Agentic fact-checking (FC) has emerged as a powerful paradigm for verifying complex claims through dynamic reasoning, tool use, and iterative evidence gathering. Understanding the vulnerability of these systems is essential for assessing their reliability against misinformation and adversarial manipulation. In this work, we study both the offensive and defensive aspects of agentic FC. First, we identify a limitation in the state-of-the-art Fact2Fiction attack, which introduces excessive semantic drift into malicious evidence, and propose F+, a relevance-filtering framework that generates more semantically consistent adversarial evidence. Second, we introduce SRSFact, an enhanced agentic FC system with a Supporter–Refuter–Summarizer mechanism for structured evidence authenticity assessment, improving robustness without relying on external open-web knowledge search. Experiments on the AVeriTeC benchmark show that F+ significantly strengthens attack effectiveness, while SRSFact substantially reduces failure rates under diverse adversarial attacks.

Reasoning large language models that produce explicit chains of thought are a new jailbreak surface: an adversary who shapes intermediate reasoning can hijack safety deliberation and elicit harmful answers the same model would refuse in a single forward pass. Defenses inherited from chat-style alignment monitor only the final response and intervene after the model has already committed to an unsafe trajectory. We argue that defending reasoning models requires looking inside the thinking phase itself, and we show that the refusal direction, previously characterized as a single linear direction in chat models, in fact evolves along the reasoning trajectory: sharp at onset, slowly drifting during long deliberation, and on hijacked traces collapsing at an identifiable step well before any harmful token is emitted. We propose RsMon, a step-level refusal-subspace monitor that tracks the projection of intermediate hidden states onto a calibrated refusal subspace and triggers a minimally invasive geometric intervention once drift exceeds a learned threshold. The monitor is purely inference-time, requires no retraining, and is compatible with any open-weight reasoning model. On three open reasoning models, five attack families, and four utility benchmarks, RsMon cuts mean attack success from 80.1% to 19.2%, a 4.2× reduction, while keeping MATH-500, GPQA-Diamond, and HumanEval pass@1 within 0.7 absolute points of the undefended baseline. The same monitor produces a step-resolved diagnostic that pinpoints when and in which layer safety deliberation breaks down. Our code is available at https://github.com/llmnjust-afk/RsMon.

In an era where misinformation spreads freely, fact-checking (FC) plays a crucial role in verifying claims and promoting reliable information. While automated fact-checking (AFC) has advanced significantly, existing systems remain vulnerable to adversarial attacks that manipulate or generate claims, evidence, or claim-evidence pairs. These attacks can distort the truth, mislead decision-makers, and ultimately undermine the reliability of FC models. Despite growing research interest in adversarial attacks against AFC systems, a comprehensive, holistic overview of key challenges remains lacking. These challenges include understanding attack strategies, assessing the resilience of current models, and identifying ways to enhance robustness. This survey provides the first in-depth review of adversarial attacks targeting FC, categorizing existing attack methodologies and evaluating their impact on AFC systems. Additionally, we examine recent advancements in adversary-aware defenses and highlight open research questions that require further exploration. Our findings underscore the urgent need for resilient FC frameworks capable of withstanding adversarial manipulations in pursuit of preserving high verification accuracy.