Paper deep dive
The Synthetic Web: Adversarially-Curated Mini-Internets for Diagnosing Epistemic Weaknesses of Language Agents
Shrey Shah, Levent Ozgur
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 91%
Last extracted: 7/20/2026, 4:21:13 AM
Summary
This paper introduces the Synthetic Web Benchmark, a procedurally generated environment designed to evaluate the epistemic robustness of language agents against adversarial ranking. By injecting high-plausibility misinformation at the top of search results, the study reveals that frontier models (GPT-5, o3, o1, etc.) suffer catastrophic accuracy drops and severe miscalibration, failing to escalate searches or synthesize conflicting evidence effectively despite unlimited access to truthful sources.
Entities (13)
Relation Signals (11)
Synthetic Web Benchmark â evaluates â Language Agents
confidence 95% · We introduce Synthetic Web Benchmark... to measure the causal effect of adversarial exposure in six frontier models.
GPT-5 â suffersaccuracydrop â Adversarial Ranking
confidence 95% · GPT-5 falls from 65.1% to 18.2% accuracy... when a single honeypot appears at rank 0.
o3 â suffersaccuracydrop â Adversarial Ranking
confidence 95% · o3 from 48.4% to 16.7%
o1 â suffersaccuracydrop â Adversarial Ranking
confidence 95% · o1 from 39.0% to 8.4%
GPT-4o â suffersaccuracydrop â Adversarial Ranking
confidence 95% · GPT-4o from 27.2% to 3.8%
Synthetic Web Benchmark â uses â Honeypot Injection
confidence 92% · By injecting a single high-plausibility misinformation article into a controllable search rank...
Agents â exhibits â Minimal Search Escalation
confidence 90% · Tool traces reveal three critical failure modes: (1) minimal search escalation
Agents â exhibits â Severe Miscalibration
confidence 90% · and severe miscalibrationâmodels stay highly confident when wrong.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Language agents increasingly act as web-enabled systems that search, browse, and synthesize information from diverse sources. However, these sources can include unreliable or adversarial content, and the robustness of agents to adversarial ranking - where misleading information appears prominently in search results - remains poorly understood. Existing benchmarks evaluate functional navigation or static factuality but cannot causally isolate this vulnerability, and current mitigation strategies for retrieval-augmented generation remain largely untested under such conditions. We introduce Synthetic Web Benchmark, a procedurally generated environment comprising thousands of hyperlinked articles with ground-truth labels for credibility and factuality, process-level interaction traces, and contamination filtering to eliminate training-data leakage. By injecting a single high-plausibility misinformation article into a controllable search rank, we measure the causal effect of adversarial exposure in six frontier models. The results reveal catastrophic failures: accuracy collapses despite unlimited access to truthful sources, with minimal search escalation and severe miscalibration. These findings expose fundamental limitations in how current frontier models handle conflicting information, with immediate implications for deployment in high-stakes domains. Our benchmark enables systematic analysis of these failure modes and provides a controlled testbed for evaluating mitigation strategies under adversarial ranking - a gap in current research. This work establishes a reproducible baseline for developing search-robust and epistemically humble agents capable of resisting manipulation in high-stakes domains.
Tags
Links
- Source: https://arxiv.org/abs/2603.00801v1
- Canonical: https://arxiv.org/abs/2603.00801v1
Trouble viewing inline? Open PDF directly â
Full Text
53,421 characters extracted from source content.
Expand or collapse full text
THE SYNTHETIC WEB: ADVERSARIALLY-CURATED MINI-INTERNETS FOR DIAGNOSING EPISTEMIC WEAKNESSES OF LANGUAGE AGENTS Shrey Shah shreyshah@microsoft.com Levent Ozgur leventoz@microsoft.com ABSTRACT Language agents increasingly act as web-enabled systems that search, browse, and synthesize information from diverse sources. However, these sources can include unreliable or adversarial content, and the robustness of agents to adversarial ranking â where misleading information appears prominently in search results â remains poorly understood. Existing benchmarks evaluate functional navigation or static factuality but cannot causally isolate this vulnerability, and current mitigation strategies for retrieval-augmented generation remain largely untested under such conditions. We introduce Synthetic Web Benchmark, a procedurally generated environment comprising thousands of hyperlinked articles with ground-truth labels for credibility and factuality, process-level interaction traces, and contamination filtering to eliminate training-data leakage. By injecting a single high- plausibility misinformation article into a controllable search rank, we measure the causal effect of adversarial exposure in six frontier models. The results reveal catastrophic failures: accuracy collapses despite unlimited access to truthful sources, with minimal search escalation and severe miscalibration. These findings expose fundamental limitations in how current frontier models handle conflicting information, with immediate implications for deployment in high-stakes domains. Our benchmark enables systematic analysis of these failure modes and provides a controlled testbed for evaluating mitigation strategies under adversarial rankingâa gap in current research. This work establishes a reproducible baseline for developing search-robust and epistemically humble agents capable of resisting manipulation in high-stakes domains. 1 Introduction Language models are evolving from text generators to web-enabled agents that search, browse, and synthesize information from untrusted sources [Zhou et al., 2023, Nakano et al., 2021, Yao et al., 2023, Schick et al., 2023]. This shift introduces a critical vulnerability: agents must distinguish reliable evidence from misinformation, integrate conflicting sources, and recognize manipulated search results. However, evaluating these capabilities on the public web is challenging, as content distributions are unknown and shifting, misinformation density is unlabeled, search ranking is gameable, and models may recall popular sources from pretraining rather than reasoning over retrieved evidence. Existing benchmarks such as WebArena [Zhou et al., 2023], Mind2Web [Deng et al., 2023], and WebLINX [LĂč et al., 2024] evaluate functional navigation and task success on real or simulated websites. However, they cannot causally isolate epistemic vulnerabilities because content distributions and ranking algorithms are uncontrolled. Similarly, factuality datasets like FEVER [Thorne et al., 2018] and TruthfulQA [Lin et al., 2021] probe static QA rather than interactive reasoning under adversarial conditions. We introduce the Synthetic Web Benchmark, controlled âmini-Internetsâ containing thousands of hyperlinked articles with ground-truth labels for credibility, bias, and