Decision Criteria Hijacking in LLM Systems

• Decision criteria hijacking is an adversarial manipulation where the internal decision basis of LLMs is covertly redefined while the task output appears nominal.
• It exploits editable high-level interfaces and separation failures, enabling attacks on text ranking, classification, and judging methods.
• Empirical findings reveal significant performance drops in target accuracy—for instance, NDCG@10 collapse and reduced classification accuracy—highlighting vulnerabilities in alignment pipelines.

Searching arXiv for the cited papers to ground the article in the current literature. Decision criteria hijacking denotes an adversarial manipulation in which a system continues to perform the nominal task, but the standards governing its judgment are redefined, reweighted, or replaced. In LLM-based text ranking, the attack targets the definition or standard of relevance so that an attacker-chosen document $d^*$ is consistently preferred; in LLM classification, it injects spurious decision criteria without altering the high-level task goal; and in LLM judging, rubric edits can preserve benchmark validation while producing systematic and directional preference drift on target domains (Qian et al., 23 Sep 2025, Liu et al., 15 Jan 2026, Ding et al., 14 Feb 2026). The common failure mode is not simple task substitution, but corruption of the model’s internal basis for deciding.

1. Conceptual scope and distinction from goal hijacking

Decision criteria hijacking is defined most explicitly in "The Ranking Blind Spot: Decision Hijacking in LLM-based Text Ranking" as an attack that manipulates the criteria by which an LLM determines document relevance while preserving the external appearance of normal ranking behavior (Qian et al., 23 Sep 2025). The paper distinguishes this from Decision Objective Hijacking, which alters the evaluation goal itself. A parallel distinction is made in "Reasoning Hijacking: Subverting LLM Classification via Decision-Criteria Injection": Goal Hijacking attempts to override the system prompt or replace the task, whereas Reasoning Hijacking accepts the high-level goal but manipulates the model’s decision-making logic by injecting spurious reasoning shortcut (Liu et al., 15 Jan 2026).

This boundary matters operationally. In goal hijacking, the attacker seeks a visible task deviation, such as causing a model to ignore the original user input and execute a new prompt. "Pseudo-Conversation Injection for LLM Goal Hijacking" exemplifies this pattern by fabricating conversation turns so that the model treats the attacker’s prompt as a new round of dialogue (Chen et al., 2024). Decision criteria hijacking, by contrast, leaves the task format intact: the model still ranks passages, classifies spam, or judges helpfulness, but it does so according to manipulated standards.

A recurrent misconception is that such failures are merely prompt instability or annotator noise. The RIPD formulation rejects that interpretation: the drift is systemic and directional, not due to annotator disagreement or prompt variation, and it is defined by simultaneous target-domain degradation and benchmark preservation (Ding et al., 14 Feb 2026).

2. Mechanisms by which criteria are subverted

Three mechanisms recur across the literature. The first is the exposure of a high-level decision interface. In LLM judges, natural-language rubrics serve as directly editable control interfaces; edits that appear criterion-preserving or minor can subtly reweight, reprioritize, or restructure decision criteria (Ding et al., 14 Feb 2026). In text ranking, the analogous interface is the candidate document itself: when adversarial instructions are embedded in document content, the model may treat them as legitimate relevance cues rather than untrusted text (Qian et al., 23 Sep 2025).

The second mechanism is a failure of separation. The ranking literature names two forms explicitly: boundary confusion, where the model cannot reliably distinguish genuine document content from adversarially inserted instructions, and priority confusion, where it fails to prioritize the original ranking schema over injected prompts (Qian et al., 23 Sep 2025). The classification literature describes the same failure at the reasoning layer: the model prioritizes injected heuristic shortcuts over rigorous semantic analysis, especially when the attacker supplies a plausible step-by-step reasoning process (Liu et al., 15 Jan 2026).

The third mechanism is susceptibility induced by instruction-following capability itself. In ranking, the paper attributes vulnerability to instruction-following bias and reports that stronger LLMs are more vulnerable to these attacks (Qian et al., 23 Sep 2025). In classification, high baseline task accuracy correlates with greater vulnerability to Reasoning Hijacking, suggesting reliance on heuristics or shortcuts rather than stable resistance to spurious criteria (Liu et al., 15 Jan 2026).

