Paper deep dive
Agentic Adversarial Rewriting Exposes Architectural Vulnerabilities in Black-Box NLP Pipelines
Mazal Bethany, Kim-Kwang Raymond Choo, Nishant Vishwamitra, Peyman Najafirad
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 98%
Last extracted: 6/21/2026, 6:53:18 AM
Summary
The paper introduces a two-agent adversarial framework designed to exploit black-box, multi-component NLP pipelines (such as RAG and misinformation detection systems) under strict constraints: binary-only feedback, no gradient access, and a 10-query budget. The framework consists of an 'Attacker Agent' that generates semantic rewrites and a 'Prompt Optimization Agent' that iteratively refines the attack strategy. The research demonstrates that while traditional token-level perturbations fail against modern LLM-based pipelines, this agentic semantic-level approach achieves evasion rates of 19.95% to 40.34%. The study also identifies architectural properties that influence vulnerability and proposes a pattern-informed defense that reduces evasion by up to 65.18%.
Entities (8)
Relation Signals (5)
Attacker Agent → generates → Adversarial Rewrite
confidence 100% · An Attacker Agent generates meaning-preserving rewrites
Adversarial Rewrite → mustsatisfy → Semantic Equivalence
confidence 100% · The first ensures semantic equivalence: the rewrite must preserve the original input’s meaning
Adversarial Rewrite → mustsatisfy → Linguistic Coherence
confidence 100% · The second ensures linguistic coherence: Coh(x̃) = 1
Prompt Optimization Agent → refines → Attacker Agent Instructions
confidence 100% · a Prompt Optimization Agent refines the attack strategy using only binary decision feedback
Attacker Agent → targets → NLP Pipeline
confidence 100% · The framework is an agentic LLM system for exploiting black-box NLP pipelines
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Multi-component natural language processing (NLP) pipelines are increasingly deployed for high-stakes decisions, yet no existing adversarial method can test their robustness under realistic conditions: binary-only feedback, no gradient access, and strict query budgets. We formalize this strict black-box threat model and propose a two-agent evasion framework operating in a semantic perturbation space. An Attacker Agent generates meaning-preserving rewrites while a Prompt Optimization Agent refines the attack strategy using only binary decision feedback within a 10-query budget. Evaluated against four evidence-based misinformation detection pipelines, the framework achieves evasion rates of 19.95 to 40.34% on modern large language model (LLM) based systems, compared to at most 3.90% for token-level perturbation baselines that rely on surrogate models because they cannot operate under our threat model. A legacy system relying on static lexical retrieval exhibits near-total vulnerability 97.02%, establishing a lower bound that exposes how architectural choices govern the attack surface. Evasion effectiveness is associated with three architectural properties: evidence retrieval mechanism, retrieval-inference coupling, and baseline classification accuracy. The iterative prompt optimization yields the largest marginal gains against the most robust targets, confirming that adaptive strategy discovery is essential when evasion is non-trivial. Analysis of successful rewrites reveals four exploitation patterns, each targeting failures at distinct pipeline stages. A pattern-informed defense reduces the evasion rate by up to 65.18%.
Tags
Links
- Source: https://arxiv.org/abs/2604.23483v1
- Canonical: https://arxiv.org/abs/2604.23483v1
Trouble viewing inline? Open PDF directly →
Full Text
73,418 characters extracted from source content.
Expand or collapse full text
IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY1 Agentic Adversarial Rewriting Exposes Architectural Vulnerabilities in Black-Box NLP Pipelines Mazal Bethany, Kim-Kwang Raymond Choo, Senior Member, IEEE, Nishant Vishwamitra, and Peyman Najafirad, Senior Member, IEEE Abstract—Multi-componentnaturallanguageprocessing (NLP) pipelines are increasingly deployed for high-stakes decisions, yet no existing adversarial method can test their robustness under realistic conditions: binary-only feedback, no gradient access, and strict query budgets. We formalize this strict black-box threat model and propose a two-agent evasion framework operating in a semantic perturbation space. An Attacker Agent generates meaning-preserving rewrites while a Prompt Optimization Agent refines the attack strategy using only binary decision feedback within a 10-query budget. Evaluated against four evidence-based misinformation detection pipelines, the framework achieves evasion rates of 19.95 to 40.34% on modern large language model (LLM) based systems, compared to at most 3.90% for token-level perturbation baselines that rely on surrogate models because they cannot operate under our threat model. A legacy system relying on static lexical retrieval exhibits near-total vulnerability (97.02%), establishing a lower bound that exposes how architectural choices govern the attack surface. Evasion effectiveness is associated with three architectural properties: evidence retrieval mechanism, retrieval-inference coupling, and baseline classification accuracy. The iterative prompt optimization yields the largest marginal gains against the most robust targets, confirming that adaptive strategy discovery is essential when evasion is non-trivial. Analysis of successful rewrites reveals four exploitation patterns, each targeting failures at distinct pipeline stages. A pattern- informed defense reduces the evasion rate by up to 65.18%. Index Terms—Adversarial attacks, black-box NLP pipelines, large language models, agentic AI, budget-constrained queries. I. INTRODUCTION Advances in large language models (LLMs) have given rise to a new class of composite software systems known as NLP pipelines, which are multi-component architectures in which natural language serves as the interface at every processing stage: input intake, intermediate reasoning, and output gen- eration. Retrieval-augmented generation (RAG) pipelines [1], tool-augmented LLM agents [2], multi-agent reasoning frame- works [3], and evidence-based fact-checking systems [4] all in- stantiate this pattern. Unlike monolithic classifiers that expose a single decision boundary, these systems accept free-form natural language at every inter-component boundary, creating a combinatorially vast and semantically rich attack surface. We M. Bethany, N. Vishwamitra, K.-K. R. Choo, and P. Najafirad are with the Department of Information Systems and Cybersecu- rity, University of Texas at San Antonio, San Antonio, TX 78249 USA (e-mail: mazal.bethany@utsa.edu; nishant.vishwamitra@utsa.edu; ray- mond.choo@fulbrightmail.org; peyman.najafirad@utsa.edu). focus on evidence-based misinformation detection as a repre- sentative domain: these systems exhibit a canonical three-stage structure (natural language input, natural language evidence retrieval, and natural language inferential comparison) and are deployed at scale for high-stakes decisions. Despite their growing deployment, the adversarial vulnera- bility of multi-stage NLP systems has not been systematically studied. Existing adversarial text attacks rely on token-level substitutions, such as synonym replacement [5] and character- level perturbations [6], guided by gradient or logit-based optimization. These approaches were designed for monolithic classifiers and face fundamental limitations against multi- component pipelines for three reasons: (1) an effective ad- versarial input must simultaneously disrupt multiple pipeline stages, specifically both retrieval and inference, rather than a single decision boundary; (2) real-world deployments expose only binary decisions with no gradient or probability access; and (3) production systems enforce strict query budgets, rate limiting, and per-call costs, ruling out the extensive querying that token-level methods require. A fourth challenge, which we investigate empirically in this work, is that different pipeline architectures may be vulnerable at different pro- cessing stages, potentially requiring adaptive, target-specific exploitation rather than a fixed perturbation scheme. Prior domain-specific approaches have not closed this gap. Du et al. [7] demonstrated vulnerability in fact-verification systems but assumed write access to the evidence database. XARELLO [8] employs reinforcement learning but requires prediction probabilities. TREPAT [9] uses LLMs for initial rewritings via beam search, yet still depends on logits. No existing method can attack multi-component pipelines under true black-box conditions, namely binary feedback only with a strict query budget. We present an agentic LLM framework that exploits black- box NLP pipelines through adversarial rewriting under budget- constrained queries (Fig. 1). A two-agent architecture operates entirely at inference time: an Attacker Agent generates seman- tically equivalent rewrites through structural and stylistic trans- formations, while a Prompt Optimization Agent iteratively refines the Attacker’s instructions based on binary evaluation feedback. The framework requires no fine-tuning, no gradient access, and operates within a budget of just 10 queries per input. We formalize this as constrained optimization over natural language input space under black-box access. Evaluated against four