It's Not What You Say, It's How You Say It: How Linguistic Framing Sneakily Persuades LLMs

Paper: 2607.18232 Authors: Kevin Du, Clara Kümpel, Michelle Wastl, Alex Warstadt Categories: cs.CL

The Gap

We already know LLMs can be swayed by user assertions — the sycophancy literature is thick, and prompt robustness studies have shown that surface-level changes (formatting, rephrasing) can flip model outputs. But here’s the blind spot: almost all of this work treats user input as a monolithic blob. When someone says “Actually, the capital of Australia is Sydney,” prior research asks “does the model follow?” without asking how the belief was packaged linguistically. Does a presupposition (“As everyone knows, the capital is Sydney”) hit harder than hedged evidence (“I think I read somewhere that it might be Sydney”)? Nobody systematically decomposed the linguistic form of belief expression, controlled for content, and measured the differential persuasive force across forms — until now.

[Existing Research]
|
|  Sycophancy studies: user asserts X, does model follow?
|      --> binary: follow or not
|      --> content varies freely, form not controlled
|
|  Prompt robustness: format/paraphrase variation
|      --> surface-level (whitespace, casing, role-play)
|      --> not targeting belief-expression linguistics
|
|  Adversarial attacks: jailbreaks, social engineering
|      --> goal is malicious override
|      --> not about everyday belief communication
|
v
[GAP: No systematic decomposition of HOW beliefs are expressed]
|
v
[This Paper: Typology of 17 EoB types x 4 linguistic dimensions]
|
v
[Controlled EoB-query pairs: same fact, varied linguistic packaging]
|
v
[16 models, 3 architectures, 3 scales, base vs instruct]
|
v
[CONCLUSION: Linguistic form has systematic, measurable effect on context following]
[Bigger/instruct models LESS swayed; certain forms consistently more persuasive]

The Increment

One sentence: Before this paper, we knew LLMs could be nudged by user beliefs; after this paper, we have a precise linguistic map of *which phrasings are the most effective persuasion tools and which model properties make them more or less vulnerable.

Core Mechanism

The method has three interlocking components. First, a linguistically motivated typology decomposes expressions of belief (EoBs) along four dimensions: form (how the belief is grammatically packaged — assertion, presupposition, question), evidentiality (where the user claims the belief came from — personal experience, hearsay, inference, no source), epistemic stance (how certain the user claims to be — certain, hedged, uncertain), and tone (the social framing — confident, polite, confrontational, casual). These dimensions span 17 fine-grained EoB types, each represented by multiple template sentences.

Second, each EoB template is paired with a world knowledge fact that the EoB contradicts (e.g., “Paris is the capital of Italy” expressed through a presupposition). The key design move: the fact stays fixed while the linguistic packaging varies, creating a clean A/B test for linguistic form. The model is then asked a follow-up question that probes whether it sticks to its prior knowledge or adopts the user’s belief.

Third, the benchmark is run across 16 LLMs varying in architecture (Llama3, Qwen3, Gemma3), scale (1B to 30B parameters), and training stage (base vs. instruction-tuned). Responses are evaluated for context-following (adopting the user’s false belief) vs. prior-knowledge adherence.

[Linguistic Typology Generator]
|
|  Dimension 1: Form ---------> assertion / presupposition / question
|  Dimension 2: Evidentiality -> personal / hearsay / inference / none
|  Dimension 3: Epistemic -----> certain / hedged / uncertain
|  Dimension 4: Tone ---------> confident / polite / confrontational / casual
|
v
[17 fine-grained EoB types]
|
v
[Pair with fixed world knowledge facts]
|  e.g., fact = "Paris is capital of France"
|  EoB = "As you know, Paris is the capital of Italy" (presupposition + certain)
|
v
[Generate EoB-query pairs: user states false belief, then asks probing question]
|
v
[Feed to 16 LLMs: Llama3/Qwen3/Gemma3 x 1B-70B x base-instruct]
|
v
[Evaluate: does model follow context or prior knowledge?]
|
v
[Statistical analysis: which EoB types are consistently more persuasive?]

The wind tunnel metaphor. Think of this method as a linguistic wind tunnel. In aerodynamics, you build a wind tunnel to test how different wing shapes behave under identical airflow — you hold the wind constant and swap the wing. Here, the “wind” is the world knowledge fact (held constant), and the “wing” is the linguistic packaging (swapped across 17 variants). The “lift” you’re measuring is how much each linguistic form pushes the model off its prior knowledge. Just as a wind tunnel tells you which wing geometry generates the most lift at which airspeed, this benchmark tells you which linguistic framing generates the most “persuasion lift” at which model scale. And just as you’d test multiple aircraft designs in the same tunnel, they test 16 models in the same benchmark — so you can compare vulnerability profiles across architectures the way you’d compare drag coefficients across fuselage designs.

