arXiv:2606.00914: Adversarial feeds can flip AI agents' decisions

A new paper on arXiv, titled “Adversarial Feeds Steer LLM Agent Decisions Against Their Defaults” by Rana Muhammad Usman, investigates how much the content and ordering of information feeds influence the decision-making of LLM agents.

How was the research conducted?

The study holds the model, persona, topic and decision prompt fixed, and varies only the content of the feed during a ten-round “scrolling” phase. The testing covered 2.785 rollouts, that is individual runs of a decision, on four modern open instruct LLM models from three independent labs. A rollout here is one complete pass of the agent through the scenario up to making a decision.

How does the feed change the decision?

The authors identify three response regimes: adversarial capitulation, saturation at the default stance, and asymmetry in the direction of the default stance. The key finding is the asymmetry: a one-sided feed can move a decision the model is genuinely unsure about, in the clearest cases from 5% to 100%, but cannot move a decision the model already holds or holds firmly. The statistical significance of the effect reached levels as strong as p = 3 × 10⁻¹⁰.

What is a practical control surface?

The authors describe information rankers as “a practical, default-bounded control surface for LLM agents”. A control surface is a layer of the system through which an agent’s behaviour can be shaped. Because recommender systems decide which information the agent sees at all and in what order, they become a powerful lever of influence, but only within the bounds set by the model’s default inclination.

What does this mean for safety?

The main implication is that safety evaluations must not be limited to testing the final prompt in isolation. The information ranking layer also needs to be reviewed, because it is precisely that layer that can steer the agent before it reaches the decision itself. The effect survived swapping the generator, generalised across different decision domains, including safety-relevant choices, and proved partially mitigable with simple defences.