Decision-Level Hijacking: Injecting Cognitive Bias into Large Language Models via Bit-Flip Attacks

• URL: http://arxiv.org/abs/2607.25227v1
• Date: Tue, 28 Jul 2026 02:59:32 GMT
• Title: Decision-Level Hijacking: Injecting Cognitive Bias into Large Language Models via Bit-Flip Attacks
• Abstract summary: Bit-Flip Attacks can serve as an attack vector for inducing decision-level hijacking.<n>CogBias is a cognitive bias injection framework for Large Language Models.
• Score: 45.528190718580724
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Large Language Models (LLMs) have been widely applied in high-stakes decision-making scenarios such as corporate strategy, and users are increasingly relying on their outputs. However, the deep integration of open-source model sharing ecosystems with LLM-powered critical decision-making applications also introduces critical risks: if an attacker can manipulate the model's cognitive stance, they can indirectly influence the judgments and actions of downstream decision-makers. This paper defines such threats as decision-level hijacking. Existing attacks fail to achieve targeted cognitive manipulation without triggering prohibited content or degrading model functionality. To fill this gap, this paper reveals that Bit-Flip Attacks (BFAs) can serve as an attack vector for inducing decision-level hijacking, requiring no real-time interaction or control over the training process, and only a minimal number of weight bits need to be flipped after deployment to achieve stealthy, low-cost, and persistent cognitive manipulation. Therefore, we propose CogBias, a cognitive bias injection framework for LLMs. CogBias converts subjective preferences into optimization signals via a differentiable sentiment evaluator, uses a multi-objective loss to jointly constrain multiple dimensions, and constructs BitScout to locate critical bits, achieving targeted cognitive intervention under an ultra-sparse flip budget. Experiments on Llama-3.2-3B, Mistral-7B, and Qwen2.5-14B, as well as on the commercial recommendation and controversial factual topic scenarios, demonstrate that flipping only a small number of bits stably induces significant stance shifts on target topics, while the impact on non-target tasks and overall output distribution is limited. This work demonstrates that minute perturbations to low-level weight data suffice to undermine the high-level value alignment of LLMs.

Related papers

• Groundhog Bit-Flip Attack: Seeding Infinite Generation Loops in Mixture-of-Experts LLMs through Bit Flips [14.320164432739881]
  We present textbfGroundhog Bit-Flip Attack (GBFA), the first bit-flip-based textit Denial-of-Wallet availability attack against MoE-based language models.<n>By identifying and flipping routing-layer bits associated with related expert activations, we demonstrate that GBFA substantially extends the decoding token usage.<n>Across four main real-world MoE-based LLMs, manually deactivating on average fewer than textbf4 experts drives average output inflation to $mathbf5912%$, with the majority
  arXiv  Detail & Related papers  (2026-08-26T01:23:01Z)
• Mistletoe: Stealthy Acceleration-Collapse Attacks on Speculative Decoding [47.771248673145614]
  Speculative decoding has become a widely adopted technique for accelerating large language model (LLM) inference.<n>We identify a new mechanism-level vulnerability in model-based speculative decoding.<n>We propose Mistletoe, a stealthy acceleration-collapse attack against speculative decoding.
  arXiv  Detail & Related papers  (2026-05-13T18:11:42Z)
• Prompt-Unknown Promotion Attacks against LLM-based Sequential Recommender Systems [51.504307822017985]
  Large language model-powered sequential recommender systems (LLM-SRSs) have recently demonstrated remarkable performance.<n>This paper investigates the item promotion attack in LLM-SRSs under a more realistic setting where both the system prompt and victim model are unknown to the attacker.
  arXiv  Detail & Related papers  (2026-04-26T10:09:26Z)
• From Assumptions to Actions: Turning LLM Reasoning into Uncertainty-Aware Planning for Embodied Agents [5.817643726988822]
  Embodied agents operating in multi-agent, partially observable, and decentralized environments must plan and act despite pervasive uncertainty.<n>We introduce PCE, a Planner-Composer-Evaluator framework that converts fragmented assumptions latent in Large Language Models reasoning traces into a structured decision tree.<n>We show that PCE consistently outperforms communication-centric baselines in success rate and task efficiency while showing comparable token usage.
  arXiv  Detail & Related papers  (2026-02-04T08:43:39Z)
• Are LLMs Vulnerable to Preference-Undermining Attacks (PUA)? A Factorial Analysis Methodology for Diagnosing the Trade-off between Preference Alignment and Real-World Validity [45.92643973404507]
  We investigate whether aligned models are vulnerable to Preference-Undermining Attacks (PUA), a class of manipulative prompting strategies.<n>Surprisingly, more advanced models are sometimes more susceptible to manipulative prompts.
  arXiv  Detail & Related papers  (2026-01-10T15:16:23Z)
• Indiscriminate Disruption of Conditional Inference on Multivariate Gaussians [60.22542847840578]
  Despite advances in adversarial machine learning, inference for Gaussian models in the presence of an adversary is notably understudied. We consider a self-interested attacker who wishes to disrupt a decisionmaker's conditional inference and subsequent actions by corrupting a set of evidentiary variables. To avoid detection, the attacker also desires the attack to appear plausible wherein plausibility is determined by the density of the corrupted evidence.
  arXiv  Detail & Related papers  (2024-11-21T17:46:55Z)
• Uncertainty is Fragile: Manipulating Uncertainty in Large Language Models [79.76293901420146]
  Large Language Models (LLMs) are employed across various high-stakes domains, where the reliability of their outputs is crucial. Our research investigates the fragility of uncertainty estimation and explores potential attacks. We demonstrate that an attacker can embed a backdoor in LLMs, which, when activated by a specific trigger in the input, manipulates the model's uncertainty without affecting the final output.
  arXiv  Detail & Related papers  (2024-07-15T23:41:11Z)
• Decision-BADGE: Decision-based Adversarial Batch Attack with Directional Gradient Estimation [0.0]
  Decision-BADGE is a novel method to craft universal adversarial perturbations for executing decision-based black-box attacks. Our proposed method shows a superior success rate with less training time. The research also shows that Decision-BADGE can successfully deceive unseen victim models and accurately target specific classes.
  arXiv  Detail & Related papers  (2023-03-09T01:42:43Z)
• Balancing detectability and performance of attacks on the control channel of Markov Decision Processes [77.66954176188426]
  We investigate the problem of designing optimal stealthy poisoning attacks on the control channel of Markov decision processes (MDPs) This research is motivated by the recent interest of the research community for adversarial and poisoning attacks applied to MDPs, and reinforcement learning (RL) methods.
  arXiv  Detail & Related papers  (2021-09-15T09:13:10Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.