通过可复用的注意力引导模块，实现低成本高效攻击RAG系统。
Eyes-on-Me: Scalable RAG Poisoning through Transferable Attention-Steering Attractors
- 将攻击文档拆分为可复用的注意力吸引器和聚焦区，降低优化成本。
- 在18种设置下平均攻击成功率提升至57.8%，较之前提升35.9点。
- 单个吸引器可迁移至未知模型，适合研究安全与可解释性方向。
现有的检索增强生成（RAG）系统数据投毒攻击因需为每个目标短语重新优化毒化文档而扩展性差。我们提出Eyes-on-Me，一种模块化攻击方法，将对抗性文档分解为可复用的注意力吸引器（Attention Attractors）和聚焦区（Focus Regions）。吸引器被优化以引导注意力至聚焦区，攻击者可插入语义诱饵或恶意指令，适应新目标仅需极低开销。该方法通过操纵一小部分与攻击成功强相关的注意力头实现。在18种端到端RAG设置（3个数据集 × 2个检索器 × 3个生成器）中，平均攻击成功率从21.9%提升至57.8%（+35.9点，超出之前工作2.6倍）。单个优化后的吸引器可无需重训即迁移至未见的黑盒检索器与生成器。研究揭示了注意力集中与模型输出之间的强关联，建立了可扩展的RAG投毒范式，并对系统安全性与可解释性研究具有启示。
原文摘要 · Abstract (English)
Existing data poisoning attacks on retrieval-augmented generation (RAG) systems scale poorly because they require costly optimization of poisoned documents for each target phrase. We introduce Eyes-on-Me, a modular attack that decomposes an adversarial document into reusable **Attention Attractors** and **Focus Regions**. Attractors are optimized to direct attention to the Focus Region. Attackers can then insert semantic baits for the retriever or malicious instructions for the generator, adapting to new targets at near zero cost. This is achieved by steering a small subset of attention heads that we empirically identify as strongly correlated with attack success. Across 18 end-to-end RAG settings (3 datasets $\times$ 2 retrievers $\times$ 3 generators), Eyes-on-Me raises average attack success rates from 21.9 to 57.8 (+35.9 points, 2.6$\times$ over prior work). A single optimized attractor transfers to unseen black box retrievers and generators without retraining. Our findings establish a scalable paradigm for RAG data poisoning and show that modular, reusable components pose a practical threat to modern AI systems. They also contribute to interpretability research by revealing a strong link between attention concentration and model outputs.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。