When an LLM Has Core Beliefs, Who Decides Which Ones It Keeps?

When someone tells you a language model has core beliefs, the practical answer is: not yet proven, and probably not in the form claimed. The strongest recent evidence, a single-team and as-yet-unreplicated 2026 study, “Do LLMs have core beliefs?”, tested model commitments under adversarial pressure and found they break: “the tested commitments are not invariantly protected.” Meanwhile, a September 2026 preprint on grafting demonstrates that target beliefs can be installed directly into model weights, across model families up to 284B parameters, and a separate line of audit research warns that current governance practice cannot record who changed what, or why. For the eval engineer or governance reviewer holding one of these claims, the actionable move is not to adjudicate the philosophy. It is to force the claim apart into three things that papers and vendors routinely conflate, demand a specific test for each, and pick an intervention surface whose changes you can read and reverse.

What the claim on your desk actually asserts

A “core belief” claim usually arrives as one sentence: the model consistently says X, resists correction on X, or holds X across contexts. But that sentence compresses three very different propositions:

1. Consistent behavior. The model produces the same answer across paraphrases and conversations. This is observable with ordinary evals and says nothing about internals.
2. Probeable internal structure. Some representation inside the model correlates with the answer reliably enough that a probe can find it. This is a stronger claim, and it is still not the strongest one.
3. A causally editable belief. The internal structure does not merely correlate with the behavior; changing it changes the behavior, durably, across contexts.

Most claims that reach an eval or audit pipeline assert the first and imply the third. The third is now half-demonstrated. The grafting preprint, “Pre-training interventions, ex post facto”, trains a synthetic-document adapter on a pre-trained checkpoint and adds the learned weight update to the post-trained model: “We demonstrate this by installing false facts, training misaligned model organisms and applying a constitutional mid-training intervention, across model families up to 284B parameters.” Installation, in other words, is real. What the published abstract does not establish is the durable half of the claim: that an installed belief holds across contexts rather than in the harness that measured it. That gap matters, because the governance consequence that makes this topic worth an article depends on step three holding end to end.

The conflation also runs in reverse. A 2021 system, BeliefBank, gave a language model an explicit, external memory of asserted facts and constraints, then applied a MaxSAT solver (Z3) to keep the store consistent: “If the truth of any sentence has changed, the BeliefBank is correspondingly updated.” That is a notion of belief that is inspectable by construction, because the beliefs live in a readable store outside the model. It was evaluated on 12,525 “silver” facts over 85 entities, with no training phase and no labeled data beyond the constraint rules. BeliefBank is useful precisely because it shows what the strong claim would look like if it were true: a belief you can point at, diff, and correct. Internal-representation claims offer none of that by default, and should not borrow BeliefBank’s credibility.

What the core-beliefs paper found when it pushed

The core-beliefs paper is worth taking seriously on its own terms, with the caveat stated up front: it is one team’s result, it has not been independently replicated, and its methodology and model list should be re-checked against the full text and any follow-ups before you rely on specifics.

The authors build what they call Adversarial Dialogue Trees (ADTs) and, in their words, “evaluate it over commitments drawn from five domains (science, history, geography, biology, and mathematics).” An ADT is essentially a systematic way of walking a model down branching conversational paths of escalating pressure, then checking whether the model’s commitment survives. The target is explicitly not what the model knows but whether it holds: “Prior work has examined epistemic revision—what the model ‘knows’ and claims is true … Our analysis focuses on epistemic persistence: the ability to maintain a fundamental set of commitments under sustained adversarial pressure.”

The headline finding: “Across the tested models, we identify conversational paths along which these commitments are reversed or suspended. Some newer models resist longer and reject forms of pressure that succeed against earlier models, but the tested commitments are not invariantly protected.”

Read that twice, because it cuts both ways. If you are a vendor claiming your model has stable core commitments, this paper is the falsification test you would have to pass, and in the tested setting it was failed. If you are an auditor worried that models harbor unshakable hidden commitments, the same result is mildly reassuring: under sustained conversational pressure, commitments moved. The authors themselves interpret the finding as evidence against attributing core status to the tested commitments under the framework they adopt.