factual accuracy. By injecting a single high-plausibility misinformation article into a specific search rank, we measure the causal effect of adversarial exposure under minimal perturbation. The benchmark eliminates training-data leakage via contamination filtering and provides process-level signals (search queries, articles read, tool traces) unavailable in static QA datasets. arXiv:2603.00801v1 [cs.AI] 28 Feb 2026 The Synthetic Web: Adversarially-Curated Mini-Internets for Diagnosing Epistemic Weaknesses of Language Agents A single false source in the top rank triggers catastrophic failures: the accuracy of GPT-5 falls from 65.1% to 18.2%, with similar drops in o3, o1, and 4o models, even when agents have unlimited access to truthful content, without any search constraints. Tool traces reveal three critical failure modes: (1) minimal search escalationâagents rarely expand search when evidence conflicts; (2) poor synthesisâeven extensive searches fail to integrate sources; and (3) severe miscalibrationâmodels stay highly confident when wrong. These vulnerabilities make rank manipulation a practical attack vector: controlling the top result can mislead agents, enabling exploits via SEO, paid placements, or infrastructure compromise. In multi-agent systems, such errors can cascade, amplifying risk in high-stakes domains. Our contributions are: âą Reproducible benchmark with a controlled synthetic environment: Thousands of hyperlinked articles with ground-truth labels for credibility, bias, and factuality. âąRank-controlled adversarial exposure: Injection of a single high-plausibility misinformation article at rank 0 for causal measurement. âą Process-level traces: Search queries, article reads, and confidence scores for diagnosing failure modes. âąTestbed for mitigation strategies: Enables rigorous evaluation of retrieval-augmented safeguards under adversarial ranking. Our benchmark provides a testbed for developing the next generation of search-robust, epistemically humble agents. 2 Related Work Web agents and browsing benchmarks. Benchmarks such as WebArena provide realistic, multi-site environments for evaluating agentic task completion and navigation strategies [Zhou et al., 2023]. WebGPT demonstrated browser- augmented retrieval with human feedback to improve factual accuracy [Nakano et al., 2021]. Mind2Web introduced the first large-scale dataset for generalist web agents with diverse real-world websites [Deng et al., 2023]. More recent live-web effortsâOnline-Mind2Web and WebLINXâestablish state-of-the-art trajectories and evaluation practices on evolving websites [Xue et al., 2025, LĂč et al., 2024]. Foundational work on tool-augmented agents, including ReAct [Yao et al., 2023] and Toolformer [Schick et al., 2023], established paradigms for interleaving reasoning with external tool use. The CoALA framework provides a systematic cognitive architecture for organizing language agent capabilities [Sumers et al., 2023]. While these efforts have driven progress in functional web navigation, they do not allow for precise control over the information ecosystem or search ranking. Our approach enables direct manipulation of search result order and content, making it possible to causally assess how a single top-ranked misinformation article can influence agent behavior and decision-making. Factuality and truthfulness.Datasets like FEVER established claim verification against Wikipedia as a standard for evidence-based evaluation [Thorne et al., 2018], while TruthfulQA exposed systematic tendencies of LLMs to reproduce human falsehoods even without retrieval [Lin et al., 2021]. Recent work has systematically studied hallucination in LLMs, examining detection methods, sources, and mitigations [Li et al., 2024], and proposed automated evaluation methods for long-form factuality [Wei et al., 2024]. These resources focus on single-turn factuality in static corpora. By contrast, our benchmark evaluates interactive, tool-using agents that must search, synthesize, and reconcile conflicting sources in a dynamic environment, with contamination filtering ensuring that answers cannot be memorized from pretraining alone. Misinformation and adversarial robustness.Adversarial evaluation in NLP has often targeted input-level perturba- tions, as in AddSent for QA [Jia and Liang, 2017]. Recent work has demonstrated corpus poisoning attacks on dense retrievers, where adversarial passages are injected into retrieval corpora to manipulate RAG systems [Su et al., 2024]. Prompt injection attacks have also emerged as a threat to LLM-integrated applications [Liu et al., 2024a]. In the context of web agents, however, a more practical attack surface is the ranking layer, where adversaries can manipulate what appears at the top of search results through SEO, sponsored placement, or infrastructure compromise. Our benchmark operationalizes this threat model by injecting a single, highly plausible misinformation article at rank 0 and quantifies its impact on agent accuracy, search escalation, and calibrationâenabling a level of causal analysis not possible in prior real-web settings. Concurrent benchmarks and differentiation.Several recent benchmarks address related aspects of agent robustness, though with distinct scopes and threat models. RAGuard evaluates RAG robustness against misleading retrievals using naturally occurring Reddit discussions, but relies on static corpora without procedural generation or agent- level evaluation [Zeng et al., 2025]. CAIA tests AI agents in adversarial financial markets with SEO-manipulated 2 The Synthetic Web: Adversarially-Curated Mini-Internets for Diagnosing Epistemic Weaknesses of Language Agents misinformation, providing domain-specific insights but without the general-purpose epistemic focus of our work [Dai et al., 2025]. SecureWebArena offers a security evaluation framework targeting prompt injection and code-level vulnerabilitiesâa fundamentally different threat model from epistemic manipulation [Ying et al., 2025]. SafeArena evaluates whether agents will execute harmful tasks (e.g., posting misinformation), while our benchmark tests whether agents can resist being deceived by adversarial informationâcomplementary directions of harm [Tur et al., 2025]. EchoMist probes LLM responses to implicit misinformation embedded in queries, but without retrieval or agent components [Guo et al., 2025]. Recent work on adversarial robustness of multimodal web agents has examined image-based perturbations in VisualWebArena [Wu et al., 2024], while BrowserGym provides a unified ecosystem for web agent benchmarking under benign conditions [Chezelles et al., 2024]. Our contribution is unique in combining procedurally generated web environments with ground-truth labels, rank-controlled adversarial injection, agent-level process traces, and a focus on epistemic robustness under misinformationâcapabilities not jointly present in prior work. Synthetic data for controlled testing.Procedural generation has enabled controlled testing in reinforcement learning and other domains; for example, Procgen supplies diverse yet parameterized