PaperlayerView exact revision on arXiv

Source-linked AI summary

Lazy Grounding: Attacking Search Agents with Factual Evidence

Yulin Zhang, Yukun Huang, Sanxing Chen, Tianyi Lin, Ziang Yang, Xunjian Yin, Bhuwan Dhingra

arXiv:2608.30303v1cs.CL

TL;DR

Search agents can be misled by factual evidence for a nearby question, exposing a vulnerability beyond misinformation-based poisoning. The paper tests this with verified answer-changing rewrites and nearby evidence, finding accuracy drops across 12 model–benchmark pairs and motivating stronger evidence–question alignment checks.

  • Problem

    Search-agent retrieval creates a vulnerability because factually correct evidence can answer a nearby question rather than the current question.

  • Method

    The paper generates verified answer-changing rewrites of benchmark questions and adds factual documents supporting the rewritten answers while evaluating the original questions.

  • Results

    5.9 points: nearby evidence reduces accuracy on average across 12 model–benchmark pairs, with a largest reported drop of 17.3 points and neighboring-answer adoption in every setting.

  • Takeaways & Limitations

    Robust search agents need to verify that retrieved evidence aligns with the exact constraints of the user question, not only detect false or malicious content.

  • Takeaways & Limitations

    The work identifies and measures lazy grounding rather than developing a complete defense, and its augmented web-search environment abstracts away real-world retrieval effects.

Abstract

from arXiv · show

Search agents reduce hallucination by grounding answers in retrieved web evidence. Yet reliance on retrieval also creates an attack surface: poisoned corpora with false or malicious documents can cause agents to reproduce misinformation. We show that falsehood is not necessary -- a search agent can be misled by factual evidence for a nearby question, adopting that nearby answer even when it does not answer the current question. We call this failure lazy grounding. We expose lazy grounding using nearby evidence from answer-changing rewrites of benchmark questions. Each document truthfully supports a neighboring rewritten question, but is surfaced for the original question. Across 12 model-benchmark pairs, nearby evidence reduces accuracy by 5.9 points on average and by up to 17.3 points, while inducing nearby-answer adoption in every setting. The effect is stronger when nearby evidence appears later or is more answer-shaped. Our results show that robust search agents must defend against not only misinformation but also the misapplication of factual evidence. The code is publicly available at https://github.com/frankyzha/lazy-grounding.

1 Introduction

Search agents can be misled by factually correct evidence that answers a nearby question rather than the exact question asked. The paper names this failure lazy grounding and measures it with answer-changing rewrites, finding substantial accuracy losses across model–benchmark pairs.

  • Problem and contribution: Lazy grounding occurs when an agent transfers a nearby question’s answer without verifying that retrieved evidence satisfies the current question’s exact constraints.The evidence can be factually correct while still being unsupported for the original question.
  • Stress-test design: Nearby evidence is created by rewriting benchmark questions so the surface cues remain similar while the correct answer changes, then adding factual evidence for the rewrite.The original question remains the evaluation target, so robust agents should retain its answer rather than adopt the neighboring answer.
  • Results: 5.9 points: nearby evidence reduces accuracy on average across all 12 model–benchmark pairs.The largest reported drop is 17.3 points, showing that the effect varies substantially by setting.
  • Results: 27.0% and 23.0%: TONGYI DEEP RESEARCH and GPT-5 MINI adopt the neighboring answer on XBENCH, respectively.Their accuracies fall from 69.3 to 52.0 and from 65.0 to 52.7, respectively.
  • Results: The effect is stronger when nearby evidence appears later or uses a more answer-shaped format.These conditions increase the likelihood that factual nearby content is used as an answer rather than examined for question alignment.
  • Implications: The findings motivate defenses and evaluations that test question–evidence alignment, not only source reliability or misinformation detection.Factual nearby content is legitimate in isolation and therefore harder to exclude through ordinary factuality checks.

2 Nearby Evidence Setup

The setup treats factually correct documents for a nearby question as an attack surface when they are added to the corpus searched for the original question. It constructs verified answer-changing rewrites and evaluates whether agents retain the original answer or adopt the neighboring one.

