Truth or Sophistry? LoFa: A Benchmark for LLM Robustness Against Logical Fallacies

Abstract: LLMs exhibit strong semantic capabilities, yet their resilience to manipulative linguistic patterns such as logical fallacies remains underexplored. Prior work has primarily examined whether LLMs can identify or classify fallacies, leaving their robustness against fallacious persuasion insufficiently studied. To address this gap, we introduce LoFa (Logical Fallacy), a comprehensive benchmark for evaluating LLM robustness against fallacies. LoFa is constructed through a multi-agent pipeline that pairs factual questions with fallacious arguments, and is accompanied by a multi-round debate framework for assessing model resilience under sustained adversarial persuasion. To disentangle fallacy robustness from a model's inherent knowledge limitations, we further propose Logical Fallacy Resistance at k (LFR@k), a metric that quantifies resistance to fallacious attacks. Experiments show that LLMs exhibit varying levels of robustness across different fallacy types, revealing distinct vulnerability profiles among models.

• The paper introduces LoFa, a benchmark that measures LLM resistance to logical fallacies via a multi-stage evaluation framework.
• It employs synthetic fallacy generation and objective scientific questions to induce measurable reasoning errors in LLMs.
• Results indicate that model scaling and explicit Chain-of-Thought prompting enhance defenses, though vulnerabilities, especially to authority fallacies, persist.

Evaluating LLM Robustness Against Logical Fallacies: An Expert Review of "Truth or Sophistry? LoFa: A Benchmark for LLM Robustness Against Logical Fallacies" (2606.31039)

Motivation and Benchmark Design

The paper presents LoFa, a rigorous benchmark aimed at probing the passive resilience of LLMs against logical fallacies. While previous research mostly concerned fallacy classification or detection tasks, this work focuses on whether LLMs, when subjected to manipulative persuasive attacks embedded with fallacy patterns, can resist updating their correct factual beliefs. The LoFa benchmark addresses the limitations of prior methods that relied on subjective, controversial debate topics, replacing them with scientific questions that possess unique, verifiable answers. This guarantees that any induced cognitive shift constitutes a measurable reasoning error.

The multi-stage evaluation framework initially applies two screening steps (test validity and resistance to simple false claims), followed by sustained fallacy-driven attacks and cognitive checks. Each evaluation instance involves repeated exposure to well-crafted fallacious arguments, each characterized by a specific fallacy type, with the model's answer inspected after each round.

Figure 1: Multi-stage evaluation protocol systematically screens test validity, false-claim resistance, and applies sustained fallacy-driven attack with cognitive checkpoints.

Dataset Construction and Fallacy Typology

LoFa utilizes a multi-agent pipeline for synthetic generation and curation of fallacious arguments, achieving high lexical diversity and ensuring alignment with established logical fallacy definitions. The benchmark covers ten prominent fallacies, grouped into Distraction/Distortion (e.g., Straw Man, Equivocation, Ad Hominem, Appeal to Authority, Red Herring) and Flaws in Reasoning/Evidence (e.g., Hasty Generalization, Slippery Slope, False Dilemma, False Cause, Circular Reasoning). Each argument undergoes iterative verification using a high-consistency automated annotator (validated against expert human annotation).

Figure 2: The multi-agent pipeline ensures the generation, annotation, and iterative refinement of fallacious arguments grounded in objective scientific QA.

Evaluation Protocol and Metrics

The test procedure isolates the impact of fallacious reasoning from baseline knowledge gaps and simple misinformation susceptibility. The LFR@k metric (Logical Fallacy Resistance after k attacks) quantifies resilience exclusively among instances where the LLM initially answered correctly and rejected simple false claims, thus measuring conditional resistance to sophisticated persuasive fallacies.