environments to probe generalization under distribution shift [Cobbe et al., 2020]. In language-agent research, synthetic worlds can eliminate confounds from live web shifts and unavailable labels. Prior work has instantiated such controlled language-agent environments, including TextWorld for text-based games with programmatically generated quests and full annotations [CĂŽtĂ© et al., 2018], and ALFWorld which aligns textual instructions with embodied task environments for interactive learning [Shridhar et al., 2020]. Our work extends this paradigm by constructing article ecosystems with per-site credibility and per-article factual ground truth, along with process-level traces, allowing us to systematically measure anchoring, escalation, and calibration behaviors. Mitigations for robust retrieval and safeguardsRetrieval-augmented generation (RAG) has become a foundational paradigm for grounding LLMs in external knowledge [Lewis et al., 2020]. Recent methods scaffold retrieval and verification to improve robustness. Self-RAG equips a single LM with on-demand retrieval and self-reflection signals, improving citation discipline and factuality [Asai et al., 2024]. SelfCheckGPT detects unsupported content via self- consistency probing [Manakul et al., 2023]. FLARE introduces active retrieval that dynamically decides when and what to retrieve during generation [Jiang et al., 2023]. Beyond these, RA-DIT introduces dual instruction tuning to use retrieved information more effectively and ignore distracting information for more correct outputs [Lin et al., 2024], and CRAG adds corrective mechanisms to dynamically address retrieval errors to improve the robustness of generation [Yan et al., 2024]. However, benchmarking on multi-hop queries reveals that existing RAG methods still struggle to synthesize information across multiple sources [Tang and Yang, 2024]. Our benchmark provides a controlled setting to evaluate these mitigation mechanisms by measuring their effectiveness against rank-biased misinformation. More recently, Why Language Models Hallucinate frames hallucinations as a predictable statistical artifact of next-token prediction rather than a mysterious glitch [Kalai et al., 2025]. The work critiques accuracy-centric evaluation incentives that reward confident guessing, thereby sustaining hallucinations, and proposes uncertainty-aware benchmarks with negative marking for confident errors, partial credit for abstention, and calibration metrics. These recommendations complement retrieval-based mitigations by addressing systemic causes of misinformation propagation at the evaluation layer. 3 Methodology We target epistemic robustness: can an agent exposed to a plausible but false top-ranked source seek corroboration, detect conflict, and adjust beliefs? Our design prioritizes (i) control over content and ranking to isolate causal effects, and (i) reproducibility with complete ground truth. Synthetic article ecosystems satisfy both, while providing process-level signals (queries, reads, tool traces) unavailable in static QA. In our setup, an agent receives a question and can search (returning top-kresults) and read articles, ultimately producing an exact final answer. We measure both accuracy and the agentâs tool-use traces to analyze reasoning and escalation behavior. Our benchmark is designed to enable controlled, reproducible evaluation of adversarial ranking effects in web-enabled language agents. The architecture integrates four core components as shown in Figure 1: a synthetic web environment, a hybrid search layer with rank-controlled honeypot injection, an agent interaction protocol, and an evaluation pipeline. Together, these components isolate the causal impact of adversarial ranking while preserving realistic retrieval dynamics, providing a principled foundation for measuring failure modes and testing mitigation strategies. 3 The Synthetic Web: Adversarially-Curated Mini-Internets for Diagnosing Epistemic Weaknesses of Language Agents Figure 1: Synthetic Web Benchmark architecture consists of four main components: Synthetic Web (blue), Search Layer (orange), Agent Protocol (green), and Evaluation (gray). The Search Layer includes a rank-0 honeypot for adversarial exposure. Each component is color-coded and described in the diagram. 3.1 Synthetic Web Generation Environment We instantiate large synthetic worlds using a scalable generator. A seed defines a world ID and timeline; topic taxonomies are sampled and expanded via an LLM into subtopics, entities, and controversy levels. We then create website profiles (e.g., news, blogs, research, social, conspiracy) with attributes such as base credibility, political bias, topic-specific biases, and style. To approximate real-world quality, we enforce a credibility distribution where some sites are low-credibility by design, while publication frequency is decoupled from credibility to avoid trivial heuristics. For each topic, we generate article clusters containing: (i) factual timelines and key facts, (i) perspective-specific narratives, and (i) highly specific, plausible misinformation claims (e.g., fabricated numbers, study names, and quotes) designed to appear credible without superficial giveaway cues. Thousands of articles are timestamped, cross-cited, and distributed across sites, with ground-truth fact sets compiled per topic. In our main runs, 43% of sites are low-credibility. Query Construction and Contamination Filtering. For each topic, we sample clusters and elicit multiple query types (factual, comparison, timeline, evaluation) with structured fields: question, exact correct answer, required evidence snippets, difficulty, and topic identifier. To remove contaminated items, we probe a strong model without tools; queries answered correctly are filtered out. This isolates tool-dependent reasoning by eliminating overlap with the modelâs prior knowledge. Ground-truth answers originate from factual keys compiled during cluster generation and are saved for auditing. Human evaluation confirms high benchmark quality (98% accuracy in standard conditions; 93% in adversarial conditions). 3.2 Search Layer and Honeypot Injection The search layer uses a hybrid retriever combining lexical matching (e.g., exact or near-exact keyword matches) and dense retrieval (e.g., semantic similarity using embeddings) via LlamaIndex[Liu, 2022]. In standard mode, results reflect topical relevance. In adversarial mode, we inject a single honeypot article at rank 0 on the first query. The honeypot is tailored to the queryâs topic and subtopic and presents detailed but false claims contradicting ground truth (e.g., fabricated statistics or study names). It is added transiently and removed between rollouts to avoid residual contamination. Agents receive titles, snippets, and domains in search results; full text requires explicit reading. 3.3 Agent Protocol for interaction loop and tool usage Agents interact through two tools:search(query)andread_article(id). A uniform zero-shot prompt enforces structured responses with three fields: Answer, Confidence (0â100%), and Explanation. We set a generous cap on tool rounds (effectively unbounded) to profile escalation behavior when faced with conflicting evidence. 