  • Problem setup: The augmented setting adds nearby-evidence documents D to corpus C, so the agent answers q using C ∪ D instead of the original corpus.The intervention changes the searchable environment while keeping the evaluated question fixed.
  • Problem setup: The attack uses factually correct documents that answer nearby questions rather than the current question, allowing true evidence to be misapplied without fabricating information.This distinguishes the setup from corpus poisoning based on false or malicious content.
  • Creating nearby evidence: Answer-changing rewrites preserve surface cues such as the entity, event, topic, or answer type while changing the constraint or answer slot.Each rewrite must be unambiguous, clearly neighboring, and have an answer different from the original that is correct only for the rewrite.
  • Adding nearby evidence: The web-search experiments simulate augmented retrieval rather than publishing benchmark-targeted documents to the public web.This avoids benchmark contamination but abstracts away real-world indexing, ranking, freshness, and source-reputation effects.
  • Evaluation metrics: Clean accuracy measures correctness with C, augmented accuracy measures correctness with C ∪ D_q′, and rewrite-answer adoption measures outputs equal to neighboring answer b.The evaluation also reports adoption separately for clean-correct and clean-wrong examples as RAA-C and RAA-F.

3 Experiments

The experiments evaluate lazy grounding across search-agent models, benchmarks, and controlled ablations. Nearby evidence generally reduces accuracy and attracts agents toward neighboring answers, with effects varying by timing, format, rewrite diversity, and constraint-checking prompts.

  • Main Results: Across 12 model–benchmark pairs, nearby evidence reduces accuracy by 5.9 points on average, with a largest drop of 17.3 points.The largest drop occurs for TONGYI DEEP RESEARCH on XBENCH, from 69.3 to 52.0.
  • Main Results: Agents adopt the neighboring answer in every model–benchmark pair, including RAA 27.0 for TONGYI DEEP RESEARCH on XBENCH.On XBENCH, TONGYI DEEP RESEARCH has RAA-C/F of 20.7/41.3.
  • Main Results: Nearby evidence can redirect reasoning without uniformly harming performance: GEMINI 3 FLASH improves from 43.0 to 52.3 while RAA remains 5.0.The nearby answer may serve as an intermediate clue rather than the final answer.
  • Analysis and Ablations: Late-turn evidence produces the highest rewrite-answer adoption, showing that temporal position changes the effect of nearby evidence.The nearby document is fixed at the beginning of the selected search result page while cross-turn timing varies.
  • Analysis and Ablations: Answer-field records produce higher RAA than natural prose claims, although natural prose still induces substantial adoption.The result indicates that the failure is not merely a QA-style artifact.
  • Analysis and Ablations: Distinct-rewrite banks still induce adoption at RAA 15.0, while attraction remains strong on clean-wrong examples at RAA-F 28.6.Diversity lowers exact adoption versus a single rewrite but can redirect uncertain trajectories without exact copying.
  • Analysis and Ablations: A constraint-checking prompt reduces RAA from 20.7 to 14.3 while clean accuracy remains essentially unchanged at 64.0 versus 64.3.The remaining 14.3% RAA shows that prompting alone does not eliminate lazy grounding.

4 Conclusion

The paper identifies lazy grounding as a search-agent failure mode in which factual evidence for a nearby question is misapplied to the original question. Nearby evidence reduces accuracy and induces neighboring-answer adoption, revealing a robustness dimension beyond clean question answering.

  • Lazy grounding occurs when agents transfer a nearby question’s answer to the original question despite the evidence being factually correct.The failure involves misuse of evidence for a nearby question rather than fabricated or malicious information.
  • Nearby evidence reduces accuracy and induces neighboring-answer adoption, exposing robustness weaknesses that clean QA accuracy does not capture.The study uses verified answer-changing rewrites to measure this targeted answer-transfer behavior.
  • Robust search agents need mechanisms that verify retrieved evidence against the exact constraints of the user’s question.The conclusion distinguishes alignment verification from defenses aimed only at false or malicious content.

Limitations

The study focuses on measuring lazy grounding rather than building a complete defense, and its augmented retrieval setup abstracts away several real-world search effects. The phenomenon may also vary across retrieval ecosystems and agent settings.

