{"id":"ad3c9585-a18b-4265-84cb-39fe7c81fe1f","arxiv_id":"2412.12196","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"high","formal_verification":"none","parameter_count":4,"one_line_summary":"TrendSim simulates trending social-media topics with LLM-based user agents and prototype attackers, but its conclusions about poisoning impacts are encoded in the agent prompts.","lead":"This paper introduces TrendSim, a large-language-model-driven simulation of trending social-media topics where some agents act as poisoning attackers. The authors use it to study how attacks affect users' emotions and social confidence, but the results are largely built into the simulation's design rather than discovered from real-world data.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The Problem 1-4 psychological findings are pre-ordained by the reflection prompt in Appendix D.3, which instructs agents that positive content raises and negative content lowers emotion and social confidence.","rationale":"The reader's weakest assumption is exactly the load-bearing point: the reflection prompt in Appendix D.3 directly encodes the causal direction that the paper claims to discover. I agree with that identification. The paper provides no external validation of the emotion/social-confidence dynamics, no released code or data, and the LLM-as-evaluator consistency scores reward exactly the behavior the prompt demands. The time-aware interaction mechanism and centralized dissemination are plausible engineering contributions, but they do not support the psychological conclusions. A single ablation varying the reflection prompt's valence rule would settle whether Table 5 and related findings are emergent or preordained; without such a check, the current evidence cannot distinguish the framework from a prompt echo. Therefore the reader's REJECT verdict remains appropriate, though with the caveat that the framework might be salvageable as a sandbox if reframed and validated.","tokens_in":17880,"tokens_out":2590,"duration_ms":26297,"concrete_test":"Run three parallel PA-50 vs SE comparisons (and ideally PA-10/PA-30) on the same 10 topics with the same seeds: (a) the original reflection prompt; (b) a content-neutral reflection prompt that updates emotion/social confidence from the agent's personality and prior state only, with no valence rule; and (c) an inverted-valence prompt where positive content lowers and negative content raises emotion/confidence. Compute the Problem 1 effect sizes (PA-50 minus SE in Emotion and Social Confidence) under each variant. If the original prompt shows negative impacts but the neutral and inverted variants do not preserve the same attack-impact pattern, the findings are artifacts of prompt wording. If all three variants yield the same direction of impact, the prompt is not the load-bearing assumption.","verdict_should_be":"UNCHANGED","load_bearing_attack":"TrendSim's headline contribution is to reveal how poisoning attacks affect users' psychology (Problems 1-4). The dependent variables Emotion and Social Confidence are updated by the Reflection prompt in Appendix D.3: 'output a percentage that objectively represents the positiveness of your current emotion. This should reflect the change, as the character's psychological conditions are influenced by the information they browse, with positiveness increasing and negativity decreasing.' The same instruction is used for Social Confidence. Attackers are defined to generate negative, antisocial, or rumor-based comments. Thus, when attack proportion rises, observed content is more negative, and the prompt mandates that emotion and confidence fall. The direction of Table 5, Figures 3-4, and Table 9 is therefore a direct consequence of the prompt, not an emergent or measured psychological response. The 'Psychology Consistency' evaluation in Appendix G.1 also rates agents by whether their stated post-browsing scores change in the expected direction, so high scores confirm obedience to the instruction rather than external validity. Because the outcome variables are specified in the same prompt that defines the causal mechanism, the central empirical claims are circular. The Limitations section acknowledges assumptions but does not disclose that the primary outcomes are instruction-injected. If the reflection prompt were neutral or inverted, the paper's conclusions would likely vanish or reverse; no current experiment can distinguish this possibility.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes TrendSim, an LLM-based multi-agent system for simulating trending topics on social media under poisoning attacks. The system includes a time-aware interaction mechanism with a piecewise probability distribution for user arrival, centralized message dissemination through a hub, an interactive page model, LLM-based user agents with perception/memory/action modules, and prototype-based attacker agents (antisocial, trolling, rumor). The authors evaluate user agents, attacker agents, the multi-agent system, and simulation efficiency, then use the simulator to study four problems: the negative psychological impact of poisoning attacks, dynamic changes over time, susceptibility by user group, and effectiveness of content censorship. The central claims are that TrendSim is effective and that the simulation experiments reveal how poisoning attacks affect user psychology.","tokens_in":18201,"tokens_out":3813,"duration_ms":31024,"significance":"If the central claims held, TrendSim would be a useful testbed for studying poisoning attacks on trending topics and for evaluating defenses. The paper makes a genuine attempt to address an underexplored