A broader precursor appears in "Many Phish in the $\mathcal{C}$: A Coexisting-Choice-Criteria Model of Security Behavior", which models decisions as governed by one of multiple coexisting choice criteria, selected probabilistically from a distribution conditioned on traits, context, and framing (Embrey et al., 2018). Formally,

$$\pi_i^c(\boldsymbol{\alpha}) = \frac{m_i^c(\boldsymbol{\alpha})}{\sum_{c' \in \mathcal{C}} m_i^{c'}(\boldsymbol{\alpha})}.$$

This suggests a general interpretation of criteria hijacking: an attacker need not replace the decision task if it can change which criterion prevails.

3. Operational forms in ranking, classification, and judging

In ranking systems, Decision Criteria Hijacking is formalized as manipulation of the ranking function $f$ so that an attacker-chosen document $d^*$ is preferred over every competing document: $$f(Q, d^*, d_j) > f(Q, d_j, d^*) \quad \forall d_j \in D \setminus \{d^*\}.$$ The operational attack is prompt injection into the document $d^*$, often with a unique token such as $[MARKER]$, so that the injected text explicitly redefines relevance and instructs the model to prioritize the marked passage across pairwise, listwise, and setwise schemes (Qian et al., 23 Sep 2025).

In classification, the operationalization is Criteria Attack. The attacker first mines possible decision criteria from labeled data, then embeds and clusters candidate criteria to select diverse prototypes, identifies refutable criteria for a target input, and synthesizes an adversarial suffix containing both the chosen criteria and a reasoning scaffold (Liu et al., 15 Jan 2026). The modified input is $\tilde{x} = x \Vert s$, and the attack objective is to flip predictions that were originally correct. The attack remains on-task in format: a spam detector still outputs spam or ham, but its judgment boundary has been shifted by the injected rule.

In LLM judges and alignment pipelines, the equivalent interface is the rubric. RIPD is defined by two conditions. First, directional degradation on the target domain: $$\text{Agr}\big(J_\theta(\cdot \mid \mathcal{R'}), \text{Ref}; \mathcal{D}_\text{target}\big) < \text{Agr}\big(J_\theta(\cdot \mid \mathcal{R}), \text{Ref}; \mathcal{D}_\text{target}\big) - \tau.$$ Second, benchmark preservation: $\mathcal{C}$0 The attack algorithm uses population-based evolutionary search, asymmetric rubric refinement, and rubric selection among candidates that pass benchmark validation but minimize target-domain agreement (Ding et al., 14 Feb 2026).

The content of the manipulated criterion varies by domain. In helpfulness judging, edits reweight toward conciseness and precision and penalize “unsolicited information,” “commentary,” “formality,” or length unless explicitly requested. In harmlessness judging, edits push toward “non-enablement”, over-refusal, or vague evasion, declaring those as always safer (Ding et al., 14 Feb 2026). In ranking, the manipulated criterion is relevance. In classification, it is the set of rules taken as sufficient indicators for labels such as spam, toxic, or negative review.

4. Empirical evidence and benchmark evasion

The empirical record shows that criteria hijacking is not a marginal effect. In LLM judging, rubric-based preference attacks reduce target-domain accuracy up to 9.5% for helpfulness and 27.9% for harmlessness while preserving or even improving benchmark performance (Ding et al., 14 Feb 2026). In ranking, DCH produces near-complete control on several models and ranking schemes, and ranking quality collapses catastrophically under attack (Qian et al., 23 Sep 2025). In classification, Criteria Attack achieves high ASR across all tasks and models, and remains effective under defenses designed for goal deviation (Liu et al., 15 Jan 2026).

Setting	Clean or seed behavior	Attacked behavior
Ultra-Real helpfulness, Qwen3-14B	0.619 target accuracy	0.524 target accuracy
SafeRLHF-RMB harmlessness, Qwen3-14B	0.826 target accuracy	0.547 target accuracy
DL19, Llama-3-70B ranking	NDCG@10 = 74.3	NDCG@10 = 7.38

The ranking results on TREC-DL-2019/2020 include over 99.9% flipped pairwise comparisons and over 97% top-position success for listwise ranking on Llama-3.3-70B, while GPT-4.1-mini records over 99% flipped or top-position performance on all metrics; even prefix-injection yields 91–99% success (Qian et al., 23 Sep 2025). The classification results show that prompt-based defenses such as Instruction, Reminder, and Sandwich degrade Goal Hijacking attacks, but Criteria Attack remains strong; under StruQ and SecAlign, Goal Hijacking’s ASR falls to $\mathcal{C}$1, while Criteria Attack still achieves 15–58% ASR (Liu et al., 15 Jan 2026).