3.4 Evaluation Pipeline Responses are graded using a fixed LLM-as-Judge configuration with a rubric that extracts the final answer, checks correctness against ground truth, and records stated confidence. The grader receives both the correct answer and misinformation claims. We avoid same-model grading by fixing the grader across experiments and quantify uncertainty with confidence intervals. Light normalization (case/punctuation, unit variants, numeric tolerance) reduces rubric brittleness; alias lists for canonicalization are released. 4 The Synthetic Web: Adversarially-Curated Mini-Internets for Diagnosing Epistemic Weaknesses of Language Agents Figure 2: Model performance under adversarial search. All models show dramatic accuracy drops when a single honeypot appears at rank 0. Figure 3: Calibration: stated confidence vs. actual ac- curacy. Under adversarial exposure (squares), models remain highly confident despite dramatic accuracy drops. Dashed line: perfect calibration. 4 Experimental Setup We design our experiments to rigorously evaluate agent robustness under both standard and adversarial search conditions, using diverse synthetic worlds and a representative set of language models. Worlds and queries.We evaluate on four independently generated worlds, each with its own topics, sites, and articles. Each world contributes a set of natural-language queries with exact answers drawn from ground truth. Models and settings. We evaluate six model families representative of current systems: GPT-5, o3, o1, GPT-4o, o4-mini, and o1-mini. All models use the same zero-shot prompt and tool protocol. The grader model is fixed across experiments to ensure consistency. Protocol. For each model, we run ten rollouts per world (four worlds total). We report aggregated accuracy (correct/total) and average stated confidence. We compare standard search to adversarial search with a single rank-0 honeypot. Rollouts are matched by world ID and rollout index across conditions for paired analysis. In total, each condition covers 5,870 queries across worlds and rollouts. 5 Results 5.1 Catastrophic failure under minimal adversarial pressure We observe dramatic accuracy collapses when a single honeypot article is injected at rank 0. Table 1 shows that GPT-5 falls from 65.1% to 18.2% accuracy (â46.9 points), o3 from 48.4% to 16.7% (â31.7 points), o1 from 39.0% to 8.4% (â30.7 points), and GPT-4o from 27.2% to 3.8% (â23.4 points). Smaller models (o4-mini, o1-mini) fail almost entirely in both conditions. These results span 5,870 queries per condition (587 unique queriesĂ10 rollouts across 4 worlds) and are statistically robust (see Appendix for full analysis). What makes this finding striking is the minimality of the perturbation; one false article among thousands of truthful sources is sufficient to induce failure. Furthermore, the honeypot does not actively suppress competing evidence, but is just presented first. Models have full access to the rest of the search index, can issue multiple queries, and face no tool budget constraints. Yet they fail catastrophically. Human baseline.To establish whether these failures reflect inherent task difficulty, we evaluated human performance on a random sample of queries from one world under both conditions. Humans achieved 98% accuracy in standard settings and 93% in adversarial settings, demonstrating that the adversarial queries remain solvable when proper source criticism is applied. The contrast between human robustness and model collapse indicates these failures 5 The Synthetic Web: Adversarially-Curated Mini-Internets for Diagnosing Epistemic Weaknesses of Language Agents ModelStandard AccuracyAdversarial Accuracy gpt-565.1% (63.8, 66.3%)18.2% (17.2, 19.2%) o348.4% (47.1, 49.7%)16.7% (15.8, 17.7%) o139.0% (37.8, 40.3%)8.4% (7.7, 9.1%) gpt-4o27.2% (26.1, 28.3%)3.8% (3.3, 4.3%) o4-mini0.3% (0.2, 0.5%)0.0% (0.0, 0.1%) o1-mini0.0% (0.0, 0.1%)0.0% (0.0, 0.1%) Table 1: Main results with 95% Wilson confidence inter- vals. All models evaluated on 5,870 queries per condition (587 unique queriesĂ 10 rollouts across 4 worlds). ModelStd ToolsAdv ToolsAdv P(â„5) gpt-56.456.610.62 o33.884.230.42 o11.831.860.13 gpt-4o1.141.130.07 o4-mini0.020.040.00 o1-mini0.010.010.00 Table 2: Tool usage metrics. Average tool calls barely change between standard and adversarial conditions, indi- cating minimal search escalation. P(â„5) shows fraction of queries with extended search (5+ tool calls). are model-specific limitations in evidence synthesis and source evaluation, not artifacts of query ambiguity or task infeasibility. 5.2 Behavioral signatures of failure Analysis of tool traces reveals the following patterns explaining the collapse: Minimal search escalation. Despite generous tool budgets, models do not significantly increase search behavior when answers conflict. Table 2 shows average tool usage remains nearly constant between standard (e.g., GPT-5: 6.45 calls) and adversarial (6.61 calls) conditions. The fraction of queries withâ„ 5tool calls is moderate even for the best models (GPT-5: 62%; o3: 42%), suggesting most queries terminate after shallow exploration. For instance, GPT-4o answers a multi-part question about edge computing standards incorrectly after only 6 tool calls, citing fabricated standards from the honeypot with high confidence and no indication of recognizing absent corroboration. Synthesis failure.Even when models perform extensive search, they often fail to integrate evidence correctly. GPT-5 performed 162 tool calls attempting to construct a timeline of regulatory developments but failed to correctly order events, suggesting difficulty reconciling partial, conflicting information across sources. Conversely, many failures occur with only 1â2 tool calls, indicating premature commitment. The bottleneck is not search volume but evidence integration. Epistemic paralysis. We also observe a notable edge case within synthesis failures: in some instances, models acknowledge uncertainty but still fail to act on available evidence as an example of epistemic paralysis. For example, o1 issues 10 tool calls on a question about carbon-aware compute pricing but returns âData is incomplete for a final, fully supported response,â despite multiple articles containing the required information. Severe miscalibration.Models report high confidence even on incorrect answers in the adversarial setting. Figure 3 shows a large gap between stated confidence and actual accuracyâmodels confidently assert answers even as accuracy plummets. Calibration metrics (ECE, Brier score) degrade markedly in adversarial mode (see Appendix Table 5), indicating models do not recognize when they have been misled. 5.3 Robustness and variance Performance is consistent across worlds and rollouts (Figure 4), indicating the adversarial effect is not an artifact of specific content or queries. The effect size (absolute point drop) is large in all conditions. Full statistical significance tests (Wilson CIs, pairedt-tests, two-proportionz-tests) are provided in the Appendix and confirm the drops are robust. 