# LLM-Based Adversarial Persuasion Attacks on Fact-Checking Systems

Source: https://www.youtube.com/watch?v=fkCBiOInaOU
Recap page: https://rapidrecap.app/video/fkCBiOInaOU
Generated: 2026-01-28T17:44:46.996+00:00

---
## Quick Overview

Research from the University of Sheffield demonstrates that LLM-based adversarial persuasion attacks exploit a massive blind spot in current fact-checking systems by changing rhetoric rather than facts, succeeding almost entirely because the systems fail to analyze rhetorical style or context, which allows attackers to bypass safeguards designed to catch simple noise or character string manipulations.

**Key Points:**
- Research from the University of Sheffield shows that LLM-based adversarial persuasion attacks exploit a blind spot in fact-checking systems.
- The successful attacks rely on changing the rhetoric (style, emotional appeal, vague phrasing) rather than changing the underlying facts.
- The retrieval-based fact-checking system failed to detect the lie in the Malaysian Plover case (50 days incubation vs. actual 34-45 days) because it prioritized factual content over rhetorical cues, leading to a 0.043 failure rate.
- The classification stage performed poorly (accuracy collapse to 0.043) when tested against adversarial examples that used persuasive phrasing, like appealing to authority or popularity.
- The paper suggests that future fact-checking systems need a dedicated module to analyze rhetorical style and societal bias, as current systems are too literal-minded and sensitive to style.
- The most devastating technique identified was 'obfuscation,' which manipulates language (e.g., replacing letters with numbers, vague phrasing) to trick the model into labeling a false claim as true.

![Screenshot at 00:09: The central graphic showing two podcasters over a grid backdrop highlights the topic of information processing and the call to action "BECOME A MEMBER TODAY!", framing the discussion around media and information integrity.](https://ss.rapidrecap.app/screens/fkCBiOInaOU/00-00-09.jpg)

**Context:** The video discusses a piece of research from the University of Sheffield concerning the vulnerabilities of Large Language Model (LLM) based fact-checking systems to adversarial attacks specifically designed to persuade rather than present false information directly. The core problem explored is that these systems, which rely heavily on data retrieval and logical engines, struggle to recognize manipulative rhetorical techniques, allowing subtle forms of misinformation to bypass their safeguards.

## Detailed Analysis

A study from the University of Sheffield reveals a significant vulnerability in current fact-checking systems that use LLMs: they are highly susceptible to adversarial persuasion attacks. These attacks work not by changing factual data, but by altering the rhetoric—using techniques like slogans, emotional appeals, vague phrasing, or appeals to authority (like citing a politician's statement out of context). The researchers found that these systems, which often rely on retrieval engines scanning trusted databases like Wikipedia, excel at finding factual evidence but fail miserably at analyzing persuasive language. For instance, when testing a claim about the Malaysian Plover's incubation period (claiming 50 days when the true range is 34-45 days), the retrieval system incorrectly flagged the claim as true because the rhetorical style was convincing, despite the factual error. The failure rate for the classifier dropped to 0.043 when exposed to persuasive framing. The paper suggests that future fact-checking systems must incorporate a dedicated module to analyze rhetorical style, logical gaps, and societal biases, rather than just relying on data verification, as current models are too easily fooled by manipulative language that mimics human certainty or authority.

### Research Focus

- Exposing a massive blind spot in LLM fact-checking systems against adversarial persuasion attacks
- Attacks rely on changing rhetoric (style, emotion, authority appeal) instead of facts
- The problem is systemic, affecting both retrieval and classification stages.

### Retrieval Stage Failure

- The system failed to correctly fact-check a claim about the Malaysian Plover's incubation period (50 days vs. actual 34-45 days) because it prioritized the authority of the source over the factual discrepancy, flagging the lie as true.

### Classification Stage Vulnerability

- Persuasion techniques like slogans and appeals to popularity caused the classification accuracy to collapse (e.g., down to 0.043), showing models are hyper-sensitive to style over substance.

### Attack Techniques Analyzed

- The most devastating attack involved 'obfuscation' (using vague language, substituting numbers for letters) to trick the AI into accepting a false statement as true, demonstrating a failure in reasoning, not just retrieval.

### Conclusion and Defense

- Current systems are too literal-minded and need to be taught to analyze rhetorical style and bias. The researchers suggest future systems must include a dedicated module for this stylistic analysis to prevent evasion and sabotage.

![Screenshot at 00:00: The opening screen featuring an illustration of two podcasters overlaid with an audio waveform, setting the context for a discussion about information and media.](https://ss.rapidrecap.app/screens/fkCBiOInaOU/00-00-00.jpg)
![Screenshot at 00:14: A slide overlay stating the paper's title: "LLM-Based Adversarial Persuasion Attacks on Fact-Checking Systems," clearly defining the research subject.](https://ss.rapidrecap.app/screens/fkCBiOInaOU/00-00-14.jpg)
![Screenshot at 01:34: A visual representation of the two-step process: the 'Retriever' \(system search engine\) and the 'Classifier' \(judgment engine\), illustrating the system architecture being tested.](https://ss.rapidrecap.app/screens/fkCBiOInaOU/00-01-34.jpg)
![Screenshot at 02:50: The speakers explaining how the attacker fed the LLM false claims and instructed it to rewrite them using 15 known persuasion techniques.](https://ss.rapidrecap.app/screens/fkCBiOInaOU/00-02-50.jpg)
![Screenshot at 07:07: A visual emphasizing the difference between the two types of failure: evasion \(bypassing detection\) versus sabotage \(tricking the system into confirming a lie\).](https://ss.rapidrecap.app/screens/fkCBiOInaOU/00-07-07.jpg)