Robustness of Search Agents under Adversarial Conditions

Determine the performance characteristics of large language model–based agentic search agents when operating in adversarial retrieval environments, and establish robustness guarantees and practical methodologies to ensure these agents remain reliable in real-world deployments.

Background

The survey highlights that search agents deployed in open environments can be exposed to adversarial content, misinformation, and malicious manipulation. Recent work such as PoisonedRAG shows that retrieval-augmented systems can be corrupted by injected knowledge, raising concerns about safety and reliability.

While some methods address uncertainty calibration, comprehensive understanding of adversarial performance and principled approaches for ensuring robustness in practical, real-world settings remain unresolved and are identified as a key area for future investigation.

References

While Search Wisely explores uncertainty-aware search to mitigate overconfidence, it remains unclear how search agents perform under adversarial conditions and how to guarantee robustness in real-world deployments.

— A Comprehensive Survey on Reinforcement Learning-based Agentic Search: Foundations, Roles, Optimizations, Evaluations, and Applications  (2510.16724 - Lin et al., 19 Oct 2025) in Section “Challenges and Future Direction”, Trustworthy Agentic Search

This vulnerability is shared by any method that reads that log. Accidental noise is not a problem (injecting up to $16$ irrelevant documents per rollout leaves the vote unchanged), but adversarial robustness remains open.

— Beyond Confidence: Test-Time Scaling for Multi-Turn Search Agents via Retrieval Grounding  (2608.24024 - Kook et al., 25 Aug 2026) in Limitations, paragraph “Scope”

We leave a controlled evaluation of these defenses to future work; the present paper focuses on characterizing the attack.

— ToxicRAG: Compromising Retrieval-Augmented Generation Systems via Single-Shot Knowledge Poisoning Attacks  (2609.11082 - Lu et al., 10 Sep 2026) in Section 2, subsection “Defenses against Knowledge Poisoning”