Search papers, labs, and topics across Lattice.
This paper investigates the security vulnerabilities of LLM-based search agents, particularly focusing on how external tool returns can be manipulated through coordinated evidence gathering. By introducing the Authority-Chain Hijack (ACH) strategy, the authors demonstrate that a single controlled search result can significantly increase the success rate of attacks on these agents, achieving an Overall Attack Success Rate (ASR) of 55.9%. Additionally, the Trace-Guided Strategy Evolution (TGSE) method enhances attacker strategies through automated refinement, achieving an impressive ASR of 71.4% in evaluations.
A single manipulated search result can dramatically amplify the effectiveness of attacks on LLM-based search agents, revealing critical vulnerabilities in their evidence-gathering processes.
LLM-based search agents are widely used for information-seeking tasks, but their reliance on external tool returns introduces a critical security risk: web content retrieved during execution is untrusted, exposing agents to prompt injection and goal hijacking. Prior work on search-agent safety primarily focuses on static web-content injection, but modern agents issue follow-up queries and cross-check competing sources, so a single injected page is often diluted or rejected. We show that the channel delivering search and page observations is a fragile security boundary: beyond exposing the agent to a single poisoned page, a mediated search interface can repeatedly steer how the agent gathers evidence and forms its final answer. Under a constrained tool-intermediary threat model, appending only one controlled result per query can substantially increase attack success when the evidence is coordinated across the agent's trajectory. We study this setting with a strategy-driven long-horizon attack system and introduce Authority-Chain Hijack (ACH), an expert-refined strategy that turns isolated search-result and page-content manipulations into a coherent evidence chain across seemingly corroborating sources. ACH achieves the highest Overall ASR among all baselines, reaching 55.9% / 83.3% ASR / MaxN ASR on the full SafeSearch test split. We further introduce Trace-Guided Strategy Evolution (TGSE), which automatically improves attacker strategies from execution traces, replacing manual redesign with trace-driven refinement; its strongest single setting reaches 71.4% / 95.0% in held-out evaluation.
