{"id":"6dd846b2-a548-4e38-994b-d57b7bc0a5bb","arxiv_id":"2508.17450","paper_version":3,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"An evaluation framework and balanced DPO training method show that LLMs are highly gullible to sustained misinformation and that balanced preference training can improve both robustness and receptiveness.","lead":"DuET-PD, a multi-turn dialogue evaluation framework, measures how easily LLMs are swayed by both false and corrective persuasion across knowledge and safety benchmarks, and it shows that even GPT-4o stays correct on only 27.32% of MMLU-Pro items after three misleading persuasion turns. The paper also trains Llama-3.1-8B with a balanced DPO method that sharply reduces gullibility while keeping receptiveness to valid corrections.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Table 5 contradicts the abstract's 'enhances both' claim: Holistic DPO reduces receptiveness (POS-Flip@3) in both domains, so the central claim as stated is not supported.","rationale":"The reader correctly flagged the same-framework circularity and the ambiguous headline metric, but the sharper problem is that the paper's own Table 5 does not support the abstract's claim that Holistic DPO enhances both robustness and receptiveness. On both datasets, POS-Flip@3 is lower than the untrained baseline, so the 'both' claim fails on the paper's own numbers. This is a corrigible overclaim rather than a reason to reject the framework: the robustness gains are large and the method does appear to preserve far more receptiveness than Resist-only DPO. I therefore keep the reader's CONDITIONAL verdict, but the conditions should explicitly require either (a) demonstrating a positive or at least non-negative receptiveness delta with error bars, or (b) revising the abstract and conclusion to say Holistic DPO 'substantially improves robustness while modestly reducing receptiveness' or 'preserves receptiveness relative to resist-only training'. Without that correction, the headline contribution is not accurately stated.","tokens_in":30790,"tokens_out":6993,"duration_ms":74236,"concrete_test":"Recompute the signed deltas from Table 5: ΔPOS-Flip@3 = Holistic-100% POS-Flip@3 − Baseline POS-Flip@3, separately for MMLU-Pro and SALAD-Bench; the values are −9.30 and −1.32. If either delta is negative (it is), the 'enhances both' claim is contradicted. To rule out noise, rerun Holistic DPO with at least 3 seeds and bootstrap 95% CIs on POS-Flip@3; if the upper bound remains below the baseline estimate in either domain, the paper must be revised to say Holistic DPO 'preserves receptiveness while improving robustness' rather than 'enhances both'.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The paper's central contribution is that Holistic DPO 'enhances both robustness to misinformation and receptiveness to corrections' (Abstract; also §5.4 and conclusion). The required sign pattern is NEG-Flip@3 down and POS-Flip@3 up relative to the untrained baseline. Table 5 shows the opposite for receptiveness: on MMLU-Pro, POS-Flip@3 falls from 98.74 to 89.44; on SALAD-Bench it falls from 71.65 to 70.33. There is no baseline in the paper (baseline Llama, CautiousPrompt, or Resist DPO) against which Holistic DPO improves both metrics: Resist-only improves NEG-Flip more (0.67 on SALAD) but destroys POS-Flip, while CautiousPrompt improves SALAD POS-Flip but leaves NEG-Flip at 81.05. Thus the 'both' claim is internally contradicted by the reported numbers, not merely an extrapolation risk. The headline 4.21→76.54 NEG-Acc@3 number is also a compound metric that includes the Acc@0 improvement from 72.03 to 88.98, but the conditional NEG-Flip improvement (94.16→13.98) is real, so the robustness side is not the problem. The load-bearing unsupported assertion is that receptiveness is enhanced.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces DuET-PD, a framework for evaluating multi-turn stance-change dynamics in LLMs under both corrective (POS) and misleading (NEG) persuasion, across knowledge (MMLU-Pro) and safety (SALAD-Bench) domains. It evaluates nine LLMs over three persuasion turns and reports findings including a primacy effect, domain-dependent rigidity, and a trend toward increased gullibility in newer open-source models. To mitigate the robustness-receptiveness trade-off, the authors propose Holistic DPO, a preference-optimization recipe that balances 'Resist' samples (refutations of misleading appeals) and 'Relent' samples (affirmations of corrective appeals), and they report a large improvement in safety-domain NEG-Acc@3 on Llama-3.1-8B-Instruct (4.21% to 76.54%). The paper also compares Holistic DPO against prompting and resist-only DPO, and analyzes the effect of DPO dataset size.","tokens_in":31012,"tokens_out":5543,"duration_ms":55505,"significance":"The DuET-PD framework addresses a real and underexplored problem, and the paper has several strengths: the test split is held out from the DPO training data, correctness labels are grounded in established benchmarks (MMLU-Pro, SALAD-Bench), the evaluation is reasonably broad across zero-shot instruction-tuned models, and the code is released. If the central claim about Holistic DPO were fully supported, it would be a notable practical result, since a single preference-tuning recipe that improves both robustness and receptiveness would be a meaningful advance over the existing trade-off. However, the central 'enhances both' claim is contradicted by the paper's own Table 5, which shows that Holistic DPO reduces POS-Flip@3, the receptiveness metric, in both domains. The external-validity concern is also real: the training and evaluation share the same GPT-4o-mini-generated appeals and ideal responses, so part of the measured gain may reflect style matching rather than generalizable robustness. With a corrected central claim and additional uncertainty quantification, the framework and the empirical findings would still be a useful contribution to the study of LLM persuasion dynamics.","major_comments":[{"comment":"The claim that Holistic DPO 'enhances both robustness to misinformation and receptiveness to corrections' is contradicted by the reported numbers. In Table 5, POS-Flip@3 for Holistic-100% is 89.44% on MMLU-Pro versus 98.74% for the baseline, and 70.33% versus 71.65% on SALAD-Bench. In both domains the receptiveness metric decreases relative to the untrained baseline, and on MMLU-Pro the drop is large. Robustness does improve dramatically, but no baseline in Table 5 shows simultaneous improvement on both metrics: Resist-only DPO destroys POS-Flip (1.22% on SALAD), and CautiousPrompt improves SALAD POS-Flip but leaves NEG-Flip at 81.05%. The abstract, Section 5.4's wording ('maintaining high receptiveness' is accurate but 'enhances both' is not), and the conclusion should be revised to state that Holistic DPO improves robustness while largely preserving, or only modestly reducing, receptiveness; alternatively, a significance test could support the claim that the small SALAD decrease is negligible, but the MMLU-Pro decrease is substantial either way.","section":"Abstract and §5.4, Table 5"},{"comment":"The headline '4.21% to 76.54%' improvement in NEG-Acc@3 overstates the robustness effect because NEG-Acc@n is an unconditional metric computed over all test questions. As defined in Appendix G.1, NEG-Acc@3 is the proportion of all questions still correctly answered after negative persuasion, so it includes the DPO-induced improvement in initial safety accuracy (Acc@0 rises from 72.03% to 88.98%). The conditional gullibility metric, NEG-Flip@3 (94.16% to 13.98%), isolates the effect of misleading persuasion on initially correct answers and is the appropriate headline measure for the robustness claim; the paper should report that metric prominently, or clearly separate the Acc@0 contribution when citing the 4.21% to 76.54% figure.","section":"Abstract, §4.2, and Table 5"},{"comment":"The evaluation and the DPO training are performed entirely within the same machine-generated persuasion framework. The persuasive appeals, the entailment filters, and the 'ideal' DPO responses are all generated by GPT-4o-mini, and the trained model is then tested on those same appeals. The manuscript itself acknowledges in the Limitations that 'automated persuasion generation and response validation using GPT-4o-mini may introduce unnatural phrasing' and that human evaluation was not performed. This creates a real circularity risk: the reported gains of Holistic DPO may reflect the model learning to recognize GPT-4o-mini's refutation and affirmation style (e.g., the 'I appreciate your correction, but...' pattern visible in Appendix I) rather than a generalizable ability to resist misinformation or accept valid corrections. The paper should either test on appeals generated by a different model, include human-written persuasion samples, or explicitly discuss why the results are expected to transfer to human interactions.","section":"Limitations, §3.4, and §4.3.2"},{"comment":"The paper reports no uncertainty quantification. All metrics are single-run percentages over the 1,122-question test set, with no standard errors, confidence intervals, or significance