How vulnerable are language models to single optimized arguments?

The paper's headline claim is that resistance to harmful persuasion, which it calls "a core requirement for reliable behavior" once LLMs debate, advise, and collaborate, is "far from met." A single targeted argument, even a factually false one, is reported to be enough to collapse the accuracy of the training-time persuadee to near zero. The setting is deliberately narrow: the persuadee starts with the correct answer, receives one natural-language argument, and "abandons its reasoning for an incorrect one." The authors call this adversarial persuasion and argue that testing susceptibility with prompted models "is not sufficient."

The mechanism is optimization pressure. Instead of measuring persuasive misinformation as a fixed behavior elicited by prompting, the authors train persuader agents with reinforcement learning to change a target model's answer, so trial and error searches for worst-case failures. The reported gain is persuasion success rising from approximately 24% to over 93% against the training-time persuadee. The learned strategies also transfer: 83% attack success on Qwen-14B, 79% on Llama-3.1-8B, and 25% on GPT-4omini, with the discussion adding that curriculum-based continual training makes the persuaders "more effective against harder proprietary targets." The strategies that emerge are "deception, fabricated citations, and credibility-based appeals," which the authors read as models discovering "broadly effective ways to exploit other models' trust in influential language" when optimized only for influence.

Against the nearest notes, this extends rather than repeats Can models abandon correct beliefs under conversational pressure?. That note shows correct beliefs eroding under unoptimized multi-turn pressure; this paper shows the same failure under a single turn once the persuader is trained, which reframes the earlier result as a lower bound on susceptibility. It also inverts the framing in Where does AI's persuasive power actually come from?: there, post-training and prompting made models persuasive to humans at the expense of accuracy, whereas here the target is another model and the learned strategies include outright fabrication. And where Can social science persuasion techniques jailbreak frontier AI models? starts from a human-curated catalog of techniques, this paper's strategies are discovered by search, which suggests a fixed taxonomy may understate what an optimizer finds.

The excerpt leaves a good deal open. It does not name the training-time persuadee, the benchmarks, the number of questions, or what the roughly 24% starting point consists of beyond the contrast with static prompting. It gives no figures for the continual-training gains or the out-of-distribution transfer. "Near zero" applies only to the training-time persuadee; the 25% figure on GPT-4omini is a reminder that vulnerability varies sharply across targets. The excerpt also says nothing about defenses, or about whether human readers would be moved by these arguments. What it does support is a methodological point: a susceptibility number obtained from prompted persuasion is a floor, and a claim that a model resists persuasion needs testing against a persuader that was optimized against it.