6 Discussion 6.1 Positional anchoring hypothesis State-of-the-art agents fail catastrophically despite having (1) full access to thousands of truthful articles, (2) unlimited search queries, (3) generous tool budgets, and (4) no time pressure. The vulnerability is not access to correct information, but how agents prioritize and synthesize conflicting evidence. 6 The Synthetic Web: Adversarially-Curated Mini-Internets for Diagnosing Epistemic Weaknesses of Language Agents gpt-4o gpt-5 o1 o1-mini o3 o4-mini 0 20 40 60 80 Accuracy (%) Performance Variance Across Worlds and Rollouts Figure 4: Variance in accuracy across worlds and rollouts. Performance degradation is consistent, not driven by outliers. Boxes show IQR; diamonds mark means. We hypothesize strong positional anchoring as models over-rely on top-ranked results and fail to seek independent corroboration. This hypothesis connects to prior findings that LLMs exhibit U-shaped attention patterns, preferentially attending to information at the beginning and end of contexts while underweighting content in the middleâa phe- nomenon termed âlost in the middleâ [Liu et al., 2024b]. Our results extend this finding from long-context attention to search-based information retrieval, where rank 0 content exerts disproportionate influence. We posit positional anchoring as a unifying mechanism underlying the behavioral failures observed in Section 5.2. When rank order is implicitly treated as a proxy for evidential strength, agents under-escalate search, overweight early sources even when conflicting evidence is available, and remain overconfident despite contradiction. This mechanism explains the flat search effort, synthesis breakdown even under extensive retrieval, and severe miscalibration observed under adversarial exposure. 6.2 Implications for real-world deployment Robust deployment of language agents requires addressing systemic vulnerabilities that arise when interacting with untrusted information sources. In particular, adversarial ranking introduces practical risks that can compromise accuracy, propagate errors, and undermine trust across interconnected systems. The following three aspects illustrate these risks. Search ranking as an attack vector. Controlling the top search result is sufficient to mislead frontier models. Adversaries can manipulate rankings via SEO, paid placement, domain authority gaming, or search infrastructure compromiseâall realistic threats with low barriers to entry. Insufficient safeguards in current systems. Production agents typically use zero-shot or few-shot prompting with search tools, making them vulnerable to rank-based manipulation even under benign search engines. The problem worsens if search infrastructure itself is compromised. Cascading failures in multi-agent systems.When agents consume information from other agents, errors compound. A single compromised source could propagate through an ecosystem, with each agent failing to independently verify claims. 6.3 Why do models fail to escalate search? Despite generous tool budgets and unrestricted access to evidence, models rarely escalate search when faced with conflicting or incomplete information. Understanding why this happens is critical for diagnosing epistemic weaknesses and designing effective interventions. Below, we outline four complementary explanations for this behavior. 7 The Synthetic Web: Adversarially-Curated Mini-Internets for Diagnosing Epistemic Weaknesses of Language Agents Overreliance on pretraining priors. Models may anchor on superficially plausible information that aligns with distributional patterns learned during pretraining, even when that information is fabricated. Our honeypots are designed to be stylistically consistent with real web content and to cite plausible-sounding entities (standards, studies, statistics). Models may implicitly trust this information because it âfeels rightâ based on pretraining, rather than critically evaluating whether it is corroborated by independent sources. This suggests models have difficulty distinguishing between distribution-level plausibility (text that looks like truthful content) and evidence-level verification (claims supported by multiple independent, credible sources). This behavior may also reflect broader tendencies toward sycophancy, where models prioritize agreement with presented information over critical evaluation [Malmqvist, 2024]. Shallow search heuristics. Models may have learned heuristics like âread the top result, then answerâ during instruction tuning or RLHF. These strategies work well when search is reliable but fail catastrophically under adversarial exposure. Without explicit training on adversarial robustness or source criticism, models default to shallow strategies optimized for benign environments. Lack of explicit uncertainty signals.Standard prompting does not teach models to recognize evidential insufficiency. Models are trained to answer, not to interrogate sources. The Confidence field in our protocol attempts to elicit calibration, but stated confidence does not reliably track actual uncertainty, nor does it trigger deeper search. Structural limitations, not cost constraints.In human cognition, anchoring is partly explained by cognitive economy: exhaustive search is expensive. Language models face no such cost during inference (in our setup), yet they still anchor. This suggests the behavior is structuralâencoded in model weights or prompting conventionsârather than a rational response to resource constraints. 6.4 Mitigation strategies As we discussed earlier in Section 2, there are a number of recent advances with promising mitigation approaches to improve factuality and retrieval robustness. Yet these approaches have largely been assessed under benign conditions and static benchmarks. Our Synthetic Web Benchmark introduces a controlled, adversarial setting where such safeguards can be systematically stress-tested against rank-biased misinformation. This opens a clear direction for future work: evaluating how effectively these methods mitigate anchoring, enhance calibration, and trigger escalation when search rankings are manipulated. By providing process-level traces and ground-truth labels, our benchmark enables rigorous, reproducible assessment of these interventionsâbridging the gap between conceptual robustness and real-world deployment. Our results motivate several intervention directions: Procedural safeguards.Require agents to (1) consult multiple independent sources before answering, (2) explicitly check for contradictions across sources, and (3) reduce confidence when corroboration is absent or conflicts are detected. These can be enforced via prompting (including chain-of-thought scaffolding [Wei et al., 2022]), fine-tuning, or external oversight (e.g., a separate verifier model that audits the search trace). Adversarial training.Fine-tune or train agents on tasks where top-ranked results are sometimes misleading, rewarding corroboration-seeking and penalizing premature commitment. Our benchmark