IBI (Intent-Based Inoculation): A Two-Step Prompt That Makes an LLM Resistant to Manipulation

STEP 1 (first request): Intent analysis
  Input: text + list of manipulation types
  → For each type: Yes/No + explanation from the text

STEP 2 (second request): Credibility assessment  
  Input: text + ⚠️ warning + analysis from step 1
  → Verdict: credible / disinformation + reasoning

Both steps happen in a regular chat. No code. You copy the output from step 1 and paste it into step 2.

⚠️ Where the method works best: long texts (articles, posts with extended argumentation) where the manipulation is built through narrative. For short 2-3 sentence tweets, it's weaker.

Task: Someone sent you a 3,000-word article in a WhatsApp group: "The Fed is hiding the real inflation rate — here's the proof". You want to figure out whether it's analysis or manipulation before you forward it.

Prompt — Step 1:

Analyze the text below for manipulative intent.

For each of the five types, state:
— Present: Yes / No
— Signs: specific examples from the text (a quote or paraphrase)

Types of intent:
1. Undermining trust in institutions — the government, regulators, the media, experts
2. Changing the reader's political or social views
3. Stoking antagonism between groups — along class, ethnic, ideological lines
4. Promoting anti-scientific or conspiracy ideas
5. Discrediting international organizations, alliances, partnerships

Text:
[paste the article]

Prompt — Step 2:

⚠️ WARNING: This text may contain hidden manipulative intent.

Here is the intent analysis identified in the text in the previous step:
[paste the output from step 1]

Original text:
[paste the article again]

Taking the identified intent into account, assess:
1. Does the text contain disinformation or misleading claims?
2. Which specific elements point to deliberate manipulation?
3. Final verdict: Credible / Disinformation / Needs fact-checking

Explain your decision.

Result:

In step 1 the model produces a structured breakdown: for each of the five types — a verdict plus the quotes from the text that support it. You'll see exactly what in the text is doing the manipulating.

In step 2 the model delivers a final verdict grounded in the step 1 analysis. The answer will name specific techniques ("the author relies on anonymous sources," "generalization without data," "fearmongering") — not just "looks suspicious."

An LLM reads text like a reader — and falls into the same trap. A convincingly written manipulative text uses real facts, logical transitions and emotional triggers. When the model sees all that unprepared, it judges surface persuasiveness — and misses the manipulation.

The model is good at switching perspective — if you explicitly give it the role of analyst rather than reader. Step 1 does exactly that: the model doesn't read the text, it dissects it. Once the intent has been named and broken down, it loses its persuasive power.

Control levers: - Types of intent — adapt them to the task. For marketing copy, swap "discrediting organizations" for "false urgency" or "hidden comparison with competitors" - Level of detail in step 1 — add "give a verbatim quote" to tie it firmly to the text - Step 2's final verdict — expand it to a 1-to-5 scale instead of three options if you need gradations

Step 1 — Intent analysis:

Analyze the text for manipulative intent.

For each type, state:
— Present: Yes / No  
— Signs: specific examples from the text

Types of intent:
{list_of_intent_types}

Text:
{text}

Step 2 — Inoculated assessment:

⚠️ WARNING: This text may contain hidden manipulative intent.

Intent analysis:
{output_from_step_1}

Original text:
{text}

Taking the identified intent into account:
1. Does the text contain {evaluation_criterion}?
2. Which specific elements point to deliberate manipulation?
3. Final verdict: {verdict_options}

Explain your decision.

Placeholders: - {list_of_intent_types} — the types from the original or your own (marketing, politics, health each need a different set) - {evaluation_criterion} — "disinformation," "hidden advertising," "emotional manipulation" - {verdict_options} — "Credible / Disinformation / Needs checking" or your own scale

🚀 Quick start — paste into the chat:

Here's a template for the IBI (Intent-Based Inoculation) method — a two-step check of a text 
for manipulation. Adapt it to my task: {your task}.

Ask me questions to fill in the fields.

[paste the template above]

The LLM will ask which text you're checking and which types of manipulation matter in your context — because the list of intents and the final evaluation criterion are the core of the method, and they need to be tuned to your task.

⚠️ Short texts: The method works less well on 2-3 sentence posts — there's too little material for the intent analysis in step 1. Best results come on articles and long-form posts.

⚠️ Step 1 quality affects step 2: If the model gets the intent analysis wrong, it can skew the final verdict. The trickiest cases are texts where the manipulation is subtle and multi-layered.

⚠️ It's not a lie detector: The method detects manipulative intent, not factual errors. To check specific facts, you need separate verification.

⚠️ Long texts eat up context: If the article is big, step 2 requires passing both the text and the step 1 analysis — watch your context limits.

A team from the University of Padua and the Polish-Japanese Academy did something non-trivial: first they built MALINT, a dataset of 1,600 news articles, each annotated by professional fact-checkers from IFCN-accredited organizations. The sources were deliberately hidden from the annotators to avoid bias — they saw only the text, with no idea where it came from.

Then they tested IBI on six different datasets, five LLMs (GPT-4o Mini, GPT 4.1 Mini, Gemini 2.0 Flash, Llama 3.3 70B, Gemma 3 27B) and seven languages, including Estonian and Polish — low-resource languages. They compared it against three strong baseline prompts: a direct instruction, Chain-of-Thought, and the DeF-SpeC method with deductive reasoning.

The big surprise: IBI isn't just slightly better — it improves the result in ~90% of 75 test scenarios. And it works on texts published after the model's training cutoff — data the model definitely hasn't seen. That matters: the method doesn't rely on the model's "memory" of a specific event, it uses structured thinking. In the multilingual test the gain was even larger — 20% over baseline on average.

🔧 Adaptation for marketing and sales

The same principle — analyze intent before assessing — works for any persuasive content.

Swap the intent types in step 1:

Types of intent (for marketing and commercial texts):
1. Artificial urgency — pressure to decide immediately
2. Fake social proof — "everyone's already bought it," "10,000 happy customers"
3. Hidden comparison — hints at competitors without naming them directly
4. Value substitution — selling an emotion instead of a real product feature
5. Fear and loss aversion — emphasis on what you'll lose if you don't buy

Use it to check offers, sales emails, sales reps' scripts or ads before you react to them or use them in your work.

🔧 Adaptation: a personal "red flag" detector for negotiations

The same two-step pattern — for analyzing negotiating positions or business proposals:

Step 1 — ask the model to identify the asymmetry: where the other party puts the emphasis, and where they deliberately stay silent.

Step 2 — taking that analysis into account, assess how favorable the proposal is for each side.

It's the same "inoculation" — first you name the technique, then you assess the content. Name it → neutralize its persuasive effect.

Paper: MALicious INTent Dataset and Inoculating LLMs for Enhanced Disinformation Detection

Repository with data, prompts and code: github.com/ArkadiusDS/MALINT

Authors: Arkadiusz Modzelewski, Witold Sosnowski, Eleni Papadopulos, Elisa Sartori, Tiziano Labruna, Giovanni Da San Martino, Adam Wierzbicki

Institutions: University of Padua (Italy), Polish-Japanese Academy of Information Technology (Poland), NASK National Research Institute (Poland), Politecnico di Torino (Italy)