Fake news articles can flip 74%-82% of LLM forecasting system predictions
Start here
Researchers propose an attack on LLM forecasting systems that use retrieved news as evidence: the attacker only needs to know the forecasting question and publish a fabricated news article, without access to the model, retriever, or query. On stock and real prediction-market questions, once the fake article enters the model's context, it can flip 74% to 82% of predictions opposing it on every frontier model tested; the models cannot verify that it is fabricated and still accept it, while average accuracy remains nearly unchanged; about 90% of runs by two leading deployed forecasting systems retrieve the fake article. Publishing two articles in opposite directions makes the model not hedge and still give a confident prediction the attacker can no longer control. Two defenses, passage filtering and partitioned retrieval, each block the single-article attack but are bypassed by a single prompt change; used together they block both bypasses of four articles but are defeated by sixteen distorted copies, changing 29% of clean decisions and discarding 39% of genuine news. Partitioned retrieval also requires control of the retrieval index; for systems searching the open web, only filtering remains available, and the attack still works.
Generated by AI from reports · Updated 2 days ago
Attention and developments
Attention, hourly
Now 42, -1% in 24 hours·Peak 44 (Nov 13 18:00)
Related research
This event's paper
- One Fabrication Is Enough: A Fake News Article Changes the Forecasts of LLM Forecasting Systems
arXiv · 2026-11-11 · Deep reading
Progress timeline
- arXiv: 其他 AI 安全论文SelectedOne fabrication is enough: a single fake news article changes the predictions of an LLM forecasting system
A paper by Northwestern University researchers empirically tested a retrieval poisoning attack against an LLM forecasting system: an attacker only needs to publish one fake news article supporting a particular direction, without touching the model or the retriever. After the article enters the model's context, 74% to 82% of predictions that originally opposed that direction were flipped, and this held across all five frontier models tested; the AIA Forecaster and xAI Grok ForecastBench systems, reproduced according to public descriptions, retrieved the article in about 90% of runs. The model cannot verify whether the article is true or false; after the attack, the forecaster's average accuracy is almost unchanged, but the direction of predictions swings with the attacker's bets, and two fake news articles in opposite directions do not cause the model to hedge. Paragraph filtering and partitioned retrieval can each block a single-article attack, but each can be bypassed by a single prompt change; used together they can block four articles but are defeated by sixteen distorted copies, and they change 29% of decisions made without attack and discard 39% of genuine news; partitioned retrieval also requires the deployer to control the retrieval index, so systems that search the open web cannot use it.
Related discussion
Attention trend
New sources per day
- Nov 13: 1 new sources (1 outlets, 0 accounts)
- Nov 14: 0 new sources (0 outlets, 0 accounts)
- Nov 15: 0 new sources (0 outlets, 0 accounts)