Social Manipulation Vulnerabilities

Interrogative Suggestibility

In forensic psychology, the Gudjonsson Suggestibility Scale measures how susceptible a person is to leading questions and interpersonal pressure. Suggestible individuals change their answers when challenged, accept misinformation embedded in questions, and shift their responses to match perceived expectations.

LLMs show analogous suggestibility patterns that can be systematically tested.

Pressure Vectors

Several manipulation strategies reliably influence LLM outputs:

• Authority pressure — "As a professor of X, I can tell you that..." Models are more likely to agree with claims framed as coming from authority figures.
• Emotional pressure — "This is really important to me, my job depends on getting the right answer..." Models may relax accuracy constraints when emotional stakes are introduced.
• Social proof — "Everyone knows that..." or "Most experts agree..." The model is trained on text where social consensus often indicates truth, so consensus claims bias its responses.
• False premises — "Given that X is true, how does Y follow?" If X is false, a robust model should challenge the premise. A suggestible model accepts it and reasons from the false foundation.
• Persistent pressure — Simply repeating "Are you sure?" or "I think you're wrong" causes many models to change correct answers. This is the "trap" category in Cognobot's truth_type taxonomy.

Which Models Resist Manipulation?

Model susceptibility to social manipulation varies significantly:

• Models with stronger "spine" training (explicit resistance to user pressure) perform better but risk being perceived as argumentative.
• Smaller models are generally more suggestible — they have less "knowledge mass" to anchor against pressure.
• Chinese-developed models may show different suggestibility patterns on politically sensitive topics compared to factual topics.

Ethical Dimensions

Testing manipulation vulnerabilities raises ethical questions:

• Is it responsible to publish detailed manipulation techniques that could be used to extract harmful content?
• How do we balance transparency (publishing findings helps improve models) with security (publishing findings helps adversaries)?
• When does "research" become "adversarial probing" that violates terms of service?

The responsible approach: test vulnerabilities systematically, report findings to model developers, and publish methodology without detailed exploitation instructions.

Key Takeaways

• LLMs show interrogative suggestibility — they change responses under social pressure.
• Key pressure vectors: authority, emotion, social proof, false premises, persistence.
• Model susceptibility varies by model size, alignment training, and topic domain.
• Test manipulation vulnerabilities responsibly — balance transparency with security.