evidence-based misinformation de- arXiv:2604.23483v1 [cs.AI] 26 Apr 2026 IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY2 tection pipelines, our framework achieves 19.95 to 40.34% attack success on modern LLM-based systems, compared to at most 3.90% for token-level baselines that rely on surro- gate models. Even the non-iterative Attacker Only variant achieves 14.55 to 35.92%, confirming that semantic-level rewriting provides a fundamental advantage independent of the optimization strategy. A legacy system with static lexical retrieval is near-completely exploitable (97.02%), establishing an architectural lower bound. Iterative prompt optimization provides the largest marginal gains against the most robust targets (+10.24 p on ICL), and analysis of successful rewrites reveals four exploitation patterns targeting distinct pipeline stages. A pattern-informed defense reduces attack success by up to 65.18%. Our contributions are as follows: • Attack Formulation. We formalize the problem of exploiting black-box NLP pipelines under budget- constrained queries as constrained optimization over nat- ural language input space, a threat model under which existing token-level methods, constrained to surrogate- model access, achieve at most 3.90% success on modern pipelines (Section I). • Agentic Attack Framework. We propose a two-agent framework that generates adversarial rewrites requiring no fine-tuning, no gradient access, and only binary feed- back within a 10-query budget (Section IV). • Vulnerability Spectrum and Defense. We evaluate against four pipelines spanning legacy to state-of-the- art architectures, revealing that attack success on mod- ern systems ranges from 19.95% to 40.34% (±4.3 p, 95% CI) and correlates with architectural properties, specifically the evidence retrieval mechanism, retrieval- inference coupling, and baseline accuracy. Analysis un- covers four exploitation patterns associated with distinct pipeline stages, and a pattern-informed defense reduces attack success by up to 65.18% (Sections V through V-F). In the next section, we will discuss the extant literature. I. RELATED WORK A. Multi-Component NLP Systems Modern NLP increasingly relies on multi-component sys- tems where LLMs communicate through natural language at each stage. RAG pipelines [1], tool-augmented agents [2], reasoning frameworks such as ReAct [3], and compound AI systems [10] all instantiate this pattern, creating a semantically rich attack surface that resists adversarial methods designed for single-model classifiers. Evidence-based misinformation detection is a prominent in- stance of this multi-stage pattern. Automated approaches span style-based, propagation-based, source-based, and evidence- based methods [11]. Evidence-based systems produce inter- pretable decisions grounded in retrieved evidence through a canonical three-stage structure: evidence retrieval, knowledge sourcing, and inferential comparison [4], [12]. We select this domain because its multi-stage structure, combined with aca- demic prototypes and commercial APIs, provides a rigorous adversarial testbed. B. Adversarial Attacks on NLP Systems Adversarial attacks on text face fundamentally different challenges than their vision counterparts: text is discrete, and even single-word changes can alter meaning [13]. Methods are organized along the white-box to black-box spectrum [14]. Score-based black-box methods receive prediction probabili- ties and can efficiently identify influential tokens: BAE [15] uses BERT masked language modeling for contextual replace- ments, BERT-Attack [16] turns BERT against its own fine- tuned classifiers, and SemAttack [17] optimizes perturbations across multiple semantic spaces. Decision-based (hard-label) methods receive only the final label, creating a substantially harder optimization problem [18]. Established score-based methods including CLARE [19], DeepWordBug [6], TextBugger [20], and TextFooler [5] were designed for monolithic classifiers. The TextAttack frame- work [21] provides a unified evaluation platform for these methods. As we demonstrate in Section V, all achieve at most 3.90% evasion against modern LLM-based pipelines because they cannot reason about multi-stage interactions. This comparison is structurally asymmetric: these baselines must rely on surrogate models because they require prediction prob- abilities unavailable from the target. We include them as the best available methods and interpret the gap as evidence that multi-stage pipeline attacks require fundamentally different approaches. C. Hard-Label Adversarial Attacks on Text Hard-label attacks operate under the most restrictive black- box threat model, where the adversary observes only the final classification label. This constraint transforms adversarial search from continuous optimization into combinatorial search over discrete text, making query efficiency the central design objective. Maheshwary et al. [22] established the first hard-label text attack using genetic optimization. Subsequent work improved query efficiency through gradient estimation [18], embedding- space optimization [23], geometry-aware perturbation [24], and perturbation minimization [25]. More recent methods further reduce query cost via LIME-based importance rank- ing [26], dual-gradient fusion [27], and hybrid optimiza- tion [28]–[31]. Despite this progress, all existing hard-label methods share two fundamental limitations: they operate at the token level, modifying individual words through synonym substitution, and they target single-model architectures. Neither property suf- fices against multi-component pipelines where the adversarial input must simultaneously disrupt retrieval and inference. Our framework operates at the semantic level, generating holistic sentence-level rewrites, and is the first to demonstrate effective hard-label attacks against multi-stage NLP pipelines. D. LLM-Based Adversarial Attacks A growing body of work leverages LLMs as adversarial tools. Perez et al. [32] pioneered automated red-teaming by using one LLM to generate test cases that expose harmful be- haviors in a target LLM. Zou et al. [33] proposed GCG, which IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY3 appends optimized adversarial suffixes achieving high evasion on both open-source and closed-source models. PromptAt- tack [34] composes structured attack prompts at multiple granularities, increasing evasion by 42% using only black- box queries. BEAST [35] achieves gradient-free jailbreaking in under one minute with transferable adversarial suffixes. Our framework shares the use of LLMs as the attack engine but differs in three critical aspects: (1) we target multi- component pipelines rather than individual LLMs, (2) we enforce strict semantic equivalence and coherence constraints, and (3) we operate under a budget of only 10 queries, whereas GCG and similar methods require thousands of optimization steps. E. Adversarial Attacks on Pipeline and RAG Systems Recent work has examined the adversarial vulnerability of multi-component systems. Greshake et al. [36] demon- strated indirect prompt injection in LLM-integrated applica- tions. PoisonedRAG [37] achieves 90% evasion by injecting five malicious documents into a knowledge database, while Phantom [38] and TrojanRAG [39] mount backdoor attacks through poisoned retrieval corpora. In misinformation detection, Du et al. [7] demonstrated vulnerability through synthetic evidence injection but assumed write access to the evidence database. Abdelnabi and Fritz [40] proposed a taxonomy of evidence manipulation attacks, and Thorne and Vlachos [41] evaluated adversarial attacks on the FEVER shared task. XARELLO [8] employs reinforcement learning and TREPAT [9] uses LLM-based beam search, but both require prediction probabilities or extensive querying. Our framework is the first to attack multi-component fact-checking pipelines under the most restrictive hard-label threat model with a strict 10-query budget, operating entirely through input- side adversarial rewriting. F. Defenses Against Adversarial Text Attacks Defenses span three paradigms [42]: certified robustness through randomized smoothing [43], [44], input purification through masked language model infilling [45] or adversarial rewriting [46], and detection-based methods such as Text- Guard [47]. Our pattern-informed defense (Section V-F) be- longs to the input purification paradigm but specifically tar- gets sentence-level complexity and hedging patterns, unlike general-purpose methods designed for token-level perturba- tions. I. ATTACK FORMULATION We formalize the problem of exploiting black-box NLP pipelines through adversarial rewriting under budget- constrained queries. We consider three entities: (1) the adver- sary, an automated agent that generates adversarial rewrites to induce misclassification; (2) the target pipeline, a black- box multi-component system that processes natural language inputs through multiple stages to produce a binary decision; and (3) the end users who rely on the pipeline’s outputs for decision-making. A claim x is a short text span (typically 1 to 2 sentences) that makes a specific assertion verifiable against evidence. Let f(x) ∈ 0, 1 represent the target pipeline that evaluates claims against evidence to output a binary decision, where 1 denotes true claims and 0 denotes false claims. Let y ∗ be the ground truth label for claim x. The adversary seeks to generate a semantically