攻击多模态检索生成系统，用少量伪造图文对操控模型输出。
Poisoned-MRAG: Knowledge Poisoning Attacks to Multimodal Retrieval Augmented Generation
- 通过优化构造恶意图文对，实现对多模态检索增强生成的精准控制。
- 仅用5个恶意样本在InfoSeek库中即达98%攻击成功率。
- 揭示现有防御手段效果有限，适合关注AI安全的研究者阅读。
多模态检索增强生成（Multimodal RAG）通过动态访问外部知识库，提升视觉语言模型（VLMs）的视觉推理能力。本文提出首个针对多模态RAG系统的知识投毒攻击——Poisoned-MRAG。该攻击将少量精心设计的图像-文本对注入多模态知识库，操纵VLMs对特定查询生成攻击者期望的响应。我们将其形式化为优化问题，并提出两种跨模态攻击策略：脏标签和干净标签，分别适配不同攻击者知识水平与目标。在多个知识库和VLM上的广泛实验表明，Poisoned-MRAG显著优于现有方法，在仅注入5个恶意样本至InfoSeek数据库（共481,782对）时，最高可达98%攻击成功率。此外，我们评估了四种防御策略：重述、去重、结构驱动缓解和净化，发现其均存在局限性且伴随权衡。结果凸显Poisoned-MRAG的有效性与可扩展性，警示其对多模态RAG系统的重大威胁。
原文摘要 · Abstract (English)
Multimodal retrieval-augmented generation (RAG) enhances the visual reasoning capability of vision-language models (VLMs) by dynamically accessing information from external knowledge bases. In this work, we introduce \textit{Poisoned-MRAG}, the first knowledge poisoning attack on multimodal RAG systems. Poisoned-MRAG injects a few carefully crafted image-text pairs into the multimodal knowledge database, manipulating VLMs to generate the attacker-desired response to a target query. Specifically, we formalize the attack as an optimization problem and propose two cross-modal attack strategies, dirty-label and clean-label, tailored to the attacker's knowledge and goals. Our extensive experiments across multiple knowledge databases and VLMs show that Poisoned-MRAG outperforms existing methods, achieving up to 98\% attack success rate with just five malicious image-text pairs injected into the InfoSeek database (481,782 pairs). Additionally, We evaluate 4 different defense strategies, including paraphrasing, duplicate removal, structure-driven mitigation, and purification, demonstrating their limited effectiveness and trade-offs against Poisoned-MRAG. Our results highlight the effectiveness and scalability of Poisoned-MRAG, underscoring its potential as a significant threat to multimodal RAG systems.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。