通过隐形符号扰动，让大模型从外部代码库中调取恶意代码。
RAG-Pull: Turning Retrieval into a Code-Injection Channel via Invisible Unicode Perturbations
- 在查询或代码库中注入隐形Unicode字符，操控检索结果。
- 联合扰动攻击下，近100%成功将模型引向恶意代码片段。
- 无需重训练，即可破坏模型安全对齐，适合安全研究者关注。
检索增强生成（RAG）通过引入外部数据提升大模型响应的可靠性，减少幻觉现象。我们提出一种新型黑盒攻击——RAG-Pull，通过在查询或外部代码仓库中注入隐藏的UTF字符，诱导检索结果转向恶意代码，从而突破模型的安全对齐机制。实验表明，仅对查询或代码进行扰动即可改变检索方向，而联合查询与目标扰动可实现接近100%的成功率。这些被检索到的代码片段可能包含远程代码执行、SQL注入等可利用漏洞。RAG-Pull的微小扰动即可改变模型的安全偏好，揭示了大模型在外部检索场景下的新威胁路径。
原文摘要 · Abstract (English)
Retrieval-Augmented Generation (RAG) increases the reliability and trustworthiness of the LLM response and reduces hallucination by eliminating the need for model retraining. It does so by adding external data into the LLM's context. We develop a new class of black-box attack, RAG-Pull, that inserts hidden UTF characters into queries or external code repositories, redirecting retrieval toward malicious code, thereby breaking the models' safety alignment. We observe that query and code perturbations alone can shift retrieval toward attacker-controlled snippets, while combined query-and-target perturbations achieve near-perfect success. Once retrieved, these snippets introduce exploitable vulnerabilities such as remote code execution and SQL injection. RAG-Pull's minimal perturbations can alter the model's safety alignment and increase preference towards unsafe code, therefore opening up a new class of attacks on LLMs.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。