equivalent rewrite ̃x of the original input x that causes the target pipeline to produce an incorrect output, formally expressed as f( ̃x) ̸= y ∗ . The adversary operates under strict black- box conditions, with access only to the pipeline’s binary decisions without visibility into model architecture, gradients, training data, confidence scores, or logits. Crucially, multi- stage pipelines may fail at different processing stages (some at evidence retrieval, others at inferential comparison), but the adversary cannot observe which stage fails, making the opti- mization problem strictly harder than attacking any individual component. Furthermore, the adversary faces a limited query budget due to rate limitations and costs associated with API calls to production systems. For the generated rewrites to constitute valid adversarial inputs, they must satisfy two constraints. The first is semantic equivalence, ensuring the core meaning and intent of the original input remains intact despite the transformation. The second is textual coherence, ensuring that the adversarial rewrites maintain grammatical correctness and readability, avoiding artifacts that would distinguish them from legitimate inputs. Unlike theoretical settings where unlimited queries are possible, we consider realistic production environments where pipelines restrict the number of queries from a single source. This models the practical constraints of attacking deployed systems: commercial APIs enforce query limits, implement rate limiting, and charge per call, making extensive trial-and- error prohibitively expensive. a) Adversary Knowledge Model: The adversary knows the ground truth label y ∗ for each claim x. This assumption is operationally realistic: a disinformation actor submitting a false claim knows it is false and aims for misclassification as true; symmetrically, a propagandist suppressing a true narrative seeks a false classification. No access to internal reasoning or confidence scores is required. We evaluate attacks in both directions (false→true and true→false) across the full dataset. IV. METHODOLOGY A. Two-Agent Architecture Our framework is an agentic LLM system for exploiting black-box NLP pipelines, built on two collaborating agents. An Attacker Agent generates adversarial rewrites and a Prompt Optimization Agent refines the attack strategy based on eval- uation feedback. The Attacker Agent receives the original input x along with system instructions ℘ (t) at iteration t, and generates an adversarial rewrite: ̃x (t) ∼P M (·|℘ (t) ⊕ x)(1) where ⊕ denotes concatenation andP M (·|p) represents the probability distribution over model M’s outputs conditioned IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY4 Fig. 1. High-level overview of the agentic adversarial rewriting framework with a worked example. Left: Iterative attack loop in which the Attacker Agent generates candidate rewrites, the constraint validation module enforces semantic equivalence and linguistic coherence, and the target detectorf provides binary feedback. Failed attempts feed constraint data to the Prompt Optimization Agent, which refines the attack strategy within a 10-query budget. The decision boundary visualization illustrates how successive rewrites navigate the semantic perturbation space. Right: A concrete three-iteration example on a political claim, progressing from a constraint failure (insufficient similarity) through a target detector failure (correct classification) to a successful evasion (misclassified as TRUE). on prompt p. The system instructions ℘ (t) are high-level directives specifying the agent’s role, constraints, and style guidelines for rewriting. The Prompt Optimization Agent analyzes the outcomes of each attempt and generates refined system instructions for the next iteration: ℘ (t+1) ∼P M (·|℘ (t) ⊕ x⊕ ̃x (t) ⊕ c (t) )(2) where c (t) denotes the outcomes and scores from the constraint validation module for the rewrite ̃x (t) . B. Rewriting Constraints Each adversarial rewrite must satisfy two categories of con- straints to constitute a valid attack. The first ensures semantic equivalence: the rewrite must preserve the original input’s meaning as measured by semantic similarity and a binary core assertion check: S( ̃x (t) ,x)≥ τ S (3) Sem( ̃x (t) ,x) = 1(4) where S(·,·) represents semantic similarity measures with threshold τ S , and Sem(·,·) is a binary function confirming the core assertion remains unchanged. The second ensures linguistic coherence: Coh( ̃x (t) ) = 1(5) where Coh(·) evaluates grammatical correctness, readability, and natural language flow, outputting 1 for coherent text and 0 otherwise. A successful attack is achieved when the adversarial rewrite causes misclassification: f ̃x (t) ̸= y ∗ (6) All four conditions (3) to (6) must hold simultaneously for a valid adversarial rewrite. Together, they form the constraint validation module. C. Iterative Optimization The framework iterates until either all constraints are sat- isfied or the query budget T is exhausted. We consider two variants of the Prompt Optimization Agent’s context. The Full-History variant provides the Prompt Optimization Agent with all previous attempts and their evaluation out- comes: ℘ (t+1) ∼P M · ℘ (t) ⊕ x⊕ ̃x (i) ,c (i) t i=1 (7) This enables the agent to identify patterns across attempts and discover target-specific exploitation strategies. This capa- bility becomes increasingly important as pipeline robustness increases and single-attempt evasion attacks become less likely to succeed, though it comes at the cost of longer prompts. The Previous-Only variant provides only the most recent attempt: ℘ (t+1) ∼P M (·|℘ (t) ⊕ x⊕ ̃x (t) ⊕ c (t) )(8) This reduces context length and enables faster iteration. To encourage exploration diversity, the Attacker Agent uses a temperature schedule: 1.0 initially, increasing by +0.1 per iteration after iteration 5, capped at 1.5. This schedule was IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY5 Algorithm 1 Agentic Adversarial Rewriting Attack Require: Original claim x, black-box detector f , ground truth y ∗ , max iterations T Ensure: Adversarial rewriting ̃x that preserves semantic meaning and coherence 1: t← 0 2: instructions← InitialSystemInstructions() 3: history←∅ 4: while t < T do 5: t← t + 1 6: ̃x (t) ← AttackerAgent(x, instructions) 7:semantic sim← S( ̃x (t) ,x)≥ τ S 8:sem check← Sem( ̃x (t) ,x) = 1 9:coherence← Coh( ̃x (t) ) = 1 10:attacksuccess← f( ̃x (t) )̸= y ∗ 11:all satisfied ←semanticsim ∧ semcheck ∧ coherence∧ attacksuccess 12:if allsatisfied then return ̃x (t) 13:end if 14:history← history∪( ̃x (t) , checks) 15:if UseFullHistory then 16:instructions← PromptOptAgent(x, history) 17:else 18:instructions← PromptOptAgent(x,( ̃x (t) , checks)) 19:end if 20: end while 21: return NULL calibrated on a held-out set of 50 claims; alternative schedules (linear increase from 1.0, fixed 1.2) yielded comparable but slightly lower success, suggesting robustness to moderate variation. The Prompt Optimization Agent maintains constant temperature 1.0 throughout. a) Two-Phase Search Intuition: The two-agent loop im- plicitly implements exploration-exploitation. Early iterations generate diverse rewrites that broadly probe the decision boundary. A rewrite that satisfies semantic constraints but fails to flip the classification serves as a warm-start point, indicating that a nearby region of the perturbation space may contain valid adversarial examples. The Prompt Optimization Agent then shifts from exploration to exploitation: analyzing which constraints were satisfied and which failed across the history, it concentrates subsequent perturbation on the dimensions most likely to induce boundary crossing. The temperature schedule reinforces this transition: conservative sampling (τ=1.0) sup- ports early exploration, while increased temperature (τ→1.5) provides diversity within the narrowed search region. The complete procedure is detailed in Algorithm 1 and the full system architecture is presented in Fig. 2. D. Semantic Equivalence and Linguistic Coherence Measure- ments The constraint validation module enforces four simultaneous checks on every adversarial rewrite. a) MPNetEmbeddingSimilarity: Wecomputecosinesimilarityusingthe sentence-transformers/all-mpnet-base-v2 model [48] via the HuggingFace SentenceTransformers library [49]: S MPNet ( ̃x (t) ,x)≥ τ MPNet (9) with threshold τ MPNet = 0.61. b) BERTScore Similarity: We use BERTScore with the microsoft/deberta-xlarge-mnli model [50], [51], computing the F1 score with baseline rescaling: S BERT ( ̃x (t) ,x)≥ τ BERT (10) with threshold τ BERT = 0.77. c) LLM-Based Semantic Check: A GPT-4o-based bi- nary verification confirms that the core assertion remains unchanged, guarding against subtle additions or omissions of essential facts: GPT4-Eq( ̃x (t) ,x) = 1(11) This check uses few-shot examples to ensure consistent evaluation. We acknowledge that using an LLM to validate LLM-generated rewrites introduces a potential same-family bias; we mitigate this through two independent embedding- based checks (MPNet and BERTScore) that provide cross- architecture validation. d) Linguistic Coherence: A GPT-4o-mini-based evalu- ator [52] assesses grammatical correctness, readability, and natural language flow: GPT4-Coh( ̃x (t) ) = 1(12) e) Threshold Derivation: The thresholds τ MPNet and τ BERT were derived through a human evaluation study with three annotators on 200 original/rewritten claim pairs from