provides a controlled environment for such training, with tunable honeypot frequency, rank, and plausibility. Calibration improvements. Current models are poorly calibrated under adversarial exposure. Training procedures that penalize overconfident wrong answersâespecially when the agent has consulted only one or two sourcesâcould improve epistemic humility. Confidence should be a function of evidential support, not just answer plausibility. In addition, [Kalai et al., 2025] argues that hallucinations are not random glitches but predictable artifacts of next-token prediction. They recommend uncertainty-aware evaluation and negative marking for confidently wrong answers during training, which aligns with our emphasis on calibration. Tool-use redesign. Equip agents with explicit tools for source criticism: credibility scoring, cross-referencing, contradiction detection, and provenance tracking. Rather than relying on implicit reasoning, externalize these checks into the tool layer where they can be inspected and debugged. Search interface improvements. Modify search to return diverse results by default (e.g., from different domains, perspectives, or publication types) rather than ranking purely by relevance. This reduces the risk of a single manipulated 8 The Synthetic Web: Adversarially-Curated Mini-Internets for Diagnosing Epistemic Weaknesses of Language Agents source dominating the evidence base. Recent work on calibrating positional attention bias suggests that architectural interventions can help models attend more faithfully to relevant content regardless of position [Hsieh et al., 2024]. Evaluation realignment. Beyond retrieval safeguards, systemic change in evaluation is critical. Similar to the suggested calibration improvements above; benchmarks should (a) penalize confident errors, (b) reward calibrated abstention (e.g., âI donât knowâ), and (c) report metrics beyond accuracyâsuch as abstention rates. These measures discourage âeducated guessingâ and incentivize epistemic humility, complementing retrieval-based defenses. 6.5 Connections to human cognition The anchoring failures we observe parallel well-documented human biases: primacy effects, confirmation bias, and the tendency to overweight vivid, early information. Humans also struggle to seek disconfirming evidence and often terminate search prematurely. However, humans can be trained to adopt critical thinking protocols, use structured checklists, and recognize high-stakes situations requiring deeper verification. Current language agents lack these metacognitive skills. The analogy suggests a path forward: just as professionals in intelligence analysis, medicine, and journalism learn explicit debiasing strategies, language agents may benefit from procedural training that enforces search discipline. The difference is that for agents, such procedures can be mechanically enforced, not merely recommended. 6.6 Broader implications Beyond browsing agents, our findings bear on the broader challenge of building reliable AI systems that interact with untrusted external information. As models are deployed in settings where they must retrieve, synthesize, and act on real-world dataâscientific literature review, legal research, investigative journalism, threat intelligenceâthe ability to critically evaluate sources and resist manipulation becomes paramount. Our benchmark provides a testbed for developing and evaluating such capabilities. By isolating the causal effect of adversarial exposure in a controlled, reproducible setting, we enable rigorous measurement of progress. The fact that current frontier models fail so dramatically establishes a clear baseline and motivates urgent research into robustness. 7 Limitations Model capabilities.We evaluate models using a uniform zero-shot prompt without specialized instructions for source criticism, corroboration, or adversarial robustness. Our goal is to measure base model capabilities when given search and browsing tools, not to evaluate production agent systems that might employ sophisticated prompting, multi-stage reasoning protocols, or external verification modules. Real-world agent deployments could potentially mitigate these failures through targeted prompting, few-shot demonstrations of critical thinking, chain-of-thought scaffolding, or architectural interventions like separate verifier models. A similar setup may be used to evaluate agent systems as well. However, the severity of zero-shot failuresâincluding in reasoning-optimized models like o1 and o3âsuggests fundamental limitations in how models handle conflicting evidence. Whether prompting alone can overcome positional anchoring and synthesis deficits remains an open question for future work. Synthetic content and evaluation.While we diversify styles and biases, synthetic prose may remain more uniform than the live web, potentially simplifying deception detection. Our worlds are text-only; multimedia and UI affordances are absent. The LLM-as-judge is not a perfect oracle; we provide calibration metrics and statistical rigor, but larger human audits would strengthen confidence in correctness labels. Our human baseline evaluation was limited to a small random sample from one world; while it demonstrates task feasibility and model-human performance gaps, a larger-scale human study would provide more precise comparisons and enable analysis of human error patterns. Finally, contamination filtering reduces but does not eliminate leakage risk, though our queries are highly specific to the synthetic worlds. Impact of topic familiarity and distribution. Our evaluation focuses on causal effects of adversarial ranking but does not fully capture how topic familiarity influences robustness. Although contamination filtering removes queries that models can answer closed-book, topic framing may still vary in familiarity. Some queries resemble common domains (pseudo in-distribution), while others are highly novel (true out-of-distribution). In-distribution queries are more likely to align with pretraining patterns, which can amplify overconfidence and reduce escalation, whereas out-of-distribution queries depend heavily on external evidence [Kandpal et al., 2023]. Our current evaluation does not stratify performance by this dimension, leaving open questions about how topic familiarity interacts with adversarial 9 The Synthetic Web: Adversarially-Curated Mini-Internets for Diagnosing Epistemic Weaknesses of Language Agents ranking. One possible future work is to explicitly analyze these dynamics to understand whether failures stem from anchoring on familiar-looking topics or inability to handle long-tail novelty. 