{"id":"https://openalex.org/W7161853389","doi":"https://doi.org/10.48550/arxiv.2605.19192","title":"Hallucination as Exploit: Evidence-Carrying Multimodal Agents","display_name":"Hallucination as Exploit: Evidence-Carrying Multimodal Agents","publication_year":2026,"publication_date":"2026-05-18","ids":{"openalex":"https://openalex.org/W7161853389","doi":"https://doi.org/10.48550/arxiv.2605.19192"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2605.19192","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.19192","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2605.19192","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5133552909","display_name":"Guijia Zhang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhang, Guijia","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136544663","display_name":"Hao Zheng","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zheng, Hao","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5103259898","display_name":"Harry Yang","orcid":"https://orcid.org/0000-0001-9125-5962"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yang, Harry","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.37040001153945923,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.37040001153945923,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.10920000076293945,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.07460000365972519,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/action","display_name":"Action (physics)","score":0.44339999556541443},{"id":"https://openalex.org/keywords/task","display_name":"Task (project management)","score":0.428600013256073},{"id":"https://openalex.org/keywords/pipeline","display_name":"Pipeline (software)","score":0.4004000127315521},{"id":"https://openalex.org/keywords/benchmark","display_name":"Benchmark (surveying)","score":0.3882000148296356},{"id":"https://openalex.org/keywords/audit","display_name":"Audit","score":0.3725000023841858},{"id":"https://openalex.org/keywords/perception","display_name":"Perception","score":0.3612000048160553},{"id":"https://openalex.org/keywords/classifier","display_name":"Classifier (UML)","score":0.30300000309944153},{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.30160000920295715},{"id":"https://openalex.org/keywords/language-model","display_name":"Language model","score":0.2915000021457672}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.737500011920929},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.45910000801086426},{"id":"https://openalex.org/C2780791683","wikidata":"https://www.wikidata.org/wiki/Q846785","display_name":"Action (physics)","level":2,"score":0.44339999556541443},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4390999972820282},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.428600013256073},{"id":"https://openalex.org/C43521106","wikidata":"https://www.wikidata.org/wiki/Q2165493","display_name":"Pipeline (software)","level":2,"score":0.4004000127315521},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.3882000148296356},{"id":"https://openalex.org/C199521495","wikidata":"https://www.wikidata.org/wiki/Q181487","display_name":"Audit","level":2,"score":0.3725000023841858},{"id":"https://openalex.org/C26760741","wikidata":"https://www.wikidata.org/wiki/Q160402","display_name":"Perception","level":2,"score":0.3612000048160553},{"id":"https://openalex.org/C204321447","wikidata":"https://www.wikidata.org/wiki/Q30642","display_name":"Natural language processing","level":1,"score":0.33889999985694885},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.303600013256073},{"id":"https://openalex.org/C95623464","wikidata":"https://www.wikidata.org/wiki/Q1096149","display_name":"Classifier (UML)","level":2,"score":0.30300000309944153},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.30160000920295715},{"id":"https://openalex.org/C137293760","wikidata":"https://www.wikidata.org/wiki/Q3621696","display_name":"Language model","level":2,"score":0.2915000021457672},{"id":"https://openalex.org/C40305131","wikidata":"https://www.wikidata.org/wiki/Q2616305","display_name":"Obfuscation","level":2,"score":0.2879999876022339},{"id":"https://openalex.org/C158251709","wikidata":"https://www.wikidata.org/wiki/Q354025","display_name":"Intrusion","level":2,"score":0.2784999907016754},{"id":"https://openalex.org/C123657996","wikidata":"https://www.wikidata.org/wiki/Q12271","display_name":"Architecture","level":2,"score":0.2777999937534332},{"id":"https://openalex.org/C25810664","wikidata":"https://www.wikidata.org/wiki/Q44325","display_name":"Ontology","level":2,"score":0.27619999647140503},{"id":"https://openalex.org/C148417208","wikidata":"https://www.wikidata.org/wiki/Q4825882","display_name":"Authentication (law)","level":2,"score":0.2743000090122223},{"id":"https://openalex.org/C107457646","wikidata":"https://www.wikidata.org/wiki/Q207434","display_name":"Human\u2013computer interaction","level":1,"score":0.2734000086784363},{"id":"https://openalex.org/C2780767217","wikidata":"https://www.wikidata.org/wiki/Q5532421","display_name":"Generality","level":2,"score":0.2732999920845032},{"id":"https://openalex.org/C39920170","wikidata":"https://www.wikidata.org/wiki/Q693083","display_name":"Soundness","level":2,"score":0.2718000113964081},{"id":"https://openalex.org/C165064840","wikidata":"https://www.wikidata.org/wiki/Q1321061","display_name":"Matching (statistics)","level":2,"score":0.2639000117778778},{"id":"https://openalex.org/C2779180768","wikidata":"https://www.wikidata.org/wiki/Q7302543","display_name":"Recklessness","level":2,"score":0.25690001249313354},{"id":"https://openalex.org/C110251889","wikidata":"https://www.wikidata.org/wiki/Q1569697","display_name":"Model checking","level":2,"score":0.2547000050544739},{"id":"https://openalex.org/C108759981","wikidata":"https://www.wikidata.org/wiki/Q788590","display_name":"Authorization","level":2,"score":0.251800000667572},{"id":"https://openalex.org/C48677424","wikidata":"https://www.wikidata.org/wiki/Q6888088","display_name":"Mode (computer interface)","level":2,"score":0.2515000104904175}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2605.19192","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.19192","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2605.19192","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.19192","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"score":0.8063413500785828,"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Multimodal":[0],"agents":[1,49,176],"increasingly":[2],"choose":[3],"tool":[4,61,218],"calls":[5],"from":[6,19,69],"screenshots,":[7],"documents,":[8],"and":[9,73,103,151,178],"webpages,":[10],"where":[11],"a":[12,42,75],"false":[13],"perceptual":[14],"claim":[15,37],"can":[16],"turn":[17],"hallucination":[18],"an":[20,24,35],"answer-quality":[21],"error":[22],"into":[23,63,96],"authorization":[25],"failure.":[26],"We":[27,45],"formalize":[28],"this":[29],"failure":[30],"mode":[31],"as":[32,56],"hallucination-to-action":[33],"conversion:":[34],"unsupported":[36,168],"supplies":[38],"the":[39,81,100,205],"precondition":[40],"for":[41,174,184],"privileged":[43],"action.":[44],"propose":[46,217],"evidence-carrying":[47],"multimodal":[48],"(ECA),":[50],"which":[51],"treat":[52],"free-form":[53],"model":[54,94,214],"text":[55],"inadmissible":[57],"evidence,":[58],"decompose":[59],"each":[60,120],"call":[62],"action-critical":[64,169],"predicates,":[65],"obtain":[66],"typed":[67],"certificates":[68,84],"constrained":[70],"DOM/OCR/AX":[71],"verifiers,":[72],"use":[74],"deterministic":[76],"gate":[77,125,193],"to":[78],"authorize":[79,224],"only":[80],"privileges":[82],"those":[83],"support.":[85],"Rather":[86],"than":[87],"hiding":[88],"perception":[89],"error,":[90],"ECA":[91,137],"converts":[92],"opaque":[93],"belief":[95],"auditable":[97],"residuals":[98],"at":[99],"verifier,":[101],"schema,":[102],"implementation":[104],"levels.":[105],"Verifier":[106],"red-teaming":[107],"across":[108],"17":[109],"canonical":[110,124],"attack":[111],"categories":[112],"shows":[113,166],"that":[114,167],"four":[115],"targeted":[116],"hardening":[117],"steps":[118],"are":[119],"necessary;":[121],"after":[122],"hardening,":[123],"bypass":[126],"is":[127,212],"0/1,700":[128],"(Wilson":[129,146],"95%":[130,147],"upper":[131,148],"bound":[132,149,156],"0.22%).":[133],"With":[134],"content-derived":[135],"certificates,":[136],"observes":[138],"zero":[139],"unsafe":[140,172,202],"executions":[141],"on":[142,161],"200":[143],"end-to-end":[144],"tasks":[145,154],"2.67%)":[150],"120":[152],"browser":[153],"(upper":[155],"4.3%).":[157],"A":[158],"HACR":[159],"audit":[160],"500":[162],"stratified":[163],"task":[164],"keys":[165],"claims":[170],"reach":[171],"execution":[173],"naive":[175],"(100.0%)":[177],"prompt-only":[179],"defenses":[180],"(49.6%),":[181],"but":[182,220],"not":[183],"ECA.":[185],"Oracle-certificate":[186],"replay":[187],"over":[188],"7,488":[189],"GPT-5.4":[190],"traces":[191],"isolates":[192],"correctness,":[194],"while":[195],"neural":[196],"judge":[197],"baselines":[198],"still":[199],"admit":[200],"most":[201],"actions":[203],"under":[204],"same":[206],"threat":[207],"model.":[208],"The":[209],"resulting":[210],"principle":[211],"simple:":[213],"language":[215],"may":[216],"use,":[219],"certified":[221],"predicates":[222],"must":[223],"it.":[225]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-05-21T00:00:00"}