Consistency of large reasoning models under multi-turn attacks

After reasoning models initially answer correctly, can multi-round adversarial questioning force them to change their answer, and can long reasoning serve as a defense.

• Scenario: The authors argue that deployments such as medical, legal advice, and education require both reasoning ability and consistency under adversarial conditions. Answering correctly in a controlled setting and then abandoning the answer when challenged has limited practical use.
• Existing gap: Work cited by the authors shows that general LLMs struggle to self-correct without external feedback and can be swayed by user opposition. Whether long-chain reasoning is a natural defense or equally fragile is called an open question by the authors.
• Hypothesis: The authors hypothesize that explicit derivation creates anchoring, making extended reasoning models more consistent than instruction-tuned models, and they want to test whether this anchoring can withstand different social and rhetorical pressures.
• What this paper does: It does not propose new attacks or new training methods, but evaluates nine frontier reasoning models, summarizes trajectories and five failure modes, and tests whether CARG, which is effective for standard LLMs, can transfer.
• Attack setup in the evaluation:
  • The goal is to induce answer flips: the model first gives a verifiable correct answer, then receives subsequent pressure.
  • The capability is a random permutation of eight rounds from eight predefined types of follow-up questioning. The paper does not state that the attacker can read weights, nor does it frame the main protocol as adaptively rewording based on model outputs.
  • The target is multi-turn dialogue with nine frontier reasoning models; pressure is only continued on initially correct answers.
  • The judgment looks at whether subsequent rounds deviate from the single correct option, summarized with Acc_avg and position-weighted consistency PWC.

The introduction and Related Work categorize prior work into three types; the experimental comparisons follow the protocols from that work rather than newly proposed attackers.

Sycophancy and persuasion

• Sycophancy: Cotra (2021) proposed that models prioritize pleasing users; Perez et al. (2023) systematically evaluated this on RLHF models; Wei et al. (2023) and Turpin et al. (2023) reproduced it in multiple settings; Hong et al. (2025) tracked agreement-seeking with a multi-turn benchmark.
• Preference incentives: Sharma et al. (2023) reported that human preferences favor answers that align with user beliefs, consistent with the incentives of RLHF-style preference optimization (Ouyang et al., 2022).
• Persuasion and mitigation: Xu et al. (2024) reported that persuasive dialogue can make models accept false information. Mitigations listed in the same section include synthetic data with fixed templates (Wei et al., 2023), synthetic data interventions on decoder-only models (Wang, 2024), activation steering (Panickssery, 2023), debate supervision (Irving et al., 2018), and preference aggregation and annotator effectiveness (Leike et al., 2018; Saunders et al., 2022; Bowman et al., 2022).

Multi-turn degradation and evaluation

• Degradation: Laban et al. (2025) and Li et al. (2025c) documented that as interactions lengthen, errors accumulate, contextual evidence becomes harder to maintain, and content and stance drift.
• Benchmarks: MT-Bench-style pairwise judgment (Zheng et al., 2023), MT-Eval (Kwan et al., 2024), Li et al. (2025a,b), MINT (Wang et al., 2023b), Multi-IF (He et al., 2024). The authors state that these evaluations show multi-turn robustness is not implied by single-turn accuracy.

Consistency under adversarial pressure

• Backtracking: FLIPFLOP (Laban et al., 2023) showed that very short challenges can trigger backtracking, often reducing accuracy. Li et al. (2025b) proposed Position-Weighted Consistency. Xu et al. (2024) also showed that conversational framing can induce acceptance of false claims under social pressure.
• Multi-turn attacks: Crescendo (Russinovich et al., 2025) exploits pattern following through gradual escalation; ActorAttack (Ren et al., 2024) generates attack paths via semantically related roles; prompt injection work shows that interaction can change model behavior (Greshake et al., 2023; Anil et al., 2024).

