Search papers, labs, and topics across Lattice.
This study investigates the susceptibility of Deep Research agents to misleading information during long-horizon investigations by introducing the MisKnow-Agent framework, which generates task-specific documents that support false conclusions. The findings reveal that a single misleading document can significantly increase the false-conclusion adoption rate (FCAR) from 0% to 54.7%, highlighting the agents' vulnerability to factually incorrect yet seemingly credible sources. Additionally, while pre- and post-research defenses can reduce FCAR, they do not completely eliminate the adoption of false conclusions, underscoring the need for continuous verification in research workflows.
A single misleading document can increase the false-conclusion adoption rate of Deep Research agents to over 54%, revealing a critical vulnerability in AI-driven research processes.
Deep Research agents conduct long-horizon investigations by iteratively planning, retrieving evidence, and generating reports. However, it remains unclear whether they can resist apparently credible but factually false information introduced into these workflows. To study this failure mode, we introduce MisKnow-Agent, a controlled evaluation framework that constructs task-specific documents supporting manually audited false conclusions with controlled authority cues and source styles. Applied to the tasks from DeepResearch Bench, it generates 5,933 misleading documents after filtering. We evaluate DeerFlow and WebThinker with three backbone LLMs, together with Gemini Deep Research, using a report-level false-conclusion adoption rate (FCAR) that counts only reports endorsing the false conclusion. Across the configurations, introducing one misleading document increases the mean FCAR from 0\% in the no-injection control to 54.7\%. FCAR varies substantially with lifecycle stage and framework design, and also with source authority and presentation style, whereas search-result rank and additional documents beyond the first have limited influence. Although cross-model verification consistently classifies retained instances as misleading, Deep Research agents can still adopt the corresponding false conclusions during long-horizon research. Pre- and post-research defenses reduce FCAR but do not eliminate adoption, motivating continuous verification when evidence enters intermediate research states and final synthesis. To facilitate reproducibility, our code and dataset are publicly available at https://github.com/whfeLingYu/MisKnow-Agent and https://huggingface.co/datasets/whfeLingYu/Misleading_Knowledge, respectively.
