Safety
Benchmarking Factual Robustness of LLMs via Multi-conversation Persuasion
arXiv:2609.16777v1 Announce Type: new Abstract: As Large Language Models (LLMs) increasingly serve as primary knowledge retrieval interfaces, their robustness against extit{persuasion attacks}---attem
arXiv:2609.16777v1 Announce Type: new Abstract: As Large Language Models (LLMs) increasingly serve as primary knowledge retrieval interfaces, their robustness against extit{persuasion attacks}---attempts to inject misinformation or enforce counterfactuals---has become a critical safety concern. Existing red-teaming frameworks typically evaluate models in multi-turn dialogues where the target model retains full conversation history. We identify a critical flaw in this setting termed extbf{Refusal Inertia''}: a model's initial refusal often propagates through subsequent turns largely to maintain contextual consistency, thereby masking its true vulnerability to sophisticated, isolated persuasion attempts. To rigorously evaluate the cold-start'' defense capabilities of SOTA models, we introduce the extbf{SAST-IR} (Stateful Attacker, Stateless Target - Iterative Refinement) framework. By enforcing a memory wipe on the target while retaining the attacker's history, we simulate a worst-case adversarial setting using extbf{multi-turn} (stateless) iterations. Leveraging extbf{CP-Agent} (Cognitive Persuasion Agent), an enhanced diagnosis-guided agent, our experiments on the custom extsc{CounterFact-Strict} dataset (N=50) yield alarming results: simple, diverse attack strategies achieved a staggering extbf{96%} success rate, exposing severe brittleness in memory-less defense. Furthermore, we reveal a extbf{``Complexity Paradox''}: while complex, iteratively refined attacks are effective, they often trigger defensive compliance, whereas simple strategies achieve a higher rate of genuine persuasion (extbf{84.7%}). Our code and dataset are available at GitHub, https://github.com/cza1006/llm-persuasion-defense.
Related
- Belief Cascades Drive Persuasion in LLM Agent Networks
- Semantic Variability of Replies Across LLMs: Implications for Designing Conversation-Based Assessment
- Learning-Based Automated Adversarial Red-Teaming for Robustness Evaluation of Large Language Models
- PsychoPass: Geometric Profiling of Multi-Turn Adversarial LLM Conversations
- The Autocorrelation Blind Spot: Why 42% of Turn-Level Findings in LLM Conversation Analysis May Be Spurious
Source: arXiv cs.CL | 2026-09-16