AI 安全
HERALD Reveals That Search Agents Can Cite Unretrieved Passages; A Single Membership Check Reduces the Observed Attack Rate to Zero
HERALD audits search-agent rewards using question-matched counterfactual edits, finding that citations to real but never-retrieved passages can score at least as highly as the original trajectory under the baseline reward. After adding a citation–retrieval-set membership check, no successful attacks were observed across 593 eligible questions, but the reinforcement signal appeared in only 0.03% of training trajectories.