Authority Is a Claim, Not a Lineage: Provenance Blindness in Instruction-Tuned Models

An instruction hierarchy is meant to make a model weigh an instruction by the trust of its source. We show that open instruction-tuned models weigh the authorization claim in front of them instead. Holding an authorization text fixed and varying only the channel it arrives through, Olmo-3-7B and Qwen3-8B obey a pasted document, a prior assistant turn, or a tool output as readily as a genuine system grant. The sharpest case is a minimal pair: the same words from the same user, reframed as a pasted document, are obeyed more often than when the user states them directly, inverting the ordering the hierarchy exists to encode. We call this provenance blindness, and find it again on three external benchmarks and in an agentic probe where every untrusted channel triggers a tool call more often than a genuine grant. The failure is developmental: on Olmo-3's open training ladder, refusal without authorization is installed at supervised fine-tuning, source tracking is never installed, and no post-training corpus carries instruction-hierarchy data. It is a failure of consultation rather than of information: the source is linearly decodable and transfers to a held-out channel at middle layers, yet is only weakly causal for compliance. A probe gate at that layer, used as a measurement instrument and not as a proposed defense, drives laundering to zero on every channel including held-out ones while firing on under 0.5% of genuine grants, so the signal suffices once consulted. Can weight training make the model consult it? With a carrier role held out, no objective we test does. Token-level fine-tuning at any data coverage, the official Circuit Breakers recipe, a source-direction-keyed interchange objective, and shortcut-subspace ablation all leave the held-out role at or above a 0.61 laundering rate whenever the genuine-grant and no-authorization floors hold, and whole-model full fine-tuning of all 32 layers leaves it unmoved at a capability-preserving rate. Several objectives do reach novel wrappers of a trained carrier role; none reaches a role it never saw. Among model-level defenses, on this evidence, the discrimination that generalizes across carrier roles is one the model carries at inference rather than in its weights.