News · 2026-07-31

One planted document flipped more than half of deep-research reports to a false conclusion

Researchers at the Shanghai AI Laboratory and Beijing University of Posts and Telecommunications generated 5,933 credible-looking documents supporting manually audited false conclusions, then inserted exactly one into the retrieval pool of several deep-research agents. The rate at which the agents' final reports endorsed the false conclusion rose from 0% with no injection to 54.7% with one document. Adding more documents barely moved the number - the first one did the damage.

Key facts

• A single misleading document raises the mean false-conclusion adoption rate from 0% to 54.7%.
• 5,933 misleading documents were generated and filtered, applied to tasks from DeepResearch Bench.
• Tested on DeerFlow and WebThinker with three backbone models, plus Gemini Deep Research.
• Primary source: Is Deep Research Reliable? Misleading Knowledge Induces False Conclusions; code and dataset public.

Deep-research agents are the current showcase application: give one a question, and it plans an investigation, runs searches, reads sources, and writes a report with citations over many minutes or hours. The pitch is that the length of the investigation makes the answer trustworthy. This study asks the obvious adversarial question - what happens when one of the things it reads is a convincing lie - and finds that length is not protection.

The evaluation framework, MisKnow-Agent, is careful in a way that matters. The false documents are task-specific, the false conclusions are manually audited to confirm they really are false, and the authority cues and source styles are varied deliberately so the effect of looking official can be separated from the effect of being retrieved. The documents live in isolated retrieval pools rather than on the public web, so nobody is poisoning anything real. Adoption is measured with a report-level metric that counts only reports actually endorsing the false conclusion, not reports that merely mention the document.

Two findings sharpen the risk. First, the attack is cheap: source authority and presentation style move the adoption rate substantially, while search-result rank and additional documents beyond the first have limited influence. You do not need to flood the zone or win the ranking - you need one document that looks like it came from somewhere serious. Second, and worse, detection is not the bottleneck. The authors report that "although cross-model verification consistently classifies retained instances as misleading, Deep Research agents can still adopt the corresponding false conclusions during long-horizon research." A separate checker, asked directly, correctly identifies the document as untrustworthy. The research agent, mid-investigation, uses it anyway.

The analogy is a graduate student who can tell you a journal is disreputable when quizzed, and who nonetheless cites it in chapter four because by then it has become one of the things they know. The knowledge and the behaviour live in different places.

Defences helped without solving it. Pre- and post-research verification reduced the adoption rate but did not eliminate it, which leads the authors to their actual recommendation: verification has to be continuous, applied "when evidence enters intermediate research states and final synthesis," rather than bolted on at either end. A check at the start cannot catch what gets retrieved at step forty; a check at the end is arguing with a conclusion the agent has already built around.

There is a second-order finding hiding in the lifecycle results. Adoption varied substantially with which stage of the research the document entered at - the same false document is far more dangerous late in the process than early. Late in an investigation the agent has already committed to a framing, has a partial report in progress, and is looking for material that completes it rather than material that challenges it. That is a recognisably human failure mode reproduced in software, and it argues that the riskiest moment in a long research run is the last retrieval, not the first.

This pairs directly with the provenance infrastructure shipping the same week. AskChem makes every retrieved claim carry a resolvable identifier and a verbatim quote, which is genuine evidence hygiene - but a resolvable citation proves a statement came from somewhere, not that the somewhere was right. Provenance and verification answer different questions, and this study is the clearest demonstration yet that a research pipeline needs both.

The caveat: the injections happen in controlled, isolated retrieval pools rather than in live search results, so this measures susceptibility rather than any observed real-world attack. The relevant question it raises is not whether someone is doing this today. It is how anyone would know if they were.

Primary source, verified: read the paper → (arXiv 2607.20891)

Ground Truth. (2026, July 31). One planted document flipped more than half of deep-research reports to a false conclusion. Ground Truth. https://groundtruth.day/news/one-planted-document-flips-half-of-deep-research-reports.html

@misc{groundtruth:one-planted-document-flips-half-of-deep-research-reports,
  title  = {One planted document flipped more than half of deep-research reports to a false conclusion},
  author = {{Ground Truth}},
  year   = {2026},
  month  = {jul},
  url    = {https://groundtruth.day/news/one-planted-document-flips-half-of-deep-research-reports.html}
}

Topics: cybersecurity · ai-security · data-poisoning · agents · rag · research