FORGE: Research-Trajectory Hijacking Attacks on Deep Research Agents¶

🕒 Published (v1): 2026-07-06 06:43 UTC · Source: Arxiv · link

Why this paper was selected

Planning-layer poisoning of deep research agents; novel attack surface, directly relevant to harness builders

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

TL;DR¶

FORGE is a two-level poisoning attack on deep research agents that hijacks subtask planning by embedding fabricated reasoning chains inside adversarial documents and coordinating them as apparent convergent multi-source evidence. The attack exploits the recursive plan–retrieve–synthesize loop where early retrieved content shapes follow-up queries, converting local injections into report-level epistemic corruption. The paper also introduces PRISM, a severity metric weighting infected claims by cognitive type, and Root Query Anchoring (RQA), a planning-layer defense.

Problem¶

Existing RAG poisoning attacks (e.g., PoisonedRAG, AuthChain) assume retrieval independence—an adversarial document misleads a single generation step but cannot influence which questions are asked next. Deep research agents break this assumption: retrieval is coupled to planning, so a single early adversarial document can steer the planner to generate V-aligned subtasks, each of which pulls further poisoned evidence in subsequent rounds. This recursive amplification creates a planning-layer attack surface that per-retrieval-step defenses do not address.

Method¶

FORGE constructs $j$ adversarial documents $P = \{p_1, \ldots, p_j\}$ at two levels:

Intra-document fabrication. Each $p_k$ embeds a fabricated reasoning chain $r_{k1} \Rightarrow r_{k2} \Rightarrow \cdots \Rightarrow r_{km_k}$ where $r_{km_k} = c_k$, presenting its assigned claim as a derived conclusion rather than a bare assertion. This exploits argumentative coherence to increase perceived credibility.

Inter-document chain. Documents are organized as a distributed argument: $$C: c_1 \to c_2 \to \cdots \to c_j = V$$ Each $p_k$ cites the conclusions of $\{p_1, \ldots, p_{k-1}\}$ as premises, making the set read as convergent multi-source evidence rather than a single minority opinion.

Subtask hijacking. When the planner performs its initial retrieval pass $D^{(0)}$, FORGE documents with high scores under $\text{score}(d, t_i) = \alpha \cdot \text{BM25}(d, t_i) + (1-\alpha)\cos(\varphi(d), \varphi(t_i))$ enter the evidence set, injecting $\hat{t} \sim V$ subtasks into the plan. These subtasks then preferentially retrieve more FORGE documents in subsequent rounds.

PRISM metric. Extracts 30 claims from the final report, classifies each by cognitive type $\tau(c) \in \{\tau_F, \tau_P, \tau_E, \tau_C, \tau_{Fr}\}$ with weights 4–8 (factual to framing), and scores: $$\text{PRISM} = \frac{\sum_{c \in C_R} \text{infected}(c) \cdot w(\tau(c))}{\sum_{c \in C_R} w(\tau(c))}$$

Root Query Anchoring (RQA). At each recursive follow-up planning step, reinjects the root query $q$ and filters/revises candidate subtasks that drift from $q$, blocking the planning channel without modifying retrieval.

Key Contributions¶

FORGE attack: two-level construction combining intra-document reasoning fabrication and inter-document chain coordination to hijack deep research planning.
PRISM metric: continuous report-level severity score weighting infected claims across five cognitive types (factual, prescriptive, evaluative, causal, framing), replacing binary ASR.
Empirical study: 25 queries × 5 topic categories × 4 depth levels under both local and network poisoning settings; ablation against PoisonedRAG and AuthChain.
RQA defense: lightweight planning-layer mitigation requiring no retraining or retrieval classifier.

Results¶

Network FORGE reaches 26.4% PRISM at $j=5$ (25 queries); Local FORGE achieves high PRISM at $j=2$–$3$.
On a stratified 10-query subset (Network, $j=5$): FORGE 38.5% vs. PoisonedRAG 23.0%, AuthChain 18.8%, B2 (intra-doc reasoning only, no inter-doc chain) 27.9%.
FORGE's gain concentrates in causal ($\text{ASR}_C = 44.5\%$) and framing ($\text{ASR}_{Fr} = 49.5\%$) dimensions; B2 matches FORGE on factual ASR (37.8 vs. 37.7) but trails by 10.6 PRISM points.
Transplant experiment: fixing the $j=5$ subtask list while varying retrieval to $j=1$ yields 22.8% PRISM; fixing the $j=1$ subtask list while scaling retrieval to $j=5$ leaves PRISM unchanged (14.1% → 14.1%). Subtask hijacking, not retrieval volume, is the decisive channel.
Depth migration ($j=3$, Network): PRISM stays in the 13–16% band across depths $\delta=1$–$4$, but at $\delta \geq 2$ contamination migrates from framing claims into factual claims—poisoning becomes less visible but not less effective.
Topic vulnerability: Trend Forecasting most exposed (37.4% Local / 35.1% Network); Method Comparison most resistant (22.8% / 14.2%).
RQA: reduces PRISM from 38.5% to 18.3% ($\Delta = -20.2$ pp) and raises utility (RACE) from 0.5000 to 0.6173, outperforming paraphrasing (−13.9 pp) and knowledge expansion (−14.6 pp).

Limitations¶

PRISM claim-type weights (4–8) are design choices; calibration against human reader-perception data is deferred to future work.
RQA blocks the planning channel but does not remove adversarial documents that survive into the top-$m$ retrieval pool—a partial defense.
Adversarial document construction uses a human-supervised LLM pipeline; scalability to large automated injection campaigns is not evaluated.
Primary testbed is gpt-researcher; cross-framework experiments (Perplexica, DeerFlow) are relegated to an appendix.
Evaluation covers 25 queries, a small sample for claims about broad category-level vulnerability.
Assumes black-box access; white-box or gray-box threat models could yield stronger attacks.

Relevance to Agentic AI / LLM Agents¶

FORGE directly exposes a vulnerability that is structural to multi-step agentic workflows: the recursive plan–retrieve–synthesize loop present in production deep research systems (gpt-researcher, OpenAI Deep Research) creates a planning layer that existing single-step RAG defenses leave unguarded. The depth migration finding is particularly significant for agentic AI safety—recursive synthesis transforms overt adversarial framing into embedded factual premises, making contamination harder to detect as agent autonomy and recursion depth increase. The transplant experiment provides mechanistic evidence that subtask hijacking, not raw evidence injection, is the dominant attack channel, pointing to planning-layer interventions (like RQA) as the necessary defense surface. This work is foundational for threat modeling any agentic system that feeds retrieval results back into its own planning loop.