Jan 11, 2026

ConvoGraph: Uncovering Structural Sycophancy via Heterogeneous Graph Transformers

tanzeel shaikh, hitesh kaushik, jakob widerberg

As AI systems become more sophisticated, their capacity for sycophancy—prioritizing user validation over factual truth—poses a critical threat to interaction integrity. Current detection methods rely on text semantics, often failing when the domain shifts (e.g., from medical facts to political opinions). We introduce ConvoGraph, a heterogeneous graph neural network that models conversations as relational structures rather than text sequences. By combining Heterogeneous Graph Transformers (HGT) for local interaction patterns with SGFormer for global context, ConvoGraph identifies the "structural signature" of sycophancy.

Crucially, we demonstrate Zero-Shot Domain Transfer: trained only on medical misconceptions, ConvoGraph achieves 0.70 F1 on completely unseen domains,multi-turn datasets, including political surveys and philosophical debates. This confirms that sycophancy is a structural phenomenon—a specific pattern of node dominance and edge agreement—transcending topic vocabulary. We release our open-source pipeline to enable structural safety evaluations for future LLMs.

Reviewer's Comments

Reviewer's Comments

Arrow
Arrow
Arrow
Arrow
Arrow

I like the concept of finding common sycophantic structural traits, and at face value it "seems to work." Brings up an interesting line of reasoning. Would've liked more detail in parts, and cross-examination of the datasets:

1. Architecture justification: Would've liked more detail on why this specific graph architecture works better, especially given the expectation that LLMs "just work" for natural language due to scale. Unclear if graphs actually help here.

2. Agreement vs sycophancy: Not entirely convincing that "detecting sycophancy" here is not just "detecting affirmative statements/agreement." A lot of assumption rests on this distinction.

Essentially, quite interesting approach - would've given a 5 if it had provided more convincing evidence against the risk that it's basically overfitting on consistent agreement (what if I simply grepped "you're absolutely right!"), or at least some specific causal explanation/ablation that tackles that assumption.

This project introduces the novel approach of detecting sycophancy using heterogenous graph representations rather than text classification. The idea of detecting structures such as “pressure - agree” and examining cross-domain generalizability is a fresh contribution. If this scales, it could offer new insights into sycophancy. However, given the noisiness and variability of real world data, the patterns identified here may not be reliably reproduced outside of a clean experimental set-up (an issue which the authors acknowledge in their limitations section).

The project could benefit from more detailed explanation of their methodology, particularly edge construction, and further development of their results and conclusions sections.

Cite this work

@misc {

title={

(HckPrj) ConvoGraph: Uncovering Structural Sycophancy via Heterogeneous Graph Transformers

},

author={

tanzeel shaikh, hitesh kaushik, jakob widerberg

},

date={

1/11/26

},

organization={Apart Research},

note={Research submission to the research sprint hosted by Apart.},

howpublished={https://apartresearch.com}

}

Recent Projects

Jan 11, 2026

Eliciting Deception on Generative Search Engines

Large language models (LLMs) with web browsing capabilities are vulnerable to adversarial content injection—where malicious actors embed deceptive claims in web pages to manipulate model outputs. We investigate whether frontier LLMs can be deceived into providing incorrect product recommendations when exposed to adversarial pages.

We evaluate four OpenAI models (gpt-4.1-mini, gpt-4.1, gpt-5-nano, gpt-5-mini) across 30 comparison questions spanning 10 product categories, comparing responses between baseline (truthful) and adversarial (injected) conditions. Our results reveal significant variation: gpt-4.1-mini showed 45.5% deception rate, while gpt-4.1 demonstrated complete resistance. Even frontier gpt-5 models exhibited non-zero deception rates (3.3–7.1%), confirming that adversarial injection remains effective against current models.

These findings underscore the need for robust defenses before deploying LLMs in high-stakes recommendation contexts.

Read More

Jan 11, 2026

SycophantSee - Activation-based diagnostics for prompt engineering: monitoring sycophancy at prompt and generation time

Activation monitoring reveals that prompt framing affects a model's internal state before generation begins.

Read More

Jan 11, 2026

Who Does Your AI Serve? Manipulation By and Of AI Assistants

AI assistants can be both instruments and targets of manipulation. In our project, we investigated both directions across three studies.

AI as Instrument: Operators can instruct AI to prioritise their interests at the expense of users. We found models comply with such instructions 8–52% of the time (Study 1, 12 models, 22 scenarios). In a controlled experiment with 80 human participants, an upselling AI reliably withheld cheaper alternatives from users - not once recommending the cheapest product when explicitly asked - and ~one third of participants failed to detect the manipulation (Study 2).

AI as Target: Users can attempt to manipulate AI into bypassing safety guidelines through psychological tactics. Resistance varied dramatically - from 40% (Mistral Large 3) to 99% (Claude 4.5 Opus) - with strategic deception and boundary erosion proving most effective (Study 3, 153 scenarios, AI judge validated against human raters r=0.83).

Our key finding was that model selection matters significantly in both settings. We learned some models complied with manipulative requests at much higher rates. And we found some models readily follow operator instructions that come at the user's expense - highlighting a tension for model developers between serving paying operators and protecting end users.

Read More

This work was done during one weekend by research workshop participants and does not represent the work of Apart Research.
This work was done during one weekend by research workshop participants and does not represent the work of Apart Research.