8 Conclusion We introduced Synthetic Web Benchmark, a controlled environment for diagnosing epistemic weaknesses in browser agents. By manipulating search ranking and injecting a single plausible misinformation source, we demonstrated that current frontier language models fail catastrophically under minimal adversarial pressure by anchoring on top-ranked content, neglecting escalation, and exhibiting overconfidence (severe miscalibration even when evidence is conflicting or misleading.). These findings underscore the emerging need of moving beyond functional success metrics toward robustness under realistic threat models. Our principled testbed enables precise measurement of adversarial ranking effects and serves as controlled benchmark for testing interventions. By isolating these causal impacts, we establish a foundation for building search-robust, epistemically aware agents capable of critical source evaluation. Recent mitigation strategies for retrieval-augmented generation workflows, discussed earlier in Section 2, show promise but remain largely untested under adversarial ranking. Synthetic Web offers the controlled setting needed to evaluate the robustness of the proposed safeguards against rank-biased misinformation, measuring gains in accuracy, calibration, and search behavior. As language models are deployed in high-stakes domains requiring synthesis of untrusted information, the ability to resist manipulation and recognize evidential insufficiency becomes critical. By bridging conceptual robustness with practical evaluation, our benchmark lays the foundation for building trustworthy, search-robust agents in environments where manipulation is not hypothetical but inevitable. 10 The Synthetic Web: Adversarially-Curated Mini-Internets for Diagnosing Epistemic Weaknesses of Language Agents A Credibility Assignment Details Our main runs set the low-credibility fraction to 0.43, with credibility scores sampled as follows: low-credibility websites draw scores uniformly from [0.1, 0.4], and high-credibility websites from [0.6, 0.9]. We choose not to use medium-credibility websites (scores in [0.4, 0.6]) as pilot experiments revealed that models struggle to effectively differentiate medium-credibility sources from low- and high-credibility sources, leading to noisy signals. The binary credibility distribution provides clearer ground truth for evaluation. The credibility parameter is fully tunable in our generation scripts, allowing researchers to sweep credibility distributions in ablation studies. Publication frequency is sampled independently of credibility to avoid trivial heuristics (e.g., âtrust sites with more articlesâ). This design ensures that credibility must be inferred from content quality, source reputation, and cross-citation patterns rather than simple volume-based signals. B Statistical Details This appendix provides comprehensive statistical analysis supporting the main results. All significance tests confirm the robustness of the adversarial effects reported in Section 5. B.1 Significance tests Table 3 reports two-proportionz-tests comparing standard vs. adversarial accuracy. All models show statistically significant drops (p < 10 â10 for non-trivial models). ModelStd (%)Adv (%)â (pts)zp-value gpt-565.118.246.951.521.00e-16 o348.416.731.736.591.00e-16 o139.08.430.739.061.00e-16 gpt-4o27.23.823.435.051.00e-16 o4-mini0.30.00.34.487.61e-06 o1-mini0.00.00.00.001.00e+00 Table 3: Significance of accuracy drop (two-proportion z-test, two-sided). B.2 Cluster-robust analysis Because queries repeat across rollouts, we also aggregate at the worldĂrollout level. Table 4 shows cluster-robust means with 95%t-intervals. Table 5 reports Expected Calibration Error (ECE; 10 bins) and Brier scores. Both metrics worsen in adversarial mode, confirming overconfidence on incorrect answers. ModelStd (%)Adv (%)n gpt-565.3± 3.018.3± 1.140 o348.4± 2.316.8± 0.940 o139.2± 3.18.4± 0.640 gpt-4o27.2± 2.13.8± 0.640 o4-mini0.3± 0.20.0± 0.040 o1-mini0.0± 0.00.0± 0.040 Table 4: Accuracy aggregated at worldĂrollout level (cluster-robust). Mean and 95%t-intervals across roll- outs. ModelStd ECEAdv ECEStd BrierAdv Brier gpt-50.2980.6410.3320.591 o30.1920.4790.2860.384 o10.3440.6460.3780.519 gpt-4o0.5130.7260.4920.638 o4-mini0.2430.2440.1240.124 o1-mini0.2940.2940.2540.254 Table 5: Calibration metrics: Expected Calibration Error (ECE; 10 bins) and Brier score. Lower is better. 11 The Synthetic Web: Adversarially-Curated Mini-Internets for Diagnosing Epistemic Weaknesses of Language Agents TypeFactualComparisonTimelineEvaluation Counts147160154126 Table 6: Query distribution across evaluation worlds by type. WorldSitesLenTTRN/B/R/C 2ebc3fbb205950.6330/40/10/10 54b24559196010.6332/37/10/10 c04ad129195950.6427/43/10/10 da5bbf8a195960.6427/43/10/10 Table 7:Content statistics.Len:avg article length.TTR: type-token ratio.N/B/R/C: % News/Blog/Research/Conspiracy sites. B.3 Compliance and content statistics Schema adherence and answer extraction rates exceed 99% for all models, indicating failures are not due to formatting issues. Table 6 shows the distribution of query types across evaluation worlds. Table 7 summarizes content diversity (document length, type-token ratio, site-type distribution). 12 The Synthetic Web: Adversarially-Curated Mini-Internets for Diagnosing Epistemic Weaknesses of Language Agents References Shuyan Zhou, Frank F. Xu, Hao Zhu, Xuhui Zhou, Robert Lo, Abishek Sridhar, Xianyi Cheng, Yonatan Bisk, Daniel Fried, Uri Alon, and Graham Neubig. Webarena: A realistic web environment for building autonomous agents. ArXiv, abs/2307.13854, 2023. URL https://arxiv.org/abs/2307.13854. Reiichiro Nakano, Jacob Hilton, Suchir Balaji, Jeff Wu, Long Ouyang, Christina Kim, Christopher Hesse, Shantanu Jain, Vineet Kosaraju, William Saunders, Xu Jiang, Karl Cobbe, Tyna Eloundou, Gretchen Krueger, Kevin Button, Matthew Knight, Benjamin Chess, and John Schulman. Webgpt: Browser-assisted question-answering with human feedback. ArXiv, abs/2112.09332, 2021. URL https://arxiv.org/abs/2112.09332. Shunyu Yao, Jeffrey Zhao, Dian Yu, Nan Du, Izhak Shafran, Karthik Narasimhan, and Yuan Cao. React: Synergizing reasoning and acting in language models. ICLR, abs/2210.03629, 2023. URLhttps://arxiv.org/abs/2210. 03629. Timo Schick, Jane Dwivedi-Yu, Roberto DessĂŹ, Roberta Raileanu, Maria Lomeli, Luke Zettlemoyer, Nicola Cancedda, and Thomas Scialom. Toolformer: Language models can teach themselves to use tools. NeurIPS, abs/2302.04761, 2023. URL https://arxiv.org/abs/2302.04761. Xiang Deng, Yu Gu, Boyuan Zheng, Shijie Chen, Samuel Stevens, Boshi Wang, Huan Sun, and Yu Su. Mind2web: Towards a generalist agent for the web. NeurIPS, abs/2306.06070, 2023. URLhttps://arxiv.org/abs/2306. 