HERALD: A New Audit Method for Proof-of-Retrieval Rewards in Search Agents

A recent paper on arXiv (2608.06012) presents HERALD, an offline auditing technique designed for proof-of-retrieval rewards in search-agent frameworks. This study highlights a significant issue: elevated scores in search-agent rewards may not reflect the actual retrieval of cited evidence, as penalties and anti-hacking clauses can negate them. HERALD utilizes identical question interventions, distinguishes between candidate-visible and oracle data, and outlines detector contracts prior to policy optimization. Testing was conducted on four Qwen3-8B pools from HotpotQA, 2WikiMultiHopQA, and MuSiQue. The findings revealed that while the baseline reward function R0 prevents search deletions and fake identities, a label-free citation-laundering attack was successful. A comprehensive 2^3 ablation pinpointed the targeted enhancement of L—citing a corpus passage not included in the retrieved evidence—as the minimal repair observed, with R[L] achieving a zero empirical ASR and a 0.50% one-sided cluster upper limit. This gap remains evident across different pool rules, a visible BM25 attacker, and four models, although broader hardening is still susceptible when evidence is removed. This research holds importance for the AI technology industry, particularly in enhancing the dependability of retrieval-augmented generation systems.