a validation subset of LIAR-New. We employed bin-based stratified sampling across MPNet and BERTScore quartiles and selected thresholds to minimize false positives. Inter- annotator agreement measured by Fleiss’ Kappa was 1.0 for coherence and 0.610 for semantic equivalence [53]. We report the scope and limitations of this calibration study in Section VII. V. EXPERIMENTS We evaluate our framework on evidence-based misinforma- tion detection, a domain that exhibits the canonical multi-stage pipeline structure: natural language input, natural language ev- idence retrieval, and natural language inferential comparison. A. Data We use the LIAR-New dataset [54], containing 1,957 real- world political statements from PolitiFact categorized into three verifiability levels: Possible (927), Hard (581), and Impossible (449). We retain only Possible and Hard categories (objectively determinable veracity). The six-class labels from the original LIAR dataset [55] are mapped to binary: False (Pants-fire + False + Mostly-false = 1,663) and True (Half- true + Mostly-true + True = 294), following the convention where “Mostly-false”/“Half-true” represents the natural deci- sion threshold. We randomly selected a stratified subset of 500 samples, preserving class distribution. Although LIAR-New IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY6 Mapping the boundary local structure with structured component negations for minimal queries. Diverse Initial Queries Deconstruction & Component Analysis Strategic Negation & Sequential Sampling Original Claim Phase 2: Focused Exploitation Phase 1: Global Exploration Diverse Initial Queries Warm-Start Point Successful Adversarial Sample(x adv ) Successful Adversarial Sample(x adv ) Final Optimized BoundaryCross Local Boundary Mapping & Optimization Fig. 2. Detailed system architecture of the agentic adversarial rewriting framework. The diagram specifies each component of the constraint validation module (MPNet similarity, BERTScore, GPT-4o semantic equivalence check, and GPT-4o-mini coherence check), the feedback loop between the target detector and the Prompt Optimization Agent, and the decision logic governing iteration termination. The right panel traces a complete attack trajectory through three iterations, illustrating how constraint and detector feedback jointly guide the Prompt Optimization Agent toward a successful adversarial rewrite. consists of political statements, the claims span diverse policy domains (healthcare, economy, immigration, foreign policy, criminal justice). B. Implementation 1) Target Pipelines: We evaluated against four evidence- based misinformation detection pipelines, each exhibiting the canonical three-stage structure (input intake, evidence re- trieval, inferential comparison). Verifact [4] employs a two-agent architecture with Google Search API retrieval and GPT-4o-mini [52] (substituting GPT- 4-0125 for cost). ICL [12] uses in-context learning with Google Search API and Qwen2-VL-72B-Instruct [56], [57], outputting binary decisions. ClaimBuster [58] is a legacy system whose fact_matcher API [59] relies on lexical retrieval; not_enough_info responses were treated as incorrect. We include it to anchor the vulnerability spec- trum. Perplexity uses the Sonar model [60] with real-time web search, achieving performance comparable to GPT-4o- mini [61]. 2) Attack Methods: a) Our Framework: Both the Attacker Agent and Prompt Optimization Agent utilized GPT-4o. The temperature sched- ule is described in Section IV-C. We evaluated three variants: Full History, where the Prompt Optimization Agent receives all previous attempts; Previous Step, where it receives only the most recent attempt; and Attacker Only, where no prompt optimization occurs and the Attacker Agent’s prompt is never updated. All variants operated under a maximum budget of 10 queries per input. b) Baseline Methods: We implemented four token-level baselines via TextAttack [21]: CLARE [19] (mask-then- infill), DeepWordBug [6] (character-level transformations), TextBugger [20] (hybrid character/word perturbations), and TextFooler [5] (synonym substitution guided by predic- tion probabilities). All used a surrogate model: RoBERTa- base [62], [63] fine-tuned on LIAR [55] with class-weighted loss and maximum sequence length of 128. All methods were allowed 10 queries and evaluated under the same se- mantic equivalence and coherence constraints (Sections IV-B and IV-D). c) Notes on Baseline Comparison: We exclude re- cent LLM-based adversarial methods (GCG [33], PromptAt- tack [34], BEAST [35]) because they target jailbreaking of individual LLMs, not multi-stage pipeline evasion, and require thousands of optimization steps without semantic equivalence constraints. The comparison with token-level baselines is structurally asymmetric: our framework queries the target pipeline directly, while baselines must query a surrogate model because they require prediction probabilities unavailable from the target. The Attacker Only variant isolates the contribution of prompt optimization from the advantage of direct target access. C. Target Pipeline Baseline Performance Table I presents baseline performance. Perplexity achieves the highest accuracy (86.20%) and Macro F1 (68.88%), fol- lowed by Verifact (82.40%), ICL (71.20%), and ClaimBuster (61.00%). The accuracy–Macro F1 gap across all systems re- flects class imbalance (1,663 false vs. 294 true claims). Claim- Buster’s high precision (65.96%) but low recall (40.12%) indicates it correctly identifies false claims but misses many true claims. D. Attack Success Results Table I presents attack success rates across all four target pipelines. We focus the analysis on the three modern systems IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY7 TABLE I BASELINE PERFORMANCE OF FOUR NLP PIPELINES FOR MISINFORMATION DETECTION ON BINARY CLASSIFICATION (TRUE/FALSE) USING THE LIAR-NEW DATASET. PERPLEXITY ACHIEVES THE HIGHEST PERFORMANCE ACROSS ALL METRICS. MetricsICLVerifactClaimBusterPerplexity Accuracy71.2082.4061.0086.20 Macro F155.0065.1149.8968.88 Macro Recall56.8164.4940.1266.22 Macro Precision54.8665.8565.9674.16 TABLE I ATTACK SUCCESS RATES (%) AGAINST FOUR NLP PIPELINES. 95% WILSON CONFIDENCE INTERVALS (CI) ARE REPORTED FOR OUR FULL HISTORY VARIANT; ALL CIS ARE±1.5 TO 4.3 P (SEE TEXT). BASELINE METHODS USE A ROBERTA SURROGATE MODEL FOR PREDICTION PROBABILITIES. † MethodICLVerifactClaimBusterPerplexity CLARE † 3.901.4626.560.46 DeepWordBug † 1.971.4610.820.23 TextBugger † 2.801.9422.950.00 TextFooler † 3.092.1823.931.16 Ours (Attacker Only)20.1135.9295.0214.55 Ours (Previous Step)25.0039.5693.0518.14 Ours (Full History)30.3540.3497.0219.95 (ICL, Verifact, Perplexity), as these represent the pipeline ar- chitectures currently deployed in practice. ClaimBuster results are reported for completeness as a legacy anchor point. a) Modern Pipeline Results: Our Full History variant achieved 40.34% [±4.3 p] against Verifact, 30.35% [±4.0 p] against ICL, and 19.95% [±3.5 p] against Perplexity (95% Wilson CIs, n=500). The strongest token-level baseline (CLARE) achieved at most 3.90% [±1.7 p] on ICL and below 2.18% on other modern targets. However, this comparison is structurally asymmetric: our framework queries the target pipeline directly, while baselines query a surrogate model because they require prediction probabilities unavailable from the target. To disentangle the effect of direct target access from that of semantic-level rewriting, we compare against our Attacker Only variant, which shares the same direct target access but performs no iterative optimization. Attacker Only achieves 14.55 to 35.92% on modern targets, confirming that the majority of the gap over token-level baselines stems from semantic-level rewriting rather than from the optimization loop or the access advantage alone. b) Legacy Baseline: Against ClaimBuster, our frame- work achieved 97.02% [±1.5 p], compared to CLARE’s 26.56% [±3.9 p]. ClaimBuster’s near-complete exploitability stems from its legacy architecture: its lexical retrieval stage fre- quently returns not_enough_info for reformulated claims, reflecting brittle keyword matching rather than a sophisticated adversarial challenge. We treat this result as an architectural lower bound rather than a primary finding. c) Prompt Optimization Value: Among our variants, Full History consistently outperformed Previous Step, which in turn outperformed Attacker Only (Fig. 3). The marginal value of prompt optimization scales inversely with target vulnerability: the Prompt Optimization Agent adds only 2.00 p against ClaimBuster (95.02% → 97.02%), where any valid rewrite suffices, but contributes 10.24 p against ICL (20.11% → 30.35%), where the search problem is harder and history- conditioned strategy refinement is most valuable. This pattern is consistent with the theoretical expectation that optimization contributes most when the feasible region of the constrained problem is narrow. d) Statistical Notes: All confidence intervals are 95% Wilson binomial intervals (n=500). No baseline CI overlaps with our Full History CI on any modern target, confirming statistical significance. These intervals capture sampling vari- ability but not LLM generation stochasticity (Section VII). e) Vulnerability Spectrum: The results reveal a vulnera- bility spectrum associated with three architectural properties: (1) evidence retrieval mechanism (lexical matching is catas- trophically vulnerable; real-time