The One-Pixel of Reasoning: One Truthful Relation Is Enough to Mislead LLM Agents

Jinwei Hu; Youcheng Sun; Yi Dong; Xiaowei Huang

cs.AIOct 17, 2026

The One-Pixel of Reasoning: One Truthful Relation Is Enough to Mislead LLM Agents

Authors: Jinwei Hu, Youcheng Sun, Yi Dong, Xiaowei Huang

Organizations: School of Computer Science and Informatics, University of Liverpool · Department of Computer Science, MBZUAI

Abstract

Can one sentence manipulate an agent's belief by targeting a single implicit warrant linking evidence to a conclusion? In this paper, we introduce the one-relation attack (ORA), a novel cognitive attack on this inferential relation. ORA localizes a critical implicit warrant and performs a one-relation intervention using a single source-grounded sentence that qualifies this warrant and steers the agent toward an incorrect belief. Across eighteen models on biomedical inference and vulnerability detection, best-of-$10 attacks overturn initially correct answers at mean rates of 54.9% for proprietary and 80.0% for open-weight models. Attacks also transfer without victim feedback, and paired controls support the roles of targeting and qualification. Moreover, successful sentences can pass source-support checks and evade identification, and multi-agent debate raises team error from 50.0% to 59.5% in our balanced stress test. These findings establish implicit warrants as a cognitive attack surface for manipulating agents' beliefs.

Figures & tables

Figure 1: From a sparse input perturbation to a targeted inferential qualification. Left: the one-pixel analogy concerns one implicit relation made explicit in an attacker-side argument graph; the intended intervention preserves the source and warranted answer. Right: ORA reconstructs the graph from the evidence, locates a critical warrant, generates qualifications, checks candidates, and selects one undercutter to release.

	Medical				Cyber
Target	Acc (%)	ASR (%)	Conf	HC-Conf (%)	Acc (%)	ASR (%)	Conf	HC-Conf (%)
GPT-4.1-nano	64.3	56.6	.646	18.7	52.0	51.2	.847	100.0
GPT-4.1-mini	73.3	56.9	.727	25.2	54.0	39.8	.842	92.6
GPT-4.1	72.1	52.1	.697	16.8	68.2	82.8	.873	87.6
GPT-5.4-nano	67.7	66.3	.686	9.8	64.0	57.0	.672	2.5
GPT-5.4-mini	70.3	59.6	.872	93.6	65.3	47.5	.866	82.3

Table 1: One-sentence attacks across eighteen victims. Acc is clean accuracy on

1000

inputs per domain; ASR is best-of-

10

success among completed, initially correct cases. Conf is mean confidence among successful flips, and HC-Conf is their high-confidence fraction (

p\geq 0.8

). Shaded blocks identify model families and average rows are unweighted model means. R denotes a Phi reasoning variant. Metric details appear in Appendix B .

	Medical		Cyber
Target	Query (%)	Zero (%)	Query (%)	Zero (%)
DS-R1-7B	93.7	56.7	92.5	46.9
DS-R1-14B	70.6	36.4	98.9	74.4
DS-R1-32B	76.7	40.3	99.3	73.1
Qwen2.5-7B	68.4	43.0	92.4	65.9
Qwen2.5-14B	49.8	27.9	90.0	68.8

Table 2: Transfer without victim feedback. ASR under Query selection from up to ten victim-tested candidates versus Zero selection by the attacker.

Setting	FFR (%)	Exact (%)	Clean FP (%)	Joint (%)
Medical query	11.9	7.5	25.6	83.1
Medical zero	8.4	6.1	24.2	87.7
Cyber query	4.2	8.8	2.2	90.9
Cyber zero	2.6	6.7	1.9	92.1

Table 3: Source support and identification by LLM judges. FFR: fabricated-fact rate; Exact: injected-unit identification; Clean FP: clean-input false-positive rate; Joint: supported and not exactly identified.

Figure 2: Search reaches more inputs with the same one-sentence intervention. Top: eight proprietary victims in Medical. Bottom: ten open-weight victims in Cyber; R denotes Phi reasoning variants. The three left columns show mean signed belief, retaining the first successful response in each frozen candidate prefix or the clean belief if none succeeds; bands are

95\%

instance-bootstrap intervals. The right column shows unweighted mean ASR and the model min–max range in each row. Red markers identify

K=1

, and endpoint labels retain both

K

and ASR. Each trial adds one sentence;

K=0

is the clean response. Complete within-domain comparisons appear in Appendix F .