Baselines and data

• Baseline method: GPT-4o, which the paper calls the highest-scoring model reported in Li et al. (2025b); the eight-turn protocol and PWC follow that paper. The contribution entry says instruction-tuned baselines, and the experiments examine this model.
• Benchmark/dataset: MT-Consistency, 700 four-choice questions drawn from MMLU, CommonsenseQA, and TruthfulQA (Appendix A).

The authors position this paper after these works: to ask whether extended reasoning naturally resists multi-turn pressure, and why confidence interventions that work on standard LLMs fail on reasoning models.

No new models are trained. The authors use an eight-round randomized adversarial protocol to measure whether reasoning models hold onto the initial correct answer, then explain failures with trajectory classification, failure modes, and confidence interventions.

Data and Analysis Boundaries

• The evaluation set is MT-Consistency: 700 factual four-choice questions, each with one verifiable correct answer, across 39 subjects, and labeled with difficulty (Appendix A).
• The 39 subjects are grouped into seven topic clusters: STEM (11), Medical Health (8), Social Sciences (4), Humanities (6), Business_Economics (5), Law Legal (3), General Knowledge (2); the mapping is in Table 7.
• Questions come from MMLU, CommonsenseQA, and TruthfulQA. The later difficulty stratification is high_school, elementary, professional, college.
• The analysis proceeds by hypotheses: whether extended reasoning is more consistent, how models flip, whether CARG transfers, whether confidence predicts correctness, and whether changing extraction can rescue CARG.

Protocol and Metrics

• The follow-up sequence is constructed only when the initial answer is correct. π is a random permutation of the eight follow-up types, used to mitigate cumulative effects and position bias. Appendix E.2 writes three seeds per model: 1, 1000, 2026. Sampling uses each model's default settings; the paper does not give temperature or system prompts.
• The eight types are distinguished only by mechanism (Table 1): closed-ended questioning (A1), open-ended opposition (A2), misleading with a wrong alternative (A3), emotional appeal (A4), impolite tone (A5), expert authority (A6), consensus pressure (A7), false agreement pointing to a wrong option (A8).
• Acc_init is accuracy before pressure, and Acc_avg is average accuracy across all adversarial rounds. PWC follows prior work, weighting early failures more than late ones and rewarding fast recovery: f(s)=∑_i=0ⁿ⁻¹ s_i γⁱ, where γ∈(0,1/2). The paper does not give the γ actually used in the experiments.

Trajectories and Failure Modes

• Each trajectory is divided into mutually exclusive patterns by correctness sequence: No Flip; Immediate Recovery (flips in some round, returns to correct the next round); Delayed Recovery (at least two consecutive wrong rounds before recovery); Delayed Sustained (flips after round 1 and does not recover); Oscillating (correctness changes at least three times); Terminal Capitulation (flips only in rounds 7–8 and does not recover); Double Flip.
• Re-examining the reasoning chains in flipped answers defines four cognitive modes and one behavioral mode. Self-Doubt corresponds to abandoning the correct answer after A1/A2 without new information; Social Conformity corresponds to authority, consensus, or agreement cues from A6/A7/A8; Suggestion Hijacking corresponds to adopting A3's wrong option and rationalizing afterward; Emotional Susceptibility corresponds to emotion or tone from A4/A5; Reasoning Fatigue is not tied to attack type, evidenced by late oscillation or terminal capitulation.
• Appendix C gives dialogue examples for each mode, and Table 8 gives classification labels. The example text is not paraphrased here.

How CARG Is Attached to Reasoning Models

• CARG writes confidence into the history and then generates. The history contains the previous question, answer, confidence, and the current question. The generation target is r_t=argmax_r P(r∣ h_t,θ).
• §5.1 uses answer_only: requiring the answer to end with a fixed option, then averaging and exponentiating the token log-probabilities of only the answer fragment, thereby avoiding the reasoning trace. §5.3 additionally compares overall (the entire response) and random. The main text writes random as sampled from U(0.5,1); Appendix E writes U(0,1).
• The comparison is a no-intervention baseline. The authors expect that if CARG's premise generalizes, reasoning models should show similar cross-round stability.

