arXiv:2510.21144cs.AI2025-10NeurIPS被引 5

通过神经元引导的遗传优化,高效生成能欺骗大模型外部知识的攻击数据。

NeuroGenPoisoning: Neuron-Guided Attacks on Retrieval-Augmented Generation of LLM via Genetic Optimization of External Knowledge

  • 基于神经元激活敏感性,用遗传算法生成恶意外部知识。
  • 在多个模型和数据集上实现超90%的覆盖成功率,且保持文本流畅。
  • 可解决外部知识与模型内部记忆冲突问题,适合安全测试场景。

检索增强生成(RAG)使大语言模型在推理时动态整合外部知识,提升事实准确性与适应性。然而,攻击者可通过注入污染的外部知识覆盖模型内部记忆。现有攻击方法多迭代修改检索内容或提示结构,却忽视模型内部表征动态与神经元级敏感性。本文提出NeuroGenPoisoning,一种基于大模型内部神经元归因与遗传优化的新型攻击框架。首先识别对中毒知识高度响应的神经元(Poison-Responsive Neurons),再通过遗传算法演化出能最大激活这些神经元的对抗性文本片段。关键在于,该框架可大规模复用初始失败但有潜力的外部知识变体,显著提升有效攻击样本生成效率。同时,神经元引导机制能有效缓解外部知识与强参数化知识间的冲突。实验结果表明,该方法在多种模型与数据集上均实现超过90%的群体覆盖成功率(POSR),并保持生成内容的自然流畅性,实证验证其有效化解知识冲突的能力。

原文摘要 · Abstract (English)

Retrieval-Augmented Generation (RAG) empowers Large Language Models (LLMs) to dynamically integrate external knowledge during inference, improving their factual accuracy and adaptability. However, adversaries can inject poisoned external knowledge to override the model's internal memory. While existing attacks iteratively manipulate retrieval content or prompt structure of RAG, they largely ignore the model's internal representation dynamics and neuron-level sensitivities. The underlying mechanism of RAG poisoning has not been fully studied and the effect of knowledge conflict with strong parametric knowledge in RAG is not considered. In this work, we propose NeuroGenPoisoning, a novel attack framework that generates adversarial external knowledge in RAG guided by LLM internal neuron attribution and genetic optimization. Our method first identifies a set of Poison-Responsive Neurons whose activation strongly correlates with contextual poisoning knowledge. We then employ a genetic algorithm to evolve adversarial passages that maximally activate these neurons. Crucially, our framework enables massive-scale generation of effective poisoned RAG knowledge by identifying and reusing promising but initially unsuccessful external knowledge variants via observed attribution signals. At the same time, Poison-Responsive Neurons guided poisoning can effectively resolves knowledge conflict. Experimental results across models and datasets demonstrate consistently achieving high Population Overwrite Success Rate (POSR) of over 90% while preserving fluency. Empirical evidence shows that our method effectively resolves knowledge conflict.

RAG攻击神经元敏感性遗传优化知识冲突

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。