Salience Induction against Multi-Hop RAG Agents: Threat and Defense

2026-07-20

AI Summary

This work addresses a novel vulnerability in multi-hop retrieval-augmented generation (RAG) agents, termed the “salience channel” attack, wherein adversaries manipulate reasoning by applying fidelity-preserving edits—such as altering fact placement, phrasing, or semantic proximity—even when retrieved content is factually correct and free of malicious instructions. The study formalizes this attack surface for the first time and introduces a “salience-inducing” attack paradigm, comprising six salience-editing operators and an iterative proposal-validation pipeline to generate semantically coherent and stealthy adversarial examples. The authors construct SalientWiki-MH, a multi-hop benchmark with decoy annotations, and propose “salience normalization,” a lightweight input-side defense. Experiments show that under a 30% editing budget, the attack achieves an 83.3% success rate, while the proposed defense reduces it to 15.3% (standard) and 23.6% (adaptive), substantially outperforming existing baselines.

Abstract

Agentic retrieval-augmented generation (RAG) systems increasingly retrieve external evidence and orchestrate tools for knowledge-intensive applications. In Multi-Hop question answering, agents chain facts across documents. Existing defenses focus on content poisoning, which injects false facts, and prompt injection, which embeds directives. We identify a third attack surface: the salience channel, through which fact position, emphasis, framing, and semantic proximity can redirect reasoning even when all retrieved claims are true and no instructions are present. We formalize Salience Induction as truth-preserving edits that redirect Multi-Hop attribute binding while leaving the retrieval trace semantically intact. We define six Salience-Editing operator classes and build an iterative proposer-verifier pipeline under factual and stealth constraints. We also introduce SalientWiki-MH, a decoy-annotated Multi-Hop benchmark. Evaluations across five frontier model families (GPT, Claude, Gemini, DeepSeek, and Qwen) and three agent architectures (ReAct, Reflexion, and tool-calling) show broad generalization. Under a 30% edit budget, Salience Induction achieves an 83.3% attack success rate; the strongest evaluated baseline defense leaves 75.7% post-defense ASR. Untargeted rewriting further reduces attacks only by degrading neutral task success. Our lightweight input-side defense, Salience Normalization, reduces attack success to 15.3% under standard attacks and 23.6% under an adaptive attack. These results show that truthfulness and instruction filtering alone are insufficient: robust agentic RAG also requires defenses against salience-relevance decoupling.

Problem

• Salience Induction
• Multi-Hop RAG
• Agentic Reasoning
• Truth-Preserving Attack
• Retrieval-Augmented Generation

Innovation

• Salience Induction
• Multi-Hop RAG
• Agentic Reasoning
• Truth-Preserving Attack
• Salience Normalization