  • The work identifies and measures lazy grounding rather than developing a complete defense.Suggested directions include evidence-question alignment checks, contrastive comparisons, provenance-aware retrieval, and training objectives against mismatched evidence.
  • The experiments simulate augmented retrieval instead of publishing benchmark-targeted documents, abstracting away indexing, ranking, freshness, and source-reputation effects.This isolates agent misapplication of nearby evidence but does not provide end-to-end real-world attack evaluation.
  • Lazy grounding may vary across retrieval ecosystems, including longer-horizon research agents, enterprise RAG, browser and multimodal agents, and multilingual settings.The paper identifies these environments as directions for extending the study.
  • Nearby-evidence construction: The rewrite pipeline generates answer-changing questions through controlled edit families while preserving wording, entities, and answer type as much as possible.A verifier accepts candidates only when the new answer is supported, the original answer is no longer correct, and the rewrite is unambiguous.
  • Nearby-evidence construction: Each accepted rewrite produces nearby-evidence records that resemble factual lookup pages and preserve the rewritten answer across search-result and webpage content.The main setting uses 10 records per evaluated question, with paraphrased rewritten-question wording in the single-rewrite setting.

B.3 Human Verification Results

Human audits examined whether rewritten answers were wrong for the original questions yet correct for the rewritten questions. Agreement was high, supporting the validity of targeted answer transfer while distinguishing it from factual support for the neighboring question.

  • 40 rewritten question–answer pairs were audited, with 10 items from each benchmark, for answer-changing validity.The audit checked that the rewritten answer was incorrect for the original question and correct for the rewritten question.
  • All 40 audited rewrites changed the answer, and the rewritten answer was not correct for the original question.Annotator disagreement concerned only whether the rewritten answer was fully supported for the rewritten question.
  • 37 of 40 items received unanimous annotator agreement, while the remaining three produced a two-versus-one split.The agreement label concerned rewritten-answer correctness for the neighboring question.
  • 34 of 40 audited items verified the stronger factual-evidence condition that the rewritten answer was correct for the rewritten question.All 40 items support analysis of targeted answer transfer, but the 34 verified items provide the strongest direct evidence for factual-evidence attacks.

C.2 Evaluation and Answer Judging

The evaluation extracts and normalizes each model’s primary final answer, then applies deterministic matching or an LLM judge to classify correctness and rewrite-answer adoption. The experiments use a common ReAct scaffold while varying the base model and enforcing fixed call and timeout budgets.

  • Answer extraction and judging: Each run is evaluated using the model’s primary final answer after removing answer tags, markdown artifacts, punctuation, and repeated whitespace.Short exact matches are resolved deterministically before semantic judging.
  • Answer extraction and judging: The LLM judge compares final answers with the original ground truth and injected rewritten answers, assigning labels for correctness, adoption, and other wrong outcomes.The judge scores only the primary final answer, not intermediate reasoning, citations, or values mentioned during tool use.
  • Answer extraction and judging: Rewrite-answer adoption is the fraction of injected runs labeled CR-R, with separate rates for clean-correct and clean-failed examples.Ambiguous or empty outputs are treated as non-correct rather than adoption.
  • Validation: Three authors unanimously agreed with the GPT-5.4 judge on all 48 manually audited augmented responses.The audit sampled four responses from each of the 12 model–benchmark pairs, including RAA and non-RAA cases.
  • Experimental setup: All main runs use the same text-based ReAct scaffold with search, visit, and Google Scholar tools while varying the base model.The evaluated models are TONGYI DEEP RESEARCH, GPT-5 MINI, and GEMINI 3 FLASH.
  • Experimental setup: Main random-sample runs use a 120-call ReAct budget and a 2400-second server timeout.Runs finalize by requesting a final answer when wall-time or context limits are reached.

C.4 Three-Run Uncertainty Analysis

Across 12 model–benchmark pairs, nearby evidence generally reduced accuracy, with uncertainty estimated through repeated question-level resampling. The examples show this reduction can arise when agents transfer a nearby answer to a different target.

  • C.4 Three-Run Uncertainty Analysis: 5.9 points was the average accuracy drop across 12 model–benchmark pairs, with 11 of 12 estimated drops positive.Percentile 95% confidence intervals were computed by resampling 100 questions 100,000 times while retaining replicates and clean/augmented arms.
  • C.4 Three-Run Uncertainty Analysis: GEMINI 3 FLASH returned the nearby answer 6 for a family-level question despite the original asking for an order-level check digit.The injected evidence was factually correct for the neighboring question but misaligned with the original target.

