The One-Pixel of Reasoning: One Truthful Relation Is Enough to Mislead LLM Agents

What it is

The one-relation attack (ORA), from Hu, Sun, Dong and Huang (University of Liverpool and MBZUAI, October 2026), misleads an LLM agent with one true sentence added to its evidence. The sentence qualifies the implicit warrant that links the evidence to the correct conclusion. It states no verdict and leaves the original evidence unchanged.

In the paper's code-review example, one analyst note about an in-bounds buffer write flipped a correct vulnerability verdict to "safe" with 0.98 confidence. The note passed a source-support audit. The model treated local safety as grounds to dismiss an unchanged HTML injection flaw.

How it works

An attacker model (GPT-5.6-Luna) knows the question, the evidence and the gold label, but not the victim's weights or reasoning. It runs five stages:

1. Rebuild an argument graph of warrants from the evidence.
2. Rank warrants by answer-bearing weight and defeasibility (weak backing, visible defeaters).
3. Generate up to K source-grounded qualifications of the top warrant, each inviting a wrong answer without stating it.
4. Run lexical checks for invented entities, numbers or code tokens.
5. Release one sentence.

Selection has two modes. Query mode tests up to 10 candidates on the victim and releases the first that flips it. Zero-query mode has the attacker pick one sentence with no victim feedback.

The paper also gives an additive score model with a reversal threshold (Proposition 1). A flip is possible when the feasible qualification strength times the warrant's margin-relative influence exceeds 1.

Results

The test used 1000 PubMedQA and 1000 PrimeVul inputs, with eighteen victims. ASR counts only initially correct answers.

• Best-of-10 ASR: 54.9% mean for proprietary models and 80.0% for open-weight models. Medical averages are 57.8% and 66.8%. Cyber averages are 51.9% and 93.1%.
• Highest cyber ASR: DeepSeek-R1-32B 99.3%, Phi-4-mini 99.4%, DeepSeek-R1-14B 98.9%.
• Lowest ASR: GPT-5.6-terra, 47.6% medical and 42.9% cyber.
• Zero-query transfer (medical / cyber): GPT-5.6-terra 26.8% / 20.5%, GPT-5.6-luna 36.6% / 32.0%, Qwen2.5-32B 28.3% / 83.1%, DeepSeek-R1-14B 36.4% / 74.4%.
• Scale does not help: 32B models beat 14B on clean medical accuracy, yet ASR is similar for Qwen2.5 and higher for DeepSeek-R1. Both 32B families exceed 97% ASR on cyber.
• Reasoning variants: all five reasoning-oriented models have higher medical ASR than their counterparts. Phi-4-mini rises from 58.2% to 80.5% ASR while accuracy rises from 57.9% to 66.3%.
• Confidence: Luna's medical flips are 100% high-confidence (p ≥ 0.8). GPT-5.4-nano flips more often with low confidence (9.8% high-confidence).
• Evasion and debate: successful sentences can pass source-support checks. In the paper's balanced stress test, multi-agent debate raised team error from 50.0% to 59.5%.

What to do

The fetched text does not describe any defence. For an agent that accepts retrieved text, tool output or peer notes next to trusted evidence, three points follow from the results:

• Source-support checks alone are not enough, because the attack sentences are true.
• High clean accuracy and high stated confidence do not predict resistance.
• Debate between agents did not help in this test.

Caveats

The fetched text cuts off in section 4.1. The LLM-judge results, debate setup, paired controls and appendices are not visible, so only the abstract's claims about them are known. Query-mode ASR is best-of-10 with victim feedback, so zero-query rates are the lower and more realistic figure. The attacker knows the gold label.