One Pixel of Reasoning: A Single True Relation Is Enough to Mislead an LLM Agent

Can a single source-supported sentence, by constraining only one implicit evidence–conclusion relation, push an agent from a correct judgment to a false belief.

• Setting: In code review and biomedical evidence synthesis, agents must judge which vulnerabilities need fixing and which findings support medical claims. The authors state that adaptive workflows can incorporate attacker-provided annotations together with the original evidence (Hu et al., 2026b), so the agent must judge both whether the statement is true and whether it constitutes a reason to change the conclusion.
• Gap in existing methods: Adversarial additions, indirect instructions and retrieval poisoning already exploit external evidence, while Generative Montage assembles real fragments into a misleading narrative. The authors state that examples still leave a more local question: can a single sentence targeting an implicit relation lead to a false belief while the original evidence is preserved.
• Core observation: Inspired by the one-pixel attack, the sparse budget is one selected relation plus one released sentence, not text length. Constraining that link is misleading with true statements (paltering) in a single direct intervention, rather than multi-turn persuasion.
• Proposed method: The authors propose the one-relation attack (ORA), which the abstract calls a novel cognitive attack. It reconstructs an implicit relation as a warrant, uses one source-supported undercutter to constrain applicability or sufficiency, and releases it with bounded queries or zero queries.
• Threat model:
  • Goal: Cause a belief leap on the initially correct set, i.e., the recorded answer changes from gold to non-gold. Under an ideal admissible intervention, the answer guaranteed by task semantics is unchanged.
  • Knowledge: The attacker knows the question, the evidence and the gold label y⋆, but not the victim's parameters, gradients or hidden reasoning.
  • Capability: Append only one sentence; original evidence units and order are unchanged; query mode allows at most K victim evaluations for separately injected candidates, while zero-query commits to one sentence before seeing any victim response to generated candidates. The choice may use bounded victim queries or no victim feedback at all.
  • Victim system: LLM agents that use retrieved documents, tool outputs and peer reasoning; this paper evaluates biomedical inference and vulnerability detection.

Distraction and injection on the evidence channel

• Jia and Liang (2017) add adversarial sentences to reading comprehension, which can distract the model's attention while preserving the correct answer. Shi et al. (2023) discuss sensitivity to irrelevant context; Gao et al. (2026) discuss a small amount of semantically related distraction in long-context reasoning.
• Greshake et al. (2023) place malicious instructions in external content, forming indirect prompt injection. InjecAgent (Zhan et al., 2024) evaluates harmful actions and data exfiltration; AgentDojo (Debenedetti et al., 2024) examines both attack resistance and legitimate task completion.
• PoisonedRAG (Zou et al., 2025) inserts malicious documents into the retrieval corpus to induce an attacker-chosen answer. Suffix-style or persuasive jailbreaks (Zou et al., 2023; Zeng et al., 2024) are used to bypass safety constraints.

True statements and argumentative relations

• Paltering in Rogers et al. (2017) uses true statements to create a misleading impression. Generative Montage (Hu et al., 2026c) realizes this threat with coordinated true fragments.
• Toulmin (1958) uses warrants to connect grounds and claims. Habernal et al. (2018) distinguish plausible warrants that connect the same premise to opposing claims; Lawrence and Reed (2019) survey argument structure recovery.
• Pollock (1987) undercutting questions the support for an inference without asserting the opposite conclusion. Defeasible NLI (Rudinger et al., 2020) evaluates or generates new information that can strengthen or weaken an inference.

Baselines and benchmarks

• The main experiments do not use the above attacks as controls. The paired controls are random warrant (the undercutter is redirected to a non-answer-bearing relation) and random content (a neutral paraphrase on the selected grounds), with 100 cases per domain, on PubMedQA and PrimeVul.

The authors position ORA as: targeting one implicit evidence–conclusion relation, using information already present in the original evidence to make a source-supported constraint, so that the interpretation of unmodified evidence becomes the attack target; this differs from distraction sentences that preserve the correct answer, external malicious instructions, and narratives assembled from multiple true fragments. The formal analysis and paired controls connect the positioning and the constraint to decision flips.