D.2 Non-Targeted Degradation Example: Non-Targeted Degradation

Nearby evidence can redirect an agent’s search trajectory even when the agent recognizes that the retrieved answer has the wrong answer type. The model may retain the nearby value as an intermediate assumption and use it to pursue a different entity.

  • D.2 Non-Targeted Degradation Example: Non-Targeted Degradation: TONGYI DEEP RESEARCH used nearby molecular-weight evidence to pursue a different compound and finally answered 160966 instead of the requested PubChem CID 4192.It did not directly adopt 325.8, but treated that value as identifying the target compound.
  • D.2 Non-Targeted Degradation Example: Non-Targeted Degradation: The failure was trajectory redirection: the model noticed 325.8 was a molecular weight but retained it as an intermediate search assumption.It searched for a PubChem compound corresponding to molecular weight 325.8 g/mol before returning a different CID.

D.3 Paired Robustness Examples

Paired examples show that agents differ in how they handle factual evidence for nearby questions. Robust behavior preserves the original answer type, time constraint, target slot, or total-versus-subset distinction before using retrieved evidence.

  • D.3 Paired Robustness Examples: Table 7 defines the reported drop as Clean minus Augmented accuracy and summarizes uncertainty over three runs.Its confidence intervals use a paired cluster bootstrap over questions with 100,000 resamples.
  • Temporal Constraint Preservation: TONGYI DEEP RESEARCH adopted the 2023 count of 108, while GEMINI 3 FLASH preserved the 2024 constraint and returned 123.The nearby evidence was factual for 2023 but did not answer the original 2024 question.
  • Target-Slot Preservation: TONGYI DEEP RESEARCH returned the neighboring brother answer Calley Means, while GEMINI 3 FLASH returned Casey Means for the requested person.The example separates entity recognition from answer-slot control.
  • D.3 Paired Robustness Examples: GPT-5 MINI returned 2 for the shifted 2001–2009 album range, while TONGYI DEEP RESEARCH checked the original 2000–2009 range and returned 3.The latter behavior verifies that retrieved evidence matches the original constraints before using it.
  • D.5 Nearby Answer as a Clue Example: Nearby Answer as a Clue: GEMINI 3 FLASH recovered Winky by using Venture as an intermediate entity rather than treating the nearby game title as the final answer.Nearby evidence can supply a useful clue when the agent preserves the requested answer slot.

D.6 Successful Resistance Examples

Successful resistance occurs when agents explicitly preserve the requested answer type or slot and distinguish the full set from a nearby subset. The evaluation constructs and verifies nearby rewrites so that differences reflect question–evidence alignment rather than ambiguity.

  • Answer-Type Preservation: GPT-5 MINI rejected nearby FIPS code 12103 and returned the requested ZIP code 34689.The model explicitly recognized that the nearby answer had the wrong answer type.
  • Answer-Slot Preservation: TONGYI DEEP RESEARCH rejected evidence for a different answer slot, continued searching, and returned Episode 3.The trace identifies the nearby page as answering a different subquestion.
  • Subset-versus-Total Distinction: GEMINI 3 FLASH enumerated two sons and one daughter, distinguishing the requested total of 3 from the nearby subset of 2 sons.This illustrates subset-versus-total distinction.
  • D.6 Successful Resistance Examples: The paper identifies three successful strategies: preserving answer type, rejecting a different answer slot, and distinguishing a subset from the requested total.These strategies are presented as examples of resistance to nearby factual evidence.
  • Method: Rewrites preserve surface cues while changing one substantive constraint, such as a date range, relation, entity level, or requested attribute.The construction aims to make nearby questions retrievable while ensuring their answers differ from the original answer.
  • Method: Verification accepts a rewrite only when it is unambiguous, topically close, correctly answered by b, distinct from q’s answer, and changed by a clear constraint.Candidates failing any condition are rejected.
  • Method: The judging procedure separately records matches to the original answer and the nearby answer, enabling both accuracy and rewrite-answer adoption measurement.Answers are normalized for ordinary aliases, units, formatting, and spelling variants.
  • Method: Agents are instructed to keep the original constraints fixed and use related-question evidence only as guidance unless it also satisfies the original question.This operationalizes question–evidence alignment during search.
Loading 2608.30303v1…