提出新方法防御检索增强生成中的知识投毒攻击
Defending Against Knowledge Poisoning Attacks During Retrieval-Augmented Generation
- 基于对抗文本与正常文本的差异特征进行过滤
- 在基准数据集上接近原始RAG系统性能
- 适合关注大模型安全与知识可信性的研究者
检索增强生成（RAG）通过引入外部实时知识源，显著提升了大语言模型的能力。然而，这也带来了知识投毒攻击的风险，攻击者可篡改知识源以误导生成结果。例如，PoisonedRAG 攻击通过注入对抗性文本，使模型对特定问题生成攻击者指定的回答。本文提出两种新型防御方法：FilterRAG 和 ML-FilterRAG。首先，识别出可用于区分对抗文本与干净文本的独特属性；随后，利用该属性在知识源中过滤掉对抗性内容。在基准数据集上的评估表明，所提方法有效缓解了攻击，且性能接近原始 RAG 系统。
原文摘要 · Abstract (English)
Retrieval-Augmented Generation (RAG) has emerged as a powerful approach to boost the capabilities of large language models (LLMs) by incorporating external, up-to-date knowledge sources. However, this introduces a potential vulnerability to knowledge poisoning attacks, where attackers can compromise the knowledge source to mislead the generation model. One such attack is the PoisonedRAG in which the injected adversarial texts steer the model to generate an attacker-chosen response to a target question. In this work, we propose novel defense methods, FilterRAG and ML-FilterRAG, to mitigate the PoisonedRAG attack. First, we propose a new property to uncover distinct properties to differentiate between adversarial and clean texts in the knowledge data source. Next, we employ this property to filter out adversarial texts from clean ones in the design of our proposed approaches. Evaluation of these methods using benchmark datasets demonstrate their effectiveness, with performances close to those of the original RAG systems.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。