仅用一条伪造文档即可攻破RAG系统，且能应对复杂多跳问题。
One Shot Dominance: Knowledge Poisoning Attack on Retrieval-Augmented Generation Systems
- 仅篡改单个文档，利用链式信任机制诱导模型采信。
- 在六种主流LLM上攻击成功率超基准方法，对复杂问题仍有效。
- 隐蔽性强，可绕过多数RAG防御，适合真实场景攻击测试。
增强检索生成（RAG）的大语言模型虽提升了响应准确性，但对外部知识库的依赖也带来了安全风险，尤其当知识库公开可修改时。现有攻击方法要么需注入多条污染文档（隐蔽性差），要么仅对简单查询有效（实用性低）。本文提出AuthChain攻击，仅通过污染单个文档即可成功攻击复杂多跳问题，解决三重挑战：确保污染文档被可靠检索、被模型信任，且在大型知识库和模型自身知识干扰下依然有效。在六种主流大模型上的实验表明，该方法攻击成功率显著高于现有最先进基线，同时具备更强隐蔽性，可有效规避当前RAG防御机制。
原文摘要 · Abstract (English)
Large Language Models (LLMs) enhanced with Retrieval-Augmented Generation (RAG) have shown improved performance in generating accurate responses. However, the dependence on external knowledge bases introduces potential security vulnerabilities, particularly when these knowledge bases are publicly accessible and modifiable. While previous studies have exposed knowledge poisoning risks in RAG systems, existing attack methods suffer from critical limitations: they either require injecting multiple poisoned documents (resulting in poor stealthiness) or can only function effectively on simplistic queries (limiting real-world applicability). This paper reveals a more realistic knowledge poisoning attack against RAG systems that achieves successful attacks by poisoning only a single document while remaining effective for complex multi-hop questions involving complex relationships between multiple elements. Our proposed AuthChain address three challenges to ensure the poisoned documents are reliably retrieved and trusted by the LLM, even against large knowledge bases and LLM's own knowledge. Extensive experiments across six popular LLMs demonstrate that AuthChain achieves significantly higher attack success rates while maintaining superior stealthiness against RAG defense mechanisms compared to state-of-the-art baselines.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。