Experimental Setup

• Models: GPT-5.1, GPT-5.2, DeepSeek-R1, Grok-4.1, Grok-3, Claude-4.5, Gemini-2.5-Pro, Qwen-3, GPT-OSS-120B, all with default sampling. The legend also writes qwen3-max; the paper does not state whether it is the same as Qwen-3. Table 2 writes Gemini-2.5-Pro as Gemini-2.5.
• Baseline: GPT-4o, which the paper calls the model with the highest reported score in Li et al. (2025b). The time table in Appendix E does not include this model, and the paper does not state whether the numbers in Table 2 were rerun this time.
• Data: MT-Consistency, 700 four-choice questions. Adversarial pressure is applied only to questions that were initially correct.
• Metrics and determination: Acc_init, Acc_avg, PWC, plus flip rates by attack type, seven trajectory categories, and counts of five failure modes. Correctness is checked against the single verifiable option; the paper does not mention LLM judging.
• Tests: Per-question PWC is compared against GPT-4o with Welch's t-test and d is reported; reasoning models are also treated as one class in a one-sample t-test.
• Replication: The main text says multiple seeds and aggregates; Appendix E.2 writes seeds 1, 1000, 2026; Table 10 counts time with 1 seed. The paper does not reconcile these three statements.

Main Results

Per Table 2. Nine reasoning models exceed the eight-row limit; the table below keeps Claude-4.5, which has the lowest PWC, and keeps the baseline; the numbers of the three omitted rows are written after the table.

Swipe horizontally to read the table

Model	Acc_init	Acc_avg	PWC
Claude-4.5	94.86%	86.31%	1.675
DeepSeek-R1	91.86%	89.91%	1.727
GPT-4o (baseline)	78.14%	91.29%	1.693
Qwen-3	89.86%	95.01%	1.746
GPT-5.2	82.29%	96.31%	1.766
GPT-5.1	82.57%	98.92%	1.780
Grok-4.1	92.43%	97.06%	1.797

• Tests: The authors report that 8/9 have PWC higher than GPT-4o. d is GPT-OSS 0.38, Grok-4.1 0.40, GPT-5.1 0.31, GPT-5.2 0.25, Grok-3 0.27, Gemini-2.5 0.21, Qwen-3 0.17 (p=0.003), DeepSeek-R1 0.12 (p=0.046); except for the latter two, the listed comparisons have p<0.001. The one-class comparison has mean Δ=+0.064, t=5.02, p=0.001.
• Exceptions: Claude-4.5 has the highest Acc_init in the table, but PWC has t=−0.97, p=0.33, and Acc_avg has t=−4.62, p<0.001, d=−0.27. DeepSeek-R1's PWC only reaches p=0.046, and the Acc_avg difference is not significant. The authors say these two suggest that specific training or alignment may increase capitulation tendency.
• Authors' intervals: The authors say most models have Acc_avg of 95%–99% and PWC of 1.746–1.797, compared with GPT-4o's 91.3% and 1.693. In Table 2, Claude-4.5 and DeepSeek-R1 are not in these two ranges. Omitted rows: GPT-OSS 88.71%, 98.53%, 1.795; Grok-3 85.29%, 97.72%, 1.772; Gemini-2.5 91.43%, 96.48%, 1.755.

