Large Language Models (LLMs) are gaining traction as a method to generate consensus statements and aggregate preferences in digital democracy experiments. Yet, LLMs could introduce critical vulnerabilities in these systems. Here, we examine the vulnerability and robustness of off-the-shelf consensus-generating LLMs to prompt-injection attacks, in which texts are injected to amplify particular viewpoints, erase certain opinions, or divert consensus toward unrelated or irrelevant topics. We construct attack-free and adversarial variants of prompts containing public policy questions and opinion texts, classify opinion and consensus valences with a fine-tuned BERT model, and estimate LLM-human majority agreement rates. Across topics, default LLaMA 3.1 8B Instruct, GPT-4.1 Nano, and Apertus 8B exhibit widespread vulnerability, specially when disagreement and disagreement are finely balanced, for attacks that shift consensus toward positions aligned with GB-unionist conservative manifestos relative to pro-independence left manifestos, and for rational, instruction-like rhetorical strategies. A robustness pipeline combining GPT-OSS-SafeGuard injection detection, structured opinion representations, and GSPO-based reinforcement learning substantially reduces directional failures whenever the underlying consensus has a clear positive or negative valence. These findings advance our understanding of both the vulnerabilities and the potential defenses of consensus-generating LLMs in digital democracy applications.

翻译：大型语言模型（LLM）作为一种在数字民主实验中生成共识声明和聚合偏好的方法正日益受到关注。然而，LLM可能给这些系统引入严重漏洞。本文研究了现成的共识生成LLM对提示注入攻击的脆弱性和鲁棒性，此类攻击通过注入文本来放大特定观点、抹除某些意见或将共识引向无关或不相关的主题。我们构建了包含公共政策问题和意见文本的提示的无攻击版本和对抗性变体，使用微调后的BERT模型对意见和共识情感倾向进行分类，并估计LLM与人类多数意见的一致率。跨主题实验表明，默认配置的LLaMA 3.1 8B Instruct、GPT-4.1 Nano和Apertus 8B模型普遍存在脆弱性，特别是在意见分歧与共识处于微妙平衡时，对于将共识转向亲英国统一主义保守派宣言（相对于独立左派宣言）的攻击，以及采用理性、指令式修辞策略的攻击尤为明显。一个结合了GPT-OSS-SafeGuard注入检测、结构化意见表示和基于GSPO强化学习的鲁棒性流程，能在基础共识具有明确正向或负向情感倾向时显著减少方向性失误。这些发现深化了我们对数字民主应用中共识生成LLM的漏洞及潜在防御机制的理解。