仅用一条恶意数据就能破坏RAG系统，攻击更隐蔽、更现实。
Practical Poisoning Attacks against Retrieval-Augmented Generation
- 攻击者只注入一条伪造文本即可干扰检索生成结果。
- 在多个数据集上，成功率显著高于现有攻击方法。
- 适合研究安全漏洞或防御机制的从业者参考。
大型语言模型虽具备强大的自然语言处理能力，但存在幻觉和知识过时等问题。检索增强生成（RAG）作为当前主流解决方案，能有效缓解上述问题，但仍易受投毒攻击。现有攻击多假设攻击者可插入大量恶意文本以压倒正确内容，这一前提在实际中难以满足。为此，本文提出CorruptRAG，一种仅需注入单条恶意文本的实用型投毒攻击，兼顾可行性与隐蔽性。在多个大规模数据集上的实验表明，CorruptRAG在攻击成功率上优于现有基线方法。
原文摘要 · Abstract (English)
Large language models (LLMs) have demonstrated impressive natural language processing abilities but face challenges such as hallucination and outdated knowledge. Retrieval-Augmented Generation (RAG) has emerged as a state-of-the-art approach to mitigate these issues. While RAG enhances LLM outputs, it remains vulnerable to poisoning attacks. Recent studies show that injecting poisoned text into the knowledge database can compromise RAG systems, but most existing attacks assume that the attacker can insert a sufficient number of poisoned texts per query to outnumber correct-answer texts in retrieval, an assumption that is often unrealistic. To address this limitation, we propose CorruptRAG, a practical poisoning attack against RAG systems in which the attacker injects only a single poisoned text, enhancing both feasibility and stealth. Extensive experiments conducted on multiple large-scale datasets demonstrate that CorruptRAG achieves higher attack success rates than existing baselines.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。