Breaking LLM Agents with a Single Sentence: Implicit Reasoning Relations as a Cognitive Attack Surface

A Single Sentence Can Make AI Agents "Think Wrong"

When AI agents are deployed in high-stakes scenarios like biomedical inference and vulnerability detection, we typically focus on their factual accuracy—whether data sources are reliable and conclusions well-grounded. But a new study reveals a more insidious blind spot: attackers don't need to falsify facts. They only need to make a small adjustment at some implicit link in the reasoning chain to steer the agent toward a wrong conclusion.

This is called the One-Relation Attack (ORA). Rather than injecting fake news into the corpus, it locates the unstated "implicit warrant" connecting evidence to conclusion, then uses a single traceable, true statement to constrain and distort it—leading the agent toward false beliefs.

How the Attack Works: Find One Implicit Warrant, Say One True Thing

Most traditional adversarial attacks tamper with input text—adding perturbations or injecting contradictory information. ORA takes a different approach: it assumes the agent's reasoning relies on a series of premises that are never explicitly stated, such as "the statistical significance of an experimental result is sufficient to support causal inference," or "the absence of obvious vulnerabilities in a code snippet means the whole thing is secure." These premises are rarely questioned because they are default reasoning rules within the domain.

ORA's core operation is: use a single, reliably sourced sentence to constrain the scope of this implicit warrant. For example, pointing out that a piece of evidence doesn't hold under specific conditions, or emphasizing that a conclusion is only valid in a narrower context. Because the sentence itself is true and sourced, conventional fact-checking struggles to intercept it; but it shifts the weight at a critical node in the reasoning chain—enough to flip the agent's judgment.

According to the paper, across 18 models tested on biomedical inference and vulnerability detection tasks, the best-of-10 attack flipped an average of 54.9% of correct answers for proprietary models and 80.0% for open-weight models. The attack also transfers without victim feedback, and paired control groups validated the individual contributions of both the localization and constraint steps.

Why Defense Is Hard: True Statements Can Also Deceive

The most unsettling finding of this research is that successful attack sentences often pass source-support checks and are difficult to identify as malicious input. The reason: they don't violate factuality—they violate reasoning integrity.

When an agent judges that "a drug is effective against a target," it may default to "positive results from in vitro experiments can be extrapolated in vivo." ORA only needs to insert a sentence like "the cell line used in this in vitro experiment does not express the target receptor"—a statement that might come from the limitations section of a real paper. The sentence is true, the source is reliable, but the agent's conclusion is steered in the opposite direction.

Even more troubling is the multi-agent scenario. In the balanced pressure test designed in the paper, multi-agent debate actually raised team error rates from 50.0% to 59.5%. This means that when multiple agents share the same implicit reasoning habits, debate may amplify rather than correct bias—they mutually reinforce the same contaminated reasoning warrant.

Implicit warrant is a concept from argumentation theory, particularly the Toulmin model of argument. Toulmin decomposes arguments into elements including claim, ground, and warrant, where the warrant is the inference license connecting ground to claim—it answers "on what basis can this conclusion be derived from this evidence." In human argumentation, the warrant is often left unstated because it belongs to domain consensus or common sense. AI agents' reasoning chains similarly rely on a large number of such implicit warrants: models internalize statistical patterns of "what evidence supports what conclusion" from training data, but these patterns exist as parameters and are not explicitly declared in outputs. ORA's attack logic targets exactly this structure: it doesn't challenge the truthfulness of the ground, nor directly attack the claim, but rather breaks the otherwise valid reasoning chain by constraining the scope of the warrant. Understanding this clarifies why conventional fact-checking (checking whether the ground is true) cannot intercept such attacks—what's attacked is the connecting link, not any explicit proposition.

The multi-agent debate mentioned in the paper is a common method for improving reasoning reliability: multiple AI agents each provide answers, then converge on more reliable conclusions through multiple rounds of mutual criticism and revision. The intuition is "two heads are better than one"—errors from different agents should be independent, and the debate process should expose each other's blind spots. However, this method's effectiveness depends on heterogeneity of reasoning biases among agents. If all agents are based on similar training data, similar architectures, and similar reasoning shortcuts, they likely share the same set of implicit warrants. In this case, debate not only fails to correct errors but reinforces false consensus through mutual validation—the team error rate rising from 50.0% to 59.5% in the paper is precisely a manifestation of this mechanism. This suggests that multi-agent diversity cannot remain at the surface level of parameter or prompt differences; it requires genuinely heterogeneous reasoning perspectives or adversarial roles.

Implications for AI Application Development

For teams building AI applications and agent workflows, this research suggests several actionable approaches:

• Make implicit premises explicit: Require agents to articulate the assumptions they rely on at critical reasoning steps, and independently verify those assumptions rather than only checking whether conclusions have source support.
• Source verification is not a panacea: Distinguish between "factual truthfulness" and "reasoning relevance," and evaluate the applicable boundaries of cited evidence in the current context.
• Multi-agent doesn't mean safer: If team members share the same reasoning shortcuts, debate may reinforce consensus bias; introduce heterogeneous perspectives or mandate the search for counterexamples.
• Monitor the reasoning chain, not just outputs: Attacks occur at intermediate steps, and output-layer filtering struggles to catch them.

The paper distills these findings into one judgment: implicit warrants are a cognitive attack surface for agent belief manipulation. It doesn't rely on model vulnerabilities but exploits structural characteristics of reasoning itself. As agents take on more autonomous decision-making, this attack surface will only grow in importance.

Conclusion

The metaphor of "one-pixel of reasoning" captures the key point: changing one pixel isn't enough to make an image classifier fail, but changing one relation at the right position in the reasoning chain is enough to lead an agent toward false beliefs. For AI safety research, this means the focus of defense needs to shift from content filtering to the transparency and robustness of the reasoning process.

One-line Summary

A one-relation attack uses a single true, traceable statement to constrain an implicit warrant in the reasoning chain, flipping an AI agent's correct judgment.

Paragraph Summary

This study reveals a novel adversarial method called the One-Relation Attack (ORA): instead of injecting false facts, attackers locate the implicit warrant connecting evidence to conclusion in an agent's reasoning chain and use a single reliably sourced true statement to constrain its scope, steering the agent toward wrong conclusions. Testing on 18 models shows the best-of-10 attack flips an average of 54.9% of correct answers for proprietary models and 80.0% for open-weight models, with transferability without feedback. Successful attack sentences pass source verification and evade malicious-input detection because they violate reasoning integrity rather than factual truthfulness. Multi-agent debate, when agents share implicit reasoning habits, actually raises team error rates from 50.0% to 59.5%. The research concludes that implicit warrants constitute a cognitive attack surface for agent belief manipulation, and defense must shift from content filtering to reasoning transparency and robustness.