AI summaryⓘ
The authors study how complex AI research agents, which break down big questions into smaller tasks and gather online information, can be tricked by fake documents that manipulate their plans and final answers. They introduce FORGE, an attack method that uses fake reasoning within documents and coordination between them to mislead the agent's task planning. To measure harm, they propose the PRISM metric, which weights false claims by their importance. They also develop a simple defense called Root Query Anchoring (RQA) that keeps follow-ups tied to the original question to reduce misinformation. Their tests show that FORGE can significantly poison reports, but RQA cuts this harm by more than half in some cases.
Research agentsOpen-ended queriesAdversarial attacksDocument retrievalSubtask planningChain of reasoningPRISM metricRoot Query Anchoring (RQA)Recursive synthesisReport contamination
Authors
Yue Pan, Ziheng Zhang, Junxiang Lei, Changhao Jia, Qingyi Si, Hongcheng Guo
Abstract
Deep research agents decompose open-ended queries into subtasks, retrieve web evidence over multiple rounds, and synthesize long-form reports. This workflow creates a planning-layer poisoning surface: adversarial documents that enter the retrieval pool can steer follow-up questions and turn a local injection into report-level contamination. We present FORGE (Fabricated Orchestrated Reasoning chain for aGent Exploitation), a two-level attack that combines intra-document reasoning fabrication with inter-document chain coordination to hijack subtask planning. We further introduce the PRISM metric, which weights infected report claims by cognitive type, and Root Query Anchoring, a lightweight defense that ties recursive follow-up generation to the root query. Across 25 queries, Network FORGE reaches 26.4% PRISM with five injected documents and exhibits depth migration, in which recursive synthesis shifts poisoned content from overt framing into factual premises. On the 10-query defense subset, RQA (Root Query Anchoring) reduces PRISM from 38.5% to 18.3%.