{"id":"https://openalex.org/W7131653186","doi":"https://doi.org/10.48550/arxiv.2602.21447","title":"Adversarial Intent is a Latent Variable: Stateful Trust Inference for Securing Multimodal Agentic RAG","display_name":"Adversarial Intent is a Latent Variable: Stateful Trust Inference for Securing Multimodal Agentic RAG","publication_year":2026,"publication_date":"2026-02-24","ids":{"openalex":"https://openalex.org/W7131653186","doi":"https://doi.org/10.48550/arxiv.2602.21447"},"language":null,"primary_location":{"id":"pmh:doi:10.48550/arxiv.2602.21447","is_oa":true,"landing_page_url":null,"pdf_url":null,"source":{"id":"https://openalex.org/S4406922384","display_name":"Open MIND","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"publisher-specific-oa","license_id":"https://openalex.org/licenses/publisher-specific-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Article"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":null,"any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5102744674","display_name":"Inderjeet Singh","orcid":"https://orcid.org/0009-0008-6849-7611"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Singh, Inderjeet","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5114601830","display_name":"Vikas Pahuja","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Pahuja, Vikas","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5120309101","display_name":"Aishvariya Priya Rathina Sabapathy","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Sabapathy, Aishvariya Priya Rathina","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5013668563","display_name":"Chiara Picardi","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Picardi, Chiara","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5074215663","display_name":"Amit Giloni","orcid":"https://orcid.org/0000-0001-6496-0148"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Giloni, Amit","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5126877333","display_name":"Roman Vainshtein","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Vainshtein, Roman","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5126902183","display_name":"Andr\u00e9s Murillo","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Murillo, Andr\u00e9s","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5077629763","display_name":"Hisashi Kojima","orcid":"https://orcid.org/0000-0002-0973-1673"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Kojima, Hisashi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5126917426","display_name":"Motoyoshi Sekiya","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Sekiya, Motoyoshi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5078591021","display_name":"Yuki Unno","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Unno, Yuki","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5078441918","display_name":"Junichi Suga","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Suga, Junichi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9545000195503235,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9545000195503235,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12026","display_name":"Explainable Artificial Intelligence (XAI)","score":0.007000000216066837,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11273","display_name":"Advanced Graph Neural Networks","score":0.004900000058114529,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/stateless-protocol","display_name":"Stateless protocol","score":0.878000020980835},{"id":"https://openalex.org/keywords/stateful-firewall","display_name":"Stateful firewall","score":0.7741000056266785},{"id":"https://openalex.org/keywords/inference","display_name":"Inference","score":0.5911999940872192},{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.5297999978065491},{"id":"https://openalex.org/keywords/set","display_name":"Set (abstract data type)","score":0.4893999993801117},{"id":"https://openalex.org/keywords/modular-design","display_name":"Modular design","score":0.4546999931335449},{"id":"https://openalex.org/keywords/partially-observable-markov-decision-process","display_name":"Partially observable Markov decision process","score":0.44119998812675476},{"id":"https://openalex.org/keywords/semantics","display_name":"Semantics (computer science)","score":0.41260001063346863}],"concepts":[{"id":"https://openalex.org/C103613024","wikidata":"https://www.wikidata.org/wiki/Q230924","display_name":"Stateless protocol","level":3,"score":0.878000020980835},{"id":"https://openalex.org/C22927095","wikidata":"https://www.wikidata.org/wiki/Q1784206","display_name":"Stateful firewall","level":3,"score":0.7741000056266785},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6827999949455261},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.5911999940872192},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.5297999978065491},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.4893999993801117},{"id":"https://openalex.org/C101468663","wikidata":"https://www.wikidata.org/wiki/Q1620158","display_name":"Modular