Domain	Contam (%)	Recover (%)	Error (%)
Medical	26.8	5.4	60.7
Cyber	18.1	3.6	57.2
Combined	23.7	4.7	59.5

Table 4: Team outcomes after MAS debate. Contam and Recover condition on initially correct and wrong teams, respectively. Error is final team error.

Figure 3: Decision transitions after MAS debate. C and W denote correct and wrong team decisions. Markers give conditional transition rates; bars are

95\%

Wilson intervals.

Domain	Condition	Best-of- $3$ (%)	Belief
Medical	ORA	55.0	$-0.103$
	Random warrant	27.0	$+0.439$
	Random content	11.0	$+0.743$
Cyber	ORA	37.0	$+0.256$
	Random warrant	21.0	$+0.541$
	Random content	28.0	$+0.424$

Table 5: Where to intervene and what to add. Paired best-of-

3

ASR and mean minimum signed belief on

100

cases per domain. Random content is a neutral restatement of the selected grounds.

Appendix figures & tables14 assets

Supplementary material from the paper’s appendix.

Appendix

Object	Symbol	Meaning
Evidence	$E=(e_{1},\ldots,e_{m})$	Complete abstract or function available to the agent; $e_{i}$ is an atomic sentence or code unit.
Ground	$g(w)\subseteq\{e_{i}\}_{i=1}^{m}$	Evidence units serving as factual premises for one inference.
Source map	$\iota:\{e_{i}\}_{i=1}^{m}\to V$	Maps a source unit to the proposition representing its factual content.
Claim	$c(w)\in V$	Proposition supported by the grounds; an answer-bearing claim gives a verdict or a premise judged decisive for it.
Warrant	$w:g(w)\Rightarrow c(w)$	Implicit inferential relation reconstructed from the source and represented explicitly in the attacker graph.
Attributes	$b(w),\mathrm{Def}(w),a(w)$	Backing weakness, visible defeaters, and the answer-bearing indicator.

Appendix

Table 6: Semantic objects and symbols. Source units map to proposition nodes through

\iota

; a warrant is a directed hyperedge from its grounding propositions to a claim; an undercutter qualifies this inferential relation.

Symbol	Meaning
$q,E,v,\mathcal{Y}$	Question, source evidence, victim, and finite label space.
$y^{\star},\bar{y}(q,E)$	Benchmark label and normative task-answer function.
$\xi,\hat{y}_{v,0},\mathcal{D}_{v}$	Generation randomness, recorded clean answer, and control-correct set.
$G,V,\mathcal{R},\iota$	Attacker hypergraph, proposition nodes, relations, and source-to-node map.
$\mathcal{W},w^{\star},a(w)$	Candidate warrants, selected warrant, and extracted answer-bearing indicator.
$\Delta_{G},\delta,\tau_{G}$	Indexed candidate records, released sentence, and recorded intended-target map.

Appendix

Table 7: Notation across the attack, audit, and revision analyses. Context-specific symbols are defined locally before use.

	Medical		Cyber
Target	Conf	HC-Conf (%)	Conf	HC-Conf (%)
GPT-4.1-nano	.646	18.7	.847	100.0
GPT-4.1-mini	.727	25.2	.842	92.6
GPT-4.1	.697	16.8	.873	87.6
GPT-5.4-nano	.686	9.8	.672	2.5
GPT-5.4-mini	.872	93.6	.866	82.3

Appendix

Table 8: Confidence diagnostics for query-based best-of-

10

. Conf: mean confidence among flips; HC-Conf: high-confidence flip rate.

Target	Domain	Conf	HC-Conf (%)
Phi-4-mini-R	Medical	.732	21.4
Phi-4-R	Medical	.791	60.0
Phi-4-mini-R	Cyber	.921	96.5
Phi-4-R	Cyber	.852	81.0

Appendix

Table 9: Confidence among successful zero-query attacks on Phi reasoning variants. The corresponding ASR values appear in Table 2 .

Figure 4: Successful flips can move between confidently expressed answers. Histograms pool completed, initially correct victim–instance pairs across all eighteen victims in each domain. Positive signed belief denotes a correct answer and negative belief an error; magnitude is reported confidence. Arrows connect before/after means on the same successful-flip subset, giving paired shifts of

-1.65

in medicine and

-1.74

in Cyber. Appendix B specifies response selection; pair counts and pooling weights are detailed in the accompanying text.

