提出RAGuard框架，有效检测知识库中毒文本。
Secure Retrieval-Augmented Generation against Poisoning Attacks
- 扩大检索范围并分块计算困惑度，识别异常文本
- 通过文本相似度过滤，发现高度重复的攻击内容
- 无需参数训练，适合提升RAG系统安全性
大型语言模型（LLMs）已深刻改变自然语言处理，从内容生成到决策支持广泛应用。检索增强生成（RAG）通过引入外部知识提升性能，但也带来数据投毒风险：攻击者向知识库注入污染文本以操纵输出。尽管已有多种防御方法，但对高级攻击仍显不足。为此，本文提出RAGuard检测框架：首先扩大检索范围以提高干净文本占比，降低污染内容被召回概率；随后采用分块困惑度过滤识别异常变化，结合文本相似度过滤标记高度相似内容。该无参数方法显著增强RAG安全性，在大规模数据集上的实验表明其能有效检测并缓解包括强自适应攻击在内的各类投毒行为。
原文摘要 · Abstract (English)
Large language models (LLMs) have transformed natural language processing (NLP), enabling applications from content generation to decision support. Retrieval-Augmented Generation (RAG) improves LLMs by incorporating external knowledge but also introduces security risks, particularly from data poisoning, where the attacker injects poisoned texts into the knowledge database to manipulate system outputs. While various defenses have been proposed, they often struggle against advanced attacks. To address this, we introduce RAGuard, a detection framework designed to identify poisoned texts. RAGuard first expands the retrieval scope to increase the proportion of clean texts, reducing the likelihood of retrieving poisoned content. It then applies chunk-wise perplexity filtering to detect abnormal variations and text similarity filtering to flag highly similar texts. This non-parametric approach enhances RAG security, and experiments on large-scale datasets demonstrate its effectiveness in detecting and mitigating poisoning attacks, including strong adaptive attacks.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。