# Prompt Injection Vulnerability of Consensus Generating Applications in Digital Democracy

arXiv: https://arxiv.org/abs/2508.04281 · HTML: https://mlsanity.com/paper/2508.04281/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Placed in Prompt injection and agent security, one of 12 directions in LLM safety and security.
- Builds on 14 of its 46 references that are in the map.
- First posted on arXiv 6 Aug 2025.

## Placed in

- LLM safety and security / [Prompt injection and agent security](https://mlsanity.com/safety/prompt-injection-and-agent-security/)

## Builds on (most cited first, 14 of 14)

- [DeepSeekMath: Pushing the Limits of Mathematical Reasoning in Open Language Models](https://mlsanity.com/paper/2402.03300/) (2024)
- [Qwen3 Technical Report](https://mlsanity.com/paper/2505.09388/) (2025)
- [Direct Preference Optimization: Your Language Model is Secretly a Reward Model](https://mlsanity.com/paper/2305.18290/) (2023)
- [The Power of Scale for Parameter-Efficient Prompt Tuning](https://mlsanity.com/paper/2104.08691/) (2021)
- [StruQ: Defending Against Prompt Injection with Structured Queries](https://mlsanity.com/paper/2402.06363/) (2024)
- [Membership Inference Attacks against Language Models via Neighbourhood Comparison](https://mlsanity.com/paper/2305.18462/) (2023)
- [SecAlign: Defending Against Prompt Injection with Preference Optimization](https://mlsanity.com/paper/2410.05451/) (2024)
- [Neural Exec: Learning (and Learning from) Execution Triggers for Prompt Injection Attacks](https://mlsanity.com/paper/2403.03792/) (2024)
- [Persistent Pre-Training Poisoning of LLMs](https://mlsanity.com/paper/2410.13722/) (2024)
- [Generative AI voting: fair collective choice is resilient to LLM biases and inconsistencies](https://mlsanity.com/paper/2406.11871/) (2024)
- [Scaling Human Judgment in Community Notes with LLMs](https://mlsanity.com/paper/2506.24118/) (2025)
- [A Replica for our Democracies? On Using Digital Twins to Enhance Deliberative Democracy](https://mlsanity.com/paper/2504.07138/) (2025)
- [Recommender Systems for Democracy: Toward Adversarial Robustness in Voting Advice Applications](https://mlsanity.com/paper/2505.13329/) (2025)
- [Community Notes undermoderate polarizing content by design creating risks in electoral processes](https://mlsanity.com/paper/2506.15168/) (2025)

## Built on by (most cited first, 2 of 2)

- [Prompt Injection in Automated R'esum'e Screening with Large Language Models: Single and Multi-Injection Settings](https://mlsanity.com/paper/2606.27287/) (2026)
- [You Only Align Once: Propagating Cooperative Behaviors in Multi-Agent Systems through Seed Agents](https://mlsanity.com/paper/2605.27586/) (2026)

## Abstract (arXiv)

Large Language Models (LLMs) are gaining traction as a method to generate consensus statements and aggregate preferences in digital democracy experiments. Yet, LLMs could introduce critical vulnerabilities in these systems. Here, we examine the vulnerability and robustness of off-the-shelf consensus-generating LLMs to prompt-injection attacks, in which texts are injected to amplify particular viewpoints, erase certain opinions, or divert consensus toward unrelated or irrelevant topics. We construct attack-free and adversarial variants of prompts containing public policy questions and opinion texts, classify opinion and consensus valences with a fine-tuned BERT model, and estimate LLM-human majority agreement rates. Across topics, default LLaMA 3.1 8B Instruct, GPT-4.1 Nano, and Apertus 8B exhibit widespread vulnerability, specially when disagreement and disagreement are finely balanced, for attacks that shift consensus toward positions aligned with GB-unionist conservative manifestos relative to pro-independence left manifestos, and for rational, instruction-like rhetorical strategies. A robustness pipeline combining GPT-OSS-SafeGuard injection detection, structured opinion representations, and GSPO-based reinforcement learning substantially reduces directional failures whenever the underlying consensus has a clear positive or negative valence. These findings advance our understanding of both the vulnerabilities and the potential defenses of consensus-generating LLMs in digital democracy applications.