用进化算法生成短指令后缀，骗过多个RAG系统输出错误答案。
DeRAG: Black-box Adversarial Attacks on Multiple Retrieval-Augmented Generation Applications via Prompt Injection
- 用差分进化优化恶意指令后缀，无需梯度信息，黑箱攻击。
- 仅用5个以内词元就让错误文档排名靠前，成功率超现有方法。
- 生成的后缀难被检测，适合研究系统漏洞或防御能力。
对抗性提示攻击可通过重新排序检索结果，显著影响检索增强生成（RAG）系统的可靠性。本文提出一种新方法，利用差分进化（DE）优化适用于RAG问答的对抗性提示后缀。该方法无梯度依赖，将RAG流程视为黑箱，通过演化候选后缀群体，最大化目标错误文档的检索排名，更贴近真实场景。我们在BEIR QA数据集上评估了多种检索应用下的攻击成功率，结果表明，基于DE的提示优化在密集检索器上表现优于GGPP、在稀疏检索器上优于PRADA，且仅需≤5个词元的对抗后缀。此外，我们引入可读性感知的后缀构建策略，经Welch's t检验验证其降低掩码语言模型负对数似然，具有统计显著性。通过BERT-based检测器评估，DE生成的后缀能有效逃避检测，检测准确率接近随机水平。
原文摘要 · Abstract (English)
Adversarial prompt attacks can significantly alter the reliability of Retrieval-Augmented Generation (RAG) systems by re-ranking them to produce incorrect outputs. In this paper, we present a novel method that applies Differential Evolution (DE) to optimize adversarial prompt suffixes for RAG-based question answering. Our approach is gradient-free, treating the RAG pipeline as a black box and evolving a population of candidate suffixes to maximize the retrieval rank of a targeted incorrect document to be closer to real world scenarios. We conducted experiments on the BEIR QA datasets to evaluate attack success at certain retrieval rank thresholds under multiple retrieving applications. Our results demonstrate that DE-based prompt optimization attains competitive (and in some cases higher) success rates compared to GGPP to dense retrievers and PRADA to sparse retrievers, while using only a small number of tokens (<=5 tokens) in the adversarial suffix. Furthermore, we introduce a readability-aware suffix construction strategy, validated by a statistically significant reduction in MLM negative log-likelihood with Welch's t-test. Through evaluations with a BERT-based adversarial suffix detector, we show that DE-generated suffixes evade detection, yielding near-chance detection accuracy.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。