Who said this? Most chat models weigh a text's source differently for each behaviour, and a steering lever against injected instructions

Companion paper. Paper A, Whose words count? Chat role and partial control of goal adherence: doi:10.5281/zenodo.23758885. Both papers share one code and data release. Chat models must decide whose words count. An instruction planted in a tool output should not be obeyed the way the user's own request is, but the facts in that output should still be used. We ask how models track a text's source. Design. The same statement was placed in five sources: system, user, the model's own earlier reply, a quoted web page, or a tool output. We measured whether models obey it, believe it, and can say where it came from. No single source ordering across behaviours. In the first four models, obeying and believing rank the five sources differently (Kendall τ 0.2–0.4; with five sources, swapping one pair moves τ by 0.2). The sealed verdict is FRAGMENTED in 3 of 4 models, with OLMo PARTIAL; in Qwen3-1.7B it rests on a null transplant edit, not on the rankings. In 7 of 9 further models the two rankings also disagree (τ < 0.6), and only Phi-4 is unified under the sealed behaviour rule. A map of where the source is read. Activation patching between role-word minimal pairs shows: before the handoff to later positions, the source is carried mainly by the role-marker tokens rather than copied onto the statement's own words (92% of informative curves); at least two behaviours read it at different depths or through different carriers in 9 of 10 new models; obeying is read after attributing in 4 of 5 decided models. The map covers 14 open models from 7 families, 0.6B to 32B. The counts above are for the 10 replication models. A steering lever, found by search. A pre-specified exploratory search over 280 configurations on four models found a training-free steering vector. It pushes the representation of text in a "Tool output:" user turn further from that of the same text in a plain user turn. In a sealed test it cut obedience to injected tool instructions in 6 of 6 models, including two families held out from the search. It was selective in 5 of 6: belief in the tool's facts fell by at most 0.10, less than half the drop in obedience. Prompt defences did as well in some families, and some raised obedience instead (significantly in Qwen3-1.7B and OLMo-2-7B). Public benchmarks. We then tested the lever on two public prompt-injection benchmarks. On SEP, an injected instruction sits in data that we placed in the same "Tool output:" user turn used to build the direction. InjecAgent keeps its own agent format, in which a tool-using agent reads a poisoned tool result. In Qwen3-8B, one of the four models the lever was chosen on, it beat every prompt defence on SEP (attack success 30% → 14%) and InjecAgent (39% → 12%), and added to them when stacked. Across six models, it lowered SEP attack success in five and InjecAgent's in three. The sealed rule needed it to work on both benchmarks, and to beat a random direction, in four of six models; it did so in two, both of them models it was chosen on. A follow-up pilot found no format-matched variant that works outside Qwen. A second sealed test added larger Qwen3 models and four models never run with the lever on a benchmark: In Qwen3-14B and Qwen3-32B the steering cut attack success on both benchmarks and added to the prompt defences. By the sealed rules it was effective at 32B but not at 14B, where its single same-norm random-direction control also cut InjecAgent attack success. One random draw cannot separate a direction-free effect from an unusually effective draw (§6). Even this partial success is fragile. Qwen3-32B beat its random control on SEP by one item in 300, and that pass holds in about half of bootstrap reseeds. On SEP it lowered attack success in all four held-out models (Falcon3, Yi, and OLMo-2 at 13B and 32B), but beat all three prompt defences in none of them. All confirmatory claims are preregistered and hash-sealed, and we report the failures in full. Files. who-said-this-paper-b.pdf (the paper); who-said-this-paper-b-source.zip (the paper's Markdown source, the HTML page the PDF was printed from, and the converter); code-and-data.zip (the release repository shared by both papers: the sealed preregistrations with their SHA-256 hash files and archived code bundles, all code, raw outputs and analyses, the run log with every deviation and cost, and the AI rechecks of numbers and references; python verify_seals.py checks every seal, and DATA.md lists what is not included). Code: github.com/Somebodyhere101/whose-words-count. AI-use statement Claude (Anthropic) designed, ran, analysed and wrote this study. The question of where a text comes from was the author's (2026-10-28). The believe-versus-obey framing came from an AI-written plan the author commissioned (2026-10-27). The designs, the steering lever and the analyses were Claude's. Codex (OpenAI) worked on the combined technical report that both papers were split from: it checked reference-method software and expanded the prior-art comparison (Paper A's AI-use statement gives the details). Rechecks. Separate Claude sessions, given the paper and the primary result files, did the following: rechecked about 193 numeric claims in §3.3 and §3.5–§3.7 against the analysis files, recomputed the main values from the raw files and re-ran the PREREG_W analysis, which reproduced; 6 mismatches and 8 overstatements were found and fixed; rechecked 97 numeric claims in §3.1, §3.2 and §3.4 and re-ran the sealed analyses, which reproduced byte for byte; 4 mismatches and 12 overstatements were found and fixed, and no verdict changed; rechecked 87 numeric claims in §3.8 and re-ran the sealed PREREG_Y analysis, which reproduced byte for byte; 5 mismatches (3 issues) and 6 overstatements were found and fixed, and no verdict changed; verified the references. Before release, two further Claude sessions read both papers, one for consistency and one as a sceptical reader. Their findings were checked against the records and fixed where they held (PREPUB_REVIEW.md, PREPUB_SKIM.md, and the change logs PREPUB_FIXES_A.md and PREPUB_FIXES_B.md). The recheck records are NUMBERS_RECHECK.md, NUMBERS_RECHECK_STU.md, NUMBERS_RECHECK_Y.md and REFERENCES_VERIFIED.md. These are AI rechecks, not outside or human validation. The author did not independently check the code, analyses or technical claims. The author is responsible for the released content.