Attack model A reconstructs and ranks warrants, generates and checks source-supported constraints, then releases one sentence. The budget K caps both the number of candidates and the victim queries in the selection stage. The authors give a flip threshold in an additive single-coordinate model, C_w=η_wmax_{y≠ y^⋆}([d_yw]₊)/(γ_y): the adversary strictly exceeds the gold label within the feasible constraint strength if and only if C_w>1; if it is less than 1, the gold label remains the unique optimum on that feasible set. Appendix Q additionally gives a multi-relation extension and a nonlinear bound; the formulas are not expanded here.

Problem setting and attack surface

• The victim model receives question q and evidence E. The attacker adds sentence δ, yielding E′=E⊕δ, with the original evidence units and order preserved.
• The attacker-side argument hypergraph maps source propositions to nodes, and warrants are directed hyperedges from non-empty grounds to a claim. These relations are explicitly reconstructed by the attacker, not annotations native to the source text.
• Ideal admissibility requires: δ points only to the selected warrant, is entailed by the source text, and constrains the applicability or sufficiency of that relation rather than asserting the opposite claim.
• The success event is a belief leap: the clean answer equals the gold label, and the answer after adding δ does not equal the gold label. ASR is the average of these events over completed initially correct evaluations.

Argument graph and key warrant

• Graph construction: Given (q, E), A records each warrant's claim, source grounds, backing strength, visible defeaters and answer-bearing indicator a(w). Answer-bearing relations support claims judged to affect the verdict; peripheral relations concern details that need not decide the verdict.
• Localization: Relation salience is RS(w)=L(w){λ U_inst+(1−λ)D(w)}, and w⋆ is the maximum. L(w) is determined by a(w), and D(w) increases as backing is weaker and visible defeaters are more numerous. The authors state that the two respectively proxy the relation's influence on the verdict and the likelihood of being hit by a source-supported constraint.
• Parameters: In the reported configuration, L is 1 for answer-bearing and 0.4 otherwise; λ=0.5. κ_def is 0.34 for medicine and 0.5 for Cyber. The medical frozen pipeline uses one entropy sample, so U_inst=0; Cyber uses three. Medical sampling requests temperature 0.8. Ties are broken by draw order.

Generation, validation and release

• Generation: Conditioned on w⋆, its grounds, the full text and y⋆, A generates at most K sentences, each with intent target {w⋆}. The prompt requires a source-supported constraint on the applicability or sufficiency of the inference and invites a non-gold answer without writing that answer out. Appendix K gives the full prompts.
• Validation: A lexical check flags entities, numbers or code tokens not present in the source text, used for the zero-query fallback; semantic source support does not participate in release but is judged separately by an audit against the original text after release.
• Query: Non-empty candidates are evaluated in generation order, and the first sentence within budget that makes the belief leap 1 is released; if none succeeds, it is recorded as a failure. Each victim evaluation still adds only one sentence.
• Zero-query: A assesses source grounding, unobtrusiveness and expected misleadingness, and selects one sentence before seeing any victim response. If the proposed index fails the lexical check and the eligible pool is non-empty, the highest-misleadingness item in the pool is selected instead. Appendix H gives pseudocode and the fallback.

Evidence channels in the two domains

• PubMedQA uses the question, the full labeled abstract and YES/NO/MAYBE. Sentences have stable identifiers; the undercutter is inserted after the selected grounding sentence, otherwise at the end of the results section or the end of the abstract, and becomes a new numbered evidence unit.
• PrimeVul uses the full function without editing it; the undercutter is an analysis note corresponding to a tool or reviewer observation. Victim models in both domains see the complete original evidence.
• Medical graph extraction links abstract sentences to PICO variables; Cyber links operations, guards and data flows to vulnerability judgments. Appendix I specifies insertion positions and rotation dimensions.

