提出双路径防御机制，防止RAG系统被逆向提取知识库。
RAGFort: Dual-Path Defense Against Proprietary Knowledge Base Extraction in Retrieval-Augmented Generation
- 通过对比重索引隔离跨类别知识，防止扩散
- 用约束级联生成保护类内细粒度信息
- 兼顾安全性与回答质量，适合高保密场景
部署在私有知识库上的检索增强生成（RAG）系统正面临重建攻击威胁，攻击者通过聚合模型响应，沿类内和类间路径逐步提取主题内细粒度知识并扩散至语义相关主题，实现对原始知识库的全面复现。现有防御仅针对单一路径，存在漏洞。我们系统性评估了分别保护每条路径的效果，发现联合防护才是有效防御的关键。基于此，提出RAGFort，一种结构感知的双模块防御：利用“对比重索引”实现类间隔离，通过“约束级联生成”强化类内保护。实验在安全、性能与鲁棒性方面均验证其显著降低重建成功率，同时保持答案质量，提供对知识库提取攻击的全面防御。
原文摘要 · Abstract (English)
Retrieval-Augmented Generation (RAG) systems deployed over proprietary knowledge bases face growing threats from reconstruction attacks that aggregate model responses to replicate knowledge bases. Such attacks exploit both intra-class and inter-class paths, progressively extracting fine-grained knowledge within topics and diffusing it across semantically related ones, thereby enabling comprehensive extraction of the original knowledge base. However, existing defenses target only one path, leaving the other unprotected. We conduct a systematic exploration to assess the impact of protecting each path independently and find that joint protection is essential for effective defense. Based on this, we propose RAGFort, a structure-aware dual-module defense combining "contrastive reindexing" for inter-class isolation and "constrained cascade generation" for intra-class protection. Experiments across security, performance, and robustness confirm that RAGFort significantly reduces reconstruction success while preserving answer quality, offering comprehensive defense against knowledge base extraction attacks.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。