search provides resilience), (2) retrieval-inference coupling (tight integration resists inter- stage mismatch), and (3) baseline accuracy (higher accuracy widens the decision margin). Perplexity (19.95%) proves most robust, ICL (30.35%) and Verifact (40.34%) occupy the middle range, and ClaimBuster (97.02%) anchors the vulnerable end. E. Exploitation Pattern Analysis We analyzed the characteristics of successful Full History adversarial rewrites across all four targets (Table I). The analysis reveals four recurring patterns in successful adver- sarial rewrites. We describe each pattern below and note the pipeline stages where they are most likely to have an effect, though we acknowledge that these stage attributions are correlational (based on the nature of the transformation and which pipelines are most affected) rather than causally verified through controlled ablation. a) Pattern 1: Hedging and Ambiguity Injection: Term frequency–inverse document frequency (TF-IDF) analysis re- veals a systematic vocabulary shift: original texts frequently use direct terms such as “says,” “and,” “are,” “people,” and “because,” while successful adversarial rewrites employ hedg- ing terms including “that,” “as,” “might,” “some,” “reportedly,” and “potentially.” This hedging introduces ambiguity that is consistent with degradation of the evidence retrieval stage, making it harder for the pipeline to match claims against definitive evidence. b) Pattern 2: Structural Elaboration: Our framework consistently generated longer texts, with character counts increasing from 103.29 (original) to 132.34 to 159.46 (ad- versarial), representing a 28 to 54% increase. This elaboration dilutes the core claim signal across a longer text span, which is consistent with challenging the retrieval mechanism’s ability to extract the key verifiable assertion. c) Pattern 3: Complexity Escalation: The Flesch Read- ing Ease score dropped from 64.40 (approximately 8th-grade level) to 39.58 to 43.48 (college level), a 32 to 39% decrease. Adversarial rewrites also exhibited lower perplexity (73.06 to 110.56) compared to originals (207.17), consistent with the observation that LLM-generated text is more predictable to language models [64]. This complexity escalation is consistent IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY8 12345678910 5% 10% 15% 20% 25% 30% 33% Attack iteration number Cumulative attack success rate (%) (a) ICL 12345678910 12% 15% 20% 25% 30% 35% 40% 43% Attack iteration number Cumulative attack success rate (%) (b) Verifact 12345678910 72% 75% 80% 85% 90% 95% 100% Attack iteration number Cumulative attack success rate (%) (c) ClaimBuster 12345678910 2% 6% 10% 14% 18% 22% Attack iteration number Cumulative attack success rate (%) (d) Perplexity Full History Previous Step Attacker Only Fig. 3. Cumulative attack success rates (%) for three framework variants over 10 attack iterations on four target pipelines: (a) ICL, (b) Verifact, (c) ClaimBuster, and (d) Perplexity. Full History consistently achieves the highest success rate, with the largest marginal gains on the most robust targets. TABLE I TEXT ANALYSIS OF SUCCESSFUL ADVERSARIAL REWRITES (OURS, FULL HISTORY) COMPARED TO ORIGINAL INPUTS. METRICS SPAN SEMANTIC SIMILARITY, LEXICAL CHANGES, SYNTACTIC/STRUCTURAL MODIFICATIONS, AND STYLISTIC DIFFERENCES. TextBERTScoreLevenshteinParse Tree Dist.Text LengthPerplexityFlesch RE Original–103.29207.1764.40 ICL0.839485.72040.3287159.4673.0639.91 Verifact0.838285.42740.3212154.68101.3439.58 ClaimBuster0.855069.55650.3050132.34110.5643.48 Perplexity0.837682.62960.3265148.3488.8443.28 with disrupting the inferential comparison stage, where the mismatch between complex adversarial inputs and simpler retrieved evidence may degrade entailment judgments. d) Pattern 4: Syntactic Restructuring: Parse tree dis- tances of 0.3050 to 0.3287, combined with high Levenshtein distances (69.56 to 85.72), confirm substantial structural and lexical modification despite meaning preservation. BERTScore values (0.8376 to 0.8550) remained well above the threshold of 0.77, confirming semantic fidelity. These modifications are consistent with disrupting pattern-matching heuristics at the retrieval stage while preserving the underlying assertion. These stage-level associations are consistent with the vul- nerability spectrum: ClaimBuster is maximally vulnerable to retrieval-associated patterns (1, 2, 4), while Perplexity’s real- time search neutralizes retrieval-stage disruption. Controlled ablation (e.g., constraining the rewriter to a single pattern) is TABLE IV EFFECTIVENESS OF TEXT SIMPLIFICATION DEFENSE AGAINST OUR FULL HISTORY VARIANT ACROSS FOUR NLP PIPELINES FOR MISINFORMATION DETECTION. PipelineFlesch REAttack Success Rate (%) AttackDefenseAttackDefenseReduction ICL39.9152.9130.3510.5765.18 Verifact39.5853.3140.3420.7748.50 ClaimBuster43.4855.6797.0258.2839.93 Perplexity43.2854.9619.9510.4347.73 needed to establish causal attribution. IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY9 F. Pattern-Informed Defense Based on the exploitation patterns identified above, par- ticularly complexity escalation (Pattern 3), we developed a defense through input transformation via text simplification as a preprocessing step. We employed a GPT-4o-based text simplifier instructed to: (1) preserve exact meaning and factual content, (2) eliminate unnecessary complexity and ambiguous qualifiers, (3) enhance clarity through simple, direct language, and (4) maintain natural language flow. This defense tar- gets the linguistic properties that our framework exploits by normalizing the complexity of inputs before they enter the pipeline. Table IV presents the defense results. The text simpli- fication defense increased the Flesch Reading Ease score by 10 to 14 points across all adversarial rewrites, bringing them closer to the readability level of original claims. On modern pipelines, ICL benefited most from the defense, with a 65.18% reduction in attack success rate (30.35% to 10.57%). Verifact saw a 48.50% reduction (40.34% to 20.77%), and Perplexity achieved a 47.73% reduction (19.95% to 10.43%). ClaimBuster, while experiencing a 39.93% reduction, retained the highest post-defense attack success rate at 58.28%. The defense effectiveness varies with vulnerability type: ICL benefits most (65.18% reduction) because its exploitation is primarily associated with complexity escalation at the in- ference stage, while ClaimBuster retains 58.28% post-defense attack success because its vulnerability is architectural (brittle lexical retrieval) rather than pattern-driven. This suggests that text simplification addresses inference-stage complexity mis- match but cannot compensate for fundamental retrieval-stage weaknesses. A comprehensive defense evaluation incorporat- ing ensemble defenses, perturbation detection, and consistency checking is important future work. G. Cost Analysis Our framework costs approximately $0.30 to $0.50 per claim (GPT-4o at $5/$15 per 1M input/output tokens), yielding $150 to $250 for the 500-claim experiment per target pipeline. Average wall-clock time is 45 to 90 seconds per claim for Full History, reduced to approximately 30 seconds for highly vulnerable targets via early termination. The convergence curves in Fig. 3 show that Full History achieves 60 to 75% of its final attack success within 4 iterations, indicating that a budget of T=5 would capture the majority of exploitable claims at half the cost, while extending beyond T=10 would yield minimal additional gains (<2 p). VI. DISCUSSION a) Why Agentic Optimization, Not Reinforcement Learn- ing: A natural question is why we use an agentic two- agent approach rather than reinforcement learning methods such as PPO [65]. Two factors motivated this choice. First, RL requires dense reward signals, but our setting provides only binary feedback with no directional information. Sparse binary rewards yield extremely high variance in policy gradi- ent estimates [65], and exploration under such sparsity may require orders of magnitude more iterations than our 10-query budget permits. Second, RL requires exemplar trajectories to bootstrap learning; in our setting, such exemplars would be the successful rewrites we aim to generate, creating a circular dependency. Our framework sidesteps both limitations by leveraging the pretrained linguistic knowledge of LLMs to generate promising adversarial candidates from the outset. The Prompt Optimization Agent then refines strategy using binary feed- back combined with iteration history, achieving an efficiency that learning-based algorithms cannot match within a 10-query budget. b) Why Two Agents, Not One: A simpler alternative would be a single LLM with self-reflection. The Attacker Only variant (Table I) tests exactly this: a single agent generating rewrites without iterative optimization, achieving 14.55 to 35.92% on modern targets. The full framework adds 5.35 to 10.24 p over this baseline, with the largest gains on the most robust targets. This confirms that semantic-level rewriting is the primary contributor, while the Prompt Optimization Agent provides essential marginal gains against robust pipelines where single-attempt attacks fail. The two-agent decomposi- tion is therefore the minimum complexity required for effective boundary search across the full vulnerability spectrum. c) Architectural Determinants of Vulnerability: Pipeline vulnerability forms a spectrum determined by three properties: