提出自适应黑盒攻击，能自动泄露RAG系统的私有知识库。
Pirates of the RAG: Adaptively Attacking LLMs to Leak Knowledge Bases
- 基于相关性机制与开源大模型生成有效查询
- 在多个RAG系统中成功泄露大部分隐藏知识
- 适合关注RAG安全性的研究人员和开发者
检索增强生成（RAG）系统在诸多实际服务中日益普及，但其安全性引发严重担忧。RAG通过检索机制调用私有知识库以增强大语言模型的生成能力，若该知识库意外暴露，可能导致敏感信息泄露。本文提出一种自适应、全自动的黑盒攻击方法，可迫使RAG系统泄露其私有知识库。该方法结合相关性判断机制与攻击者侧开源大模型，生成高效查询以挖掘知识库内容。大量实验表明，该算法在不同RAG架构与领域中表现优异，优于近期其他方法——后者或非全黑盒、或不具自适应性、或依赖闭源模型。研究结果凸显了在RAG系统设计与部署中亟需更强的隐私保护机制。
原文摘要 · Abstract (English)
The growing ubiquity of Retrieval-Augmented Generation (RAG) systems in several real-world services triggers severe concerns about their security. A RAG system improves the generative capabilities of a Large Language Models (LLM) by a retrieval mechanism which operates on a private knowledge base, whose unintended exposure could lead to severe consequences, including breaches of private and sensitive information. This paper presents a black-box attack to force a RAG system to leak its private knowledge base which, differently from existing approaches, is adaptive and automatic. A relevance-based mechanism and an attacker-side open-source LLM favor the generation of effective queries to leak most of the (hidden) knowledge base. Extensive experimentation proves the quality of the proposed algorithm in different RAG pipelines and domains, comparing to very recent related approaches, which turn out to be either not fully black-box, not adaptive, or not based on open-source models. The findings from our study remark the urgent need for more robust privacy safeguards in the design and deployment of RAG systems.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。