Experimental Setup

• Victim models: 18. Closed-source: GPT-4.1-nano, GPT-4.1-mini, GPT-4.1, GPT-5.4-nano, GPT-5.4-mini, GPT-5.4, GPT-5.6-luna, GPT-5.6-terra. Open-source: DeepSeek-R1-Distill-Qwen 7B/14B/32B, Qwen2.5-Instruct 7B/14B/32B, Phi-4-mini-instruct, Phi-4, Phi-4-mini-reasoning, Phi-4-reasoning. In the table, R denotes the Phi reasoning variants, and DeepSeek-R1 denotes that distilled family.
• Data: 1000 each from PubMedQA and PrimeVul. PrimeVul is 500 vulnerable functions plus 500 benign functions drawn with seed 42; functions longer than 2500 characters are filtered out, and retained functions are not truncated or edited.
• Attack and denominator: The construction model is GPT-5.6-LUNA, the same as GPT-5.6-luna in the victim list. Main results are best-of-10. ASR is computed only on the initial correct samples that the victim model had already completed; missing plans or failed calls are excluded and not counted as successes. Model averages are unweighted.
• Metrics: Acc is clean accuracy on the 1000 items. Conf is the average self-reported confidence of flipped samples, and HC-Conf is the proportion of those with p≥0.8. The medical main table takes, for flips with confidence, the lowest signed belief within budget, i.e., the highest-confidence error; Cyber takes the first successful response. Correct is +p, incorrect is −p.
• Judging: Source support and blind identification are separate calls to Luna. Exact requires the returned identifier to equal the hidden injected identifier; Clean FP counts any suspicion on unmodified input. Joint is supported and not exactly localized. The query audit covers Luna's successful attacks, and the zero-query audit covers all deployed sentences.
• Other protocols: Ablations use 100 cases per domain, 3 candidates, seed 20260924, with Luna as both attacker and victim. Debate uses Luna, DeepSeek-R1-Distill-Qwen-14B and Phi-4, with 149+149 medical and 83+83 Cyber, seed 42. Belief bands use 800 instance-bootstraps, seed 0. Decoding varies by provider, and the paper states it is not uniformly deterministic. The paper does not report the number of repetitions across random seeds for the main experiments.

Main Results

The abstract reports: across eighteen models, on biomedical inference and vulnerability detection, the average best-of-10 rate of flipping initially correct answers is 54.9% for closed-source and 80.0% for open-source. The table below gives the per-domain unweighted means from Table 1, plus the model with the lowest ASR and a row for the attack model itself as victim.

Swipe horizontally to read the table

Model	Medical Acc	Medical ASR	Cyber Acc	Cyber ASR
GPT-5.4	71.9%	63.6%	68.9%	36.6%
GPT-4.1-mini	73.3%	56.9%	54.0%	39.8%
GPT-5.6-terra	77.7%	47.6%	69.2%	42.9%
GPT-5.6-luna (i.e., the attack model)	73.5%	59.6%	70.7%	57.6%
Proprietary Avg.	71.4%	57.8%	64.0%	51.9%
Qwen2.5-32B	70.0%	48.7%	58.0%	97.2%
DeepSeek-R1-7B	47.5%	93.7%	53.1%	92.5%
Open-Weight Avg.	64.9%	66.8%	54.4%	93.1%

• The authors state that Table 1 shows broad susceptibility: open-source is higher on Cyber, while closed-source has a smaller gap between the two domains and in the opposite direction. Among the 12 models not listed in the table, the highest Cyber ASR is Phi-4-mini at 99.4%, GPT-4.1 is 82.8%, and DeepSeek-R1-32B is 99.3% (all per Table 1).
• The authors state that clean accuracy provides little guarantee, and larger scale does not guarantee decision stability: from 14B to 32B, medical clean accuracy rises for Qwen2.5 with similar susceptibility, and rises for DeepSeek-R1, and both have Cyber ASR above 97%.
• The authors state that all five reasoning-oriented controls have higher medical best-of-10 ASR. On Cyber, DeepSeek-R1 remains higher than Qwen2.5 at the same scale, and the Phi reasoning variants are lower but still above 80% (in Table 1, Phi-4-R is 80.4% and Phi-4-mini-R is 91.7%).

Transfer Without Victim Feedback

• What was tested: Table 2 compares Query, with at most ten victim test candidates, against Zero, chosen by the attacker itself. 10 models are listed; zero-query ASR is not reported for the GPT-4.1 family, the GPT-5.4 family, Phi-4 and Phi-4-mini.
• Results: The authors state that Query is higher than Zero for every listed model–domain pair, but Zero remains effective in both groups and both domains. The lowest listed value is GPT-5.6-terra's Cyber Zero at 20.5% (its Query is 42.9%); Qwen2.5-32B's Cyber Zero is 83.1% and Medical Zero is 28.3%.
• Authors' interpretation: The authors state that source-visible reasoning relations provide a target that transfers across decision rules and reasoning capabilities, and that the threat is not limited to settings where the victim model can be interactively queried. The domain gap still varies by model family.

