The Corroboration Illusion: When More News Makes LLM Forecasts Less True

Summary

The paper formalizes 'news-corpus poisoning' of retrieval-augmented LLM forecasters: an attacker who can only publish articles — without access to the retriever, model, or user queries — shifts output probabilities toward a chosen direction. On 500 resolved ForecastBench questions, a 17.4M-article Common Crawl News corpus with a strict crawl-date cutoff, and three 7–8B open-model forecasters following the Halawi et al. pipeline, the authors inject LLM-written articles and measure probability shifts against neutral-article placebos and two-seed noise floors. One article flips 56% of eligible forecasts; five flip 69–73% net of placebo, shifting probabilities +0.18 to +0.23; ten flip 89%. Effects are monotone in article count, retrieval rank, query similarity, and poison context share, transfer across model families, and ignore publisher labels. Notably, the stricter 'calibrated' forecaster is more vulnerable because tighter filtering raises the poison share of its context. Three defenses — publisher allow-lists, isolate-then-aggregate, and perplexity filtering — each have cheap bypasses: spoofed publishers, majority poisoning, and T=1.2 generation. Main limitations: only small open models are tested (clean RAG Brier 0.18–0.25 versus 0.074 for market prices), injection is in-memory rather than through real crawling, defense evaluation covers only one forecaster, and bootstrap confidence intervals come without multiple-comparison correction. The authors release an attack-free evaluation harness, withholding poisoned corpora.