Towards Safer RAG: Only Agents Capable of System 2 Thinking may Access Untrusted Documents

A new arXiv paper (2608.17153v1) proposes that only AI agents capable of deliberative 'System 2' reasoning should be allowed to access untrusted documents in Retrieval-Augmented Generation (RAG) systems, as a more practical alternative to the strict Cordon Principle. The authors introduce novel metrics to quantify the gap between misinformation detection and downstream influence, and empirically show that reasoning-capable models are substantially more robust to corrupted evidence without the computational overhead of strict isolation.

arXiv:2608.17153v1 Announce Type: new Abstract: Retrieval-Augmented Generation RAG has significantly enhanced the performance of large language models LLMs , yet these systems remain vulnerable to knowledge-poisoning attacks, in which misinformation in retrieved documents can influence the model's final outputs. Notably, an LLM may correctly detect that a document contains incorrect information while nevertheless being influenced by it. Prior work has addressed this vulnerability through the Cordon Principle, which prevents models responsible for final answer synthesis from directly accessing raw evidence. Although effective, this strict isolation can introduce substantial computational overhead. In this work, we propose a refined security principle: only agents capable of deliberative System 2 reasoning may access untrusted documents. To evaluate this principle, we introduce novel metrics that quantify the discrepancy between misinformation detection and downstream influence. We then empirically compare state-of-the-art reasoning language models with standard language models across these metrics. Our results show that reasoning-capable models are substantially more robust to corrupted evidence, without requiring the strict isolation imposed by the Cordon Principle. These findings provide empirical support for our refined principle and suggest a more practical foundation for secure RAG system design.