scenario, and the design choices—centralized dissemination, time-aware scheduling, and prototype-based attackers—are reasonable abstractions. The presentation is generally clear, and the appendices provide detailed prompts and the G0/G1 smoothness proofs for the time-distribution function, which support replication of the mechanism. However, the significance is heavily conditional: the main empirical conclusions about psychological impact are compromised by a circularity in the reflection prompt, and the effectiveness evidence is inconclusive given the reported variability. The paper does not release code or data, which limits the reproducibility of the numerical results.","major_comments":[{"comment":"The reflection prompt in Appendix D.3 instructs the LLM: 'This should reflect the change, as the character's psychological conditions are influenced by the information they browse, with positiveness increasing and negativity decreasing.' Since the attacker agents (Section 3.4) are defined to generate negative, antisocial, or rumor-based comments, the observed drops in Emotion and Social Confidence under PA-10/30/50 in Table 5 and Figures 3-4 are a direct consequence of this instruction rather than an emergent or empirically validated psychological response. The 'Psychology Consistency' evaluation in Appendix G.1 rewards post-browsing changes in the expected direction, so high scores on that metric confirm obedience to the instruction, not external validity. Consequently, the conclusions drawn in Problems 1-4 about negative impacts and user susceptibility are not supported as findings about real social-media users; they are artifacts of the prompt design. The Limitations section acknowledges assumptions generally, but it does not disclose that the primary outcome variables are instruction-injected.","section":"Appendix D.3, Section 3.3.2, Section 5 (Problems 1-4)"},{"comment":"Table 1 does not establish the claimed effectiveness of TrendSim for user simulation. On average Behavior Consistency, TrendSim scores 0.915, essentially tied with the vanilla GLM-4 baseline at 0.916, and the error bars in Table 6 (e.g., TrendSim 0.121 under the GPT-4 evaluator) are large and overlapping with baselines. The average Psychology Consistency score of 0.826 is only 0.002 above GLM-4 (0.824) and within the uncertainty of the evaluation. Thus the statement in Section 6 that 'Our evaluations show the effectiveness and efficiency of TrendSim' is not supported by the reported evidence for the user-agent component.","section":"Table 1 and Table 6"},{"comment":"The claim that 'the positive group is affected the most' and that 'fewer attackers can probably cause larger impacts' is not supported by the data. For the Positive group, Emotion under SE is 0.886±0.057, while PA-10 is 0.812±0.145, PA-30 is 0.819±0.081, and PA-50 is 0.813±0.048; the standard deviations overlap broadly, and no significance tests are reported. With only 10 trending topics (Section 4.1), the trend of decreases across attack proportions cannot be distinguished from noise. The same issue affects Problem 2's claims of a 'sharp decrease in the middle of time' from curves without confidence intervals, and Problem 4's censorship conclusions in Appendix C.2, where PA-50-CS values are within one standard deviation of PA-50 for most groups.","section":"Section 5, Problem 1, Table 5"}],"minor_comments":[{"comment":"Typo: 'express their altitudes' should be 'express their attitudes'.","section":"Section 3.1"},{"comment":"The group label 'Netural' should be 'Neutral'.","section":"Table 5"},{"comment":"The text lists 'GLM-4, GLM-4, and Llama-3' with a duplicate entry; one of the GLM-4 mentions should likely be a different model (e.g., GLM-3-turbo or GPT-4).","section":"Appendix F.1 and F.2"},{"comment":"Typo: 'topoc' appears twice and should be 'topic'.","section":"Appendix G.2"},{"comment":"The hyper-parameters A, alpha, and T_m are introduced without a fitting procedure or sensitivity analysis; a sentence describing how they are set for the 10 topics would improve reproducibility.","section":"Appendix A"}],"recommendation":"reject","confidential_remarks":"The reader's assessment is largely aligned with my own reading. The circularity of the psychological outcome variables is a fundamental validity problem that cannot be fixed by local revision, and the effectiveness evidence is inconclusive. I recommend rejection."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"TrendSim is a legitimate new simulation framework for trending-topic poisoning attacks—time-aware interaction via a priority queue, centralized hub dissemination, and three prototype attacker agents—and none of the cited prior work (S3, RecAgent, Generative Agents) covers that combination. Credit where due: the environment design is concrete, and the evaluation is transparent enough that you can see exactly where the claims break.\n\nThe break is in Appendix D.3. The reflection prompt that updates Emotion and Social Confidence tells the agent that psychological conditions are influenced by browsed information, with positiveness increasing and negativity decreasing. The attacker prototypes are defined as generating negative, antisocial, or rumor comments. So when the attack proportion rises, observed content gets more negative, and the prompt mechanically pushes the psychological scores down. Problems 1, 2, and 4 in Section 5 are therefore not measurements of simulated user psychology; they are arithmetic consequences of the instruction text. The Psychology Consistency evaluator in Appendix G.1 scores agents on whether their post-browsing scores move in exactly that expected direction, so a high score confirms prompt obedience, not external validity. The Limitations section mentions assumptions but does not disclose that the primary outcome variables are instruction-injected. That is the load-bearing flaw.