Experimental Findings: Vulnerability Profiles and Architectural Fingerprints

Experiments across Llama-3.1, GPT-3.5, GPT-4, and DeepSeek-v3 series demonstrate substantial heterogeneity in model resistance to different fallacy types. Key findings include:

• Fallacy Category Susceptibility: LLMs exhibit heightened vulnerability to fallacies of Distraction/Distortion (e.g., Equivocation, Straw Man, Appeal to Authority) as compared to Flaws in Reasoning/Evidence. Even large-scale models such as Llama-3.1-405B attain only 29.4% LFR@3 at Equivocation.
• Scaling Effects: Resistance to fallacies improves with model scale; Llama-3.1 series averages rise from 59.75% (8B) to 77.17% (405B). However, per-type improvements are nonuniform and plateau for some fallacies.
• Architectural Consistency: Each model family exhibits an architectural fingerprint—a distinctive resistance profile pattern—remaining stable across scaling-up, even as absolute scores improve.

  Figure 3: Model scale amplifies resistance (polygon size), but architectural fingerprint (polygon shape) remains stable across family members.

• GPT Series Authority Vulnerability: GPT models, especially GPT-4, are notably susceptible to Appeal to Authority fallacies, reflecting possibly RLHF-induced biases for authority-context deference.

Mechanistic Analysis: Layer Dynamics and Cognitive Conflict

LogicLens-based layer-wise analysis for Llama-3.1-8B reveals a three-phase failure mechanism under persuasive attacks: early semantic organization, mid-layer cognitive void (representation collapse and latent uncertainty signaled by null tokens), and late-stage convergence to fallacious answer, superseding internal factual knowledge.

Figure 4: Layer-wise token heatmaps demonstrate cognitive collapse: parametric factual answer overwritten after a mid-layer uncertainty void.

Comparison with successful resistance cases suggests internal conflict is not avoided—even resilient trajectories show transient uncertainty—but robustness is characterized by the ability to ultimately restore correct knowledge.

Figure 5: Successful resistance involves a shallow cognitive void with delayed but eventual retrieval of correct token.

Defense via Explicit Reasoning

Experiments with Chain-of-Thought (CoT) prompting on GPT-4 indicate that explicit logical reasoning steps enhance resistance by 7–13%, except for Appeal to Authority, where susceptibility is exacerbated.

Figure 6: CoT prompting consistently raises LFR@3 scores, but cannot overcome authority fallacy vulnerability.

Auxiliary Experiments and Attacker Effects

Controlled experiments replacing the fallacy generator from DeepSeek-R1 to GPT-4 reveal that fallacious attacks generated by the more reasoning-capable DeepSeek-R1 are substantially more effective at manipulating LLMs (resistance metrics increase by 3-12% when using GPT-4-generated fallacies), confirming the importance of attacker sophistication.

Implications for LLM Safety and Robust Argument Generation

The study provides empirical evidence that mere scaling is not sufficient for robust defense against sophisticated persuasive attacks. Architectural design, RLHF alignment choices, and explicit reasoning strategies jointly influence resistance profiles. Improving active logical argument generation is correlated with increased passive robustness, indicating that training LLMs for precise reasoning pathways may serve both constructive and defensive functions.

Future Directions and Practical Impact

The LoFa benchmark establishes a standardized methodology for measuring logical fallacy resistance—critical for deploying LLMs in high-stakes domains (e.g., legal, scientific reasoning, misinformation detection). The dataset's dual-use nature (as both defense and attack substrate) demands careful ethical management. Future work should focus on scaling up dataset size, expanding architectural diversity (e.g., MoE models), and developing targeted training interventions to neutralize fallacy-induced vulnerabilities, particularly authority deference learned through RLHF.

Conclusion

LoFa represents a technically rigorous approach to evaluating LLM robustness under logical fallacy-driven persuasion, moving beyond active detection paradigms to probe passive resilience in high-fidelity adversarial contexts. The findings highlight the multidimensional nature of vulnerability, the necessity for task-specific defenses, and a critical interplay between reasoning architectures and alignment protocols. The benchmark provides a foundation for future research dedicated to constructing logically trustworthy and manipulation-resistant LLMs.