evidence retrieval mechanism, retrieval-inference coupling, and baseline accuracy. Legacy systems with lexical retrieval are near-completely exploitable (97.02%) because keyword matching is trivially defeated. Modern LLM-based pipelines resist retrieval-stage attacks but remain vulnerable at inference, where complexity escalation creates stylistic mismatch with retrieved evidence. Pipelines with real-time evidence ground- ing resist both stages most effectively (19.95%). This analysis generalizes: any multi-stage system relying on surface-level lexical matching can be expected to exhibit similar vulnera- bility. The finding that modern pipelines are not immune (30 to 40% attack success without gradient access) underscores that semantic retrieval does not fully protect the inference stage. d) Query Efficiency Through Implicit Boundary Search: Each adversarial rewrite probes the target’s decision space within a feasible region B(x,τ) defined by the intersection of similarity constraints (MPNet, BERTScore, LLM-based check). The two-agent framework implicitly decomposes search into exploration (diverse rewrites locating the bound- ary) followed by exploitation (history-informed refinement). This explains why the Prompt Optimization Agent’s marginal contribution scales inversely with vulnerability: against Claim- Buster the boundary intersects a large portion of B(x,τ) (+2.00 p), while against ICL the feasible region is narrow and exploitation is essential (+10.24 p). Full History outperforms Previous Step because accumulated observations enable finer boundary localization, and achieves steep early gains followed by diminishing returns (Fig. 3), consistent with exploration- exploitation transition. e) Validity of Semantic Equivalence Evaluation: Our constraint validation module uses three independent meth- ods: two embedding-based similarity measures (MPNet and BERTScore) and one LLM-based binary verification (GPT- IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY10 4o). Thresholds were calibrated against human judgments on 200 pairs with Fleiss’ Kappa of 1.0 (coherence) and 0.610 (se- mantic equivalence). We acknowledge three limitations: (1) the LLM-based check uses a model from the same family as the generator, introducing potential same-family bias, mitigated by the cross-architecture embedding checks; (2) the calibration used validation pairs, not actual attack outputs; and (3) the Kappa of 0.610, while substantial, reflects inherent ambiguity in semantic equivalence judgments for adversarial rewrites. Successful rewrites maintain BERTScore values of 0.8376 to 0.8550, well above the threshold, and the four identified patterns are stylistic rather than semantic transformations. Human evaluation of actual attack outputs remains important future work. f) Generalizability and Model Selection: While we in- stantiate our framework on misinformation detection, the approach is domain-agnostic. Any system that (a) accepts natural language input, (b) processes it through multiple NL stages, and (c) returns a discrete decision is a candidate for adversarial exploitation. The two-agent architecture and prompt optimization mechanism require no domain-specific adaptation; only the rewriting constraints may need recalibra- tion. We selected GPT-4o as the attack model for its strong instruction-following and generation quality; the framework architecture is model-agnostic and could use any sufficiently capable LLM. GPT-4o-mini serves as the coherence evaluator because coherence checking is a simpler task that does not require the full model’s capabilities, reducing cost without sacrificing evaluation quality. VII. LIMITATIONS While our framework demonstrates effective adversarial exploitation of black-box NLP pipelines, several limitations warrant acknowledgment. First, the semantic equivalence validation relies in part on a GPT-4o-based binary check from the same model family as the Attacker Agent. Although two independent embedding-based measures (MPNet and BERTScore) provide cross-architecture validation, and thresholds were calibrated against human judg- ments on 200 pairs with Fleiss’ Kappa of 1.0 (coherence) and 0.610 (semantic equivalence), the human evaluation did not cover actual successful adversarial rewrites. A comprehensive human evaluation of attack outputs would quantify the false- positive rate of the constraint validation module. Second, our evasion rates are point estimates from a single experimental run. The 95% Wilson confidence intervals cap- ture sampling variability but do not account for the additional stochasticity introduced by LLM generation with temperature- based sampling. Multi-seed evaluation would provide a more complete picture of result stability. Third, our evaluation uses only the LIAR-New dataset [54] of political statements from PolitiFact. Although the claims span diverse policy domains and the attack framework is domain-agnostic, generalization to structurally different datasets such as FEVER [66] and AVERITEC [67] should be validated empirically. Similarly, evaluation is limited to evidence-based misinformation detection; validation across other multi-stage domains (RAG-based question answering, tool-augmented LLM applications) remains important future work. The vulnerability spectrum we observe appears driven by pipeline architecture rather than claim content, but this hypothesis requires direct experimental confirmation. Fourth, we do not evaluate cross-pipeline transferability of adversarial rewrites. Determining whether a rewrite crafted to evade one pipeline also evades others would reveal shared ver- sus pipeline-specific vulnerabilities. Additionally, the frame- work currently targets pipelines with binary outputs; extending to multi-class or free-text output spaces requires adapting the feedback mechanism. Fifth, the four exploitation patterns are described post- hoc through aggregate statistics and their stage attributions are correlational. Controlled ablation experiments (e.g., con- straining the rewriter to produce only hedging-based or only complexity-based rewrites) would establish causal attribution and quantify per-pattern contributions. Sixth, the framework depends on commercial LLM APIs (GPT-4o) that may change over time. Model updates, safety filter modifications, or API deprecation could affect repro- ducibility. While the two-agent architecture and optimization strategy are model-agnostic, the specific evasion rates are tied to the model version used at evaluation time. VIII. ETHICAL CONSIDERATIONS This work presents a framework for adversarial exploitation of NLP pipelines deployed in misinformation detection. We recognize the dual-use concern and address it through delib- erate design and disclosure choices. a) Responsible Disclosure: All target systems are pub- licly available research prototypes or commercial APIs. Our evaluation used a public benchmark dataset (LIAR-New) of previously published political statements. The adversarial rewrites constitute novel adversarial content (stylistically trans- formed versions of existing claims) that could, in principle, evade deployed systems. However, they preserve the factual content of the original claims and are therefore no more or less harmful than the original misinformation from which they are derived. No novel misinformation was generated or disseminated. b) Defensive Intent: The primary motivation is to expose vulnerabilities before malicious actors discover them indepen- dently. The vulnerability spectrum and exploitation pattern analysis provide system designers with actionable intelligence for hardening their pipelines. Our pattern-informed defense demonstrates that adversarial evaluation insights translate di- rectly into protective countermeasures (up to 65.18% evasion reduction). This research is analogous to penetration testing in network security. c) Scope Limitations: The framework is deliberately constrained: the 10-query budget bounds adversarial cost, strict semantic equivalence constraints prevent transformation of claims into genuinely different (more harmful) content, and we do not release the specific system prompts or provide a turnkey attack tool. The contribution is at the level of the two-phase architecture and boundary-search formulation. IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY11 d) Broader Impact: As multi-stage NLP systems are deployed in high-stakes domains (medical triage, financial compliance, content moderation), understanding their adver- sarial robustness becomes a matter of public interest. We advocate for adversarial red-teaming as a standard evaluation component for all multi-stage NLP systems deployed in safety- critical contexts. IX. CONCLUSION We presented a two-agent framework for exploiting black- box NLP pipelines through adversarial rewriting under budget- constrained queries. Operating with only binary feedback and a 10-query budget, the framework achieves 19.95 to 40.34% evasion on modern LLM-based misinformation de- tection pipelines (±4.3 p, 95% CI), compared to at most 3.90% for token-level baselines that rely on surrogate models because they cannot operate under our threat model. Even our non-iterative Attacker Only variant, which shares the same direct target access, achieves 14.55 to 35.92%, confirming that semantic-level rewriting provides a fundamental advantage independent of the optimization strategy. A legacy system with static lexical retrieval proves near- completely