Source Support and Identification Under LLM Judging

• What was tested: Luna performs source support and blind identification separately on the same input. Table 3 reports the fabricated-fact rate FFR, exact identification Exact, clean-input false positives Clean FP, and Joint (supported and not exactly localized).
• Results: Medical query Joint is 83.1% (FFR 11.9%, Exact 7.5%, Clean FP 25.6%); Cyber query is 90.9% (4.2%, 8.8%, 2.2%). Zero Joint is 87.7% Medical and 92.1% Cyber. Appendix N: the actual joint counts for query are 364/438 for medical and 370/407 for Cyber, accounting for 49.5% (735) and 52.3% (707) of Luna's initially correct inputs, respectively.
• Authors' interpretation: The authors state that source support cannot resolve the verdict; blind detection flags roughly a quarter of clean inputs in medicine (25.6% in Table 3) but rarely localizes the injection. In the opening example of Appendix C, an in-bounds written note changes a correct vulnerability verdict to safe with confidence 0.98, and passes source support while the detector does not flag the unit. The appendix gives the original text of that sentence.

Team Revision After Multi-Agent Debate

• What was tested: All three answer correctly before the attack, and after the frozen best-of-10 sentence flips Luna, all see the same attacked evidence. Teams are balanced between correct and incorrect before debate. Table 4, Figure 3, Table 13.
• Results: Merged Contam 23.7%, Recover 4.7%, Error 59.5%. Per-domain Error is 60.7% Medical and 57.2% Cyber. Table 13 merged is 55 correct-to-incorrect and 11 incorrect-to-correct; final errors comprise 221 persistent errors and 55 new errors, a net increase of 44/464. The authors state that correct-to-incorrect is five times the repairs, and the error rate goes from 50.0% to 59.5%.
• Authors' interpretation: The authors offer one explanation: all agents see the injected sentence, and peer agreement may reinforce the same interpretation without providing independent grounds. The authors state that this separates "adding perspectives" from "adding evidence," and connect it to the difficulty of correction without external feedback. The stratified exact test in Appendix R gives a merged p-value of 3.07×10−9; the paper does not present this test as anything beyond a significance statement, and only the p-value is reported here.

Other Ablations and Analyses

• Search budget (Table 10): closed-source Medical average ASR is 18.6% at K=1 and 57.8% at K=10; open-source Cyber is 60.4% and 93.1%. The authors state that closed-source Medical increases by a further 39.2 percentage points after K=1. Figure 2 endpoint labels are K=1: 0.19 and K=10: 0.58 for closed-source Medical, and 0.60 and 0.93 for open-source Cyber; bands are 95% instance-bootstrap intervals.
• Paired ablation (Table 5): merged best-of-3 ASR is 46.0% for ORA, 24.0% for random warrant and 19.5% for random content; the authors state these are 22.0 and 26.5 percentage points higher, respectively. Table 12 merged single-candidate is 27.8%, 13.2%, 10.8%; Cyber single-candidate random content is 17.0%, higher than random warrant at 11.0%. The Cyber exact p=0.136 for random content, and the authors state that this content control is inconclusive.
• Confidence (Table 1, Appendix B): Luna's medical flip Conf is .943 and HC-Conf is 100.0%; GPT-5.4-nano's medical HC-Conf is 9.8%. On 32B Cyber, high-confidence errors account for 75.6% (DeepSeek-R1) and 67.2% (Qwen2.5) of eligible cases. From 14B to 32B, DeepSeek-R1's medical ASR rises while HC-Conf falls, and Qwen2.5's ASR is similar while HC-Conf rises.
• Direction (Table 11, Table 16): On 32B, 290/293 of the vulnerabilities initially identified by DeepSeek-R1 are judged safe after the attack, and 149/152 for Qwen2.5. In Table 11, DeepSeek-R1-32B's benign-to-vulnerable rate is .996 (denominator 260), while Qwen2.5-7B's aggregate result is mainly contributed by benign false positives (B→V .919, denominator 470; its vulnerable-to-safe is 1.000, denominator 31).
• Belief shift (Figure 4): On the merged successful-flip subset across eighteen models, the paired signed belief shift is −1.65 for medical (n=12191) and −1.74 for Cyber (n=10556). The authors state that the near-zero aggregate values may simultaneously contain high-confidence correct and high-confidence incorrect cases.
• Reasoning variants (Table 1, Appendix D.1): Phi-mini medical Acc goes from 57.9% to 66.3%, and ASR from 58.2% to 80.5%. Phi-4 medical HC-Conf goes from 44.9% to 85.7% for the reasoning variant. On Cyber, the two Phi reasoning variants have lower ASR than the corresponding models, and zero-query is still 50.9% and 45.4% (Table 2).

