0:00Juniper: Here's a question you might hand to a research assistant. Which supplier held a valid safety certification on the thirty-first of March, and delivered all three of its March shipments on time? The true answer is a company called Brindle Components — and no single page says so. You have to cross a vendor directory against certification-expiry records and shipment logs to piece it together. One of the strongest AI research agents out there solved that style of task ninety-six percent of the time. Then the researchers slipped one fake page into its search results — a bland trade-review article naming a different supplier — and its accuracy dropped to twenty-six percent.
0:40Tyler: And the unsettling part isn't that it got fooled. It's how it got fooled. The agent found the real records. It read them. It pulled the truth into its own memory — and then it typed the lie.
0:52Juniper: So this is a paper called DRNOISE, out this July, and by the end you'll understand exactly why a system that clearly knows how to find the truth will hand you a confident, well-cited, wrong answer instead. And it matters because these deep research agents — the ones that browse the web and write you a synthesized answer with citations — are being pitched as front-ends for real work... Like, financial due diligence, regulatory research, and competitive analysis. The whole selling point is that you act on the summary instead of re-reading every source.
1:25Tyler: Okay, but my first instinct is the boring explanation. The web is messy, right? The agent probably just never dug up the real records. It found the convenient fake page, that page looked like an answer, so it grabbed it and left. Bad luck in retrieval, not some deep flaw.
1:42Juniper: That's the natural read, Tyler, and it's wrong — and the fact that it's wrong is the whole paper. Across all one hundred of the poisoned tasks, the agent retrieved the truthful records. Every single run. It didn't miss the truth. It saw the truth, it saw the lie sitting right next to it, and it stopped before finishing the job.
2:04Tyler: So it had the receipts in hand and quit anyway. Why?
2:07Juniper: Because nothing in how it decides to stop said "keep going." And to see why that's the failure — not stupidity, not bad search — you have to look at how they built the test. The design is a controlled A/B trial. Think of a drug study where two groups are identical in every way except one gets a single pill, so anything that changes can only be that pill. Here, every task comes in two versions. The clean one and the noisy one are word-for-word identical, same records, same search tool, same everything, except the noisy version has exactly one extra document added, and that's the only difference. So if accuracy falls, there's nothing else to blame.
2:50Tyler: And that one document is the fake summary.
2:53Juniper: Right. And the second design choice is the sharp one. In these tasks, the true answer is never stated anywhere. You can't just find the one right sentence. You have to reconstruct it — join a certification list against a shipment log, cross two independent chains of records that both happen to point at Brindle Components. The truth is laborious. The lie, meanwhile, is one tidy trade-review article that just names a different supplier outright. It's hard-won truth and easy-to-grab falsehood, side by side.
3:26Tyler: Hm. That asymmetry bugs me a little, actually. They've built a world where the truth is buried and the lie is gift-wrapped. Hold that thought — I want to come back to whether that stacks the deck.
3:39Juniper: Fair, and we will. Because it turns out to matter more than you'd think. So they built a hundred of these tasks — seventeen hundred documents, everything from date lookups to multi-step joins — so nobody could wave it off as an arithmetic quirk. Then they ran five current top models through the identical setup. Without the fake page, the scores are strong: Gemini's flash model solves ninety-six percent, DeepSeek's close to eighty-nine. Now add the one fake page. Gemini falls from ninety-six down to twenty-six. And DeepSeek falls from eighty-nine down to one percent — one added page, and one of the strongest agents in the test essentially goes to zero.
4:19Tyler: Wait — one percent? From eighty-nine? That can't just be normal error. That's the agent actively choosing the wrong answer.
4:28Juniper: That's exactly the distinction the authors chase, and it's the cleanest idea in the paper. They don't report raw failure. They define something called conditional deference.
4:39Tyler: Right, so here's why raw failure would lie to you, Juniper. A weak model that can't solve the clean task at all would look robust — it can't defer to a lie on a question it was never going to get. So they only count the tasks a model already got right when the page was absent. Of those — the ones it provably could solve — how often does it now switch to the exact fake value the document planted? Not just any wrong answer, but that specific planted one.
5:07Juniper: And those numbers are brutal.
5:09Tyler: They are. DeepSeek defers about ninety-eight percent of the time. Gemini, roughly three out of four. So on tasks these models had already shown they could solve, the mere presence of one confident wrong page flips them to the lie almost every time. And that reframes the whole thing. This isn't a capability problem — the model has the skill, it used it a second ago. It's a capability-deployment problem. It stops deploying the skill the moment an answer-shaped shortcut shows up...
5:39Juniper: But "it defers" is a description, not a mechanism. Why does it defer? This next part is the detective work, and it pays off in one experiment that pins the failure to a single culprit. To follow it, you need three things kept separate that usually blur together. First, retrieval — that's just finding the relevant documents. Second is reasoning — combining what's in those documents into the right conclusion.
6:04Tyler: And the third is the one everyone forgets — the agentic loop. That's the outer control process that decides which search to run next, and, critically, when to quit. A plain chatbot answers off the top of its head. An agent is someone you sent to the library who reports back when they decide they're done. That decision, "am I done," is the whole ballgame.
6:27Juniper: So they anchor all of this on one model, GPT-5.4, and trace what it actually did, step by step. First suspect: maybe it never retrieved the truth.
6:36Tyler: Let me guess — dead on arrival.
6:39Juniper: Completely. In all one hundred noisy runs, the agent pulled up the truthful records and the fake summary together. And take the sixty-eight tasks it flipped from right to wrong — every one of them had the truth sitting in the agent's own retrieved results. Only ten of those runs bothered to assemble a complete chain of evidence. The rest quit early. The fake page actually makes the agent lazier — its average number of searches drops from about seven to about four and a half. The lie shortens the investigation.