exploitable (97.02%), anchoring a vulnerability spectrum that is associated with three architectural properties: evidence retrieval mechanism, retrieval-inference coupling, and baseline accuracy. Analysis of successful rewrites reveals four exploitation patterns targeting distinct pipeline stages, and a pattern-informed text simplification defense reduces evasion by up to 65.18%. As multi-stage NLP systems are increasingly deployed in high-stakes domains, including fact-checking, medical triage, and financial compliance, principled adversarial evaluation becomes essential. The vulnerability spectrum we identify pro- vides system designers with actionable intelligence for archi- tectural hardening. Future work should validate the framework on additional NLP pipeline domains (RAG-based question answering, tool-augmented LLM applications), conduct con- trolled ablation experiments to establish causal attribution of individual exploitation patterns, and develop multi-technique defenses combining text simplification with input perturbation detection and consistency checking. SUPPLEMENTARY MATERIAL Supplementary material accompanies this paper and in- cludes: (A) representative adversarial rewrite examples that illustrate the four exploitation patterns, (B) human annotation guidelines used in the threshold calibration study, and (C) a complete walk-through of the iterative prompt optimization process across six iterations. REFERENCES [1] P. Lewis, E. Perez, A. Piktus, F. Petroni, V. Karpukhin, N. Goyal, H. K ̈ uttler, M. Lewis, W.-t. Yih, T. Rockt ̈ aschel, S. Riedel, and D. Kiela, “Retrieval-augmented generation for knowledge-intensive NLP tasks,” in Advances in Neural Information Processing Systems, vol. 33, 2020, p. 9459–9474. [2] T. Schick, J. Dwivedi-Yu, R. Dess ` ı, R. Raileanu, M. Lomeli, E. Hambro, L. Zettlemoyer, N. Cancedda, and T. Scialom, “Toolformer: Language models can teach themselves to use tools,” in Advances in Neural Information Processing Systems, vol. 36, 2023. [3] S. Yao, J. Zhao, D. Yu, N. Du, I. Shafran, K. Narasimhan, and Y. Cao, “ReAct: Synergizing reasoning and acting in language models,” in The Eleventh International Conference on Learning Representations, 2023. [Online]. Available: https://openreview.net/forum?id=WE vluYUL-X [4] L. Zheng, C. Li, X. Zhang, Y.-M. Shang, F. Huang, and H. Jia, “Evidence retrieval is almost all you need for fact verification,” in Findings of the Association for Computational Linguistics: ACL 2024.Bangkok, Thailand: Association for Computational Linguistics, Aug. 2024, p. 9274–9281. [Online]. Available: https: //aclanthology.org/2024.findings-acl.551/ [5] D. Jin, Z. Jin, J. T. Zhou, and P. Szolovits, “Is BERT really robust? a strong baseline for natural language attack on text classification and entailment,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 34, no. 05, 2020, p. 8018–8025. [6] J. Gao, J. Lanchantin, M. L. Soffa, and Y. Qi, “Black-box generation of adversarial text sequences to evade deep learning classifiers,” in 2018 IEEE Security and Privacy Workshops (SPW). IEEE, 2018, p. 50–56. [7] Y. Du, A. Bosselut, and C. D. Manning, “Synthetic disinformation attacks on automated fact verification systems,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 36, no. 10, 2022, p. 10 581–10 589. [8] P. Przybyła, E. McGill, and H. Saggion, “Know thine enemy: Adaptive attacks on misinformation detection using reinforcement learning,” in Proceedings of the 14th Workshop on Computational Approaches to Subjectivity, Sentiment, & Social Media Analysis. Bangkok, Thailand: Association for Computational Linguistics, Aug. 2024, p. 125–140. [Online]. Available: https://aclanthology.org/2024.wassa-1.11/ [9] —, “Attacking misinformation detection using adversarial examples generated by language models,” arXiv preprint arXiv:2410.20940, 2024. [Online]. Available: https://arxiv.org/abs/2410.20940 [10] M. Zaharia, O. Khattab, L. Chen, J. Q. Davis, H. Miller, C. Potts, J. Zou, M. Carbin, J. Frankle, N. Rao, and A. Ghodsi, “The shift from models to compound AI systems,” https://bair.berkeley.edu/blog/2024/ 02/18/compound-ai-systems/, Feb. 2024. [11] X. Zhou and R. Zafarani, “A survey of fake news: Fundamental theories, detection methods, and opportunities,” ACM Computing Surveys, vol. 53, no. 5, p. 1–40, 2020. [12] R. Singal, P. Patwa, P. Patwa, A. Chadha, and A. Das, “Evidence- backed fact checking using RAG and few-shot in-context learning with LLMs,” in Proceedings of the Seventh Fact Extraction and VERification Workshop (FEVER).Miami, Florida, USA: Association for Computational Linguistics, Nov. 2024, p. 91–98. [Online]. Available: https://aclanthology.org/2024.fever-1.10/ [13] M. Alzantot, Y. Sharma, A. Elgohary, B.-J. Ho, M. Srivastava, and K.-W. Chang, “Generating natural language adversarial examples,” in Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing.Brussels, Belgium: Association for Computational Linguistics, 2018, p. 2890–2896. [Online]. Available: https://aclanthology.org/D18-1316/ [14] R. Maheshwary, S. Maheshwary, and V. Pudi, “A strong baseline for query efficient attacks in a black box setting,” in Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing. Online and Punta Cana, Dominican Republic: Association for Computational Linguistics, 2021, p. 8396–8409. [Online]. Available: https://aclanthology.org/2021.emnlp-main.661/ [15] S. Garg and G. Ramakrishnan, “BAE: BERT-based adversarial examples for text classification,” in Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing.Online: Association for Computational Linguistics, 2020, p. 6174–6181. [Online]. Available: https://aclanthology.org/2020.emnlp-main.498/ [16] L. Li, R. Ma, Q. Guo, X. Xue, and X. Qiu, “BERT-ATTACK: Adversarial attack against BERT using BERT,” in Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing.Online: Association for Computational Linguistics, 2020, p. 6193–6202. [Online]. Available: https://aclanthology.org/2020. emnlp-main.500/ [17] B. Wang, C. Xu, X. Liu, Y. Cheng, and B. Li, “SemAttack: Natural textual attacks via different semantic spaces,” in Findings of the Association for Computational Linguistics: NAACL 2022. Seattle, United States: Association for Computational Linguistics, 2022, p. 176–205. [Online]. Available: https://aclanthology.org/2022. findings-naacl.14/ IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY12 [18] M. Ye, J. Chen, C. Miao, T. Wang, and F. Ma, “LeapAttack: Hard- label adversarial attack on text via gradient-based optimization,” in Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining. ACM, 2022, p. 2307–2315. [19] D. Li, Y. Zhang, H. Peng, L. Chen, C. Brockett, M.-T. Sun, and B. Dolan, “Contextualized perturbation for textual adversarial attack,” in Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies.Online: Association for Computational Linguistics, 2021, p. 5053–5069. [Online]. Available: https://aclanthology.org/ 2021.naacl-main.400/ [20] J.Li,S.Ji,T.Du,B.Li,andT.Wang,“TextBugger: Generating adversarial text against real-world applications,” in Proceedingsofthe26thAnnualNetworkandDistributed SystemSecuritySymposium(NDSS).InternetSociety,2019. [Online].Available:https://w.ndss-symposium.org/ndss-paper/ textbugger-generating-adversarial-text-against-real-world-applications/ [21] J. Morris, E. Lifland, J. Y. Yoo, J. Grigsby, D. Jin, and Y. Qi, “TextAttack: A framework for adversarial attacks, data augmentation, and adversarial training in NLP,” in Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing: System Demonstrations.Online: Association for Computational Linguistics, 2020, p. 119–126. [Online]. Available: https://aclanthology.org/2020. emnlp-demos.16/ [22] R. Maheshwary, S. Maheshwary, and V. Pudi, “Generating natural language attacks in a hard label black box setting,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 35, no. 15, 2021, p. 13 525–13 533. [23] M. Ye, C. Miao, T. Wang, and F. Ma, “TextHoaxer: Budgeted hard-label adversarial attacks on text,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 36, no. 4, 2022, p. 3877–3884. [24] M. Ye, J. Chen, C. Miao, H. Liu, T. Wang, and F. Ma, “PAT: Geometry- aware hard-label black-box adversarial attacks on text,” in Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining. ACM, 2023, p. 3093–3104. [25] H.Liu,Z.Xu,X.Zhang,F.Zhang,F.Ma,H.Chen, H.Yu,andX.Zhang,“HQA-Attack:Towardhighquality black-box hard-label adversarial attack on text,” in Advances in Neural Information Processing Systems, vol. 36, 2023. [Online]. Available:https://proceedings.neurips.c/paper files/paper/2023/hash/ a124b5e7385d35e5c8ad05d192106e19-Abstract-Conference.html [26] H. Zhu, Q. Zhao, W. Shang, Y. Wu, and K. Liu, “LimeAttack: Local explainable method for textual hard-label adversarial attack,” in Proceed- ings of the AAAI Conference on Artificial Intelligence, vol. 38, no. 17, 2024, p. 19 759–19 767. [27] S. Qiu, Q. Liu, S. Zhou, M. Gou, Y. Zeng, Z. Zhang, and Z. Wu, “Hard label adversarial attack with high query efficiency against NLP models,” Scientific Reports, vol. 15, p. 9378, 2025. [28] Z. Liu, X. Xiong, Y. Li, Y. Yu, J. Lu, S. Zhang, and F. Xiong, “HyGloadAttack: Hard-label black-box textual adversarial attacks via hybrid optimization,” Neural Networks, vol. 178, p. 106461, 2024. [29] X. Hu, G. Liu, B. Zheng, L. Zhao, Q. Wang, Y. Zhang, and M. Du, “FastTextDodger: Decision-based adversarial attack against black-box NLP models with extremely high efficiency,” IEEE Transactions on Information Forensics and Security, vol. 19, p. 3553–3568, 2024. [30] H. Peng, S. Guo, D. Zhao, X. Zhang, J. Han, S. Ji, X. Yang, and M.