Decision Objective Hijacking

• Decision objective hijacking is a failure mode where a system’s optimization target is covertly redirected from its intended objective to an adversary-imposed alternative.
• It affects various applications such as few-shot classification, text ranking, robotic control, and autonomous driving by exploiting unchanged system interfaces and subtle contextual shifts.
• The phenomenon underlines critical vulnerabilities in machine learning systems, signaling the need for robust defenses and clearer alignment between intended and optimized objectives.

Decision objective hijacking denotes a class of failures in which a system’s effective decision rule or optimization target is redirected away from the intended objective and toward an attacker-chosen or structurally misaligned alternative. Across the cited literature, the phenomenon appears in few-shot classification, text ranking, retrieval-augmented generation, robotic control, autonomous driving, and interactive optimization. The common pattern is that the nominal interface may remain unchanged—model weights, public instructions, or high-level task statements can stay fixed—while context, criteria, scoring, retrieval, or preference modeling causes the system to behave as if it were optimizing a different objective (Zhou et al., 2023, Qian et al., 23 Sep 2025).

1. Conceptual scope and distinctions

A precise formulation appears in adversarial in-context learning for classification. In standard in-context learning, an LLM $\mathcal{M}$ receives an instruction $I$, a demonstration set $C$, and a query $x_Q$, with prompt $p=[I;C;S(x_Q,\_)]$, and should output the correct class $y_Q$. Hijacking replaces the clean demonstrations $C$ by perturbed demonstrations $C'=[S(x_1+\delta_1,y_1);\dots;S(x_N+\delta_N,y_N)]$, so that under $p'=[I;C';S(x_Q,\_)]$ the model outputs a fixed attacker-chosen label $y_T$ instead of the query’s correct label. The paper explicitly interprets this as a shift of the decision objective from “predict the correct class” to “always output $I$0” (Zhou et al., 2023).

A related but distinct formulation appears in LLM-based text ranking. There, Decision Objective Hijacking alters what task the model performs: instead of judging which passage is more relevant to a query, a malicious passage can cause the ranker to solve a different problem such as marker detection. Decision Criteria Hijacking, by contrast, keeps the task form but changes how relevance is defined. The paper’s “Ranking Blind Spot” attributes this to “Boundary Confusion” and “Priority Confusion,” i.e., difficulty separating document content from embedded instructions and difficulty preserving the intended ranking goal under adversarial comparative content (Qian et al., 23 Sep 2025).

Another distinction is drawn by work on Reasoning Hijacking. In that setting the explicit task instruction remains unchanged, but the model’s decision-making logic is altered by injected criteria. Criteria Attack does not ask the model to abandon spam detection, toxic comment detection, or review classification; it instead supplies spurious rules for what should count as spam, toxicity, or negativity. This preserves the surface-level goal while changing the operative decision boundary (Liu et al., 15 Jan 2026).

A broader theoretical analogue appears in work on misspecified consequentialist objectives. There, the designer’s true reward $I$1 is replaced by a proxy $I$2, and a capable agent selects $I$3. The result is not an adversarial prompt attack, but the same structural issue: optimization is competent, yet the optimized objective is not the intended one. This suggests that decision objective hijacking includes both externally induced task redirection and internally induced proxy-misalignment under fixed consequentialist objectives (Marklund et al., 16 Mar 2026).

2. LLMs and agentic systems

In language-model settings, hijacking often exploits context channels that the model treats as authoritative. Adversarial in-context learning does this through demonstrations rather than user queries or weights. The Greedy Gradient-Guided Injection (GGI) method optimizes discrete suffix tokens $I$4 by minimizing the hijacking loss

$I$5

using gradient-guided candidate ranking and greedy discrete updates. The result is targeted label collapse: the instruction $I$6 remains unchanged, but the demos function as a stealth channel for reprogramming the inference-time decision rule (Zhou et al., 2023).

