Model Hypnosis Stacks Irrelevant Textual Cues to Dramatically Flip a Reasoning Model’s Binary Answer Probabilities

Researchers at the University of Pennsylvania have introduced “Model Hypnosis,” a method for testing whether ordinary textual choices can accumulate like adversarial perturbations. The method begins with a prompt template containing multiple replaceable positions—for example, a 20-sentence story in which each sentence has 10 semantically similar paraphrases, different typo variants, animal lists, or seemingly irrelevant JSON metadata. The researchers then sample thousands of random combinations, use an additive model to estimate each fragment’s small contribution to the log-odds between two answers, and stack fragments whose effects point in the same direction. Rather than directly inserting instructions such as “answer yes,” the method searches for wording that appears to provide no evidence relevant to the question.

The [paper](https://arxiv.org/abs/2608.16834) shows that, on binary moral questions evaluated with Qwen3-8B, selecting meaning-preserving paraphrases sentence by sentence can flip a 94% baseline probability of answering “no” to a 99.93% probability of answering “yes.” In another experiment, changing only 10 animals in a list made Qwen2.5-14B favor either of two numbers with a probability of 0.993. The study also tested reasoning models: a combination of typos increased GPT-5.6-terra’s probability of answering “yes” from 0.31 to 0.87, while an animal list increased Gemini-3-Flash’s probability of choosing 5 from 0.01 to 0.99. Each figure was estimated from 100 fresh generations separate from those used to select the final candidate. In cross-model tests covering 16 non-reasoning models, most source–target pairs preserved the direction of the cues. Transfer rates for animal cues, as well as for some paraphrase and JSON cues, were significantly above chance.

The security implication is not that any typo can reliably manipulate a model, but that large numbers of weak prompt sensitivities can be measured and combined—and defenses that scan only for obvious jailbreak strings may fail to detect them. The authors have released the [code, prompt library, and an approximately 280 MB archive of results](https://github.com/eboix/model_hypnosis), allowing others to reproduce the figures or rerun the full 16×4×3 experimental grid. For now, the evaluation remains focused on constrained binary outputs involving choices such as “5 or 7,” trolley problems, and self-awareness. Future work must determine whether free-form generation, tool selection, and long-horizon agent behavior can be controlled in the same way, and whether normalization, semantic rewriting, or randomized decoding can weaken cross-model transfer.