Adversarial Intent is a Latent Variable: Stateful Trust Inference for Securing Multimodal Agentic RAG
Fuente:
arXiv
Guardado en:
| Autores principales: | , , , , , , , , , , |
|---|---|
| Formato: | Preprint |
| Publicado: |
2026
|
| Materias: | |
| Acceso en línea: | |
| Etiquetas: |
Agregar Etiqueta
Sin Etiquetas, Sea el primero en etiquetar este registro!
|
| _version_ | 1866908851963428864 |
|---|---|
| author | Singh, Inderjeet Pahuja, Vikas Sabapathy, Aishvariya Priya Rathina Picardi, Chiara Giloni, Amit Vainshtein, Roman Murillo, Andrés Kojima, Hisashi Sekiya, Motoyoshi Unno, Yuki Suga, Junichi |
| author_facet | Singh, Inderjeet Pahuja, Vikas Sabapathy, Aishvariya Priya Rathina Picardi, Chiara Giloni, Amit Vainshtein, Roman Murillo, Andrés Kojima, Hisashi Sekiya, Motoyoshi Unno, Yuki Suga, Junichi |
| contents | Current stateless defences for multimodal agentic RAG fail to detect adversarial strategies that distribute malicious semantics across retrieval, planning, and generation components. We formulate this security challenge as a Partially Observable Markov Decision Process (POMDP), where adversarial intent is a latent variable inferred from noisy multi-stage observations. We introduce MMA-RAG^T, an inference-time control framework governed by a Modular Trust Agent (MTA) that maintains an approximate belief state via structured LLM reasoning. Operating as a model-agnostic overlay, MMA-RAGT mediates a configurable set of internal checkpoints to enforce stateful defence-in-depth. Extensive evaluation on 43,774 instances demonstrates a 6.50x average reduction factor in Attack Success Rate relative to undefended baselines, with negligible utility cost. Crucially, a factorial ablation validates our theoretical bounds: while statefulness and spatial coverage are individually necessary (26.4 pp and 13.6 pp gains respectively), stateless multi-point intervention can yield zero marginal benefit under homogeneous stateless filtering when checkpoint detections are perfectly correlated. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2602_21447 |
| institution | arXiv |
| publishDate | 2026 |
| record_format | arxiv |
| spellingShingle | Adversarial Intent is a Latent Variable: Stateful Trust Inference for Securing Multimodal Agentic RAG Singh, Inderjeet Pahuja, Vikas Sabapathy, Aishvariya Priya Rathina Picardi, Chiara Giloni, Amit Vainshtein, Roman Murillo, Andrés Kojima, Hisashi Sekiya, Motoyoshi Unno, Yuki Suga, Junichi Cryptography and Security Artificial Intelligence Computation and Language Machine Learning Current stateless defences for multimodal agentic RAG fail to detect adversarial strategies that distribute malicious semantics across retrieval, planning, and generation components. We formulate this security challenge as a Partially Observable Markov Decision Process (POMDP), where adversarial intent is a latent variable inferred from noisy multi-stage observations. We introduce MMA-RAG^T, an inference-time control framework governed by a Modular Trust Agent (MTA) that maintains an approximate belief state via structured LLM reasoning. Operating as a model-agnostic overlay, MMA-RAGT mediates a configurable set of internal checkpoints to enforce stateful defence-in-depth. Extensive evaluation on 43,774 instances demonstrates a 6.50x average reduction factor in Attack Success Rate relative to undefended baselines, with negligible utility cost. Crucially, a factorial ablation validates our theoretical bounds: while statefulness and spatial coverage are individually necessary (26.4 pp and 13.6 pp gains respectively), stateless multi-point intervention can yield zero marginal benefit under homogeneous stateless filtering when checkpoint detections are perfectly correlated. |
| title | Adversarial Intent is a Latent Variable: Stateful Trust Inference for Securing Multimodal Agentic RAG |
| topic | Cryptography and Security Artificial Intelligence Computation and Language Machine Learning |
| url | https://arxiv.org/abs/2602.21447 |