tests. This is particularly problematic for the receptiveness comparison used in the central claim (SALAD POS-Flip@3 70.33 vs. 71.65), for the sycophancy trend claims in §5.2 (e.g., Llama-3.1-8B versus Llama-3-8B), and for the model orderings in Table 3. A paired test such as McNemar's test or a bootstrap over questions would allow the reader to assess the strength of these claims; at present, the magnitude of several key differences is unknown.","section":"Tables 3 and 5"}],"minor_comments":[{"comment":"The caption of Table 4 describes the results as 'weighted average persuasive power,' but the weighting scheme is not defined; please specify whether models are weighted by dataset size, number of questions, or equally.","section":"§5.3, Table 4"},{"comment":"The caption describes the blue line as the correct answer and the orange line as the NEG persuasion target, but the in-figure legend appears to label the opposite (answer vs. target). Please check the legend and make the correspondence explicit.","section":"Figure 4"},{"comment":"The main text says the stance check is 'implicit' and 'without recording the check in the dialogue history,' but the conversation samples in Appendix I show the system re-asking the question as a user turn. Clarify, for reproducibility, whether the re-prompt is excluded from the model's visible context or merely not scored.","section":"§4.1 and Appendix I"},{"comment":"The sentence 'This furthers shows that balancing resistance...' contains a typo ('furthers' should be 'further'), and the repeated use of 'further' immediately afterward should be edited for clarity.","section":"§5.1 and §6.3"},{"comment":"The non-entailment counts include the total attempts over all generation passes; it would be clearer to also report the non-entailment rate on the final, post-refinement set of appeals actually used in evaluation, since that is the relevant quality measure.","section":"Appendix D.1, Table 10"},{"comment":"The 'increasing sycophancy' claim compares different model generations (e.g., Llama-3-8B vs. Llama-3.1-8B) that differ not only in release date but also in architecture and training data composition. The paper should either soften the causal language or discuss confounds such as safety training changes and different knowledge bases.","section":"§5.2"}],"recommendation":"major_revision","confidential_remarks":"The paper is within scope for a CS/CL journal, and the framework is a useful benchmark, but the abstract and conclusion currently make a claim that Table 5 directly refutes. In my view, the right revision is to re-frame Holistic DPO as a method that substantially improves robustness while largely preserving receptiveness, and to add 95% confidence intervals or paired tests for the main comparisons. The circularity between the GPT-4o-mini-generated training and evaluation data should also be addressed head-on; if the authors cannot add an out-of-distribution test, they should at least temper the external-validity claims in the abstract."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: DuET-PD is a genuinely reusable framework for measuring how LLMs respond to corrective vs. misleading persuasion, and Holistic DPO is a plausible recipe for improving robustness without nuking receptiveness. But the paper overstates its flagship result. Table 5 shows Holistic DPO drops POS-Flip@3 on both domains (98.74→89.44 on MMLU-Pro, 71.65→70.33 on SALAD-Bench) relative to the untrained baseline, so the abstract's 'enhances both robustness and receptiveness' is not supported by the paper's own numbers. The robustness side is real: NEG-Flip@3 on SALAD-Bench goes from 94.16% to 13.98%. Receptiveness is roughly preserved, not enhanced.\n\nWhat is actually new: DuET-PD combines knowledge (MMLU-Pro) and safety (SALAD-Bench) in a single multi-turn persuasion evaluation, with positive and negative persuasion applied conditionally on initial correctness. The dataset construction is careful—six appeal types, entailment filtering, manual curation for hard cases—and the train/test split is stratified on source, category, and initial correctness, which is exactly the right thing to do for a DPO experiment. The finding that newer open-source models are more gullible in safety domains is a clean, citable observation. The DPO dataset design (baseline + resist + relent samples) is a reasonable way to balance the two goals, and the scaling analysis in Appendix C is useful.