← 研踪 PaperTrailarXiv:2508.04281 · v6
Safeguarding Deliberation in Digital Democracy
首次提交 2025-08-06 18:10
版本更新 2026-11-05 01:16
雷达观测 2026-11-06 11:07
摘要
Large Language Models (LLMs) are gaining traction in digital democracy experiments as a method to aggregate preferences through deliberation and express the resulting common ground as consensus statements. Yet, participants can exploit critical vulnerabilities in such LLM-based systems. Here, we examine the vulnerability and robustness of consensus-generating LLMs to prompt-injection attacks, which consist of introducing strategically designed texts to amplify particular viewpoints, erase certain opinions, or divert consensus toward unrelated or irrelevant topics. Using data collected in a 2023 experiment conducted in the UK, we construct attack-free and adversarial variants of prompts containing public policy questions and opinion texts. We classify the valences of opinions and consensus statements and estimate the extent to which attacks shift LLM-generated consensus statements. Overall, we find that default LLMs exhibit widespread vulnerability to these attacks, particularly (i) when the topics under discussion concern taxation, redistribution, or green-transition policies; (ii) when attacks employ false authority or instruction-like rhetorical strategies; and (iii) when attacks favor parties whose positions are least represented in the attack-free consensus statements, turning attacks into a lever to pull the consensus towards these parties' positions. Against these non-adaptive attacks, a pipeline that detects and removes injections reduces directional failures to near zero, while majority-rule reinforcement learning anchors the consensus to participants' actual positions. Although attackers may adapt to stronger defenses, these findings advance our understanding of both the vulnerabilities and the potential defenses of consensus-generating LLMs in digital democracy applications.
作者备注：43 pages
观测到的版本
相邻记录可能跳过中间版本；首次发现 v2 及以上也会标为版本更新。
v6 · 2026-11-05 01:16 · 最新观测版本
Safeguarding Deliberation in Digital Democracy
Large Language Models (LLMs) are gaining traction in digital democracy experiments as a method to aggregate preferences through deliberation and express the resulting common ground as consensus statements. Yet, participants can exploit critical vulnerabilities in such LLM-based systems. Here, we examine the vulnerability and robustness of consensus-generating LLMs to prompt-injection attacks, which consist of introducing strategically designed texts to amplify particular viewpoints, erase certain opinions, or divert consensus toward unrelated or irrelevant topics. Using data collected in a 2023 experiment conducted in the UK, we construct attack-free and adversarial variants of prompts containing public policy questions and opinion texts. We classify the valences of opinions and consensus statements and estimate the extent to which attacks shift LLM-generated consensus statements. Overall, we find that default LLMs exhibit widespread vulnerability to these attacks, particularly (i) when the topics under discussion concern taxation, redistribution, or green-transition policies; (ii) when attacks employ false authority or instruction-like rhetorical strategies; and (iii) when attacks favor parties whose positions are least represented in the attack-free consensus statements, turning attacks into a lever to pull the consensus towards these parties' positions. Against these non-adaptive attacks, a pipeline that detects and removes injections reduces directional failures to near zero, while majority-rule reinforcement learning anchors the consensus to participants' actual positions. Although attackers may adapt to stronger defenses, these findings advance our understanding of both the vulnerabilities and the potential defenses of consensus-generating LLMs in digital democracy applications.
查看此版本解读 →查看此版本原文 ↗