mlsanityData to 14 Oct 2026

Lazy Grounding: Attacking Search Agents with Factual Evidence

arXiv 2608.30303 ↗First posted 31 Aug 2026cs.CLcited by 0

Not on the map. Why?

Abstract (arXiv)

Search agents mitigate hallucination by grounding their answers in retrieved web results. However, retrieval-based approaches also introduce an attack surface: agents may cite misinformation from poisoned search corpora containing false or malicious documents. We demonstrate that, in some cases, search agents' reasoning and responses may be steered by completely factual but distracting information. We refer to this failure as lazy grounding. We expose lazy grounding by injecting nearby evidence from answer-changing rewrites of benchmark questions into the search corpora. Each document contains factual evidence that supports a neighboring rewritten question but is retrieved for the original question. Across 12 model-benchmark pairs, the attack causes the accuracy of search agents' responses to drop by 5.9 points on average and by up to 17.3 points, while inducing nearby-answer adoption in every setting. The effect is even stronger when nearby evidence appears later or is more answer-shaped. Our results show that robust search agents must defend against not only misinformation but also the misapplication of factual evidence. The code is publicly available at https://github.com/frankyzha/lazy-grounding.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 28 of its 38 references that are in the map. First posted on arXiv 31 Aug 2026.

Builds on

28 of 38 references.

References · 28

  1. 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,297
  2. 2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,695
  3. 2023FActScore: Fine-grained Atomic Evaluation of Factual Precision in Long Form Text Generationcited by 1,282
  4. 2023GAIA: a benchmark for General AI Assistantscited by 1,128
  5. 2025Humanity's Last Examcited by 491
  6. 2024AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Basescited by 429
  7. 2025BrowseComp-Plus: A More Fair and Transparent Evaluation Benchmark of Deep-Research Agentcited by 200
  8. 2024EIA: Environmental Injection Attack on Generalist Web Agents for Privacy Leakagecited by 150
  9. 2025Memory Injection Attacks on LLM Agents via Query-Only Interactioncited by 144
  10. 2024Machine Against the RAG: Jamming Retrieval-Augmented Generation with Blocker Documentscited by 102
  11. 2024"Glue pizza and eat rocks" -- Exploiting Vulnerabilities in Retrieval-Augmented Generative Modelscited by 60
  12. 2025The Obvious Invisible Threat: LLM-Powered GUI Agents' Vulnerability to Fine-Print Injectionscited by 59
16 more
  1. 2025From Prompt Injections to Protocol Exploits: Threats in LLM-Powered AI Agents Workflowscited by 58
  2. 2025WebInject: Prompt Injection Attack to Web Agentscited by 51
  3. 2025PR-Attack: Coordinated Prompt-RAG Attacks on Retrieval-Augmented Generation in Large Language Models via Bilevel Optimizationcited by 32
  4. 2024To Trust or Not to Trust? Enhancing Large Language Models' Situated Faithfulness to External Contextscited by 25
  5. 2025BrowseSafe: Understanding and Preventing Prompt Injection Within AI Browser Agentscited by 24
  6. 2026Poison Once, Exploit Forever: Environment-Injected Memory Poisoning Attacks on Web Agentscited by 24
  7. 2025Cats Confuse Reasoning LLM: Query Agnostic Adversarial Triggers for Reasoning Modelscited by 23
  8. 2024Retrieval-Augmented Generation with Estimation of Source Reliabilitycited by 19
  9. 2025Secure Retrieval-Augmented Generation against Poisoning Attackscited by 19
  10. 2025ReliabilityRAG: Effective and Provably Robust Defense for RAG-based Web-Searchcited by 18
  11. 2025Manipulating LLM Web Agents with Indirect Prompt Injection Attack via HTML Accessibility Treecited by 14
  12. 2024Real-time Factuality Assessment from Adversarial Feedbackcited by 12
  13. 2024Generating Media Background Checks for Automated Source Critical Reasoningcited by 10
  14. 2026DeepFact: Co-Evolving Benchmarks and Agents for Deep Research Factualitycited by 10
  15. 2025Illusions of Relevance: Arbitrary Content Injection Attacks Deceive Retrievers, Rerankers, and LLM Judgescited by 5
  16. 2025Attacks by Content: Automated Fact-checking is an AI Security Issuecited by 4

Built on by

Not cited yet.