这篇论文揭露了RAG系统的新漏洞：即使事实正确也可能被误导。还给出了一个轻量级的防御方法，做Agent安全的人值得一读。
论文识别出多跳RAG系统的新攻击面——显著性诱导，通过调整检索事实的位置、强调和语义框架来误导推理，即使所有事实真实且无指令注入。定义六类显著性编辑操作符，在SalientWiki-MH基准上对GPT、Claude、Gemini、DeepSeek、Qwen五个模型族和ReAct、Reflexion、tool-calling三种架构评估，30%编辑预算下攻击成功率83.3%。最强基线防御后ASR仍达75.7%；提出的Salience Normalization防御将攻击成功率降至15.3%（标准攻击）和23.6%（自适应攻击）。
Salience Induction against Multi-Hop RAG Agents: Threat and Defense
Agentic retrieval-augmented generation (RAG) systems increasingly retrieve external evidence and orchestrate tools for knowledge-intensive applications. In Multi-Hop question answering, agents chain facts across documents. Existing defenses focus on content poisoning, which injects false facts, and prompt injection, which embeds directives. We identify a third attack surface: the salience channel, through which fact position, emphasis, framing, and semantic proximity can redirect reasoning even when all retrieved claims are true and no instructions are present. We formalize Salience Induction as truth-preserving edits that redirect Multi-Hop attribute binding while leaving the retrieval trace semantically intact. We define six Salience-Editing operator classes and build an iterative proposer-verifier pipeline under factual and stealth constraints. We also introduce SalientWiki-MH, a decoy-annotated Multi-Hop benchmark. Evaluations across five frontier model families (GPT, Claude, Gemini, DeepSeek, and Qwen) and three agent architectures (ReAct, Reflexion, and tool-calling) show broad generalization. Under a 30% edit budget, Salience Induction achieves an 83.3% attack success rate; the strongest evaluated baseline defense leaves 75.7% post-defense ASR. Untargeted rewriting further reduces attacks only by degrading neutral task success. Our lightweight input-side defense, Salience Normalization, reduces attack success to 15.3% under standard attacks and 23.6% under an adaptive attack. These results show that truthfulness and instruction filtering alone are insufficient: robust agentic RAG also requires defenses against salience-relevance decoupling.