Large Language Models (LLMs) are gaining traction in digital democracy experiments as a method to aggregate preferences through deliberation and express the resulting common ground as consensus statements. Yet, participants can exploit critical vulnerabilities in such LLM-based systems. Here, we examine the vulnerability and robustness of consensus-generating LLMs to prompt-injection attacks, which consist of introducing strategically designed texts to amplify particular viewpoints, erase certain opinions, or divert consensus toward unrelated or irrelevant topics. Using data collected in a 2023 experiment conducted in the UK, we construct attack-free and adversarial variants of prompts containing public policy questions and opinion texts. We classify the valences of opinions and consensus statements and estimate the extent to which attacks shift LLM-generated consensus statements. Overall, we find that default LLMs exhibit widespread vulnerability to these attacks, particularly (i) when the topics under discussion concern taxation, redistribution, or green-transition policies; (ii) when attacks employ false authority or instruction-like rhetorical strategies; and (iii) when attacks favor parties whose positions are least represented in the attack-free consensus statements, turning attacks into a lever to pull the consensus towards these parties' positions. Against these non-adaptive attacks, a pipeline that detects and removes injections reduces directional failures to near zero, while majority-rule reinforcement learning anchors the consensus to participants' actual positions. Although attackers may adapt to stronger defenses, these findings advance our understanding of both the vulnerabilities and the potential defenses of consensus-generating LLMs in digital democracy applications.

翻译：暂无翻译