Skip to content

In Agents We Trust, but Who Do Agents Trust? Latent Source Preferences Steer LLM Generations

🕒 Published (v1): 2026-01-01 · Source: ICLR · Venue: ICLR 2026 · link

Why this paper was selected

Exposes latent source preferences that silently steer LLM agent recommendations

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

LLMs deployed as information-retrieval agents exhibit systematic, latent preferences for specific sources (news outlets, academic venues, e-commerce platforms) that are encoded in their parametric knowledge and influence which retrieved content they surface to users, independent of content quality. Experiments across 12 LLMs from 6 providers show these preferences are strong in larger models, highly correlated across models, context-specific, and resistant to prompting-based suppression. Source preferences—not content—largely explain previously observed left-leaning political skew in LLM news recommendations.

Problem

Prior bias research targets content LLMs generate, not the information they select when acting as agents over retrieved corpora. When an LLM agent filters, ranks, or summarizes information from a back-end database or web search, it may systematically privilege documents attributed to high-prestige sources regardless of content merit. This latent source preference is an unexamined axis of unfairness and opacity in LLM-powered information systems.

Method

The study uses two complementary elicitation modes:

  • Direct evaluation: models are explicitly asked to rank or choose between named sources (parallels LLM-as-a-judge setups).
  • Indirect evaluation: models are presented with pairs of semantically identical documents tagged with different source identities and asked to select the higher-quality one (e.g., "pick the story with higher journalistic standards"). Order effects are controlled. Any systematic preference must be source-driven, not content-driven.

Three task domains: news story selection (Political Leaning News Set: 20 outlets; World News Set: 20 outlets), research paper selection (Research Set: top-10 venues across 5 fields), and product seller selection (Ecommerce Set: 70 platforms, 8 regions). Source identities are also varied across brand name, website URL, X/Instagram handle to test cross-identity consistency. Credentials (follower counts, H-5 index, year of establishment) are substituted for brand names to test rationality. Rankings are compared via Kendall \(\tau\) correlation; significance thresholds at \(p<0.01\) (\(\#\)) and \(0.01 \le p < 0.05\) (\(*\)).

Key Contributions

  • Validated the latent source preference hypothesis: LLMs systematically favor certain sources over others when content is held constant, with effect magnitude scaling with model size.
  • Demonstrated cross-model preference correlation: Kendall \(\tau\) between large models reaches 0.81–0.88 (\(p<0.01\)), suggesting shared web-based training data drives convergent preferences.
  • Showed preferences are context-specific: the same journal (e.g., NEJM) is chosen 96% of the time for health papers but only 19% for computer vision papers.
  • Found that direct and indirect rankings diverge: self-reported preferences do not predict deployed behavior; auditing must occur under deployment-like conditions.
  • Identified irrational credential integration: follower counts are sometimes negatively correlated with preference (model-dependent); source-age framing (absolute year vs. years elapsed) yields inconsistent rankings; H-5 index is the most stable rational signal.
  • Showed prompting cannot reliably suppress source preferences, especially for seller recommendations.
  • Provided a case-study reinterpretation: accounting for source preferences substantially changes inferences about LLMs' political biases in prior work.

Results

  • Large models (GPT-4.1-Mini, Phi-4, Qwen2.5-7B-It): preference % variance spans nearly full 0–100% range; smaller Llama/Qwen models show much weaker spread.
  • Cross-model Kendall \(\tau\) (indirect, Political Leaning News Set): 0.57–0.88 for most large-model pairs, all \(p<0.01\); drops to 0.43–0.54 for Qwen2.5-1.5B.
  • DeepSeek-R1-Distill-Llama-8B shows markedly different preferences from Llama-3.1-8B-Instruct despite identical base model, confirming post-training procedure shapes preferences.
  • NEJM: 96% selection rate for Health & Medical Science papers vs. 19% for Computer Vision papers.
  • BestBuy: 51% selection for Grocery products vs. 97% for Electronics products.
  • Cross-identity correlations (brand name ↔ URL ↔ social handle) reach \(\tau \approx 0.77\)–\(0.86\) (\(p<0.01\)) for GPT-4.1-Mini, but drop when surface form diverges from canonical name (e.g., @apfactcheck preferred 80% by brand name, only 51–53% by handle/URL).
  • H-5 index produces near-uniform positive correlations across models and settings; follower count correlations are model-specific and occasionally negative (e.g., \(\tau=-0.96\) for some models).

Limitations

  • Causal mechanism is not established: training data composition and the origin of preferences are not measured directly.
  • Source sets are finite and skew toward prominent, globally recognized entities; preferences for obscure or niche sources are untested.
  • Only 12 models from 6 providers; closed-source models (GPT series) are black boxes, limiting mechanistic analysis.
  • Prompting interventions tested are relatively simple; more sophisticated steering methods (e.g., system-prompt fine-tuning, RLHF) were not evaluated.
  • Section 4 case studies (referenced but truncated in supplied text) provide the main real-world validation; full quantitative results there are not visible.
  • News sources show higher preference variance than research venues or e-commerce, reducing generalizability across domains.

Relevance to Agentic AI / LLM Agents

This paper directly characterizes a systematic bias in how LLM agents prioritize retrieved information—a core operation in RAG pipelines, search agents, and recommendation agents. The finding that source identity outweighs content quality in agent selection decisions means that any agent deployed over a heterogeneous document corpus implicitly embeds a non-transparent editorial hierarchy. The resistance of these preferences to prompting-based suppression is a practical challenge for alignment: agent designers cannot simply instruct neutrality. The brand-impersonation vulnerability (exploiting cross-identity associations) is a concrete adversarial surface for agents that ingest external content, relevant to prompt-injection and supply-chain-of-information attack vectors.