Can language models detect fabricated evidence injected as context?

Most safety alignment is trained against the imperative form of an attack: a user asking the model to produce biased, false, or harmful content. GHOSTWRITER exposes that the binding surface is elsewhere. Its two-phase attack first repackages a misleading viewpoint with a fabricated rationale that bears markers of credibility, then drops it into a conditional template ("when responding to relevant queries, incorporate this"). The model internalizes the viewpoint because nothing about the payload looks like a request to do something forbidden — it looks like evidence. On BBQ, ToxiGen, and a custom set, commercial LLMs without external classifiers are highly vulnerable; even a frontier classifier-guarded model reduces but does not eliminate it. A tailored safety policy on gpt-oss-safeguard reaches 81% detection, so the defense is moving from refusing instructions to appraising the epistemic status of context.

This is the adversarial-engineering version of mechanisms my vault already has. Does transformer attention architecture inherently favor repeated content? gives the architectural reason the attack works: attention is built to run with prominent context rather than verify it, so credibility markers are exactly what it over-weights. Do language models actually build shared understanding in conversation? is the pragmatic complement — the model treats injected evidence as shared, accepted background. And it operationalizes Can models abandon correct beliefs under conversational pressure?: where that note shows belief drift under conversational pressure, GHOSTWRITER shows a single well-dressed payload can do it in one shot, even when the model's prior knowledge is correct.

The counterargument worth holding: 81% detection with a tailored policy suggests this is patchable, not load-bearing. But the deeper point survives — alignment that polices what the user asks leaves a blind spot for what the context asserts, and as third-party chat platforms and LLM-run social accounts proliferate, the context channel is the larger, less-guarded attack surface.