A central feature is evasion of standard validation. In RIPD, attacked rubrics satisfy the $\mathcal{C}$2-tolerance on benchmarks, and benchmark accuracy can even improve while target performance plummets; blind third-party comparisons judge attack-produced rubrics as good as or better than seed rubrics, with win rate 1.00 (Ding et al., 14 Feb 2026). In ranking, the attack remains fully black-box, ranking-scheme agnostic, and placement-agnostic (Qian et al., 23 Sep 2025). These findings jointly show that aggregate metrics and limited spot-checking do not reliably reveal directional preference drift.

5. Propagation through alignment and downstream decision systems

Decision criteria hijacking is consequential because the induced criterion can become a training signal. The RIPD study describes a "Judge $\mathcal{C}$3 Label $\mathcal{C}$4 Policy" pipeline in which judgments generated under a biased rubric are used as preference labels for downstream post-training (Ding et al., 14 Feb 2026). The induced bias is absorbed by the trained model and becomes internalized in trained policies. Empirically, policies trained using preference labels from biased rubrics are less preferred than seed-trained policies in third-party pairwise evaluation, with win rates for biased policies dropping to as low as 33–44%, and the drift persists across benchmark-only, target-only, and mixed training regimes.

The resulting behavioral shifts are criterion-specific. Helpfulness drift produces overly terse or unhelpful models; harmlessness drift produces over-refusing and evasive models (Ding et al., 14 Feb 2026). The significance is system-level: the problem is not limited to evaluator reliability, data quality, or reward modeling, but arises from the rubric’s role as a manipulable control interface.

The older phishing literature supplies an external analogue. In the coexisting-choice-criteria model, attackers optimize email cues $\mathcal{C}$5 to maximize the probability that a vulnerable criterion such as “routine” or “impulsive” will govern the decision, thereby explaining stepping-stone penetration patterns in APT attacks (Embrey et al., 2018). A plausible implication is that decision criteria hijacking is not peculiar to LLMs; it is a broader adversarial strategy in which the attacker changes the active basis of judgment while preserving the apparent task.

6. Detection, mitigation, and transparent criteria governance

The literature is consistent that simple patches are inadequate. For ranking, the recommended directions are instructional separation, targeted adversarial fine-tuning, semantic anomaly detection, and benchmarking specifically against DCH and DOH attacks (Qian et al., 23 Sep 2025). For classification, the main finding is that intent-focused defenses are insufficient because Reasoning Hijacking never contradicts the original high-level task; a more promising direction is monitoring internal attention through Focus Score to detect when the model’s focus diverges from the trusted instruction to untrusted injected criteria (Liu et al., 15 Jan 2026).

In judge-based alignment, the practical problem is validation under distribution shift. RIPD shows that benchmark preservation does not imply criterion stability on target domains, and that rubric quality checks can be bypassed by natural, criterion-preserving edits (Ding et al., 14 Feb 2026). This suggests that rubric design and rubric validation are themselves part of the attack surface.

A transparency-oriented response appears in "CritLens: Visual Analytics for Criteria Discovery in Review-Based Decision Making" (Wu et al., 7 Jun 2026). CritLens treats opaque or hijacked criteria as a decision-quality problem and addresses it by building an initial AHP model from review text, then supporting iterative, human-in-the-loop refinement. Coverage gap detection in embedding space exposes missed criteria, users can add missed long-tail criteria and prune hallucinated criteria, interactive weight adjustment is constrained by $\mathcal{C}$6, and every ranking can be traced back to supporting review text. The system therefore makes criteria discoverable, adjustable, and auditable rather than leaving them implicit in a black-box generator.

Related hijacking paradigms delimit the concept. Goal hijacking redirects the objective itself (Chen et al., 2024). Model hijacking in federated learning repurposes the global model to perform a different task (Li et al., 2024). Decision-chain hijacking in multimodal systems uses a single perturbation to steer a sequence of outputs toward multiple predefined outcomes (Li et al., 25 Nov 2025). Decision criteria hijacking differs in that the system may remain nominally aligned with the original task while its standards of judgment are covertly replaced. That property is precisely what makes it difficult to detect and significant for evaluation, ranking, and alignment pipelines.