design","level":2,"score":0.4546999931335449},{"id":"https://openalex.org/C17098449","wikidata":"https://www.wikidata.org/wiki/Q176814","display_name":"Partially observable Markov decision process","level":4,"score":0.44119998812675476},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.41260001063346863},{"id":"https://openalex.org/C48103436","wikidata":"https://www.wikidata.org/wiki/Q599031","display_name":"State (computer science)","level":2,"score":0.3671000003814697},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.36399999260902405},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.34790000319480896},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.34689998626708984},{"id":"https://openalex.org/C51167844","wikidata":"https://www.wikidata.org/wiki/Q4422623","display_name":"Latent variable","level":2,"score":0.33469998836517334},{"id":"https://openalex.org/C159886148","wikidata":"https://www.wikidata.org/wiki/Q176645","display_name":"Markov process","level":2,"score":0.3176000118255615},{"id":"https://openalex.org/C98763669","wikidata":"https://www.wikidata.org/wiki/Q176645","display_name":"Markov chain","level":2,"score":0.299699991941452},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.2987000048160553},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.2888000011444092},{"id":"https://openalex.org/C106189395","wikidata":"https://www.wikidata.org/wiki/Q176789","display_name":"Markov decision process","level":3,"score":0.2881999909877777},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.28040000796318054},{"id":"https://openalex.org/C98184364","wikidata":"https://www.wikidata.org/wiki/Q1780131","display_name":"Argument (complex analysis)","level":2,"score":0.25459998846054077},{"id":"https://openalex.org/C2775892892","wikidata":"https://www.wikidata.org/wiki/Q6509517","display_name":"Revocation","level":3,"score":0.25279998779296875}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:doi:10.48550/arxiv.2602.21447","is_oa":true,"landing_page_url":null,"pdf_url":null,"source":{"id":"https://openalex.org/S4406922384","display_name":"Open MIND","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"publisher-specific-oa","license_id":"https://openalex.org/licenses/publisher-specific-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Article"},{"id":"doi:10.48550/arxiv.2602.21447","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2602.21447","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:doi:10.48550/arxiv.2602.21447","is_oa":true,"landing_page_url":null,"pdf_url":null,"source":{"id":"https://openalex.org/S4406922384","display_name":"Open MIND","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"publisher-specific-oa","license_id":"https://openalex.org/licenses/publisher-specific-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Article"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions","score":0.814584493637085}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Current":[0],"stateless":[1,134,144],"defences":[2],"for":[3],"multimodal":[4],"agentic":[5],"RAG":[6],"fail":[7],"to":[8,84,104],"detect":[9],"adversarial":[10,36],"strategies":[11],"that":[12,61],"distribute":[13],"malicious":[14],"semantics":[15],"across":[16],"retrieval,":[17],"planning,":[18],"and":[19,121,129],"generation":[20],"components.":[21],"We":[22,47],"formulate":[23],"this":[24],"security":[25],"challenge":[26],"as":[27,72],"a":[28,39,56,73,78,94,112],"Partially":[29],"Observable":[30],"Markov":[31],"Decision":[32],"Process":[33],"(POMDP),":[34],"where":[35],"intent":[37],"is":[38],"latent":[40],"variable":[41],"inferred":[42],"from":[43],"noisy":[44],"multi-stage":[45],"observations.":[46],"introduce":[48],"MMA-RAG^T,":[49],"an":[50,63],"inference-time":[51],"control":[52],"framework":[53],"governed":[54],"by":[55],"Modular":[57],"Trust":[58],"Agent":[59],"(MTA)":[60],"maintains":[62],"approximate":[64],"belief":[65],"state":[66],"via":[67],"structured":[68],"LLM":[69],"reasoning.":[70],"Operating":[71],"model-agnostic":[74],"overlay,":[75],"MMA-RAGT":[76],"mediates":[77],"configurable":[79],"set":[80],"of":[81],"internal":[82],"checkpoints":[83],"enforce":[85],"stateful":[86],"defence-in-depth.":[87],"Extensive":[88],"evaluation":[89],"on":[90],"43,774":[91],"instances":[92],"demonstrates":[93],"6.50x":[95],"average":[96],"reduction":[97],"factor":[98],"in":[99],"Attack":[100],"Success":[101],"Rate":[102],"relative":[103],"undefended":[105],"baselines,":[106],"with":[107],"negligible":[108],"utility":[109],"cost.":[110],"Crucially,":[111],"factorial":[113],"ablation":[114],"validates":[115],"our":[116],"theoretical":[117],"bounds:":[118],"while":[119],"statefulness":[120],"spatial":[122],"coverage":[123],"are":[124,149],"individually":[125],"necessary":[126],"(26.4":[127],"pp":[128,131],"13.6":[130],"gains":[132],"respectively),":[133],"multi-point":[135],"intervention":[136],"can":[137],"yield":[138],"zero":[139],"marginal":[140],"benefit":[141],"under":[142],"homogeneous":[143],"filtering":[145],"when":[146],"checkpoint":[147],"detections":[148],"perfectly":[150],"correlated.":[151]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-02-27T00:00:00"}