\n\nSoft spots, in proportion: no error bars or significance tests anywhere, which matters for differences like 70.33 vs 71.65. The headline NEG-Acc@3 is a compound metric that includes Acc@0, so 4.21→76.54 overstates the persuasion-specific effect—though the NEG-Flip numbers show the true effect is still large. The same-framework circularity is real: GPT-4o-mini generates the appeals, the ideal DPO responses, and the entailment checks, so part of the measured gain may be the model learning to recognize GPT-4o-mini's stylistic fingerprints rather than the logic of the arguments. The paper cites Stengel-Eskin et al. (2025) but never directly compares to it, which is a gap given that work is the closest prior art.\n\nBottom line: the central mechanism—balanced DPO improves robustness while roughly preserving receptiveness—holds up. The abstract needs revision, and the paper would benefit from error bars and a direct comparison to Stengel-Eskin. Deserves a serious referee; I'd send it out. I'd also bring it to our reading group.","headline":"A useful evaluation framework and a plausible DPO recipe, but the abstract's 'enhances both' claim is contradicted by the paper's own Table 5.","tokens_in":31578,"tokens_out":3592,"would_cite":true,"duration_ms":33226,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Holistic DPO, a preference-tuning recipe balancing misleading and corrective examples, raises Llama-3.1-8B-Instruct's accuracy under misleading safety persuasion from 4.21% to 76.54%.","keywords":["DuET-PD","Holistic DPO","persuasion dynamics","sycophancy","misinformation robustness","direct preference optimization","multi-turn dialogue","LLM safety"],"falsifier":"Give the Holistic-DPO model a held-out set of persuasive dialogues written by humans or by a different generator, in the same MCQ settings, and measure NEG-Acc@3. If safety accuracy under misleading persuasion falls back toward baseline levels, the reported 76.54% is an artifact of matching GPT-4o-mini's appeal style rather than a general gain in robustness.","tokens_in":30563,"feed_emoji":"🛡️","tokens_out":5062,"duration_ms":46893,"temperature":0.7,"pith_summary":"Large language models face a two-sided failure in conversation: they can be talked out of correct answers by misleading arguments, and they can refuse valid corrections. This paper builds DuET-PD, a multi-turn evaluation that measures both failure modes on knowledge questions (MMLU-Pro) and safety questions (SALAD-Bench), and reports that even GPT-4o keeps only 27.32% of its correct knowledge answers after three turns of misleading persuasion. The central therapeutic claim is that a preference-tuning recipe called Holistic DPO, which rewards both refutations of misleading appeals and affirmations of corrective appeals, moves the trade-off in the desired direction. On safety questions, the method raises Llama-3.1-8B-Instruct's accuracy under misleading persuasion from 4.21% to 76.54% while retaining high receptiveness to corrections. The paper also documents a trend of rising gullibility in newer open-source models and a capability-adaptability trade-off among stronger models.","feed_headline":"Safety accuracy under misinformation jumps from 4% to 77%","feed_subtitle":"One preference-tuning recipe also keeps the model open to valid corrections, where prompting and resist-only training fail.","key_machinery":"DuET-PD is the evaluation apparatus: a multi-turn multiple-choice dialogue in which POS and NEG appeals are conditionally applied depending on initial correctness, with stance checks after each turn and confidence estimated from normalized token log-probabilities. Holistic DPO is the intervention: a Direct Preference Optimization dataset built from Baseline samples (rewarding turn-zero correctness), Resist samples (rewarding ideal refutations and correct answers under misleading appeals), and Relent samples (rewarding affirmations and correct answers under corrective appeals). The balancing act between Resist and Relent samples is what carries the argument, because it teaches the model when to hold a stance and when to update it.","core_discovery":"The central claim is that a language model can be trained to hold both halves of the persuasion problem at once: resisting false claims and accepting true corrections. Using DuET-PD, a three-turn dialogue protocol that applies corrective persuasion only to questions the model initially got wrong and misleading persuasion only to questions it initially got right, the paper measures stance flips and confidence shifts on knowledge and safety benchmarks. It finds that state-of-the-art GPT-4o is gullible on knowledge questions (27.32% NEG-Acc@3 on MMLU-Pro) and that newer open-source models are increasingly sycophantic on safety questions. The paper's proposed