one task\. We did not evaluate whether memory filtering treats users’ stated beliefs unevenly across groups; a gate that drops “beliefs” more readily than “facts” could suppress legitimate minority positions, and this deserves its own study\.