测试提示注入攻击在真实RAG系统中的存活率，发现多数攻击中途失效。
Can It Reach the Generator? Investigating the Survival of Prompt-Injection Attacks in Realistic RAG Settings
- 构建三阶段真实RAG流程，模拟攻击在检索与重排序中的衰减
- 仅大模型驱动的注入攻击能全程通过，其他类型成功率降至20%以下
- 轻量级防御模型在小数据集上即可100%检测所有攻击
近期生成引擎优化（GEO）研究显示，提示注入攻击可使目标文档在大模型推荐列表中排名靠前，最强攻击成功率约80%，引发对基于RAG推荐系统的安全担忧。然而，这些结果假设被攻击文档始终直接输入生成器，绕过检索器和重排序器，这在实际部署中不成立：攻击修改文档内容后，可能影响其是否被检索并获得足够高排名以进入生成器。本文在真实的三阶段流程（检索器→大模型重排序器→大模型生成器）下重新评估七种GEO攻击。结果表明，先前方法严重夸大攻击效果：基于梯度和指令覆盖的攻击在抵达生成器前基本失效，仅大模型驱动的提示注入仍能端到端生效。进一步分析发现，当前攻击极易被检测：一个在小规模攻击数据集上微调的轻量级提示注入防护模型即可实现100%检测率。代码与数据已公开于https://github.com/ielab/geo_injection_rag_survival。
原文摘要 · Abstract (English)
Recent generative engine optimisation (GEO) research has shown that prompt-injection attacks can push a target product to the top of an LLM's recommendation list, with the strongest attacks reporting around $80\%$ success and raising serious security concerns about RAG-based recommendation. However, these results assume the attacked document is always fed directly to the generator, bypassing the retriever and reranker. This is unrealistic: in deployed RAG systems, the attack modifies the document content, which can in turn change whether the document is retrieved and reranked highly enough to reach the generator at all. In this paper, we re-evaluate seven GEO attacks under a realistic three-stage pipeline (retriever\,$\to$\,LLM reranker\,$\to$\,LLM generator). We find that prior protocols substantially overstate attack effectiveness: gradient-based and instruction override attacks largely collapse before reaching the generator, and only LLM-driven prompt injections remain effective end-to-end. Our analysis further reveals that current GEO attacks are easily detectable: a lightweight prompt-injection guard finetuned on a small attack dataset already detects every attack. Our code and data are available at https://github.com/ielab/geo_injection_rag_survival.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。