发现政府RAG系统中数值篡改漏洞，提出直接校验数值的检测方法
RAGShield: Detecting Numerical Claim Manipulation in Government RAG Systems
- 不依赖嵌入相似度，直接提取文本中的金额和百分比
- 在真实税务文档上检测到100%攻击，而现有方法漏检79%-90%
- 适合关注政务AI安全、数字治理的开发者与政策制定者
检索增强生成（RAG）系统被广泛用于联邦机构的税务指导、福利资格和法律信息等面向公众的服务中，单个错误数值可能导致直接经济损失。本文证明所有基于嵌入的RAG防御均存在根本盲区：将税额扣除项修改5万美元，其余弦相似度高达0.9998，远超所有已知检测阈值。在174组篡改样本和两种嵌入模型下，平均敏感性差距达1,459倍。该盲区已在真实美国国税局（IRS）文档上验证。根源在于嵌入编码主题而非数值精度。RAGShield通过直接操作提取数值来规避此问题：基于模式识别引擎提取政府文本中的金额与百分比，通过双阶段上下文传播（在2,742段真实IRS文本中实现99.8%实体识别率）将其关联至对应管理机构，并与自建跨源注册表比对验证每项声明。时间追踪器标记偏离政府更新周期的数值变化。在430个基于真实IRS内容生成的攻击样本中，RAGShield实现0.0%误报率（95%置信区间[0%, 1%]），而嵌入式防御漏检79%-90%。
原文摘要 · Abstract (English)
Retrieval-Augmented Generation (RAG) systems are deployed across federal agencies for citizen-facing tax guidance, benefits eligibility, and legal information, where a single incorrect number causes direct financial harm. This paper proves that all embedding-based RAG defenses share a fundamental blind spot: changing a tax deduction by $50,000 produces cosine similarity 0.9998, invisible to every known detection threshold. Across 174 manipulation pairs and two embedding models, the mean sensitivity gap is 1,459x. The blind spot is confirmed on real IRS documents.The root cause is that embeddings encode topic, not numerical precision. RAGShield sidesteps this by operating on extracted values directly: a pattern-based engine identifies dollar amounts and percentages in government text, links each value to its governing entity through two-pass context propagation (99.8% entity detection on 2,742 real IRS passages), and verifies every claim against a cross-source registry built from the corpus itself. A temporal tracker flags value changes that fall outside known government update schedules. On 430 attacks generated from real IRS document content, RAGShield detects every one (0.0% ASR, 95% CI [0%, 1%]) while embedding-based defenses miss 79-90% of the same attacks.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。