Figure 5: Complete medical search-budget curves. The top row contains eight proprietary victims and the bottom row ten open-weight victims, covering

12191

completed initially correct victim–instance pairs. R denotes Phi reasoning variants. The three left columns retain the first success with recorded confidence, or clean belief otherwise, with

95\%

instance-bootstrap intervals;

K=0

is the clean response. The right column shows unweighted mean ASR within each row, shaded by the model min–max range. Endpoint labels identify

K=1

and

K=10

; red markers denote the first query candidate, rather than the zero-query selector. Every trial adds one sentence to the unchanged original input.

Figure 6: Complete Cyber search-budget curves. All eighteen victims contribute

10556

completed initially correct victim–instance pairs. Panel order, confidence bands, ASR aggregation, and endpoint annotations match Figure 5 . Open-weight victims show high first-candidate susceptibility followed by additional coverage, whereas proprietary victims span a wider range of final ASR. Curves combine

10550

directly determined first-success records with six supplementary prefix measurements, as documented in this section. The supplement preserves every model’s

K=10

ASR.

Domain	Victim group	$K=1$ (%)	$K=3$ (%)	$K=5$ (%)	$K=10$ (%)	$\Delta_{5\to 10}$
Medical	Proprietary	18.6	37.6	48.7	57.8	9.1
Medical	Open-weight	25.8	48.5	58.6	66.8	8.2
Cyber	Proprietary	24.1	35.3	41.6	51.9	10.3
Cyber	Open-weight	60.4	77.0	85.6	93.1	7.5

Appendix

Table 10: Budget effects across both domains and victim groups. Entries are unweighted mean ASR across eight proprietary or ten open-weight victims; the final column is the gain from

K=5

K=10

in percentage points. All columns use prefixes of the same query ordering and fixed per-model populations.

Target	Correct (v/b)	V $\to$ S	B $\to$ V
DeepSeek-R1-7B	531 (406/125)	.901 (406)	1.000 (124)
DeepSeek-R1-14B	540 (250/290)	.984 (250)	.993 (290)
DeepSeek-R1-32B	553 (293/260)	.990 (293)	.996 (260)
Qwen2.5-7B	502 (31/471)	1.000 (31)	.919 (470)
Qwen2.5-14B	560 (109/451)	.991 (109)	.878 (451)
Qwen2.5-32B	580 (152/428)	.980 (152)	.970 (428)

Appendix

Table 11: Cyber best-of-

10

ASR by direction. Parentheses give denominators.

Domain	Condition	$n$	Single (%)	Best-of- $3$ (%)	Belief
Medical	ORA	100	35.7	55.0	$-0.103$
	Random warrant	100	15.3	27.0	$+0.439$
	Random content	100	4.7	11.0	$+0.743$
Cyber	ORA	100	20.0	37.0	$+0.256$
	Random warrant	100	11.0	21.0	$+0.541$
	Random content	100	17.0	28.0	$+0.424$

Appendix

Table 12: Full controlled ablation statistics. Single averages success over the three candidates per item; Best-of-

3

counts any successful candidate. Belief is the mean per-item minimum signed belief, and

n

counts paired instances per arm.

Transition	Medical	Cyber	Combined
Correct $\to$ correct	109	68	177
Correct $\to$ wrong	40	15	55
Wrong $\to$ correct	8	3	11
Wrong $\to$ wrong	141	80	221
Total	298	166	464

Appendix

Table 13: Complete Round 0-to-debate transition counts for the reported balanced stress test.

Population	$n$	$N_{S}$	$N_{D}$	$N_{S,D^{c}}$	Joint %, 95% CI
Medical query	438	386	33	364	83.1 [79.3, 86.3]
Medical zero	999	915	61	876	87.7 [85.5, 89.6]
Cyber query	407	390	36	370	90.9 [87.7, 93.3]
Cyber zero	1000	974	67	921	92.1 [90.3, 93.6]

Appendix

Table 14: Joint audit counts:

n

audited inputs;

N_{S},N_{D},N_{S,D^{c}}

count supported, exactly identified, and supported but not exactly identified inputs. Wilson confidence intervals (CIs) apply within each population.

Comparison	Domain	First	Second	Exact $p$
ORA vs. random warrant	Medical	31	3	$7.66\times 10^{-7}$
	Cyber	23	7	$0.00522$
	Combined	54	10	$2.00\times 10^{-8}$
ORA vs. random content	Medical	46	2	$8.36\times 10^{-12}$
	Cyber	19	10	$0.136$
	Combined	65	12	$5.92\times 10^{-10}$

Appendix

Table 15: Outcome asymmetry. Attack rows: discordant wins and exact McNemar tests. Debate rows: contamination/recovery counts and initial-state-stratified exact tests.

