通过追踪关键词影响，轻量级检测检索增强生成中的恶意篡改。
Tracing Target Answers in Poisoned Retrieval Corpora via Token Influence Attribution
- 基于关键词影响力追踪，定位被污染文档中的异常词
- 在三大问答基准上对六种大模型实现高精度攻击检测
- 可同时暴露攻击者指定的目标答案，适合安全审计场景
检索增强生成（RAG）系统易受语料库投毒攻击，攻击者通过恶意检索文档操纵模型输出。现有检测方法多依赖辅助分类器或额外大模型验证，计算开销大。本文提出TRACE框架，通过令牌影响归属追踪答案相关令牌，首先发现跨文档重复出现的高影响关键词，再进行二次验证以确认其对模型预测的影响。在三个问答基准和六种大模型上的实验表明，该方法具备强检测性能，同时能揭示攻击者指定的目标答案。
原文摘要 · Abstract (English)
Retrieval-Augmented Generation (RAG) systems are vulnerable to corpus poisoning attacks that manipulate model outputs through malicious retrieved documents. Existing detection methods typically rely on auxiliary classifiers or additional LLM-based verification, introducing substantial computational overhead. We present TRACE, a lightweight detection framework that identifies poisoning attacks by tracing answer-related tokens through token influence attribution. TRACE first discovers recurrent high-influence keywords across retrieved documents and then performs a secondary verification to confirm their influence on model predictions. Experiments on three QA benchmarks and six LLMs demonstrate strong detection performance while simultaneously uncovering attacker-specified target answers.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。