arXiv:2603.22934cs.AI2026-03中稿 · KDD被引 1

通过梯度探测增强检索鲁棒性,防御语料投毒攻击。

ProGRank: Probe-Gradient Reranking to Defend Dense-Retriever RAG from Corpus Poisoning

  • 利用随机扰动与梯度信号检测异常查询-文档对
  • 在不重新训练的情况下提升对抗攻击下的检索稳定性
  • 适合部署在现有RAG系统中,无需修改原始模型

检索增强生成(RAG)通过引入检索证据提升大模型应用效果,但也带来了语料投毒这一新攻击面。攻击者可篡改或注入文本,使其进入目标查询的前K项结果并影响生成内容。现有防御方法多依赖内容过滤、辅助模型或生成器侧推理,部署复杂。本文提出ProGRank,一种后置、免训练的稠密检索器侧防御机制。该方法对每个查询-文档对施加轻微随机扰动,从固定参数子集提取探针梯度,生成两个不稳定性信号:表征一致性与分布风险,并结合得分门控进行重排序。ProGRank保持原文本不变,无需重训练,且在无法访问部署检索器时支持代理版本。跨数据集、检索器、攻击方式及检索阶段与端到端设置的实验表明,ProGRank显著提升鲁棒性,维持良好的鲁棒性-实用性平衡,包括在自适应规避攻击下仍有效。

原文摘要 · Abstract (English)

Retrieval-Augmented Generation (RAG) improves large language model applications by grounding generation in retrieved evidence, but also introduces corpus poisoning as a new attack surface. In this setting, an adversary injects or edits passages so that they enter the Top-$K$ results for target queries and influence downstream generation. Existing defences often rely on content filtering, auxiliary models, or generator-side reasoning, which complicates deployment. We propose ProGRank, a post hoc, training-free retriever-side defence for dense-retriever RAG. ProGRank stress-tests each query--passage pair under mild randomized perturbations, extracts probe gradients from a small fixed parameter subset, and derives two instability signals: representational consistency and dispersion risk. It then combines these signals with a score gate for reranking. ProGRank preserves the original passage content, requires no retraining, and supports a surrogate-based variant when the deployed retriever is unavailable. Experiments across datasets, retrievers, attacks, and retrieval-stage and end-to-end settings show that ProGRank improves robustness and maintains a favorable robustness--utility trade-off, including under adaptive evasive attacks.

RAG安全对抗攻击检索增强无训练防御

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。