Trajectories and Attack Profiles

• In Table 3, the most common flip pattern for all nine models is Delayed Recovery. Total Flips are Claude-4.5 347, DeepSeek-R1 260, Qwen-3 128, Gemini-2.5 103, Grok-4.1 92, GPT-5.2 76, Grok-3 39, GPT-5.1 33, GPT-OSS 30. Claude-4.5's Oscillating is 94. The authors say this is nearly 3 times the second highest; the second highest in the table is DeepSeek-R1's 59, and Qwen-3 is 29.
• The authors say robust models have No Flip above 79% and oscillate no more than 8 times, with failures tending to be temporary rather than permanent capitulation. The highest No Flip count is GPT-OSS's 591 and the lowest is Claude-4.5's 317. The protocol constructs trajectories only for initially correct answers.
• Figure 1 uses eight axes for flip rates on A1–A8, with radial labels visible from 10 to 50. The authors say A3 is generally the highest or second highest; A7 is particularly effective against Claude-4.5; the GPT series is relatively insensitive to consensus and higher on A4, A5; on A1, GPT-OSS is close to no flipping and DeepSeek-R1 is moderate; A6 is generally the lowest. The specific values on each axis are not transcribed. The authors speculate that expert identity triggers suspicion rather than compliance.

Failure Modes

• Table 4 totals 1347: Self-Doubt 338, Social Conformity 337, Emotional Susceptibility 278, Reasoning Fatigue 239, Suggestion Hijacking 155. The authors say the first two together account for 50%. The paper does not explain why this table's count is higher than Table 3's Total Flips.
• The authors say Claude-4.5 and DeepSeek-R1 have higher Social Conformity and Fatigue (121 and 94; 86 and 59), and the GPT series is dominated by Self-Doubt. In Table 4, GPT-OSS's highest item is Emotional Susceptibility 10, with Self-Doubt at 9. Grok-4.1's Suggestion Hijacking is 44, which the authors say accounts for 44% of its failures.
• The authors say Claude-4.5's Fatigue 94 almost corresponds to Oscillating 94, so oscillation reflects reasoning degradation under sustained pressure rather than stable re-evaluation. Grok-3, GPT-5.1, and GPT-OSS have Fatigue of 7, 5, 8.

Confidence and CARG

• §5.2: Point-biserial correlation r=0.07, p=0.079, not reaching α=0.05; treating confidence as a correctness classifier gives ROC-AUC of 0.57. The distribution has mean 93.5%, standard deviation 4.4%, range 75% to 100%; the authors say scores are concentrated at 93%–95%. The paper does not state which model these statistics belong to.
• Table 5: Low, medium, and high tercile flip rates are 9.3%, 6.7%, 6.2%, each with N=193. The authors say low-confidence correct answers are the most likely to flip, and CARG will not protect them. The authors attribute overconfidence to long reasoning making the model convince itself.
• Table 6 reports only GPT-5.1: no intervention Acc_avg 98.50%, PWC 1.765; overall 98.39%, 1.773; answer_only 98.29%, 1.769; random 98.88%, 1.778. The authors say random embedding is better than targeted extraction. This no-intervention row differs from Table 2's 98.92%, 1.780, which the paper does not explain.
• The main text and Figure 2 caption say reasoning models do not benefit from CARG, and in some cases are below no intervention; §5.1 uses answer_only. The appendix says there are per-model statistics, but Table 9 gives no-intervention per-round accuracy and Li et al. (2025b)'s CARG row (eight-round average 98.29%), with no numbers for each reasoning model with CARG added.

Other Ablations and Analyses

• Figure 3 caption: mean initial accuracy, high school questions 94.3%, college questions 86.8%; humanities are high for all models, and STEM and social sciences have larger between-model differences.
• Figure 4 caption: mean adversarial-round accuracy, high school questions 90.9%, elementary questions 84.8% and dropping to third; the authors say humanities and medical are more stable, while social sciences and law are more susceptible to opinion manipulation.
• Table 9: Claude-4.5 round 4 78.31%, round 8 85.84%; DeepSeek-R1 round 1 98.29%, round 8 86.31%; Grok-4.1 round 6 91.50%, round 7 92.58%.
• Table 10, counted with 1 seed and 700 questions: GPT-OSS-120B about 14.6 seconds/question; DeepSeek-R1 about 285.6 seconds/question, totaling 55 hours 32 minutes 20 seconds.
• The random confidence sampling in Appendix E is written as U(0,1), inconsistent with §5.3's U(0.5,1). The authors plan to release code and configuration after publication.