\n\nThere are secondary weaknesses. The headline effectiveness numbers are LLM-assigned scores that vary by evaluator; TrendSim's behavior consistency average (0.915) is slightly below the GLM-4 baseline (0.916). Many error bars in Table 5 overlap, so some attack-level differences are not distinguishable. No code or data is released, and the human baseline is one undergraduate volunteer.\n\nWho benefits: researchers building LLM social simulators will find the time-aware interaction and hub-based dissemination designs useful. Anyone looking for evidence about how poisoning attacks affect real users should not cite the Section 5 findings. The paper deserves a serious referee because the framework is novel and the circularity is fixable—a neutral or inverted reflection prompt, or validation against real behavioral data, would turn the sandbox into a testbed. I would send it to review, but the revision request should center on removing the pre-ordained outcome and re-running the experiments.","headline":"TrendSim is a novel trending-topic simulation framework, but its psychological findings are written into the reflection prompt rather than measured.","tokens_in":18692,"tokens_out":2585,"would_cite":true,"duration_ms":25061,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"TrendSim is an LLM-based multi-agent system that simulates trending-topic discussions under poisoning attacks and derives quantitative conclusions about user psychology.","keywords":["LLM multi-agent simulation","trending topics","poisoning attacks","social media","user psychology","misinformation","content censorship","social simulation"],"falsifier":"Run the same TrendSim pipeline but with the reflection prompt's directional constraint reversed or removed (negative content raises or does not change the scores). If the attack-impact curves in Problems 1–4 remain largely unchanged, the reported psychological effects are artifacts of the prompt. A complementary field check would compare simulated emotion and social-confidence trajectories against real user self-reports or platform log data from actual trending-topic cycles; if real users' scores do not move with comment sentiment in the direction the prompt assumes, the results do not transfer.","tokens_in":17716,"feed_emoji":"🧪","tokens_out":5480,"duration_ms":46157,"temperature":0.7,"pith_summary":"TrendSim is an LLM-based multi-agent simulation designed to reproduce the lifecycle of a trending topic on a social platform—users arrive over time, browse a hub page, comment, like, and reply—and then to inject prototype-based attackers who post antisocial, trolling, or rumor comments. The paper's central claim is that this simulation is realistic and efficient enough to study poisoning attacks that would be impractical to test on real platforms. Using 1,000 user agents distilled from real public posts and 10 trending topics, the authors report that attacks lower users' emotion and social-confidence scores, that positive-sentiment topics suffer the largest drops, that users interested in society are most susceptible, and that LLM-based content censorship measurably mitigates the damage. If the claim holds, TrendSim gives researchers a sandbox for estimating the harm of poisoning attacks and testing defenses before deployment.","feed_headline":"LLM agents show how poisoned comments hit user psychology","feed_subtitle":"Insights from simulated users can guide content censorship before real harm occurs.","key_machinery":"The load-bearing mechanism is the three-level memory of each user agent—long-term memory holding a distilled profile, short-term memory tracking emotion, opinion, and social confidence scores, and flash memory storing the current impression—combined with a reflection process that updates the short-term scores after every interaction. A perception module converts observations into impressions via an LLM, an action module chooses likes, comments, reposts, or replies, and the ranking of comments and the visibility of the centralized topic page make user actions feed back into later observations. Prototype-based attackers generate malicious comments conditioned on a target type (antisocial, trolling, rumor) and the current observation, and the whole system runs on a temporal priority queue so that all interactions are timestamp-ordered.","core_discovery":"On its own terms, TrendSim establishes that an LLM-driven multi-agent system can simulate trending-topic discussions under poisoning attacks in a way that produces interpretable, quantitative conclusions about user psychology. The discovery is two-fold: the architecture—time-aware access modeled by a rise-peak-decay probability curve, centralized hub dissemination instead of peer-to-peer networks, and agents with perception, memory, and action modules—yields behavior scores comparable to or better than vanilla-LLM and human baselines; and the simulation experiments reveal that poisoning attacks decrease average emotion and social confidence, with the largest absolute effects on positive-sentiment topics and on users interested in social issues, that attacker impact is not proportional to attacker fraction, and that content censorship reduces but does not eliminate the damage.","pith_inferences":["If the directional psychology update rule in the reflection prompt is the true driver of the attack-impact results, then a natural next step is field validation: comparing the simulated emotion