RAG系统文档加载阶段存在隐蔽攻击漏洞，可被恶意篡改内容
The Hidden Threat in Plain Text: Attacking RAG Data Loaders
- 提出9类知识污染攻击，发现内容混淆与注入新威胁
- 19种隐蔽注入技术在357场景中成功率74.4%
- 六款端到端RAG系统均被攻破，含OpenAI等黑盒服务
大型语言模型自2022年ChatGPT发布以来深刻改变了人机交互方式，检索增强生成（RAG）作为关键框架，通过整合外部知识提升模型输出质量。然而，RAG依赖外部文档的摄入，带来了新的安全风险。本文揭示了数据加载阶段的关键安全漏洞：攻击者可通过文档摄入环节隐蔽地破坏RAG流程。我们提出了9类基于知识的投毒攻击分类，并引入两种新型威胁向量——内容混淆和内容注入，针对常见格式（DOCX、HTML、PDF）。利用自动化工具实现19种隐蔽注入技术，在五种主流数据加载器上测试，357个场景中攻击成功率达74.4%。进一步在六种端到端RAG系统上验证，包括白盒管道及黑盒服务如NotebookLM和OpenAI Assistants，结果表明攻击成功率高且能绕过过滤机制，无声破坏输出完整性。研究强调必须加强对RAG系统文档摄入过程的防护，以应对隐蔽内容操纵威胁。
原文摘要 · Abstract (English)
Large Language Models (LLMs) have transformed human-machine interaction since ChatGPT's 2022 debut, with Retrieval-Augmented Generation (RAG) emerging as a key framework that enhances LLM outputs by integrating external knowledge. However, RAG's reliance on ingesting external documents introduces new vulnerabilities. This paper exposes a critical security gap at the data loading stage, where malicious actors can stealthily corrupt RAG pipelines by exploiting document ingestion. We propose a taxonomy of 9 knowledge-based poisoning attacks and introduce two novel threat vectors -- Content Obfuscation and Content Injection -- targeting common formats (DOCX, HTML, PDF). Using an automated toolkit implementing 19 stealthy injection techniques, we test five popular data loaders, finding a 74.4% attack success rate across 357 scenarios. We further validate these threats on six end-to-end RAG systems -- including white-box pipelines and black-box services like NotebookLM and OpenAI Assistants -- demonstrating high success rates and critical vulnerabilities that bypass filters and silently compromise output integrity. Our results emphasize the urgent need to secure the document ingestion process in RAG systems against covert content manipulations.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。