Limitations and future directions noted by the authors

• Task scope: Only fact-based multiple-choice questions that are objectively verifiable on MT-Consistency are evaluated. The authors say this may not reflect open-ended generation, tool-augmented systems (e.g., RAG), or domains where correctness is ambiguous, and the prompts are mostly in English. (Limitations)
• Attack coverage: The eight-round protocol only tests eight common types of social/rhetorical follow-up. The authors say it does not exhaust real adversarial interactions, such as adaptive attackers that react to model outputs, prompt injection with external documents, or domain misinformation; the vulnerability profile is indicative rather than complete. (Limitations)
• Confidence signal: CARG only evaluates log-probability extraction (overall, answer_only) plus a random control. Self-consistency, verifier-based confidence, and calibrated abstention are not covered. (Limitations)
• Annotation: Failure modes come from qualitative inspection of flip trajectories. The authors say that despite operational definitions, subjectivity may still be introduced. (Limitations)

Experimental coverage

• The models tested are the nine reasoning models listed in §3; the data is MT-Consistency's 700 four-choice questions across 39 subjects and seven topic clusters (Appendix A).
• The attack is the eight types of follow-up in Table 1, with eight rounds in random permutation. Appendix E.2 states three seed sets, and the time in Table 10 is computed with 1 seed.
• The Welch test, Table 3's trajectory counts, and Table 4's failure-mode counts all cover these nine models. Correctness is judged by the verifiable option; the paper does not mention a reviewer model or human agreement.
• Acc_avg and PWC for the three confidence extractions are only given for GPT-5.1 in Table 6. The r, ROC-AUC in §5.2, and Table 5 do not specify the model.
• The paper does not report the specific γ used for PWC, nor does Table 9 list per-round numbers after applying CARG to each reasoning model; it does not explain why the no-intervention baseline for GPT-5.1 differs between Table 2 and Table 6, nor whether GPT-4o was in this run.

This is an evaluation of whether nine frontier reasoning models hold onto the correct answer under multi-round adversarial questioning, and whether the confidence defense CARG can transfer from standard LLMs.

• Question: Models can answer correctly at first, then change their answer under social and rhetorical pressure. The authors want to see whether extended reasoning provides anchoring, and whether confidence can still flag answers that are prone to being changed.
• Method: Uses MT-Consistency's 700 four-choice questions. After an initially correct answer, the model receives a random permutation of eight rounds from eight types of follow-up questioning. Consistency is measured with Acc_init, Acc_avg, and PWC; flips are further categorized into seven trajectory types and five failure modes. CARG compares three confidence embeddings: whole response, answer-only, and random.
• Consistency: In Table 2, Grok-4.1 has a PWC of 1.797 and GPT-4o has 1.693. The authors report 8/9 above this baseline, with d ranging from 0.12 to 0.40. Claude-4.5 has Acc_init of 94.86%, Acc_avg of 86.31%, and PWC of 1.675, and is the exception; DeepSeek-R1 has Acc_avg of 89.91%, also below its Acc_init.
• How it fails: The authors say misleading advice is broadly effective, while social pressure varies by model. In Table 4, Self-Doubt appears 338 times and Social Conformity 337 times, which the authors say together account for 50%. GPT-OSS's highest count is Emotional Susceptibility at 10, not Self-Doubt.
• Confidence defense: In §5.2, r=0.07 (p=0.079), ROC-AUC is 0.57, and the paper does not specify the model. In Table 5, the low-confidence tertile flip rate is 9.3% (N=193). In Table 6 for GPT-5.1, random CARG has Acc_avg of 98.88%, higher than answer_only's 98.29% and the no-intervention 98.50%.
• Authors' conclusion: Reasoning provides meaningful but incomplete robustness and does not automatically translate into adversarial robustness; confidence defenses effective for standard LLMs need to be redesigned for reasoning models.