A new arXiv preprint reports an 83.3% attack success rate against multi-hop RAG agents, achieved without a single false fact or injected instruction [S1]. The attack, called Salience Induction, reorders, reframes and re-emphasises true information so that AI agents following retrieval chains reach the wrong conclusion anyway. It works across five frontier model families and three agent architectures, and the strongest existing defence still leaves a 75.7% success rate [S1]. If truth-checking and prompt-injection filters cannot stop an attack that never lies, what can?

The attack that never lies

RAG, or retrieval-augmented generation, is how most production AI agents get their facts. Instead of relying on a model's training data, the agent searches a database, pulls relevant documents, and reasons over them. Multi-hop RAG goes further: the agent chains several retrieval steps together, using the answer from one lookup to fuel the next.

The new paper identifies what the authors call a third attack surface, the salience channel [S1]. The first two are well known. Content poisoning injects false facts into the retrieval database, while prompt injection embeds malicious instructions in retrieved text. Both leave fingerprints, since false facts can be fact-checked and injected instructions can be filtered.

The salience channel is different. It exploits how language models weight information. Fact position, emphasis, framing and semantic proximity all influence which details an agent treats as most relevant. By editing these signals, an attacker can redirect the agent's reasoning chain without changing any underlying truth and without writing any instructions [S1].

Six ways to bend a reasoning chain

The authors define six classes of salience-editing operators and build an iterative proposer-verifier pipeline that generates edits under two constraints: every fact must remain true, and the retrieval trace must stay semantically intact [S1]. In plain terms, the attacker rewrites documents so a search engine still finds them for the same queries, a fact-checker still passes them, and a prompt-injection filter sees nothing suspicious. But the agent's reasoning bends toward a decoy answer.

To test this, the authors built SalientWiki-MH, a multi-hop benchmark annotated with decoy targets [S1]. They evaluated the attack across five frontier model families: GPT, Claude, Gemini, DeepSeek and Qwen [S1]. They tested three agent architectures: ReAct (the standard reason-then-act loop), Reflexion (which adds self-correction), and tool-calling agents [S1].

Under a 30% edit budget, meaning the attacker can modify fewer than a third of retrieved passages, Salience Induction achieved an 83.3% attack success rate [S1]. The strongest baseline defence the authors evaluated still left a 75.7% success rate after defence was applied [S1]. Untargeted rewriting, a common defensive approach, reduced attacks only by degrading the agent's performance on normal tasks [S1]. You trade safety for usefulness.

The defence that almost works

The authors propose Salience Normalization, a lightweight input-side defence that strips positional and emphasis cues before the agent processes retrieved text [S1]. Under standard attacks, it drops the success rate to 15.3% [S1]. Under an adaptive attack, where the attacker knows the defence and adjusts, it still holds at 23.6% [S1].

That residual 23.6% matters. The defence does not eliminate the attack. It raises the cost and reduces the odds. The authors argue that truthfulness checks and instruction filtering are necessary but insufficient: agentic RAG also needs defences against what they call salience-relevance decoupling [S1].

What it means

The core finding is unsettling for anyone building AI agents that reason over retrieved documents. The security community has spent years building defences against false facts and malicious prompts. This paper shows a gap between those two attack surfaces that neither defence covers.

Think of it like a courtroom. Existing defences check whether witnesses are lying (content poisoning) and whether someone is whispering instructions to the jury (prompt injection). Salience Induction is the lawyer who rearranges the seating, puts the most sympathetic witness closest to the jury box, and lets every true statement land in the order most favourable to their case. Nothing is false, nothing is instructed, and yet the verdict shifts anyway.

For developers, the practical takeaway is that input-side processing matters. Normalising how retrieved text is presented to the agent, stripping emphasis and position cues, can cut attack success by roughly 68 percentage points under standard conditions [S1]. That is a cheap intervention with a large effect, though it does not close the door entirely.

What it means for business

A two-person firm running a customer support agent on top of a knowledge base is the most exposed. If that knowledge base pulls from public sources, wikis, or content the firm does not fully control, an attacker who can edit those sources can redirect the agent's answers without ever inserting a lie. The agent will confidently reach the wrong conclusion, and a fact-check will pass.

The risk is highest for multi-hop agents that chain lookups together. Single-retrieval agents are less exposed because there is no reasoning chain to bend. A suburban real estate agency using RAG to answer questions about council regulations, for example, would be vulnerable if an attacker can edit the council's public documents to emphasise the wrong permit requirement. The agent retrieves true facts, chains them, and gives the client incorrect guidance.

The practical step this quarter: if you are deploying a multi-hop RAG agent, ask your vendor or engineering team whether they normalise retrieved text before feeding it to the model. Salience Normalization is not yet a product feature, but the concept is simple enough to implement as a preprocessing layer. Strip bold text, reorder paragraphs into a fixed template, and remove emphasis markers before the agent sees them.

What we don't know yet

The paper is a preprint and has not been peer-reviewed [S1], and all results are self-reported with no third party having independently replicated the attack or the defence.

The benchmark SalientWiki-MH and the six operator classes have no external validation or adoption yet [S1]. The attack was tested against five model families and three architectures, but there is no evidence it generalises to every LLM or RAG implementation beyond those tested.

The defence leaves a 23.6% success rate under adaptive attacks [S1]. An attacker who knows Salience Normalization is in place can still redirect the agent nearly one in four times. Whether layering this defence with others, such as the information-flow control approach in Cordon-MAS [P4], can close that gap is an open question.

Related work is moving fast. KidnapRAG [P2], another recent preprint, attacks agentic RAG reasoning from a black-box angle. The A-RAG framework [P5], with 313 GitHub stars, is a popular open-source multi-hop RAG implementation that would be a natural test target. Whether its community adopts salience defences is worth watching.

The next concrete event to watch: peer review and community replication. If independent researchers reproduce the 83.3% attack rate and the 15.3% defence rate, salience normalisation will move from preprint curiosity to production checklist item.

If this kind of reporting helps you build safer AI systems, subscribe to keep reading.

Sources

More from Not A Tech Guy

Generated from an audited evidence pack with primary-source research. Social-media items are discussion signals, not verified facts. Nothing here is financial, legal or medical advice.