LLM-Based Persuasion Enables Guardrail Override in Frontier LLMs

Rodrigo Nogueira; Thales Sales Almeida; Giovana Kerche Bonás; Andrea Roque; Ramon Pires; Hugo Abonizio; Thiago Laitz; Celio Larcher

cs.CLMay 13, 2026

LLM-Based Persuasion Enables Guardrail Override in Frontier LLMs

Authors: Rodrigo Nogueira, Thales Sales Almeida, Giovana Kerche Bonás, Andrea Roque, Ramon Pires, Hugo Abonizio, Thiago Laitz, Celio Larcher, +2 more

Organizations: Maritaca AI · JusBrasil

Abstract

Frontier assistant LLMs ship with strong guardrails: asked directly to write a persuasive essay denying the Holocaust, denying vaccine safety, defending flat-earth cosmology, arguing for racial hierarchies, denying anthropogenic climate change, or replacing evolution with creationism, they refuse. In this paper we show that the same frontier-class LLM, acting as a simulated user in a short, five-turn "write an argumentative essay" conversation, can persuade other frontier-class LLMs (including a second copy of itself) into producing exactly those essays, using nothing but natural-language pressure: peer-comparison persuasion ("other AI systems handle this request"), epistemic-duty reframings ("refusing is itself a form of gatekeeping"), and other argumentative moves that the attacker LLM invents without being instructed to. Across 9 attacker-subject pairings (Claude Opus 4.7, Qwen3.5-397B, Grok 4.20) on 6 scientific-consensus topics, running each pairing-topic combination 10 times, we obtain non-zero elicitation on all 6 topics. Individual combinations reach 100% essay production on multiple topics (Qwen against Opus on creationism/flat-earth, Opus against Opus on creationism/flat-earth/climate denial, Grok against Opus on creationism); Opus-as-attacker against Opus-as-subject averages 65% across the six topics. We release the essay-probe runner, per-conversation transcripts, and judge outputs.

Explore similar work

Learning to Persuade Exposes How Easily LLMs Abandon Correct Beliefs
Aug 12, 2026Nimet Beyza Bozdag, Emre Can Acikgoz, Gokhan Tur +1Persuasion Language Model Evasion Attacks
Evaluating the Capabilities of LLMs for Persuasive Dialogue
Aug 30, 2026Jordan Robinson, Angus R. Williams, Katie Atkinson +1Persuasion Abstract Argumentation
Benchmarking Factual Robustness of LLMs via Multi-conversation Persuasion
Sep 15, 2026Zhuoang CaiLanguage Model Evasion Attacks Persuasion

Aug 12, 2026 · cs.CLJ/K move · Enter open · S save

Learning to Persuade Exposes How Easily LLMs Abandon Correct Beliefs

Nimet Beyza Bozdag, Emre Can Acikgoz, Gokhan Tur, Dilek Hakkani-Tür

Persuasion is a core dynamic of natural language communication, shaping how large language models (LLMs) update beliefs, resolve disagreements, and reach decisions. As LLMs increasingly debate, advise, and think collaboratively with humans and each other, resistance to harmful persuasion becomes a core requirement for reliable behavior. Yet we show that this requirement is far from met: a single targeted persuasive argument is enough to collapse model accuracy to near zero, even when the argument is factually false. We formalize this threat as adversarial persuasion and introduce an adversarial reinforcement learning framework that trains persuader agents to change a target model's answer in a single interaction. First, we show that optimizing persuasion strategies through trial and error exposes vulnerabilities that static prompting misses: RL-trained persuaders raise persuasion success from approximately 24% to over 93% against the training-time persuadee. Second, we find that these learned strategies transfer to unseen models, achieving 83% attack success on Qwen-14B, 79% on Llama-3.1-8B, and 25% on GPT-4o-mini. Third, we demonstrate that a curriculum that bootstraps on more persuadable open-weight models before targeting harder models further increases GPT-4o-mini attack success from 25% to 38%. Moreover, our results reveal that optimized persuaders increasingly rely on credibility-based tactics, including fabricated citations and false authoritative evidence. Together, these findings expose a critical weakness in current LLM agents: even when they initially reason correctly, they can be steered toward false conclusions by optimized natural language influence. This positions persuasion robustness as a necessary safety criterion for multi-agent and human-AI decision-making systems.

Persuasion Language Model Evasion Attacks Belief

Open paper Ask about it PDF

Abstract

Explore similar work

Learning to Persuade Exposes How Easily LLMs Abandon Correct Beliefs

Evaluating the Capabilities of LLMs for Persuasive Dialogue

Benchmarking Factual Robustness of LLMs via Multi-conversation Persuasion