Relevance as a Vulnerability: How Web Retrieval Degrades Safety Alignment in LLM Agents

arXiv:2605.29224 · cs.CL, cs.AI, cs.CR · Submitted 2026-05-28 · Read on arXiv

cs.CL, cs.AI, cs.CR

Submitted: 2026-05-28

Updated: 2026-08-30

Terminology

• Topical Relevance — 15× in this paper
• Ablation — 10× in this paper · explained in 1 episode
• Alignment — 10× in this paper · explained in 1 episode
• Safe Source Paradox — 10× in this paper
• RAG — 9× in this paper · explained in 3 episodes
• Core — 5× in this paper · explained in 2 episodes
• AI Agents — 4× in this paper · explained in 2 episodes
• Benchmark — 4× in this paper · explained in 2 episodes
• Calibration — 4× in this paper · explained in 7 episodes
• Robustness — 4× in this paper · explained in 5 episodes
• Stance Score — 4× in this paper
• Decoupling — 3× in this paper · explained in 2 episodes
• Post-Selection — 3× in this paper · explained in 2 episodes
• Alternation — 2× in this paper · explained in 1 episode
• Generalization — 2× in this paper · explained in 13 episodes
• Trace — 2× in this paper · explained in 2 episodes
• Accuracy — 1× in this paper · explained in 1 episode
• Adversarial Attacks — 1× in this paper · explained in 1 episode
• Agentic Retrieval — 1× in this paper · explained in 1 episode
• Alignment Techniques — 1× in this paper · explained in 1 episode
• Benchmarking — 1× in this paper · explained in 4 episodes
• Consistency — 1× in this paper · explained in 3 episodes
• Distillation — 1× in this paper · explained in 2 episodes
• Fine-Tuning — 1× in this paper · explained in 5 episodes
• LLM judge — 1× in this paper · explained in 2 episodes
• LLM-as-a-Judge — 1× in this paper · explained in 3 episodes
• Large Language Models (LLMs) — 1× in this paper · explained in 6 episodes
• Score Function — 1× in this paper · explained in 4 episodes
• Verification — 1× in this paper · explained in 2 episodes

Sources

• Constitutional AI: Harmlessness from AI Feedback
• Why Are Web AI Agents More Vulnerable Than Standalone LLMs? A Security Analysis
• Pandora: Jailbreak GPTs by Retrieval Augmented Generation Poisoning
• Retrieval-Augmented Generation for Large Language Models: A Survey
• WebGPT: Browser-assisted question-answering with human feedback
• Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations
• ToolLLM: Facilitating Large Language Models to Master 16000+ Real-world APIs
• X-Teaming: Multi-Turn Jailbreaks and Defenses with Adaptive Multi-Agents
• RAG Makes Guardrails Unsafe? Investigating Robustness of Guardrails under RAG-style Contexts
• Progent: Securing AI Agents with Privilege Control
• Llama 2: Open Foundation and Fine-Tuned Chat Models
• DRIFT: Dynamic Rule-Based Defense with Injection Isolation for Securing LLM Agents
• STAC: When Innocent Tools Form Dangerous Chains for LLM Agents
• HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal
• Safety Degradation in AI Agents
• SafeSearch: Do Not Trade Safety for Utility in LLM Search Agents
• AgentAlign: Navigating Safety Alignment in the Shift from Informative to Agentic Large Language Models
• RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage
• Universal and Transferable Adversarial Attacks on Aligned Language Models

Related papers

• Exploring Solution Divergence and Its Effect on Large Language Model Problem Solving
• Ishigaki-IDS-Bench: A Benchmark for Generating Information Delivery Specification from BIM Information Requirements
• Subliminal Steering: Stronger Encoding of Hidden Signals
• MedStruct-S: A Benchmark for Key Discovery, Key-Conditioned QA and Semi-Structured Extraction from OCR Clinical Reports
• The End of Transformers? On Challenging Attention and the Rise of Sub-Quadratic Architectures
• Untangling the Mechanisms of Misleading Context in Medical Question Answering