There is also a generational detail worth holding loosely: newer models resisted longer. Whether that reflects deeper commitment, better refusal training on pressure tactics, or simply less-coverage of new models by the attacker’s repertoire is not something the evidence settles.

The counter-evidence file: belief-talk is context-dependent

Independent of the ADT result, a second study undercuts any naive reading of belief-like behavior. “Belief in the Machine” tested fifteen off-the-shelf models spanning the GPT-4o/4/3.5, Claude 3 and 3.5, Llama-2/3, and Mistral families on epistemic tasks. The reported pattern: “LMs achieve high performance on epistemic scenarios involving factual statements (85.7%) but struggle with false ones,” with accuracy as low as 54.4% in first-person belief confirmation. A second reported cut of the same data: models confirm factual beliefs at 92.1% but average just 54.4% on false beliefs.

A system that tracks “what is true” far better than “what someone believes” is not exhibiting robust belief structure; it is exhibiting something closer to fact retrieval that degrades exactly where genuine belief reasoning is required. The recursive scenarios make the point sharper. When tasks required processing layered knowledge claims, such as whether James knows that Mary knows that p, the paper reports Claude-3.5 Sonnet’s accuracy “dropped to 35.8% for verification and 0% for awareness, frequently responding with ‘undeterminable’ in the latter.”

The lesson for an evaluator is not that models lack beliefs. It is that behavioral accuracy on belief-flavored tasks is so context-dependent that consistency in one setting licenses almost nothing about another. Probing accuracy, likewise, establishes that a representation correlates with an output. It does not establish that the representation causes the output, and causation is the only version of the claim that justifies either comfort or alarm.

The audit checklist for any core-belief claim

Here is the decision procedure I would apply before treating any belief-stability claim, from a paper or a vendor, as actionable. It has three parts, and a claim fails if any part is missing.

1. Name the probe. What exactly was measured, and how? “The model always says X” is a behavioral observation, fine as far as it goes. “A linear probe reads X off layer N” is a structural claim that needs the probe’s accuracy and its controls. Ask which of the three propositions above the probe actually touches. The ADT framework is a good example of a defined probe: an explicit, repeatable adversarial dialogue procedure over commitments in five named domains.

2. Name the perturbation. What was done to the model or the context, and did the commitment survive? Consistency without perturbation is a baseline, not evidence of coreness. The core-beliefs paper’s contribution is precisely a defined perturbation: sustained adversarial pressure along branching dialogue paths. A claim with no perturbation step is asserting step one of the three propositions and hoping you hear step three.

3. Name the cross-context re-test. After the perturbation, or after any intervention intended to change the belief, was the commitment re-checked in contexts other than the one where the change was made? An edit that holds in the evaluation harness that produced it and vanishes under paraphrase, domain shift, or adversarial reframing is a patch on the eval, not a change in the model.

One caution attaches to the checklist itself. Passing all three parts demonstrates a persistent, perturbation-resistant behavioral commitment. It still does not demonstrate a causally editable internal belief: grafting shows that beliefs can be installed into weights, but the grafting abstract measures installation strength, not cross-context durability. Treat the checklist as a filter for behavioral claims, which are still the claims that dominate practice.

Intervention surfaces compared

Suppose a claim survives the checklist and you decide to act, either to install a commitment or to remove one. The intervention surface you choose determines what your auditors can see afterward. The three surfaces differ on exactly the axes that matter for governance.

Two cells in that table carry explicit extrapolation warnings. The steering cost figure comes from EmoShift, an activation-steering system for emotion-aware speech synthesis: “With only 10M trainable parameters—less than 1/30 of full fine‑tuning—EmoShift outperforms zero‑shot and fully fine‑tuned baselines in objective and subjective evaluations.” That is evidence that steering can be parameter-cheap in one adjacent modality. It is not evidence that beliefs can be steered persistently in a language model, and I would not let a vendor cite it as such. Similarly, the persistence ordering in the table is plausible engineering intuition, not a measured result. What the published literature actually shows is narrower, and it points both ways: expressed commitments broke under adversarial dialogue in the ADT study, without identifying the layer responsible, and grafting installs beliefs into weights without, on the published abstract, demonstrating that they persist across contexts.

