攻击者通过污染检索器数据，让大模型生成恶意链接。
Backdoored Retrievers for Prompt Injection Attacks on Retrieval Augmented Generation of Large Language Models
- 在检索器训练数据中植入后门，触发特定指令时输出恶意内容
- 仅需少量污染文档即可实现高成功率的提示注入攻击
- 适合研究系统安全、对抗样本或大模型防御的读者
大型语言模型（LLMs）虽能生成连贯文本，但受限于训练数据的静态性。检索增强生成（RAG）通过结合实时信息检索缓解此问题，但也扩大了攻击面。本文研究针对RAG的提示注入攻击，关注除误导信息外的恶意目标，如插入有害链接、推广未经授权服务及引发拒绝服务行为。我们基于现有语料库污染技术，提出一种针对密集检索器微调过程的新后门攻击。实验表明，通过向检索器语料库中注入少量受损文档，语料库污染可实现较高的攻击成功率；而后门攻击成功率更高，但需受害者使用被污染的数据集进行检索器微调，设置更复杂。
原文摘要 · Abstract (English)
Large Language Models (LLMs) have demonstrated remarkable capabilities in generating coherent text but remain limited by the static nature of their training data. Retrieval Augmented Generation (RAG) addresses this issue by combining LLMs with up-to-date information retrieval, but also expand the attack surface of the system. This paper investigates prompt injection attacks on RAG, focusing on malicious objectives beyond misinformation, such as inserting harmful links, promoting unauthorized services, and initiating denial-of-service behaviors. We build upon existing corpus poisoning techniques and propose a novel backdoor attack aimed at the fine-tuning process of the dense retriever component. Our experiments reveal that corpus poisoning can achieve significant attack success rates through the injection of a small number of compromised documents into the retriever corpus. In contrast, backdoor attacks demonstrate even higher success rates but necessitate a more complex setup, as the victim must fine-tune the retriever using the attacker poisoned dataset.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。