用相关但错误的真相误导搜索代理，暴露其依赖证据的漏洞。
Lazy Grounding: Attacking Search Agents with Factual Evidence
- 用邻近问题的正确答案干扰原问题检索结果
- 平均准确率下降5.9点，最高降17.3点
- 适合研究AI安全与检索增强系统的学者
搜索代理通过引用检索到的网络证据来减少幻觉。然而，依赖检索也带来了攻击面：包含虚假或恶意文档的污染语料库会导致代理传播错误信息。我们发现，无需制造虚假内容——仅用与邻近问题相关的正确证据，就能误导搜索代理采纳该邻近答案，即使它不回答当前问题。我们将此现象称为‘懒惰定位’（lazy grounding）。我们通过基准问题的改写版本生成邻近证据进行验证，每个文档都真实支持一个邻近改写问题，却被用于原问题。在12个模型-基准组合中，邻近证据使准确率平均下降5.9点，最高下降17.3点，且所有设置下均引发邻近答案采纳。当邻近证据出现较晚或更符合答案格式时，影响更强。结果表明，鲁棒的搜索代理必须防范的不仅是错误信息，还包括事实证据的误用。代码已公开于https://github.com/frankyzha/lazy-grounding。
原文摘要 · Abstract (English)
Search agents mitigate hallucination by grounding their answers in retrieved web results. However, retrieval-based approaches also introduce an attack surface: agents may cite misinformation from poisoned search corpora containing false or malicious documents. We demonstrate that, in some cases, search agents' reasoning and responses may be steered by completely factual but distracting information. We refer to this failure as lazy grounding. We expose lazy grounding by injecting nearby evidence from answer-changing rewrites of benchmark questions into the search corpora. Each document contains factual evidence that supports a neighboring rewritten question but is retrieved for the original question. Across 12 model-benchmark pairs, the attack causes the accuracy of search agents' responses to drop by 5.9 points on average and by up to 17.3 points, while inducing nearby-answer adoption in every setting. The effect is even stronger when nearby evidence appears later or is more answer-shaped. Our results show that robust search agents must defend against not only misinformation but also the misapplication of factual evidence. The code is publicly available at https://github.com/frankyzha/lazy-grounding.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。