arXiv cs.CY· Jairo Gudi\~no-Rosero, Juan Ignacio Zambrano, Umberto Grandi, C\'esar A. Hidalgo·· 10 天前AI 评分27
推理能力提升 LLM 共识生成对提示词注入的鲁棒性
Reasoning Enhances Robustness to Prompt Injection in LLM-Based Consensus
AI 导读
研究发现，现成 LLM 在生成共识声明时普遍易受提示词注入攻击，尤其在意见分歧均衡、采用理性指令式修辞策略，以及攻击将共识引向 GB-unionist 保守派立场时更为脆弱。结合 GPT-OSS-SafeGuard 注入检测、结构化意见表示与 GSPO 强化学习的鲁棒性流程可大幅减少方向性失败，优于现有最先进方案。
正文 · 原文
Abstract:Large Language Models (LLMs) are gaining traction as a method to generate consensus statements and aggregate preferences in digital democracy experiments. Yet, participants can introduce critical vulnerabilities in LLM-based systems. Here, we examine the vulnerability and robustness of off-the-shelf consensus-generating LLMs to prompt-injection attacks, which consist of introducing strategically designed texts to amplify particular viewpoints, erase certain opinions, or divert consensus toward unrelated or irrelevant topics. Using data collected from a 2023 experiment conducted in the UK and predefining a majority-rule, we construct attack-free and adversarial variants of prompts containing public policy questions and opinion texts, classify opinion and consensus valences with a fine-tuned BERT model, and estimate LLM--human majority agreement rates. Overall, we find that default LLMs exhibit widespread vulnerability, especially when: (i) disagreement and agreement are finely balanced, (ii) under rational, instruction-like rhetorical strategies, and (iii) for attacks that shift consensus toward positions aligned with GB-unionist conservative manifestos relative to pro-independence left manifestos. A robustness pipeline combining GPT-OSS-SafeGuard injection detection, structured opinion representations, and GSPO-based reinforcement learning substantially reduces directional failures, outperforming state-of-the-art alternatives. While more effective detectors may enable more sophisticated attacks, these findings advance our understanding of both the vulnerabilities and the potential defenses of consensus-generating LLMs in digital democracy applications.
| Comments: | 29 pages |
| Subjects: | Computers and Society (cs.CY); Cryptography and Security (cs.CR) |
| Cite as: | arXiv:2508.04281 [cs.CY] |
| (or arXiv:2508.04281v5 [cs.CY] for this version) | |
| https://doi.org/10.48550/arXiv.2508.04281 arXiv-issued DOI via DataCite |
Submission history
From: Jairo Gudiño-Rosero [view email]
[v1]
Wed, 6 Aug 2025 10:10:01 UTC (25,267 KB)
[v2]
Mon, 10 Nov 2025 14:20:03 UTC (23,756 KB)
[v3]
Thu, 8 Jan 2026 21:11:43 UTC (12,598 KB)
[v4]
Sat, 28 Feb 2026 21:46:28 UTC (9,707 KB)
[v5]
Wed, 7 Oct 2026 13:40:55 UTC (9,329 KB)
来源：arXiv cs.CY · arxiv.org