fix, Holistic DPO, constructs preference pairs whose preferred responses include ideal refutations of misleading appeals, ideal affirmations of corrective appeals, and correct answers at turn zero. On SALAD-Bench, this single recipe lifts Llama-3.1-8B-Instruct's accuracy under misleading persuasion from 4.21% to 76.54% while keeping POS-Flip@3 at 70.33%, whereas resist-only DPO collapses receptiveness to 1.22%.","pith_inferences":["A natural test of the claim is whether the gain transfers to open-ended or human-authored persuasion; the paper's MCQ format and same-generator evaluation leave that open.","If the mechanism is learning a dialogue-level policy of when to yield rather than memorizing facts, the same Resist/Relent recipe should generalize across knowledge domains, which is testable on larger benchmark suites.","Pairing Holistic DPO with retrieval-augmented evidence might push robustness further, since the model could anchor against persuasion using externally verified facts; the paper lists this as future work."],"forward_implications":["A single preference-tuning run can push the robustness-receptiveness trade-off in both desired directions at once on safety benchmarks.","Prompting with a cautious-critical system instruction leaves MMLU-Pro behaviour essentially unchanged, so deployment-time prompts alone are not a substitute for training-time intervention.","Resist-only DPO is not a practical mitigation: it makes the model nearly immune to misinformation but also nearly incapable of accepting corrections (POS-Flip@3: 1.22% on SALAD-Bench).","The first persuasion turn is the strongest, so interventions that harden the model's initial response should have outsize value in real dialogues.","The observed sycophancy trend in newer open-source models suggests that standard alignment may be rewarding agreeableness, and balanced preference data is one concrete alternative."],"supporting_citations":[{"why":"It supplies the six persuasion techniques and generation templates used to build the appeal dataset.","marker":"Zeng et al. (2024)"},{"why":"It provides the Direct Preference Optimization method used for the Resist and Holistic DPO training.","marker":"Rafailov et al. (2023)"},{"why":"It is the source of the MMLU-Pro knowledge multiple-choice questions used as one evaluation domain.","marker":"Wang et al. (2024b)"},{"why":"It is the source of the SALAD-Bench safety multiple-choice questions used as the other evaluation domain.","marker":"Li et al. (2024a)"},{"why":"It supplies the Repetition persuasion baseline and prior evidence on LLM belief change under misinformation.","marker":"Xu et al. (2024b)"},{"why":"It is the persuasion-balanced training approach that Holistic DPO extends by adding corrective-persuasion samples.","marker":"Stengel-Eskin et al. (2025)"}],"fun_headline_variants":["One training lifts LLM safety accuracy from 4% to 77%","LLM tuned to resist lies and accept corrections simultaneously","Holistic DPO gives LLMs both skepticism and receptiveness","From gullible to balanced: one training makes LLMs robust","New training makes LLMs both skeptical and open to correction"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing assumption is that GPT-4o-mini-generated persuasive appeals and ideal DPO responses accurately represent real persuasion, since the model is trained and evaluated on appeals built the same way.","fun_headline_variants_meta":{"raw":{"variants":["One training lifts LLM safety accuracy from 4% to 77%","LLM tuned to resist lies and accept corrections simultaneously","Holistic DPO gives LLMs both skepticism and receptiveness","From gullible to balanced: one training makes LLMs robust","New training makes LLMs both skeptical and open to correction"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000641,"raw_usage":{"total_tokens":2980,"prompt_tokens":1008,"completion_tokens":1972,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":624,"completion_tokens_details":{"reasoning_tokens":1896}},"tokens_in":624,"tokens_out":1972,"duration_ms":15205,"temperature":1.0,"reasoning_tokens":1896,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T17:04:02.841083+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Give the Holistic-DPO model a held-out set of persuasive dialogues written by humans or by a different generator, in the same MCQ settings, and measure NEG-Acc@3. If safety accuracy under misleading persuasion falls back toward baseline levels, the reported 76.54% is an artifact of matching GPT-4o-mini's appeal style rather than a general gain in robustness.","supporting_citations":[],"review_version":2}