7:11Tyler: Okay, so retrieval's off the hook. But that leaves the other obvious suspect. Maybe it sees the truth and the lie and just can't reconcile the conflict — the reasoning isn't good enough to work out that the records beat the summary...
7:26Juniper: So they ran the cleanest test in the paper. Take retrieval out of the loop entirely. Don't make the agent search for anything — just dump all the truthful evidence straight into its context, and ask the question. With no fake page, it gets a hundred out of a hundred. Fine. Then add the fake summary right there in the pile, the same lie that crushed it before. Ninety-one out of a hundred correct.
7:51Tyler: Wait — so when you hand it everything, the lie basically stops working?
7:56Juniper: It reconciles it fine. It reads the summary, checks it against the records, sees it doesn't hold up, and answers correctly. The reasoning was never the problem. Think of one student taking the same test twice. Sent to the library to do the research themselves, they grab the wrong summary and leave. Handed a folder with all the right documents already inside, they read everything and get it right. Nothing about the student changed. What changed is whether they had to decide when to stop gathering.
8:27Tyler: So before we go further — why does the agent fail, if it found the truth and can reason about the truth?
8:34Juniper: Because the failure lives entirely in the stopping. An answer-shaped document acts like a stop sign when it should be a question mark. So the picture so far: retrieval works, reasoning works, and the agent fails anyway — because its stopping policy treats a fluent, direct answer as permission to quit. The authors call it verification inertia.
8:55Tyler: And there's a familiar shape to this. You know how models tend to tell a user what the user wants to hear — they cave to a stated opinion instead of pushing back? This is that reflex, just pointed at the corpus instead of the person. The agent yields to an answer asserted inside its own search results. And here's what should worry anyone hoping for a quick fix. They tried just telling it to be careful — a generic "verify your answer against your documents, don't stop at the first plausible one" prompt. It barely moved the needle, from twelve solved up to twenty-eight out of a hundred. You don't patch this with a politer instruction. It's baked into how the agent decides it's done.
9:37Juniper: Right.
9:37Tyler: Now — Juniper, that thing I flagged earlier. I want to be honest about how far this goes. This is a constructed corpus. The researchers built every document. They guaranteed the truth is present, sufficient, and reachable, and they guaranteed the fake page is genuinely false. The real web is messier than that. Sometimes the truth is incomplete, sources genuinely conflict, and the records don't cleanly point to one answer. So this proves the failure can happen. It does not tell us how often it bites in the wild.
10:09Juniper: That's a fair limit, and the authors admit it plainly — documents they built by hand may not capture what real web sources look like. I'd push back on one thing, though. The mechanism findings don't depend on that. The agent retrieved the truth. The agent can reconcile the conflict when everything is handed to it. Those are facts about the agent itself, and they hold no matter how artificial the documents are.
10:34Tyler: Sure, but here's the sharper version, and the paper's own data hands it to me. They built a maximum convenience gap — truth buried across two chains, lie stated outright. So they tested that directly. They rewrote one of the truth chains as a document stating the true answer plainly, matched in style and authority to the fake. Now the truth is as easy to grab as the lie. Accuracy jumps from twelve up to sixty-three. Most of the effect was that convenience gap. So the honest read is, this is a real failure mode, but the benchmark engineers the worst case for it. And the deep mechanism story runs on one model, GPT-5.4. Whether DeepSeek fails the same way, at one percent, or for some other reason, they infer by analogy. They don't show it.
11:23Juniper: Both true, Tyler. Though I'd note even with the truth stated just as directly, a third of the time it still followed the lie. So the convenience gap explains most of it — not all. But step back, because the reframe here is the thing to carry out. For years the field measured these agents by whether they could find hard-to-locate facts — "found it and cited it" counted as "got it right." This paper drives a wedge between those. The agents do cite their sources. They just cite the wrong one, while the right one sits untouched in the same result list. Finding and citing is not verifying.
12:02Tyler: And the practical version is blunt. If you point one of these agents at anything consequential, the danger was never that it can't find the truth. It's that the moment the open web contains one convenient, plausible, wrong page — a stale dashboard, a sloppy secondary article — the agent may hand you a confident, well-cited, wrong conclusion. No attacker required. Just an ordinary bad page, which is the realistic case.
12:30Juniper: So go back to Brindle Components, the supplier from the top, the one buried in the records. Back at the start of this episode, "ninety-six percent to twenty-six" sounded like the model got worse at research. Now you know it didn't. It found Brindle. It could have proven Brindle. It just decided a glossy summary naming someone else was a good enough place to stop. The fix has to change when the agent is allowed to quit — smarter retrieval and better reasoning both already work.
13:01Tyler: So here's the question. Do we fix this by teaching agents a better stopping policy, where a direct answer triggers more checking, not less? Or is expecting a model to distrust its own search results a lost cause, and we need humans back in the verification loop for anything that matters? Drop where you land.
13:21Juniper: The full annotated version is on paperdive dot AI — every term tap-to-define, with links to the related papers on agents and misinformation, grouped by theme.
13:31Tyler: Quick housekeeping: the script was written by Anthropic's Claude Opus 4.8, Juniper and I are both AI voices from Eleven Labs, and the producer isn't affiliated with either company. The paper is "DRNOISE," by Jun Nie and colleagues, posted July 19th, 2026.
13:48Juniper: It found the truth, cited the lie, and called the job done.