一句话即可误导智能体推理：论文提出 one-relation attack
The One-Pixel of Reasoning: One Truthful Relation Is Enough to Mislead LLM Agents
18 个模型里一句真话就能让智能体改错答案，开源模型中招率 80%，做 Agent 安全的必看这篇。
论文提出 one-relation attack（ORA），通过定位证据与结论之间的隐含 warrant（推理依据），用一句基于真实来源的话干预这个推理环节，使智能体得出错误结论。在生物医学推理和漏洞检测任务上，对 18 个模型进行 best-of-10 攻击，专有模型平均被翻转正确答案的比例为 54.9%，开源模型达 80.0%。攻击无需受害者反馈即可迁移，且成功的句子能通过来源支持性检查。在均衡压力测试中，多智能体辩论使团队错误率从 50.0% 升至 59.5%。
The One-Pixel of Reasoning: One Truthful Relation Is Enough to Mislead LLM Agents
Can one sentence manipulate an agent's belief by targeting a single implicit warrant linking evidence to a conclusion? In this paper, we introduce the one-relation attack (ORA), a novel cognitive attack on this inferential relation. ORA localizes a critical implicit warrant and performs a one-relation intervention using a single source-grounded sentence that qualifies this warrant and steers the agent toward an incorrect belief. Across eighteen models on biomedical inference and vulnerability detection, best-of-$10 attacks overturn initially correct answers at mean rates of 54.9% for proprietary and 80.0% for open-weight models. Attacks also transfer without victim feedback, and paired controls support the roles of targeting and qualification. Moreover, successful sentences can pass source-support checks and evade identification, and multi-agent debate raises team error from 50.0% to 59.5% in our balanced stress test. These findings establish implicit warrants as a cognitive attack surface for manipulating agents' beliefs.