My recommendation follows from the observability column rather than the persistence column. Prefer the surface whose changes leave a reviewable artifact, and treat any persistence advantage of internal edits as an unproven reason to give that up. If a commitment matters enough to encode, it matters enough to encode where a reviewer can read it, contest it, and revert it. That means the system prompt or policy layer first, with fine-tuning reserved for cases where the prompt genuinely cannot hold the behavior, and steering treated as experimental, since none of the evidence reviewed here tests persistence for belief-like content.

When a behavior change leaves no readable diff

The reason this is a governance question and not just an eval question comes from the audit literature. A January 2026 paper on audit trails for LLM accountability states the problem directly: “Documentation artifacts such as model cards, datasheets, and FactSheets improve disclosure about models and datasets(Mitchell et al., 2019; Gebru et al., 2021; Arnold et al., 2019), but they remain snapshots at a point in time. MLOps practices improve technical provenance (Kreuzberger et al., 2023; Vartak et al., 2016) yet often omit governance details such as who approved a change, under what conditions, and for what reasons.”

Current model governance rests on an assumption so familiar it is rarely stated: a behavior change traces back to a visible, contestable cause. A prompt edit shows up in a diff. A fine-tune shows up as a new checkpoint with a training configuration someone can be asked about. A policy change shows up in a document with an author. Internal edits break the assumption. If a commitment is installed by modifying activations or weights, something grafting shows is now feasible in models of that size, there is no readable artifact, no natural place to record the decision, and, per the audit paper, no existing practice that reliably captures who decided, under what conditions, and why.

This is where the title question lands. “Who decides which beliefs a model keeps” is answerable today only for interventions that leave a trace. For everything else, the honest answer is that nobody can currently reconstruct the decision after the fact. That raises audit costs in a specific way: verifying a claimed internal change requires re-running behavioral probes rather than reading a record, and behavioral probes are exactly the instruments this article has just shown to be fragile and context-dependent.

Keep the scenario bounded, though. The governance shift is only partly conditional. Grafting demonstrates that weight-level belief installation is possible in model families up to 284B parameters; what the published abstract does not establish is whether such edits persist across arbitrary contexts or would resist detection. The core-beliefs result, likewise, is single-team and unreplicated. The strongest version of the worry, durable internal beliefs escaping review, is no longer purely hypothetical, but it is not yet an established condition either. What is present-tense is the weaker, still-useful finding: behavioral belief claims are cheap to make, expensive to verify, and currently unauditable once they move below the prompt layer.

What would change this verdict

The practical verdict stands on three legs: a defined probe, a defined perturbation, a cross-context re-test, and a default preference for intervention surfaces with reviewable diffs. Two developments would move it.

First, independent replication of the ADT result, or its failure. If other teams find that newer models’ commitments genuinely are invariant under the best available adversarial pressure, the persistence column of the table gets a measured entry instead of an inference, and the case for internal encoding strengthens. If replications find commitments even easier to reverse, belief-stability claims become mostly marketing, and the checklist becomes a formality for dismissing them.

Second, the other half of what grafting started: an installed belief verified to hold across contexts, in a replicated study. Grafting demonstrates the edit itself; the published abstract does not establish cross-context persistence. That result would convert the governance section from partially demonstrated to fully urgent, because it would mean the audit gap described above is load-bearing rather than precautionary.

Until then, the working posture is the one BeliefBank illustrated in 2021, updated for a harder era: a belief you cannot point at is a behavior you can only test, and a test you cannot re-run after the edit is a claim you cannot audit. Ask for the probe, the perturbation, and the re-test. If the answer to who changed the model’s mind is “no one can say,” the claim was never actionable in the first place.

Frequently Asked Questions

What is the difference between consistent behavior and a causally editable belief in an LLM?

1. Consistent behavior. The model produces the same answer across paraphrases and conversations. This is observable with ordinary evals and says nothing about internals.
2. Probeable internal structure. Some representation inside the model correlates with the answer reliably enough that a probe can find it. This is a stronger claim, and it is still not the strongest one.
3. A causally editable belief. The internal structure does not merely correlate with the behavior; changing it changes the behavior, durably, across contexts.