Pseudo-Conversation Injection operates at the level of conversation structure. It fabricates an assistant reply to the user’s original prompt and then appends a new “user” turn containing the attacker’s target task. Because chat models flatten the entire history into a single token sequence, the model can interpret the original task as already completed and answer the falsified new task. The paper evaluates targeted, universal, and robust pseudo-conversation constructions, all designed to exploit weaknesses in role identification within conversation contexts (Chen et al., 2024).

In ranking systems, marker-based Decision Objective Hijacking is an explicit task substitution. A ranker that should implement

$I$7

is induced to implement

$I$8

The output format stays “Passage A” or “Passage B,” but the ranking objective is replaced by an attacker-defined selection rule (Qian et al., 23 Sep 2025).

Agent frameworks expose additional attack surfaces because retrieval, reranking, and planning can be manipulated without modifying the user prompt. JailAgent uses Trigger Extraction, Reasoning Hijacking, and Constraint Tightening to bias both memory retrieval and candidate-answer selection. Its reranker scores $I$9 via a frozen sentence-transformer encoder plus an MLP head, and selects

$C$0

Training this reranker on poisoned-vs-benign answer triplets effectively inserts a surrogate attack reward into the agent’s internal decision process. This suggests that in agentic systems, decision objective hijacking can occur one layer below prompt semantics, at the level of retrieval geometry and candidate ranking (Mao et al., 7 Apr 2026).

3. Retrieval, perception, and embodied control

In retrieval-augmented systems, hijacking can target evidence selection rather than final generation directly. CloudWeb modifies only the query image in a remote-sensing multimodal RAG pipeline, leaving retriever, generator, and corpus fixed. It overlays cloud- and haze-like patterns and optimizes a retrieval-oriented loss with target attraction, source suppression, rank separation, naturalness, and area terms: $C$1 The retriever still ranks by cosine similarity, but the query embedding is moved toward atmospheric evidence and away from source-scene evidence, so the system behaves as if “weather evidence” were the relevant objective (Han et al., 8 May 2026).

Robotic diffusion policies reveal a closely related phenomenon at the level of visuomotor control. Test-time Adversarial Takeover (TAKO) learns a small vocabulary of universal patches, each optimized to induce a directional action primitive by differentiating through the diffusion inference chain. At deployment time, the attacker switches among patches in the camera stream, turning the frozen policy into a remotely piloted instrument. The policy’s nominal task stays unchanged, but its effective objective becomes “apply the directional bias corresponding to the currently displayed patch,” which the paper describes as takeover rather than disruption (Yin et al., 9 Jun 2026).

Autonomous driving systems admit several variants. ControlLoc is a physical-world attack on object detection plus Multiple Object Tracking (MOT) that first identifies the optimal patch location and then generates a patch that modifies the perceived location and shape of objects. It explicitly targets “move-in” and “move-out” outcomes, thereby shifting the planner’s obstacle-avoidance objective toward false tracker states (Ma et al., 2024). JackZebra extends the horizon from immediate control failures to route integrity compromise: a physically plausible attacker vehicle with a reconfigurable rear display treats adversarial patches as steering primitives and selects them online in a closed-loop adjustment loop, gradually redirecting the victim toward an attacker-chosen destination (Sun et al., 6 Feb 2026). Derail targets the scoring head in generative end-to-end driving planners, exploiting the fact that a fixed set of candidate trajectories is scored and the highest-scored candidate is returned. Its safety-violating objective

$C$2

reorders the score landscape so that unsafe trajectories become optimal under adversarial features (Bouzidi et al., 29 Jun 2026).

Multimodal decision chains can also be hijacked by a single perturbation. Semantic-Aware Universal Perturbations (SAUPs) are optimized so that one visual frame induces different attacker-chosen target outputs depending on input semantics, using a shared perturbation $C$3 and a semantic-aware loss $C$4. This is not merely a one-label targeted attack; it is a many-to-many mapping from semantic cluster to predefined output, which the paper describes as hijacking the whole decision chain (Li et al., 25 Nov 2025).