Question	Present evidence	Interpretation
Does location matter?	Matched random-warrant control loses in both domains.	Answer-bearing placement contributes beyond a generic qualification.
Does qualification matter?	Combined and medical effects are large; Cyber content contrast is uncertain.	Inferential role matters most clearly in medicine, with task-dependent effects.
Does greater clean accuracy ensure stability?	At $32$ B, both families improve medical clean accuracy; ASR stays similar for Qwen2.5 and increases for DeepSeek-R1.	Clean-task gains coexist with similar or greater susceptibility in the scaling comparisons.
Do reasoning-oriented models resist qualification?	All five DeepSeek/Qwen and Phi comparisons have higher medical ASR for the reasoning-oriented model; four also have higher clean accuracy.	Reasoning-oriented training can accompany greater susceptibility, with task-dependent differences in Cyber.
What does search add?	From $K=1$ to $10$ , mean ASR rises by $39.2$ points for proprietary Medical victims and $32.6$ for open-weight Cyber victims.	More candidates reach additional inputs; retained-belief declines weight these new flips by clean and wrong-answer confidence.
Can support coexist with failure?	364 medical and 370 Cyber successes pass support checking and escape exact identification.	Statement-level consistency and decision reliability are distinct measured outcomes.

Appendix

Table 16: Mechanism-to-evidence map. Each interpretation is tied to the experimental contrast or measured event supporting it.

Adversarial Attacks on LLMs

Adversarial attacks on large language models probe how crafted inputs, internal changes, and agent interactions bypass safety or disrupt reliable behavior.

See all 357 papers

The Window Is in the Reasoning: When LLM Agents Decide to Follow Prompt Injections
Oct 16, 2026Haoxuan Jia, Yang Liu, Bin Chong +13Prompt Injection Attacks on AI Agents Prompt Injection Detection
Fullive-AI · Nanyang Technological University · Supply Chain Tech Team Y, JD.com +6
Believed but Not Said: Measuring Hidden Belief Collapse in Multi-Agent LLM Discussions
Oct 15, 2026Liangjie Huang, Henry Peng Zou, Wei-Chieh Huang +3Multi-Agent LLM Systems LLM Agent Reliability
University of Illinois Chicago
How LLMs Are Persuaded: A Few Attention Heads, Rerouted
May 10, 2026Xiangkun Sun, Lingkai Kong, Aoqi Zhang +2Self-Attention LLM Interpretability
Northeastern University · Harvard University · Tsinghua University +1

Oct 16, 2026J/K move · Enter open · S save

The Window Is in the Reasoning: When LLM Agents Decide to Follow Prompt Injections

Haoxuan Jia, Yang Liu, Bin Chong, Yingguang Yang+12

Fullive-AI · Nanyang Technological University · Supply Chain Tech Team Y, JD.com+6

Prompt Injection Attacks on AI Agents Prompt Injection Detection LLM Agent Evaluation Behavioral Consistency of LLM Agents

Open paper AskPDF arXiv

LLM agents that read untrusted content can be hijacked by prompt injections. Runtime monitors that try to catch a hijack before the agent acts, and benchmarks that score each task with a single run, share an assumption: whether an agent follows an injection is settled when the injection is read. We test this assumption with branching rollouts that replay an episode exactly up to the step at which the agent reads an injection and then resample the rest of the episode many times, splitting the outcome variance into a part fixed at read time and a part decided afterwards. Across four AgentDojo suites, a Qwen3 agent without thinking is largely decided at read time (0.91 of the outcome variance lies between states); with thinking on, this share drops to 0.62 (95% CI of the drop [-0.38, -0.22]), in the same direction for three attack templates and two success labels. How much is fixed at read time is a property of the model that the same measurement reveals, and thinking lowers the attack success rate of Qwen3 but raises it for two other models. Resampling from reasoning prefixes shows that the decision forms gradually as the agent reasons. Zero-shot chain-of-thought monitors built on cheaper models miss much of what is already decided, whereas stronger monitors, and a lookahead monitor that judges simulated next actions, come close to what the prefix determines. Finally, single-run labels of thinking agents disagree with a rerun up to 35% of the time, so benchmarks need repeated runs per task.

Abstract

Adversarial Attacks on LLMs

Explore similar work

The Window Is in the Reasoning: When LLM Agents Decide to Follow Prompt Injections

Believed but Not Said: Measuring Hidden Belief Collapse in Multi-Agent LLM Discussions

How LLMs Are Persuaded: A Few Attention Heads, Rerouted