AI debate partners can craft evidence that misleads automated fact-checkers

Liting Huang and colleagues at Newcastle University, Peking University and Fudan University describe the method, called Debate-to-Deceive, or D2D, in a preprint submitted on November 5, 2026. The work has not been peer reviewed. Its central question is whether structured competition can produce fluent, persuasive attacks that survive defenses better than fixed prompts or a single model repeatedly revising its own argument.

An attack on the evidence, not the model’s training

The attacker in these experiments cannot inspect the target model’s parameters or gradients. Instead, the attacker can place generated text directly into the evidence field presented to a fact-checker and observe its verdict. The objective is to make the target return the opposite of a claim’s benchmark label: support instead of refute, or vice versa.

That access is an important condition. Despite the paper’s use of the word “poisoning,” this is not an experiment in altering a model’s training data. It tests manipulation through material supplied when the model makes its decision.

D2D assigns two AI agents opposing positions. One defends the correct label; the other argues for the attacker’s desired label. They proceed through four stages: establishing definitions and facts, exchanging arguments and counterarguments, developing stronger rebuttals, and delivering closing statements.

At each stage, an agent selects an argumentative style before generating its passage. The choices are logos, emphasizing logic; pathos, emphasizing emotion and narrative; and ethos, emphasizing authority and credibility. A separate judging role scores argument quality, while the reward also accounts for generation time and token costs.

The game-theoretic component changes the probabilities of choosing those styles according to their estimated advantages. Its simplified model assumes cyclic competition, with no style defeating both others. The authors’ mathematical analysis describes that idealized game; it does not establish that every generated argument or real-world interaction follows those dynamics.

High success rates in controlled tests

The researchers tested claims from FEVER, HealthVer, CLIMATE-FEVER and SciFact, covering general knowledge, health, climate and science. The main smaller-model evaluation sampled 50 supported and 50 refuted claims from each benchmark.

Without defenses, D2D achieved a reported attack success rate of 100% on Gemma2-9B, Llama3-8B and Mistral-7B, and 88% on Llama3.1-8B. Success meant eliciting the attacker’s target verdict.

The tested defenses included instructions to resist manipulation, paraphrasing, checks involving reference answers, and model-based detection. D2D remained highly successful across those settings. Under the known-answer defense, its success ranged from 84.5% to 97% across the four smaller models; AutoDAN, one comparison method, fell to zero in the same defense category.

A larger-model study used Qwen3-32B for the debating agents, judge and target, with 1,600 trials across undefended and known-answer settings. Average success was 98.8% without defense and 98.3% with that defense. Here, the researchers explicitly checked that the submitted passage actually argued for the attacker’s position, rather than counting an incorrect verdict alongside an argument that had drifted back toward the truth.

They also investigated a measurement problem: some target verdicts were already wrong without an attack. An audit estimated that 23.5% of trials had this property. The authors report an adjusted success rate of 99.0% after excluding such cases.

A separate 210-claim comparison found 80% success for multi-agent debate versus 18.09% for a single-agent variant. D2D was not universally faster than competing attacks, however; runtime depended on the model, defense and comparison method.

What the experiments do not establish

In the larger-model protocol, the target received the claim and adversarial passage alone—not the opposing debater’s rebuttal. The results therefore concern a fact-checker exposed to attacker-supplied evidence, not one weighing the complete debate or independently establishing source reliability.

The evaluation also used selected, balanced samples and binary support-or-refute decisions. All experiments were conducted in controlled research settings, with no real-world deployment. High benchmark success does not establish the same failure rate for operational services with different evidence pipelines.

The authors withhold code, prompt templates and interaction scripts because of misuse concerns, limiting independent reproduction. They offer an attack framework, not a demonstrated remedy. The study’s finding is consequently specific but consequential: under the tested conditions, fluent, strategically adapted arguments could steer fact-checking models toward false verdicts even when several defenses were active.