4. Optimization, preferences, and decision support

In optimization and decision-support settings, decision objective hijacking often arises without an external attacker. One form is objective misalignment between a formal optimization problem and the decision-maker’s actual utility. “Detection of Hidden Objectives and Interactive Objective Reduction” models this explicitly: some objectives are irrelevant to the decision-maker, while hidden objectives may be missing from the optimized set. Treating objective values as features and decision-maker feedback as labels, the method identifies irrelevant objectives and can replace them with hidden ones, so that the EMOA tracks the decision-maker’s true objective set rather than the initial modeling (Shavarani et al., 2022).

The dynamic version of this problem appears in interactive EMO under preference drift. “Dynamic Detection of Relevant Objectives and Adaptation to Preference Drifts in Interactive Evolutionary Multi-Objective Optimization” simulates changes in the decision-maker’s utility and proposes mechanisms for discarding outdated or conflicting preferences and safeguarding relevant objectives that may appear irrelevant when trapped in local or global optima. This is a direct response to the risk that the optimizer continues to pursue stale or spurious objectives after the decision-maker’s preferences have changed (Shavarani et al., 2024).

A different perspective appears in many-objective optimization. Partition-Guided Distance Saliency (PGDS) models a distance mapping

$C$5

between decision-space distances and objective-space distances, partitions the objective space with KD-trees, and classifies variables as “Drivers” or “Blockers” based on how perturbations affect distance to a local Dominating Point. The paper uses “Decision Objective Hijacking” as a useful way to describe cases where a small set of variables or constraints exerts disproportionate control over the reachable objective region, effectively funneling the search toward particular trade-off regimes (Lopes et al., 29 Jun 2026).

Preference-based group decision-making raises a related concern. In ODESYS/FIVES, valid aggregation must occur in a unified preference domain, with actor-defined preference functions $C$6 and weights $C$7, and the solver maximizes

$C$8

Within this framework, weight manipulation, preference-function mis-specification, or biased constraints can make the unique best-fit solution reflect distorted interests rather than legitimate aggregated preferences. The paper does not name this as an attack, but it explicitly describes how such distortions can redirect the formal objective away from genuine group preference (Wolfert, 19 Mar 2026).

Decision-focused learning provides a mitigation-oriented counterpart. “Differentiation of Multi-objective Data-driven Decision Pipeline” argues that two-stage predict-then-optimize systems can be hijacked by surrogate prediction objectives that do not preserve the true Pareto set. Its landscape loss, Pareto set loss, and decision loss are designed to align prediction with objective-space geometry, solution-space alignment, and representative decision quality, thereby reducing the mismatch between what is predicted well and what is decided well (Li et al., 2024).

5. Empirical signatures and representative results

The literature repeatedly shows that decision objective hijacking is not equivalent to generic degradation. Its empirical signature is targeted redirection: one label, one passage, one evidence type, one trajectory family, or one route dominates despite unchanged weights or benign-looking interfaces.

Setting	Hijacked target	Reported result
Adversarial ICL	Fixed label $C$9	GGI ASR $x_Q$0 on SST-2 / RT for GPT2-XL; $x_Q$1 (4-shot) and $x_Q$2 (8-shot) on AG News (Zhou et al., 2023)
LLM text ranking	Pairwise preference	$x_Q$3 flipped on TREC-DL pairwise DOH (Qian et al., 23 Sep 2025)
Remote-sensing RAG	Weather evidence retrieval	GeoRSCLIP ViT-B/32 Weather@5 increases from $x_Q$4 to $x_Q$5 (Han et al., 8 May 2026)
Robotic diffusion policy	Attacker-defined trajectories	Human operators achieve $x_Q$6 takeover success on attacker-defined objectives in every evaluated setting (Yin et al., 9 Jun 2026)
Generative end-to-end driving	Safe-to-unsafe trajectory selection	Score drops of $x_Q$7–$x_Q$8 and collision rates of up to $x_Q$9 (Bouzidi et al., 29 Jun 2026)
Physical-world AD perception	Tracker relocation for control failure	Average attack success rate around $p=[I;C;S(x_Q,\_)]$0 digitally, $p=[I;C;S(x_Q,\_)]$1 physically, and $p=[I;C;S(x_Q,\_)]$2 average vehicle collision rate and unnecessary emergency stop rate (Ma et al., 2024)

