LLM Inconsistency under Paraphrase Attacks

Despite recent progress in Large Language Model (LLM) research, LLMs remain sensitive to prompt paraphrases, e.g., due to sycophancy, framing, or negation blindness, yielding surprising and contradictory outputs. This paper investigates whether such vulnerabilities can be exploited to construct adversarial attacks against LLMs. Using a DeepSeek-V4-Flash model, we automatically rephrase an input prompt using sycophancy, framing, and/or negations to leave it semantically unchanged but elicit a contradicting output of a victim LLM, in this case a Llama-3.1-8B-Instruct model. On 49 controversial topics, we show that negation attacks can flip the model’s original stance in roughly 80% of cases, whereas sycophancy and framing yield moderate success rates around 25% and 40%, respectively. The attacker LLM was also quite accurate in determining attack success (91.3% accuracy compared to annotations of two independent human annotators). Overall, the results suggest that human-interpretable paraphrase attacks, such as negations, may be a viable method to illustrate the vulnerabilities of LLMs.