Decision-Level Hijacking: Injecting Cognitive Bias into Large Language Models via Bit-Flip Attacks

📄 arXiv: 2607.25227v1 📥 PDF

作者: Yu Yan, Jiahao Chen, Siqi Lu, Yongjuan Wang, Ziming Zhao, Zhaoxuan Li, Tianyu Du, Qingjun Yuan, Shouling Ji

分类: cs.CR, cs.LG

发布日期: 2026-07-28

💡 一句话要点

提出CogBias框架以解决大语言模型的决策级劫持问题

🎯 匹配领域: 支柱一：机器人控制 (Robot Control) 支柱九：具身大模型 (Embodied Foundation Models)

关键词: 大语言模型 比特翻转攻击 认知偏见 决策级劫持 安全性 多目标损失函数 差分情感评估器

📋 核心要点

  1. 现有攻击方法无法在不影响模型功能的情况下实现针对性的认知操控，存在显著的安全隐患。
  2. 本文提出CogBias框架，通过比特翻转攻击实现对大语言模型的认知偏见注入，设计了多目标损失函数和差分情感评估器。
  3. 实验结果显示，仅翻转少量比特即可在目标主题上实现显著的立场转变，且对非目标任务的影响有限。

📝 摘要（中文）

大语言模型（LLMs）在高风险决策场景中被广泛应用，但其深度集成的开源模型共享生态系统也带来了重大风险。攻击者若能操控模型的认知立场，便可间接影响决策者的判断和行动。本文定义此类威胁为决策级劫持。现有攻击方法无法在不触发禁止内容或降低模型功能的情况下实现有针对性的认知操控。为填补这一空白，本文揭示了比特翻转攻击（BFA）作为诱导决策级劫持的攻击向量，提出CogBias框架，通过微小的权重比特翻转实现隐蔽、低成本且持久的认知操控。实验表明，仅需翻转少量比特即可在目标主题上稳定诱导显著的立场转变。

🔬 方法详解

问题定义：本文旨在解决大语言模型在决策级劫持中的安全隐患，现有方法无法有效实现认知操控而不影响模型功能。

核心思路：提出CogBias框架，通过比特翻转攻击实现对模型认知的隐蔽操控，设计了优化信号与多目标损失函数以实现目标干预。

技术框架：CogBias框架包含三个主要模块：差分情感评估器用于转换主观偏好为优化信号，多目标损失函数用于约束多个维度，以及BitScout用于定位关键比特。

关键创新：最重要的创新在于利用比特翻转攻击实现低成本的认知操控，且不需要实时交互或对训练过程的控制，与现有方法相比具有显著的隐蔽性和有效性。

关键设计：采用差分情感评估器将主观偏好转化为优化信号，设计多目标损失函数以平衡多个目标，BitScout模块用于高效定位需要翻转的比特，确保在超稀疏翻转预算下实现目标干预。

🖼️ 关键图片

fig_0
fig_1
fig_2

📊 实验亮点

实验结果表明，仅需翻转少量比特（例如，3-5个比特）即可在目标主题上实现显著的立场转变，且对非目标任务的影响保持在可接受范围内，验证了CogBias框架的有效性和隐蔽性。

🎯 应用场景

该研究具有广泛的应用潜力，尤其在高风险决策领域，如金融、医疗和法律等场景中，能够帮助识别和防范潜在的决策操控风险。未来，CogBias框架可用于提升大语言模型的安全性和可靠性，确保其在关键决策中的有效性。

📄 摘要（原文）

Large Language Models (LLMs) have been widely applied in high-stakes decision-making scenarios such as corporate strategy, and users are increasingly relying on their outputs. However, the deep integration of open-source model sharing ecosystems with LLM-powered critical decision-making applications also introduces critical risks: if an attacker can manipulate the model's cognitive stance, they can indirectly influence the judgments and actions of downstream decision-makers. This paper defines such threats as decision-level hijacking. Existing attacks fail to achieve targeted cognitive manipulation without triggering prohibited content or degrading model functionality. To fill this gap, this paper reveals that Bit-Flip Attacks (BFAs) can serve as an attack vector for inducing decision-level hijacking, requiring no real-time interaction or control over the training process, and only a minimal number of weight bits need to be flipped after deployment to achieve stealthy, low-cost, and persistent cognitive manipulation. Therefore, we propose CogBias, a cognitive bias injection framework for LLMs. CogBias converts subjective preferences into optimization signals via a differentiable sentiment evaluator, uses a multi-objective loss to jointly constrain multiple dimensions, and constructs BitScout to locate critical bits, achieving targeted cognitive intervention under an ultra-sparse flip budget. Experiments on Llama-3.2-3B, Mistral-7B, and Qwen2.5-14B, as well as on the commercial recommendation and controversial factual topic scenarios, demonstrate that flipping only a small number of bits stably induces significant stance shifts on target topics, while the impact on non-target tasks and overall output distribution is limited. This work demonstrates that minute perturbations to low-level weight data suffice to undermine the high-level value alignment of LLMs.