首次实现对RAG系统中毒文本的溯源追踪，提升知识库安全
Traceback of Poisoning Attacks to Retrieval-Augmented Generation
- 通过迭代检索+定制提示词，定位知识库中的中毒文本
- 在多个数据集上有效识别前沿攻击生成的恶意响应
- 为RAG系统提供可落地的攻击溯源方案，适合安全研究者
大型语言模型（LLMs）结合检索增强生成（RAG）系统可通过外部知识源提升准确性。然而，近期研究表明RAG易受中毒攻击：攻击者向知识数据库注入恶意文本，诱导模型生成特定响应。现有防御多聚焦推理阶段，难以应对复杂攻击。本文提出RAGForensics，首个针对RAG系统的中毒溯源工具，通过迭代检索并利用定制提示词，引导大模型识别潜在中毒文本。在多个数据集上的实证评估表明，该方法能有效应对当前最先进的中毒攻击。本工作开创性地实现了RAG中中毒文本的溯源，为提升系统安全性提供了实用且有前景的防御机制。代码已开源：https://github.com/zhangbl6618/RAG-Responsibility-Attribution
原文摘要 · Abstract (English)
Large language models (LLMs) integrated with retrieval-augmented generation (RAG) systems improve accuracy by leveraging external knowledge sources. However, recent research has revealed RAG's susceptibility to poisoning attacks, where the attacker injects poisoned texts into the knowledge database, leading to attacker-desired responses. Existing defenses, which predominantly focus on inference-time mitigation, have proven insufficient against sophisticated attacks. In this paper, we introduce RAGForensics, the first traceback system for RAG, designed to identify poisoned texts within the knowledge database that are responsible for the attacks. RAGForensics operates iteratively, first retrieving a subset of texts from the database and then utilizing a specially crafted prompt to guide an LLM in detecting potential poisoning texts. Empirical evaluations across multiple datasets demonstrate the effectiveness of RAGForensics against state-of-the-art poisoning attacks. This work pioneers the traceback of poisoned texts in RAG systems, providing a practical and promising defense mechanism to enhance their security. Our code is available at: https://github.com/zhangbl6618/RAG-Responsibility-Attribution
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。