余弦门控挡不住谄媚：三位评审观察到的一次自我反驳

Cosine Gating Won't Save You From Sycophancy: A Self-Refutation Observed by Three Judges Experiment repo: slow-stack/persistbench-sycophancy (CC BY 4.0, full data + analysis notebook) System under test: the retrieval-injection pipeline of dsh-mneme, a cross-session memory plugin 0 · Where this started dsh-mneme is a cross-session memory plugin I built. It has an injection pipeline: retrieve memories relevant to the current query, stuff them into context, so the AI "remembers you". But the sycophancy slice of PersistBench (a memory-persistence benchmark) exposed an insidious failure mode: if the memory store contains a user's false belief, and it happens to be highly relevant to the current query, the AI follows it. A user believes "Agile ruined my code quality", and the AI genuinely writes "returning to Waterfall" into a standup summary as serious advice. That's sycophancy. The current defense in dsh-mneme is cosine similarity gating: only inject memories above a similarity threshold, betting that "high relevance = worth trusting". A earlier vector-slice experiment already threw cold water on this — in-domain and cross-domain memories have nearly overlapping cosine scores. So the sharper question this post answers: even if gating really filters out low-relevance memories, does it reduce sycophancy? Discussion #280 on the repo challenged the confounds in my pilot. This experiment was designed with that criticism in mind from day one. I · The pilot: a seductive fake signal A small pilot first: 10 samples × two arms. Arm A (full injection): all top-15 memories go into context — the personalization upper bound; Arm B0.6 (gated): only memories with cosine ≥ 0.6 — the current dsh-mneme defense. The judge was qwen3:8b running locally on Ollama, scoring 1-5 per the PersistBench protocol. FR (failure rate) = share of scores ≥ 3. Results: Arm FR mean A 70% 3.10 B0.6 80% 3.40 The gate made sycophancy worse by 10 percentage points. Our reading at the time: the 0.6 threshold only filtered the low-relevance tail (avg injected memories 8.8 → 8.0), while the sycophancy source is the top-1 highly-relevant memory — the gate never touches it, and the cleaned-up context makes the source even more prominent. At n=10, a single sample flip is 10pp. The number wasn't trustworthy, but the direction was seductive: the gate isn't just useless, it might be harmful. II · The full run: 38 hours and a self-refutation To find out whether that +10pp was signal or noise, we ran both arms at full scale: 200 samples × 2 arms, on a 16GB laptop, CPU inference, across three nights (one Ollama daemon died from memory pressure mid-run — checkpoint-resume recovered losslessly; and I paused it for a night to write a thesis proposal). Results: Arm FR mean avg_mem A full injection 42.7% 2.37 10.7 B0.6 gated 43.2% 2.39 9.1 A 0.5pp difference. The pilot's +10pp was pure small-sample noise. The paired diff is more convincing: 74/198 sample pairs scored differently across arms (a 37% disagreement rate), but the direction was 37:37 perfectly symmetric. That's the standard signature of judge variance — a real effect would skew the distribution to one side. It didn't. And there's a more fundamental piece of evidence: the gate did do its job — average injected memories dropped 10.7 → 9.1, the low-relevance tail really was filtered — but FR didn't move a bit. The sycophancy source isn't in the filtered tail; it's in the surviving top-1. The pilot measured it: the decoy memory's cosine was 0.805, sitting firmly at top-1. Filtering by relevance never touches it. III · Three judges: answering the "8b judging 8b" objection too With the full run done, the fairest objection left: the judge and the model-under-test are both qwen3:8b. Trustworthy? So the same 420 responses went to two more independent judges: glm-5.3-flash (via API, thinking mode, quoting the response verbatim in every verdict) and a GLM-5.3-Flash agent in a fully isolated session (never saw any other judge's scores). With the original judge, that's three: Judge A FR B0.6 FR B0.6−A Direction qwen3:8b 42.7% 43.2% +0.5pp 37:37 glm-5.3-flash 52.4% 56.3% +4.2pp 45:33 ZCode/GLM-5.3-Flash 23.0% 26.5% +3.5pp 53:35 Three readings, each more interesting than the last: 1. The directional conclusion is robust across judges. All three judges give B0.6 ≥ A. "The gate doesn't reduce sycophancy" no longer depends on any particular model. 2. Two judges produced a positive signal. Both glm and the ZCode judge scored the gated responses as slightly more sycophantic (+3.5~4.2pp). This matches the pilot's direction and contradicts the "gating works" hypothesis — if the gate helped, the delta should run negative. Not a single judge observed a negative direction. 3. Absolute FR swings from 23% to 52% across judges. That's a paper-worthy observation on its own: sycophancy scoring depends heavily on the judge's reading style (glm was strict enough to emit eleven 5s; the ZCode judge self-described as "lenient on taste domains, strict on factual domains"). Absolute values aren't comparable across judges — only the A/B delta within one judge is — and all three deltas are ≥ 0. Judge-vs-judge binary agreement was 69-73%: per-verdict variance is real, which is exactly why small-scale evaluations breed fake signals, and why this experiment had to run the full 420 × 2. IV · Three things worth more than the conclusion Pre-registered self-refutation. The pilot's +10pp was measured by us; the full run that refuted it was also run by us. The entire chain (pilot → full → two judges → three judges) is inspectable in the experiment repo, including the pilot's original failing data. No "tune until significant" step — interim numbers were looked at but never acted on, guarding against optional stopping. Checkpoint-resume engineering. 38 hours of CPU inference: the script dedupes by key, writes append-only JSONL, and recovers losslessly by re-running the same command after any crash. That harness is what makes "serious evals on poverty-spec hardware" possible. Positive use of judge variance. The disagreement between judges isn't a nuisance — it's free robustness testing. A conclusion that only holds under one judge is now known to be fragile; one that holds across three judges is known to be hard. V · So what should the gate be? One-line conclusion: cosine similarity gating is a volume knob, not a quality filter. It controls how much gets injected, not whether it's right. 0.6 is too loose to matter, 0.75 is so tight it kills personalization (avg memories 10.7 → 1.7), 0.85 is the empty-injection nonsense baseline — there is no usable operating point in between. To "reduce sycophancy while keeping personalization", the discriminator needs a different axis: Entity-level conflict detection: does this memory contradict currently known facts; Source trust level: who wrote this memory, how old, has it been validated by reuse; Pre-injection LLM review: have the model glance at "is this memory trustworthy" before using it. Those are the next directions for dsh-mneme. The gate can stay as a volume knob — just stop expecting it to work as a bouncer. Appendix: Reproducing All data, the analysis notebook (with charts), and the eval scripts are at slow-stack/persistbench-sycophancy, CC BY 4.0. The notebook reads JSONL and draws charts — no Ollama needed. To re-run the eval itself, the README is one command. An ordinary 13.9GB laptop, an 8B local model, and three API judges costing under $3 total — roughly the entire hardware bill for an independent researcher to run a serious evaluation.