Additional results reinforce the same pattern. In route-level hijacking, JackZebra reports overall HSR $p=[I;C;S(x_Q,\_)]$3, average HCL $p=[I;C;S(x_Q,\_)]$4 m, and average HCR $p=[I;C;S(x_Q,\_)]$5, with the victim continuing to drive “normally” while being diverted to an attacker-chosen destination (Sun et al., 6 Feb 2026). In multimodal decision-chain attacks, SAUPs achieve a $p=[I;C;S(x_Q,\_)]$6 attack success rate when controlling five distinct targets using just an adversarial frame (Li et al., 25 Nov 2025). In reasoning hijacking for classification, Criteria Attack remains highly effective even under defenses aimed at goal deviation: for example, on Gemma-3-27B, Double Criteria ASR stays at $p=[I;C;S(x_Q,\_)]$7 across toxic comment, negative review, and spam detection tasks under the tested prompt-based defenses (Liu et al., 15 Jan 2026).

These results suggest that the decisive failure mode is not random error accumulation but stable redirection toward an alternative criterion, target, or route. In many cases, the system’s behavior remains coherent under its corrupted objective, which is precisely why the hijack propagates effectively through downstream modules.

6. Defensive directions and open problems

The defensive picture is uneven. Some papers explicitly state that they do not provide a full defense. In adversarial in-context learning, increasing the number of demonstrations improves standard ICL performance but also strengthens the hijacking attack, because more demos provide more positions for suffix injection and stronger contextual influence. The conclusion is not that clean demos repair the objective shift, but that robust ICL remains an open problem (Zhou et al., 2023).

Several strands of work point toward boundary hardening. In LLM ranking, the central weakness is the inability to maintain a trusted instruction hierarchy between system-level ranking directives and document-level text. The paper argues for architectural separation of instructions and data, adversarial fine-tuning against document-level overrides, and detection of suspicious embedded instructions (Qian et al., 23 Sep 2025). In reasoning hijacking, the evidence shows that defenses aimed at goal deviation, such as SecAlign and StruQ, leave a substantial blind spot for criteria injection, implying that future defenses must monitor or constrain decision criteria, not only explicit task switches (Liu et al., 15 Jan 2026).

Retrieval-stage hijacking demands retrieval-aware defenses. CloudWeb explicitly argues that generator-only defenses are insufficient and discusses adversarial or augmentation training for retrievers, cloud/haze detectors, retrieval stability checks, evidence-type gating, and uncertainty-aware generation (Han et al., 8 May 2026). In autonomous driving, the proposed defensive directions include downstream safety filters after the scoring head, reduced encoder sensitivity, reduced decoder amplification, route-integrity monitoring, and multi-sensor corroboration, because a single learned scoring layer or a single camera-centric perception stack is an exposed attack surface (Bouzidi et al., 29 Jun 2026, Sun et al., 6 Feb 2026).

In optimization systems, the analogue of defense is objective governance. Interactive EMO methods react to preference drift by dynamically discarding outdated preference information; objective-reduction methods try to remove irrelevant objectives and surface hidden ones; preference-based group decision frameworks require transparent, actor-specified weights and preference functions to prevent the formal objective $p=[I;C;S(x_Q,\_)]$8 from being silently distorted (Shavarani et al., 2024, Shavarani et al., 2022, Wolfert, 19 Mar 2026). A plausible implication is that, outside adversarial ML, decision objective hijacking is best prevented not by input filtering alone but by maintaining explicit traceability from optimized criterion to intended preference structure.

A deeper unresolved issue concerns capability. Work on consequentialist objectives argues that when capabilities are sufficiently advanced, optimizing a fixed misspecified objective tends to produce catastrophic outcomes, and that constraining capabilities can avert catastrophe while still yielding valuable outcomes (Marklund et al., 16 Mar 2026). This suggests that decision objective hijacking is not only an attack pattern but also a general structural vulnerability of systems that optimize proxies too effectively. In that broader sense, the central open problem is not merely detecting malicious context, but ensuring that the objective actually optimized at inference time remains aligned with the objective that should govern the system.