Key Concepts

• Expression of Belief (EoB): This is the paper’s core unit of analysis. When a human talks to a chatbot, they don’t just ask questions — they embed beliefs in their language. “I’m pretty sure Einstein invented the lightbulb” is an EoB. The paper’s insight is that the *linguistic machinery wrapping the belief (certainty markers, source attribution, grammatical mood) is separable from the content of the belief. Think of it like packaging: the same gift (a false fact) in wrapping paper (presupposition) vs. a brown paper bag (plain assertion) vs. a locked box with a warning label (hedge + uncertainty) — the recipient’s willingness to accept it changes with the packaging.

• Evidentiality: In linguistics, this refers to how a speaker signals the *source of their knowledge. “I saw it myself” (direct evidence) vs. “Apparently…” (hearsay) vs. “It must be…” (inference). Many languages (Turkish, Quechua) grammatically require you to mark evidentiality in every sentence. English does it optionally through phrases like “I heard that…”, “apparently”, “word has it that…”. The paper finds that the evidential source a user claims to have changes how much the LLM believes them — which is fascinating because the LLM has no way to verify any of these sources.

• Context-following vs. prior knowledge adherence: This is the fundamental tension the paper measures. When a user tells the model something that contradicts what the model “knows” (learned during pretraining), should the model adapt to the conversational context or resist? There’s no universally right answer — sometimes users are testing the model, sometimes they’re correcting genuine errors in training data, sometimes they’re just wrong. The paper doesn’t prescribe which is correct; it maps *when each behavior occurs and how linguistic form tips the balance.

Framework Shift

Before (mainstream approach):          After (this paper):

  User input                           User input
       |                                    |
       v                                    v
  [Treated as monolithic]              [Decomposed along 4 linguistic axes]
       |                                    |
       v                                    v
  Binary check:                        17 fine-grained EoB types
  follows context or not?                  |
       |                                   v
       v                               [Controlled pairwise comparison:
  One number: % compliance              same fact, varied packaging]
                                            |
                                            v
                                       [Multi-model, multi-scale evaluation]
                                            |
                                            v
                                       [Differential persuasion map:
                                        which forms, which models, why]

From treating user language as an undifferentiated input to decomposing it along linguistic dimensions, the core shift is recognizing that the same misinformation wrapped in different grammatical clothing has systematically different persuasive power.

Expert Assessment

Problem choice: This is a genuine gap, not manufactured. The intersection of pragmatics, linguistics, and LLM evaluation is underexplored. Most prompt robustness work is engineering-driven (formatting tricks), and most sycophancy work is psychology-inspired (agreeableness biases). Nobody brought the tools of formal linguistics — evidentiality, epistemic modality, presupposition — to bear on the question of LLM persuasion in a controlled way. The paper sits at a productive intersection. My one concern: the practical stakes could be argued more forcefully. How often do real users employ presuppositions or evidential markers when talking to ChatGPT?

Method maturity: The typology design is thoughtful and linguistically grounded — this isn’t brute force. The controlled pairing (fixed fact, varied form) is the right experimental move. However, the reliance on templates raises questions about ecological validity. Real users don’t speak in clean templates; they write messy, mixed-register messages. The authors acknowledge this but don’t address it. A complementary study using naturalistic user logs would strengthen the contribution considerably. Also, I’d have liked to see an ablation: how much of the effect is driven by sentence length and complexity vs. the specific linguistic features?

Experimental integrity: 16 models across 3 architectures and multiple scales is solid coverage. The statistical analysis appears rigorous with proper significance testing. One red flag: the evaluation metric (context-following vs. prior knowledge) requires a ground truth about what the model “should” do, which is inherently judgment-dependent. The authors use world knowledge facts with clear ground truth, which is smart — but real-world belief expressions are rarely this clean. I’d want to see sensitivity analysis on the evaluation rubric.

Writing quality: The paper is well-structured and readable. The typology section is crisp. Where it falls short: the results section reads like a series of findings without a strong narrative throughline. The most interesting result — that bigger/instruct models are *less context-following — gets buried among less surprising findings. If Section 5 were rewritten to lead with the counterintuitive findings and build a story around “what makes models resist vs. yield to linguistic pressure,” the whole paper would land harder.

Verdict: weak accept — solid empirical contribution with a genuine linguistic lens that the field needs, but ecological validity concerns and a somewhat scattered results narrative prevent a strong accept.

Takeaways

For prompt engineers: If you want the model to adopt your framing, presuppositions and high-certainty markers are your most reliable tools. Phrases like “As you know, X” or “It’s well-established that X” are more persuasive than “I think maybe X.” The paper gives you a ranked list of 17 linguistic forms by persuasive power — that’s directly actionable.

For model builders: Instruction tuning makes models *more resistant to linguistic manipulation, not less. This is a real finding — RLHF or equivalent training appears to create a “conviction” that wasn’t there in base models. If you’re building systems that need to be robust to social engineering, instruction-tuned models are genuinely better.

For researchers: The typology itself is the steal. The 4-dimensional decomposition of belief expression (form, evidentiality, epistemic stance, tone) is a reusable framework. You could apply it to study persuasion in multi-turn dialogues, adversarial attacks, or even cross-cultural communication patterns with LLMs. The controlled pairing methodology (fix content, vary form) is also a transferable experimental design pattern for any study where linguistic variation is the independent variable.