Search papers, labs, and topics across Lattice.
This paper identifies a novel attack surface in agentic retrieval-augmented generation (RAG) systems, focusing on the salience channel, which can manipulate reasoning through the positioning and framing of true facts. The authors formalize Salience Induction, a method that employs truth-preserving edits to redirect Multi-Hop attribute binding while maintaining semantic integrity of the retrieval trace. Evaluations reveal that their approach achieves an 83.3% attack success rate against leading models, highlighting the inadequacy of existing defenses that rely solely on truthfulness and instruction filtering.
Salience Induction can redirect reasoning in RAG systems even when all retrieved claims are true, achieving an 83.3% attack success rate against leading models.
Agentic retrieval-augmented generation (RAG) systems increasingly retrieve external evidence and orchestrate tools for knowledge-intensive applications. In Multi-Hop question answering, agents chain facts across documents. Existing defenses focus on content poisoning, which injects false facts, and prompt injection, which embeds directives. We identify a third attack surface: the salience channel, through which fact position, emphasis, framing, and semantic proximity can redirect reasoning even when all retrieved claims are true and no instructions are present. We formalize Salience Induction as truth-preserving edits that redirect Multi-Hop attribute binding while leaving the retrieval trace semantically intact. We define six Salience-Editing operator classes and build an iterative proposer-verifier pipeline under factual and stealth constraints. We also introduce SalientWiki-MH, a decoy-annotated Multi-Hop benchmark. Evaluations across five frontier model families (GPT, Claude, Gemini, DeepSeek, and Qwen) and three agent architectures (ReAct, Reflexion, and tool-calling) show broad generalization. Under a 30% edit budget, Salience Induction achieves an 83.3% attack success rate; the strongest evaluated baseline defense leaves 75.7% post-defense ASR. Untargeted rewriting further reduces attacks only by degrading neutral task success. Our lightweight input-side defense, Salience Normalization, reduces attack success to 15.3% under standard attacks and 23.6% under an adaptive attack. These results show that truthfulness and instruction filtering alone are insufficient: robust agentic RAG also requires defenses against salience-relevance decoupling.