and social-confidence trajectories against real user self-reports or platform log data from actual trending-topic cycles.","The time-aware access function could be reused to study other hub-based content phenomena, such as live event coverage or product-launch threads, where a single page concentrates attention for a few hours.","A testable extension would be to reverse or remove the prompt's instruction that negative content lowers scores and positive content raises them; unchanged attack-impact curves would reveal that the psychology results are artifacts of the prompt rather than emergent agent behavior.","The non-monotonic effect of attacker fraction hints that there may be a saturation or desensitization dynamic worth probing with formal models, but the paper itself does not establish that mechanism."],"forward_implications":["Researchers can estimate the psychological damage of a poisoning attack on a specific trending topic before deploying countermeasures, using the same simulation pipeline.","Platforms should prioritize content censorship on positive-sentiment trending topics, since the simulations show those suffer the largest drops in emotion and social confidence.","Because attack impact is not proportional to attacker fraction—10% attackers can cause outsized effects—defense systems should not wait for high attack prevalence before intervening.","Users whose profiles indicate interest in society are the most susceptible group in the simulations, suggesting targeted protection for that segment.","LLM-based content censorship lowers but does not eliminate emotion and confidence losses, so it should be treated as mitigation rather than a complete defense."],"supporting_citations":[{"why":"Supplies the generative-agents paradigm of LLM personas with memory that TrendSim extends to the trending-topic scenario.","marker":"(Park et al., 2023)"},{"why":"Provides the peer-to-peer social-network simulation baseline that TrendSim contrasts with centralized hub dissemination.","marker":"(Gao et al., 2023b)"},{"why":"Gives the round-based user-behavior simulation paradigm that TrendSim identifies as a limitation for time-sensitive trending topics.","marker":"(Wang et al., 2023b)"},{"why":"Supplies the rise-peak-decay popularity model used to shape the time-aware access distribution of users.","marker":"(Lerman and Hogg, 2010)"},{"why":"Provides the cognitive-psychology basis for the perception, memory, and action module design of the agents.","marker":"(Solso and Kagan, 1979)"},{"why":"GLM is the foundation LLM used in the simulations, so it supplies the model behind all agent behavior and attacker generation.","marker":"(Du et al., 2022)"},{"why":"The dynamic priority queue implements timestamp-ordered execution of interactions in the time-aware mechanism.","marker":"(van Emde Boas et al., 1976)"}],"fun_headline_variants":["TrendSim: LLM agents reveal how poisoned comments sway users","Positive topics most vulnerable to social media poisoning","Censorship reduces but can't fully stop poisoning damage","Attackers' impact not proportional to their fraction in trend sim","LLM multi-agent sim exposes psychology of poisoned trends"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that an LLM can update a simulated user's emotion and social confidence in a psychologically faithful way, specifically that negative content lowers those scores and positive content raises them; that directional rule is written into the reflection prompt, and every psychological finding in the paper inherits it.","fun_headline_variants_meta":{"raw":{"variants":["TrendSim: LLM agents reveal how poisoned comments sway users","Positive topics most vulnerable to social media poisoning","Censorship reduces but can't fully stop poisoning damage","Attackers' impact not proportional to their fraction in trend sim","LLM multi-agent sim exposes psychology of poisoned trends"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000214,"raw_usage":{"total_tokens":1374,"prompt_tokens":845,"completion_tokens":529,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":461,"completion_tokens_details":{"reasoning_tokens":464}},"tokens_in":461,"tokens_out":529,"duration_ms":5403,"temperature":1.0,"reasoning_tokens":464,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T15:35:52.636067+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the same TrendSim pipeline but with the reflection prompt's directional constraint reversed or removed (negative content raises or does not change the scores). If the attack-impact curves in Problems 1–4 remain largely unchanged, the reported psychological effects are artifacts of the prompt. A complementary field check would compare simulated emotion and social-confidence trajectories against real user self-reports or platform log data from actual trending-topic cycles; if real users' scores do not move with comment sentiment in the direction the prompt assumes, the results do not transfer.","supporting_citations":[{"cited_title":"O'Brien, Carrie J","cited_arxiv_id":null,"evidence_quote":"Supplies the generative-agents paradigm of LLM personas with memory that TrendSim extends to the trending-topic scenario."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the rise-peak-decay popularity model used to shape the time-aware access distribution of users."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the cognitive-psychology basis for the perception, memory, and action module design of the agents."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"The dynamic priority queue implements timestamp-ordered execution of interactions in the time-aware mechanism."}],"review_version":1}