- H. Zhong, “TextCheater: A query-efficient textual adversarial attack in the hard-label setting,” IEEE Transactions on Dependable and Secure Computing, vol. 21, no. 4, p. 3901–3916, 2024. [31] H. Liu, Z. Xu, X. Zhang, X. Xu, F. Zhang, F. Ma, H. Chen, H. Yu, and X. Zhang, “SSPAttack: A simple and sweet paradigm for black- box hard-label textual adversarial attack,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 37, no. 11, 2023, p. 13 228– 13 235. [32] E. Perez, S. Huang, F. Song, T. Cai, R. Ring, J. Aslanides, A. Glaese, N. McAleese, and G. Irving, “Red teaming language models with language models,” in Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing.Abu Dhabi, United Arab Emirates: Association for Computational Linguistics, 2022, p. 3419– 3448. [Online]. Available: https://aclanthology.org/2022.emnlp-main. 225/ [33] A. Zou, Z. Wang, N. Carlini, M. Nasr, J. Z. Kolter, and M. Fredrikson, “Universal and transferable adversarial attacks on aligned language models,” arXiv preprint arXiv:2307.15043, 2023. [34] X. Xu, K. Kong, N. Liu, L. Cui, D. Wang, J. Zhang, and M. Kankanhalli, “An LLM can fool itself: A prompt-based adversarial attack,” in The Twelfth International Conference on Learning Representations, 2024. [Online]. Available: https://openreview.net/forum?id=VVgGbB9TNV [35] V. S. Sadasivan, S. Saha, G. Sriramanan, P. Kattakinda, A. Chegini, and S. Feizi, “Fast adversarial attacks on language models in one GPU minute,” in Proceedings of the 41st International Conference on Machine Learning, 2024. [36] K. Greshake, S. Abdelnabi, S. Mishra, C. Endres, T. Holz, and M. Fritz, “Not what you’ve signed up for: Compromising real-world LLM- integrated applications with indirect prompt injection,” in Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security. ACM, 2023. [37] W. Zou, R. Geng, B. Wang, and J. Jia, “PoisonedRAG: Knowledge corruption attacks to retrieval-augmented generation of large language models,” in 34th USENIX Security Symposium (USENIX Security 25). USENIX Association, 2025, p. 3827–3844. [38] H. Chaudhari, G. Severi, J. Abascal, M. Jagielski, C. A. Choquette-Choo, M. Nasr, C. Nita-Rotaru, and A. Oprea, “Phantom: General backdoor attacks on retrieval augmented language generation,” arXiv preprint arXiv:2405.20485, 2024. [39] P. Cheng, Y. Ding, T. Ju, Z. Wu, W. Du, P. Yi, Z. Zhang, and G. Liu, “TrojanRAG: Retrieval-augmented generation can be backdoor driver in large language models,” arXiv preprint arXiv:2405.13401, 2024. [40] S. Abdelnabi and M. Fritz, “Fact-Saboteurs: A taxonomy of evidence manipulation attacks against fact-verification systems,” in 32nd USENIX Security Symposium (USENIX Security 23).Anaheim, CA: USENIX Association, 2023, p. 6719–6736. [41] J. Thorne, A. Vlachos, C. Christodoulopoulos, and A. Mittal, “Evaluating adversarial attacks against multiple fact verification systems,” in Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing.Hong Kong, China: Association for Computational Linguistics, 2019, p. 2944–2953. [Online]. Available: https://aclanthology.org/D19-1292/ [42] S. Goyal, S. Doddapaneni, M. M. Khapra, and B. Ravindran, “A survey of adversarial defenses and robustness in NLP,” ACM Computing Surveys, vol. 55, no. 14s, p. 1–39, 2023. [43] M. Ye, C. Gong, and Q. Liu, “SAFER: A structure-free approach for certified robustness to adversarial word substitutions,” in Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics.Online: Association for Computational Linguistics, 2020, p. 3465–3475. [Online]. Available: https://aclanthology.org/2020. acl-main.317/ [44] J. Zeng, J. Xu, X. Zheng, and X. Huang, “Certified robustness to text adversarial attacks by randomized [MASK],” Computational Linguistics, vol. 49, no. 2, p. 395–427, Jun. 2023. [Online]. Available: https://aclanthology.org/2023.cl-2.5/ [45] L. Li, D. Song, and X. Qiu, “Text adversarial purification as defense against adversarial attacks,” in Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers).Toronto, Canada: Association for Computational Linguistics, Jul. 2023, p. 338–350. [Online]. Available: https://aclanthology.org/2023.acl-long.20/ [46] A. Gupta, C. Blum, T. Choji, Y. Fei, S. Shah, A. Vempala, and V. Srikumar, “Don’t retrain, just rewrite: Countering adversarial perturbations by rewriting text,” in Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers).Toronto, Canada: Association for Computational Linguistics, Jul. 2023. [Online]. Available: https://aclanthology.org/ 2023.acl-long.781/ [47] H. Pei, J. Jia, W. Guo, B. Li, and D. Song, “TextGuard: Provable defense against backdoor attacks on text classification,” inProceedingsoftheNetworkandDistributedSystem SecuritySymposium(NDSS).InternetSociety,2024. [Online].Available:https://w.ndss-symposium.org/ndss-paper/ textguard-provable-defense-against-backdoor-attacks-on-text-classification/ [48] N. Reimers and I. Gurevych, “Sentence-BERT: Sentence embeddings using Siamese BERT-networks,” in Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing. Hong Kong, China: Association for Computational Linguistics, 2019, p. 3982–3992. [Online]. Available: https://aclanthology.org/D19-1410/ [49] HuggingFace,“Sentencetransformers,”https://huggingface.co/ sentence-transformers, 2023. [50] P. He, X. Liu, J. Gao, and W. Chen, “DeBERTa: Decoding-enhanced BERT with disentangled attention,” in International Conference on Learning Representations, 2021. [Online]. Available: https: //openreview.net/forum?id=XPZIaotutsD IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY13 [51] HuggingFace, “Deberta-xlarge-mnli,” https://huggingface.co/microsoft/ deberta-xlarge-mnli, 2021. [52] OpenAI, “GPT-4o mini: Advancing cost-efficient intelligence,” https: //openai.com/index/gpt-4o-mini-advancing-cost-efficient-intelligence/, July 2024. [53] J. R. Landis and G. G. Koch, “The measurement of observer agreement for categorical data,” Biometrics, vol. 33, no. 1, p. 159–174, 1977. [54] K. Pelrine, A. Imouza, C. Thibault, M. Reksoprodjo, C. Gupta, J. Christoph, J.-F. Godbout, and R. Rabbany, “Towards reliable misinformation mitigation: Generalization, uncertainty, and GPT-4,” in Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing.Singapore: Association for Computational Linguistics, Dec. 2023, p. 6399–6429. [Online]. Available: https: //aclanthology.org/2023.emnlp-main.395/ [55] W. Y. Wang, “Liar, Liar pants on Fire”: A new benchmark dataset for fake news detection,” in Proceedings of the 55th Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers).Vancouver, Canada: Association for Computational Linguistics, Jul. 2017, p. 422–426. [Online]. Available: https://aclanthology.org/P17-2067/ [56] A. Yang, B. Yang, B. Hui, B. Zheng, B. Yu, C. Zhou, C. Li, C. Li, D. Liu, F. Huang, G. Dong, H. Wei, H. Lin, J. Tang, J. Wang, J. Yang, J. Tu, J. Zhang, J. Ma, J. Xu, J. Zhou, J. Bai, J. He, J. Lin, K. Dang, K. Lu, K.-Y. Chen, K. Yang, M. Li, M. Xue, N. Ni, P. Zhang, P. Wang, R. Peng, R. Men, R. Gao, R. Lin, S. Wang, S. Bai, S. Tan, T. Zhu, T. Li, T. Liu, W. Ge, X. Deng, X. Zhou, X. Ren, X. Zhang, X. Wei, X. Ren, Y. Fan, Y. Yao, Y. Zhang, Y. Wan, Y. Chu, Z. Cui, Z. Zhang, and Z.-W. Fan, “Qwen2 technical report,” arXiv preprint arXiv:2407.10671, 2024. [57] P. Wang, S. Bai, S. Tan, S. Wang, Z. Fan, J. Bai, K. Chen, X. Liu, J. Wang, W. Ge, Y. Fan, K. Dang, M. Du, X. Ren, R. Men, D. Liu, C. Zhou, J. Zhou, and J. Lin, “Qwen2-VL: Enhancing vision-language model’s perception of the world at any resolution,” arXiv preprint arXiv:2409.12191, 2024. [58] N. Hassan, G. Zhang, F. Arslan, J. Caraballo, D. Jimenez, S. Gawsane, S. Hasan, M. Joseph, A. Kulkarni, A. K. Nayak, V. Sable, C. Li, and M. Tremayne, “ClaimBuster: The first-ever end-to-end fact-checking system,” Proceedings of the VLDB Endowment, vol. 10, no. 12, p. 1945–1948, 2017. [59] iDIR Lab, University of Texas at Arlington, “ClaimBuster API docu- mentation,” https://idir.uta.edu/claimbuster/, 2017. [60] Perplexity AI, “Sonar models documentation,” https://docs.perplexity.ai/ getting-started/models/models/sonar, 2025. [61] —, “Introducing PPLX online LLMs,” https://w.perplexity.ai/hub/ blog/introducing-pplx-online-llms, 2024. [62] Y. Liu, M. Ott, N. Goyal, J. Du, M. Joshi, D. Chen, O. Levy, M. Lewis, L. Zettlemoyer, and V. Stoyanov, “RoBERTa: A robustly optimized BERT pretraining approach,” arXiv preprint arXiv:1907.11692, 2019. [63] Hugging Face, “RoBERTa-base model card,” https://huggingface.co/ roberta-base, 2024. [64] A. Holtzman, J. Buys, L. Du, M. Forbes, and Y. Choi, “The curious case of neural text degeneration,” in International Conference on Learning Representations, 2020. [Online]. Available: https: //openreview.net/forum?id=rygGQyrFvH [65] J. Schulman, F. Wolski, P. Dhariwal, A. Radford, and O. Klimov, “Prox- imal policy optimization algorithms,” arXiv preprint arXiv:1707.06347, 2017. [66] J. Thorne, A. Vlachos, C. Christodoulopoulos, and A. Mittal, “FEVER: a large-scale dataset for fact extraction and VERification,” in Proceedings of the 2018 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long Papers).New Orleans, Louisiana: Association for Computational Linguistics, Jun. 2018, p. 809–819. [Online]. Available: https://aclanthology.org/N18-1074/ [67] M. Schlichtkrull, Z. Guo, and A. Vlachos, “AVeriTeC: A dataset for real-world claim verification with evidence from the web,” in Advances in Neural Information Processing Systems, vol. 36, 2023.