Salience Induction against Multi-Hop RAG Agents: Threat and Defense
2026-07-20 • Cryptography and Security
Cryptography and SecurityComputation and Language
AI summaryⓘ
The authors studied how advanced AI systems that answer complex questions by pulling together facts from multiple documents can be tricked in a new way. They found that even when all facts are true and no sneaky instructions are given, changing how important or noticeable certain facts appear can mislead the AI's reasoning. They tested this method, called Salience Induction, and showed it successfully fooled many leading AI models. The authors also created a defense technique, Salience Normalization, that reduces these tricks but doesn’t completely stop them, showing that simply checking truth and instructions isn’t enough for safety.
Agentic retrieval-augmented generationMulti-Hop question answeringSalience InductionAttribute bindingFact poisoningPrompt injectionSalientWiki-MH benchmarkReAct architectureSalience NormalizationTruth-preserving edits
Authors
Xingfu Zhou, Pengfei Wang, Yuan Zhou, Wei Xie, Xu Zhou
Abstract
Agentic retrieval-augmented generation (RAG) systems increasingly retrieve external evidence and orchestrate tools for knowledge-intensive applications. In Multi-Hop question answering, agents chain facts across documents. Existing defenses focus on content poisoning, which injects false facts, and prompt injection, which embeds directives. We identify a third attack surface: the salience channel, through which fact position, emphasis, framing, and semantic proximity can redirect reasoning even when all retrieved claims are true and no instructions are present. We formalize Salience Induction as truth-preserving edits that redirect Multi-Hop attribute binding while leaving the retrieval trace semantically intact. We define six Salience-Editing operator classes and build an iterative proposer-verifier pipeline under factual and stealth constraints. We also introduce SalientWiki-MH, a decoy-annotated Multi-Hop benchmark. Evaluations across five frontier model families (GPT, Claude, Gemini, DeepSeek, and Qwen) and three agent architectures (ReAct, Reflexion, and tool-calling) show broad generalization. Under a 30% edit budget, Salience Induction achieves an 83.3% attack success rate; the strongest evaluated baseline defense leaves 75.7% post-defense ASR. Untargeted rewriting further reduces attacks only by degrading neutral task success. Our lightweight input-side defense, Salience Normalization, reduces attack success to 15.3% under standard attacks and 23.6% under an adaptive attack. These results show that truthfulness and instruction filtering alone are insufficient: robust agentic RAG also requires defenses against salience-relevance decoupling.