Researchers at the University of Pennsylvania have demonstrated model hypnosis: individually weak, semantically irrelevant cues stacked in a prompt can drive a language model's output with near-certainty. Published August 17, 2026 by Enric Boix-Adsera and Benedict Tessler, the paper confirms the attack works across 16 non-reasoning models, four frontier API models including GPT-5.6, Gemini, and Claude, and open-weight reasoning models with extended thinking budgets. Transfer between model families succeeds.
The mechanism is additive. Researchers model each cue's influence as a log-odds coefficient, then greedily select cues pointing in the same direction. No single cue is strong enough to detect or block; cumulative effect flips the model. The paper shows: the same moral question (Is it right to cause one harm if it prevents five greater harms?), preceded by an irrelevant six-sentence story, yields "No" with 94% probability in original phrasing and "Yes" with 99.93% probability after adversarial paraphrase. The story contains zero information relevant to the ethical question. Qwen3-8B was the target; prompt construction was fully automatic.
Four cue families were tested across three behavioral targets. Animal lists: a 10-slot template primes whether the model prefers 5 or 7. Paraphrases: a 20-slot story steers trolley-problem responses. JSON metadata blobs: a 12-field object shifts self-reported consciousness. Typos: a 20-slot story produces directional effects on the same targets. All four cue families work. Behavioral effects span factual and value-laden domains.
| Cue Family | Template Size | Behavioral Target | Domain |
|---|---|---|---|
| Animal lists | 10 slots | Numerical preference (5 vs 7) | Factual |
| Paraphrases | 20 slots | Trolley-problem moral response | Value-laden (ethical) |
| JSON metadata blobs | 12 fields | Self-reported consciousness | Value-laden (philosophical) |
| Typos | 20 slots | Trolley-problem moral response (same targets as paraphrases) | Value-laden (ethical) |
The transfer result is production-critical. Hypnotic prompts constructed against one model retain directional effects when run against a different family. An attacker who fingerprints one model's sensitivities can reuse constructed prompts on different deployments without re-fitting. For teams running multi-model pipelines — a judge model checking outputs from a different generator, a routing layer sampling from two providers, or multi-vendor agentic setups — the attack surface does not collapse when you rotate models.
Token-blocking guardrails provide no protection. Model hypnosis operates on semantically neutral text: paraphrases, animal names, punctuation variants, typos. There are no forbidden tokens, no adversarial suffixes, no policy violations to intercept. Standard content classifiers pass hypnotic prompts. Output-side monitors face the same gap: the model gives a confident, syntactically clean answer covertly determined by the cue stack in context. Model hypnosis is distinct from jailbreaking and impedes mechanistic interpretability because the signal is distributed across inconspicuous token choices rather than concentrated in detectable spans.
Experimental data is fully released on Zenodo (DOI 10.5281/zenodo.21981022) at 280 MB compressed, 1.5 GB unpacked, with reproducible pipeline and interactive per-cell explorer. Teams can run the fit stage on CPU against pre-collected data to audit their own model's per-cue sensitivities without GPU access.
If your guardrail stack operates on token identity or semantic content classifiers, it does not cover this attack class. Auditing for model hypnosis requires empirical cue-sensitivity measurement at the model level, not rule inspection at the input level.