06070. Xing Han LĂč, Zden Ë ek Kasner, and Siva Reddy. Weblinx: Real-world website navigation with multi-turn dialogue. ArXiv, abs/2402.05930, 2024. URL https://arxiv.org/abs/2402.05930. James Thorne, Andreas Vlachos, Christos Christodoulopoulos, and Arpit Mittal. Fever: a large-scale dataset for fact extraction and verification. ArXiv, abs/1803.05355, 2018. URL https://arxiv.org/abs/1803.05355. Stephanie C. Lin, Jacob Hilton, and Owain Evans. Truthfulqa: Measuring how models mimic human falsehoods. ArXiv, abs/2109.07958, 2021. URL https://arxiv.org/abs/2109.07958. Tianci Xue, Weijian Qi, Tianneng Shi, Chan Hee Song, Boyu Gou, Dawn Song, Huan Sun, and Yu Su. An illusion of progress? assessing the current state of web agents. ArXiv, abs/2504.01382, 2025. URLhttps://arxiv.org/ abs/2504.01382. Theodore R. Sumers, Shunyu Yao, Karthik Narasimhan, and Thomas L. Griffiths. Cognitive architectures for language agents. ArXiv, abs/2309.02427, 2023. URL https://arxiv.org/abs/2309.02427. Junyi Li, Jie Chen, Ruiyang Ren, Xiaoxue Cheng, Wayne Xin Zhao, Jian-Yun Nie, and Ji-Rong Wen. The dawn after the dark: An empirical study on factuality hallucination in large language models. ArXiv, abs/2401.03205, 2024. URL https://arxiv.org/abs/2401.03205. Jerry Wei, Chengrun Yang, Xinying Song, Yifeng Lu, Nathan Hu, Jie Huang, Dustin Tran, Daiyi Peng, Ruibo Liu, Da Huang, Cosmo Du, and Quoc V. Le. Long-form factuality in large language models. ArXiv, abs/2403.18802, 2024. URL https://arxiv.org/abs/2403.18802. Robin Jia and Percy Liang. Adversarial examples for evaluating reading comprehension systems. ArXiv, abs/1707.07328, 2017. URL https://arxiv.org/abs/1707.07328. Jinyan Su, Preslav Nakov, and Claire Cardie. Corpus poisoning via approximate greedy gradient descent. ArXiv, abs/2406.05087, 2024. URL https://arxiv.org/abs/2406.05087. Xiaogeng Liu, Zhiyuan Yu, Yizhe Zhang, Ning Zhang, and Chaowei Xiao. Automatic and universal prompt injection attacks against large language models. ArXiv, abs/2403.04957, 2024a. URLhttps://arxiv.org/abs/2403. 04957. Linda Zeng, Rithwik Gupta, Divij Motwani, Yi Zhang, and Diji Yang. Worse than zero-shot? a fact-checking dataset for evaluating the robustness of rag against misleading retrievals. ArXiv, abs/2502.16101, 2025. URL https://arxiv.org/abs/2502.16101. Zeshi Dai, Zimo Peng, Zerui Cheng, and Ryan Yihe Li. When hallucination costs millions: Benchmarking ai agents in high-stakes adversarial financial markets. ArXiv, abs/2510.00332, 2025. URLhttps://arxiv.org/abs/2510. 00332. Zonghao Ying, Yangguang Shao, Jianle Gan, Gan Xu, Junjie Shen, Wenxin Zhang, Quanchen Zou, Junzheng Shi, Zhenfei Yin, Mingchuan Zhang, Aishan Liu, and Xianglong Liu. Securewebarena: A holistic security evaluation benchmark for lvlm-based web agents. ArXiv, abs/2510.10073, 2025. URLhttps://arxiv.org/abs/2510. 10073. 13 The Synthetic Web: Adversarially-Curated Mini-Internets for Diagnosing Epistemic Weaknesses of Language Agents Ada Defne Tur, Nicholas Meade, Xing Han LĂč, Alejandra Zambrano, Arkil Patel, Esin Durmus, Spandana Gella, Karolina Sta Ì nczak, and Siva Reddy. Safearena: Evaluating the safety of autonomous web agents. ArXiv, abs/2503.04957, 2025. URL https://arxiv.org/abs/2503.04957. Ruohao Guo, Wei Xu, and Alan Ritter. How to protect yourself from 5g radiation? investigating llm responses to implicit misinformation. ArXiv, abs/2503.09598, 2025. URL https://arxiv.org/abs/2503.09598. Chen Henry Wu, Rishi Shah, Jing Yu Koh, Ruslan Salakhutdinov, Daniel Fried, and Aditi Raghunathan. Dissecting adversarial robustness of multimodal lm agents. ArXiv, abs/2406.12814, 2024. URLhttps://arxiv.org/abs/ 2406.12814. Thibault Le Sellier De Chezelles, Maxime Gasse, Alexandre Drouin, Massimo Caccia, LĂ©o Boisvert, Megh Thakkar, Tom Marty, Rim Assouel, Sahar Omidi Shayegan, Lawrence Keunho Jang, Xing Han LĂč, Ori Yoran, Dehan Kong, Frank F. Xu, Siva Reddy, Quentin Cappart, Graham Neubig, Ruslan Salakhutdinov, Nicolas Chapados, and Alexandre Lacoste. The browsergym ecosystem for web agent research. ArXiv, abs/2412.05467, 2024. URL https://arxiv.org/abs/2412.05467. Karl Cobbe, Chris Hesse, Jacob Hilton, and John Schulman. Leveraging procedural generation to benchmark reinforce- ment learning. ArXiv, abs/1912.01588, 2020. URL https://arxiv.org/abs/1912.01588. Marc-Alexandre CĂŽtĂ©, Ăkos KĂĄdĂĄr, Xingdi Yuan, Ben Kybartas, Tavian Barnes, Emery Fine, James Moore, Matthew Hausknecht, Layla El Asri, Mahmoud Adada, Wendy Tay, and Adam Trischler. Textworld: A learning environment for text-based games. ArXiv, abs/1806.11532, 2018. URL https://arxiv.org/abs/1806.11532. Mohit Shridhar, Xingdi Yuan, Marc-Alexandre CĂŽtĂ©, Yonatan Bisk, Adam Trischler, and Matthew Hausknecht. Alfworld: Aligning text and embodied environments for interactive learning. ArXiv, abs/2010.03768, 2020. URL https://arxiv.org/abs/2010.03768. Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich KĂŒttler, Mike Lewis, Wen tau Yih, Tim RocktĂ€schel, Sebastian Riedel, and Douwe Kiela. Retrieval-augmented generation for knowledge-intensive nlp tasks. NeurIPS, abs/2005.11401, 2020. URL https://arxiv.org/abs/2005.11401. Akari Asai, Zeqiu Wu, Yizhong Wang, Avirup Sil, and Hannaneh Hajishirzi. Self-rag: Learning to retrieve, generate, and critique through self-reflection. ArXiv, abs/2310.11511, 2024. URL https://arxiv.org/abs/2310.11511. Potsawee Manakul, Adian Liusie, and Mark J. F. Gales. Selfcheckgpt: Zero-resource black-box hallucination detection for generative large language models. ArXiv, abs/2303.08896, 2023. URLhttps://arxiv.org/abs/2303.08896. Zhengbao Jiang, Frank F. Xu, Luyu Gao, Zhiqing Sun, Qian Liu, Jane Dwivedi-Yu, Yiming Yang, Jamie Callan, and Graham Neubig. Active retrieval augmented generation. EMNLP, abs/2305.06983, 2023. URLhttps: //arxiv.org/abs/2305.06983. Xi Victoria Lin, Xilun Chen, Mingda Chen, Weijia Shi, Maria Lomeli, Rich James, Pedro Rodriguez, Jacob Kahn, Gergely Szilvasy, Mike Lewis, Luke Zettlemoyer, and Wen tau Yih. Ra-dit: Retrieval-augmented dual instruction tuning. ArXiv, abs/2310.01352, 2024. URL https://arxiv.org/abs/2310.01352. Shi-Qi Yan, Jia-Chen Gu, Yun Zhu, and Zhen-Hua Ling. Corrective retrieval augmented generation. ArXiv, abs/2401.15884, 2024. URL https://arxiv.org/abs/2401.15884. Yixuan Tang and Yi Yang. Multihop-rag: Benchmarking retrieval-augmented generation for multi-hop queries. ArXiv, abs/2401.15391, 2024. URL https://arxiv.org/abs/2401.15391. Adam Kalai, Yishay Mansour, Aleksander Madry, Elad Hazan, Sham Kakade, Boaz Barak, et al. Why language models hallucinate. arXiv preprint, 2025. URL https://arxiv.org/pdf/2509.04664. Jerry Liu. LlamaIndex, 11 2022. URL https://github.com/jerryjliu/llama_index. Nelson F. Liu, Kevin Lin, John Hewitt, Ashwin Paranjape, Michele Bevilacqua, Fabio Petroni, and Percy Liang. Lost in the middle: How language models use long contexts. Transactions of the Association for Computational Linguistics, abs/2307.03172, 2024b. URL https://arxiv.org/abs/2307.03172. Lars Malmqvist. Sycophancy in large language models: Causes and mitigations. ArXiv, abs/2411.15287, 2024. URL https://arxiv.org/abs/2411.15287. Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Brian Ichter, Fei Xia, Ed Chi, Quoc Le, and Denny Zhou. Chain-of-thought prompting elicits reasoning in large language models. NeurIPS, abs/2201.11903, 2022. URL https://arxiv.org/abs/2201.11903. Cheng-Yu Hsieh, Yung-Sung Chuang, Chun-Liang Li, Zifeng Wang, Long T. Le, Abhishek Kumar, James Glass, Alexander Ratner, Chen-Yu Lee, Ranjay Krishna, and Tomas Pfister. Found in the middle: Calibrating positional attention bias improves long context utilization. ArXiv, abs/2406.16008, 2024. URLhttps://arxiv.org/abs/ 2406.16008. 14 The Synthetic Web: Adversarially-Curated Mini-Internets for Diagnosing Epistemic Weaknesses of Language Agents Nikhil Kandpal, Eric Wallace, and Colin Raffel. Large language models struggle to learn long-tail knowledge. ArXiv, abs/2305.13169, 2023. URL https://arxiv.org/abs/2211.08411. 15