Limitations and future directions noted by the authors

• The evaluation is a single-relation intervention on fixed biomedical and code evidence pools, with the original evidence available throughout the attack. This design measures how easily initially correct decisions can be flipped; the frequency of failures in practice also depends on what evidence an attacker can insert and what tasks the agent performs. (Limitations)
• The victim models cover multiple families and reasoning capabilities; more attacker families, and evidence that changes over time, would broaden this evaluation. (Limitations)
• Extending to other languages or modalities would also require adapting source units and checking how implicit relations are reconstructed, because the expression and interpretation of arguments may depend on context and language patterns. (Limitations)
• The end-to-end latency and cost of a full agent pipeline remain to be measured. (Limitations)
• Query and zero-query provide complementary conditions with and without victim feedback; the candidate defenses in Appendix T can be re-evaluated under these conditions for future work to consider. (Limitations)
• The Conclusion states that these results motivate deployment analysis of cognitive attacks and consideration of the possible defenses in Appendix T.

Scope of the experiments

• The victim models are the 8 closed-source and 10 open-source models listed in Section 4 and Appendix I, 18 in total; 1000 per domain, and the ASR denominator is the initially correct samples completed by each model (Table 1).
• The benchmarks are PubMedQA and PrimeVul. PrimeVul is balanced between vulnerable and benign functions, uses sampling seed 42, and filters out functions longer than 2500 characters (Appendix I, J).
• Attack construction is done by one model, GPT-5.6-LUNA; the main release is best-of-10 and zero-query. The source-support and blind-identification review is also Luna, which the paper states is the same model family as the attacker (Section 4.2; Appendix Q.2). The zero-query in Table 2 lists 10 models.
• Debate uses Luna, DeepSeek-R1-Distill-Qwen-14B and Phi-4, with one revision on balanced initial team states; medicine 149 vs. 149, Cyber 83 vs. 83 (Appendix O). The ablation is 100 cases per domain with 3 candidates per arm (Table 5).
• The paper reports 800 instance-bootstrap runs for the belief curves, and paired and stratified exact test p-values in Appendix R, Table 15. The paper does not report the number of repetitions across random seeds for the main experiments.

ORA treats an implicit evidence-to-conclusion relation as an attack surface: the original evidence remains intact, and adding just one source-supported qualifier may cause the agent to change its judgment.

• Problem: In biomedical inference and vulnerability detection, agents must both check whether a statement has a source and judge whether it is sufficient to change the conclusion. The authors target the latter. The attacker knows the question, the evidence and the gold label, but not the victim's parameters, gradients or hidden reasoning.
• Method: The attack model reconstructs the evidence as an argument graph, selects a warrant by answer relevance and source-visible defeatability, and generates an undercutter. Release either takes the first successful candidate within at most 10 victim queries, or selects on its own when there is no feedback. In the ideal setting, the sentence qualifies the relation without writing out an incorrect verdict.
• Main results: The abstract gives the best-of-10 average ASR across eighteen models and two domains: 54.9% for closed-source and 80.0% for open-source. The per-domain unweighted means in Table 1 are 57.8% Medical and 51.9% Cyber for closed-source, and 66.8% Medical and 93.1% Cyber for open-source. The listed model with the lowest Cyber ASR is GPT-5.4, at 36.6%.
• Transfer and downstream: For the model–domain pairs listed in Table 2, no-feedback ASR is lower than query, but flips still occur; GPT-5.6-terra's Cyber zero-query is 20.5%. Among Luna's query successes, Medical Joint is 83.1% and Cyber is 90.9% (Table 3). After balanced debate, the merged team error rate goes from 50.0% to 59.5% (Table 4).
• Controls and authors' conclusions: In the 100 paired cases where Luna is both attacker and victim, the merged best-of-3 ASR is 46.0% for ORA, lower than which are random warrant at 24.0% and random content at 19.5% (Table 5). The authors state that a single source-supported qualifier can rewrite the conclusion while the full text remains visible; scale and reasoning-oriented training can accompany higher clean accuracy without bringing stronger resistance to relation manipulation. The authors accordingly discuss deployment analysis and possible defenses.