攻击者用伪造文档让AI生成看似正常实则无用的回答。
Beyond Explicit Refusals: Soft-Failure Attacks on Retrieval-Augmented Generation
- 用进化算法生成欺骗性文档，诱导AI产生看似合理却无信息量的回答。
- 在保持高检索成功率的同时，使回答有用性得分低于20%，软失败率超79%。
- 攻击隐蔽性强，能绕过检测并跨模型迁移，适合安全测试与防御研究。
现有对检索增强生成（RAG）系统的干扰攻击多导致明确拒绝或服务中断，易被发现。本文提出一种更隐蔽的可用性威胁——软失败：通过诱导大语言模型生成流畅但无信息量的回答来降低系统实用性。我们提出欺骗性进化干扰攻击（DEJA），一个基于黑盒的自动化框架，利用大模型的安全对齐行为，生成对抗性文档。DEJA采用进化优化过程，以基于LLM评估器计算的细粒度答案效用评分（AUS）为指导，系统性降低答案确定性，同时保持高检索成功率。在多个RAG配置和基准数据集上的实验表明，DEJA持续将响应推向低效软失败状态，在硬失败率低于15%的前提下实现超过79%的软失败率（SASR），显著优于已有攻击方法。生成的对抗文档具有高隐蔽性，可规避困惑度检测并抵抗查询改写，且无需重训练即可跨模型族迁移至专有系统。
原文摘要 · Abstract (English)
Existing jamming attacks on Retrieval-Augmented Generation (RAG) systems typically induce explicit refusals or denial-of-service behaviors, which are conspicuous and easy to detect. In this work, we formalize a subtler availability threat, termed soft failure, which degrades system utility by inducing fluent and coherent yet non-informative responses rather than overt failures. We propose Deceptive Evolutionary Jamming Attack (DEJA), an automated black-box attack framework that generates adversarial documents to trigger such soft failures by exploiting safety-aligned behaviors of large language models. DEJA employs an evolutionary optimization process guided by a fine-grained Answer Utility Score (AUS), computed via an LLM-based evaluator, to systematically degrade the certainty of answers while maintaining high retrieval success. Extensive experiments across multiple RAG configurations and benchmark datasets show that DEJA consistently drives responses toward low-utility soft failures, achieving SASR above 79\% while keeping hard-failure rates below 15\%, significantly outperforming prior attacks. The resulting adversarial documents exhibit high stealth, evading perplexity-based detection and resisting query paraphrasing, and transfer across model families to proprietary systems without retargeting.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。