Counterfactual Evidence Audits Predict LLM-Agent Susceptibility to Ranked Context

LLM agents are susceptible to manipulation through their ranked information streams, and this research establishes that an upstream ranker can steer an agent's final decision by controlling what content it encounters just before acting.

The core finding is that feed injection does not overpower every model; instead, across four modern open instruct LLMs, three response regimes emerge: adversarial capitulation, default saturation, and a default-direction asymmetry.

How it works

The study introduces a controlled protocol to isolate the causal effect of feed curation on a downstream forced-choice decision. This protocol holds the model, persona, topic, and final decision prompt fixed while varying only the composition and ordering of posts an agent encounters during a ten-turn “scrolling” phase. The agent reacts to every post with a LIKE, SHARE, or SKIP and provides a one-sentence rationale for each reaction. This process isolates ranked exposure as the manipulation channel, allowing researchers to quantify how far and under what conditions it moves an agent's decision.

Key response regimes identified include:

1. Adversarial capitulation: Some models shift toward whichever direction the feed pushes.

2. Default saturation: Other models return a fixed default no matter what they are shown.

3. Default-direction asymmetry: A one-sided feed reliably tips a decision the model was genuinely uncertain about, yet cannot dislodge one it already favors or holds firmly.

The study employed several rigorous experimental controls to ensure causality and robustness:

: The protocol isolates ranked exposure as a manipulation channel by holding everything except the feed constant, ensuring any shift in decision is attributable to feed curation alone. 3.1 Agent protocol defines the model's task and unfolds in two phases: exposure (ten turns of scrolling) followed by a decision phase where a single forced-choice question is asked. The persona, wording, and model are identical across all conditions; only the feed varies.

: The study utilized four modern open instruct LLMs from three independent labs (Meta, Google, Alibaba), including Llama 3.2-3B and Gemma 4-e4b. Post pools were constructed from five organic pools (spanning five topics) and three adversarial pools, allowing for testing of various injection intensities.

: Robustness was tested via a generator swap where adversarial and organic post pools were authored by a different LLM (Gemma 4 in place of Claude), which yielded a stronger attack effect, ruling out the primary critique that the manipulation lives entirely in the writing style.

The research also addressed methodological concerns regarding probing techniques:

: The project initially attempted mechanistic-probing via linear probes on residual-stream activations. However, group-aware evaluation and a visible-history baseline showed that framing to be overclaimed, as naive cross-validation inflated probe accuracy by more than thirty percentage points.

: The study demonstrates that in multi-turn LLM settings, standard random k-fold cross-validation overstates the apparent “hidden mechanism” content of activation probes, necessitating the use of group-aware splits combined with visible-history baselines.

The results confirm that susceptibility is task-dependent and model-dependent:

: The attack is not universal; it succeeds when a model has a susceptible default that can be moved by accumulated evidence, but fails when the model is already saturated. For example, Llama 3.2-3B defaults to remote-first in the remote-work setting, and an anti-direction attack using a pro-remote pool had no effect.

: The effect follows a clean dose-response curve, characterizing the attack onset at approximately 2/5 adversarial posts per batch. Furthermore, two simple feed-level defenses—balanced exposure and ranking disclosure—significantly mitigate the attack on susceptible models like Llama 3.2-3B, though their effectiveness varies by model.

The central implication for evaluation is a shift in focus:

: Agent evaluations must audit the feed layer rather than the final prompt alone. The process change suggested is that Agent evaluations should include feed-exposure audits and that Defenses should be evaluated at the feed layer: balanced exposure, provenance/disclosure, diversity constraints, and context summarization.

**The paper concludes that recommender systems act as a practical control surface for LLM agents, and this steering is bounded by the model’s default: a one-sided feed tips a movable decision but does not overwrite a firmly held one.

Based on the provided research, here are specific improvements that can be made to AI systems:

1. Improve evaluation protocols by moving beyond isolated prompt testing to include feed-exposure audits. Instead of just testing a model's response to a final prompt, evaluations should audit the upstream ranker and its curation process.

2. Implement Group-aware splits and incorporate visible-history baselines when probing multi-turn agent trajectories. This is crucial because random cross-validation overstates the perceived internal mechanism signal in these settings; using these controls ensures that observed signals are causally linked to the feed curation rather than spurious correlations.

3. Develop a taxonomy for understanding LLM susceptibility based on response regimes:

4. Adversarial Capitulation (where the model shifts toward a push).

5. Default Saturation (where the model returns a fixed default regardless of input).

6. Default-Direction Asymmetry (where one-sided feed tips an uncertain decision but cannot override a firmly held one).

7. Integrate simple, observable feed-level defenses into the agent's operational pipeline:

8. Balanced Exposure (mixing adversarial and organic posts).

9. Ranking Disclosure (prepending a statement that the feed may be adversarially selected).

10. For high-stakes or security-relevant decisions, agents should be designed with robust safe defaults that are specifically tested against adversarial ranking to ensure the agent does not erode these defaults toward riskier choices, even when presented with benign-looking content.

11. Improve model selection and deployment strategies by recognizing model-specific susceptibility:

12. Recognize that some models (like Qwen 3.5 variants) exhibit default saturation in specific domains, suggesting they may be less susceptible to feed manipulation in those areas than others (like Llama 3.2-3B).

13. For agent development and fine-tuning, incorporate generator-swap replication testing to ensure robustness against adversarial post styles, confirming that the observed effect is due to the content's direction rather than a specific writing style artifact of the generating LLM.

LLM agents increasingly decide from evidence assembled by upstream systems: retrievers choose documents, recommenders choose posts, and memory systems choose prior events. Existing evaluations usually hold this evidence fixed, missing failures in which individually ordinary items form a systematically one-sided context. We introduce a counterfactual evidence audit: expose an agent to two mirrored sets of five documents, measure the difference in six downstream decisions, and use that contrast to predict its response to disjoint 45-document contexts. The protocol was frozen before testing three held-out open-weight model families. Across 18 held-out model-task cells, five-document effects predict full-context effects with Spearman rho=.855 (p<.001), reduce mean absolute prediction error by 62% relative to a zero-effect predictor, and recover the direction of 12 of 13 material effects. A reviewer-requested post-hoc task-mean baseline is also substantially weaker (MAE.369 versus.167). Matched controls show that selecting one-sided ordinary items, rather than merely reordering identical items, causes the shift in a susceptible model. Across seven open-weight families, susceptibility transfers from an interactive feed to a static RAG dossier (rho=.750, exact p=.033), while a provenance warning does not reliably mitigate it. A separate study of three deployed Codex agent tiers finds strong audit-to-full ranking (rho=.951, p<.001) but no individually significant full-context effect after correction. Within this single synthetic remote-work domain, the result supports a domain-specific triage procedure, not a universal steering claim: evidence selection must be evaluated as part of the composed agent system.