攻击者伪造文档可伪装成可信控制信号，突破RAG系统安全边界。
Document-Authored Control-Signal Impersonation: A Low-Cost Indirect Prompt Attack on RAG Safety Boundaries
- 用伪造文档内容冒充元数据等控制信号，绕过RAG系统信任机制。
- 在6种模型设置中均出现越界行为，部分模型（如DeepSeek V4 Pro）风险显著。
- 适合研究AI安全、提示注入防御的开发者关注，揭示设计漏洞本质。
检索增强生成（RAG）系统常将用户查询、检索文档、元数据、系统标签和任务指令合并为一个自然语言提示。我们研究该设计中的源权威边界失效问题：攻击者伪造的检索文本可伪装成对模型有控制意义的元数据、出处、权威性或披露策略信号。我们称此现象为文档作者控制信号仿冒（DACSI）。DACSI是一种非指令型、类元数据的间接提示注入子类。核心启示是：文档内容是数据，不是政策。命令式注入要求模型忽略或违反政策；而DACSI则通过将不可信文档文本误认为授权控制信号，利用RAG提示渲染中可信与不可信文本混入同一语言通道的漏洞实现攻击。我们在六种模型设置、多种提示压力水平、不同注入基线、信号分类体系、RAG管道、系统控制探测器、源权威归属探测器及合成蜜罐格式下评估了DACSI。结果按模型类型解读而非简单重复：DeepSeek V4 Pro和Qwen3.5-397B表现出最清晰的正向提升，DeepSeek V4 Flash为高敏感性场景，GPT-5.5和Gemini 3.1 Pro Low为强边界探测器且存在残留风险，GLM-4.7则呈现饱和泄漏边界特征。这些结果表明，需单独评估DACSI，因其使用无命令的元数据/出处/政策表面，遵循RAG特有的源权威路径，并响应源与通道分离机制。源权威探测为行为归因证据，不证明内部机制。
原文摘要 · Abstract (English)
Retrieval-augmented generation (RAG) systems often serialize user queries, retrieved documents, metadata, system labels, and task instructions into one natural-language prompt. We study a source-authority boundary failure in this design: attacker-authored retrieved text can impersonate metadata, provenance, authority, or disclosure-policy signals that appear control-relevant to the model. We call this pattern Document-Authored Control-Signal Impersonation (DACSI). DACSI is a non-imperative, metadata-like payload subclass within indirect prompt injection. Its central lesson is simple: document-authored labels are data, not policy. Command-style injection asks the model to ignore, override, or violate policy; DACSI asks whether untrusted document text can be misattributed as an authorized control signal when RAG prompt rendering collapses trusted and untrusted text into the same natural-language channel. We evaluate DACSI across six model settings, prompt-pressure levels, injection baselines, signal taxonomies, RAG-mediated pipelines, system-control probes, a source-authority attribution probe, and synthetic canary formats. We interpret the evidence by model regime rather than as six equal replications: DeepSeek V4 Pro and Qwen3.5-397B provide the cleanest positive lift, DeepSeek V4 Flash is a high-susceptibility setting, GPT-5.5 and Gemini 3.1 Pro Low are strong-boundary probes with selected residual risks, and GLM-4.7 is a saturated leakage boundary case. Across these regimes, DACSI warrants separate evaluation because it uses a command-free metadata/provenance/policy surface, follows a RAG-specific source-authority path, and responds to source/channel separation. The source-authority probe is behavioral attribution evidence, not proof of an internal mechanism.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。