提出可证明鲁棒的检索聚合方法，防御恶意篡改的检索内容攻击
PRA-RAG: Provably Robust Aggregation in Retrieval-Augmented Generation against Retrieval Corruption
- 通过多组合采样与嵌入空间几何结构识别稳健文本子集
- 攻击成功率降至1%，准确率保持71%，显著优于现有方法
- 适合关注大模型安全、对抗攻击防御的研究者
检索增强生成（RAG）通过引入外部知识提升大语言模型的能力，有效缓解其固有的知识局限。然而，RAG仍易受中毒攻击影响，攻击者通过操纵检索内容误导模型输出。现有防御机制通常缺乏理论鲁棒性保障，且在大模型对检索内容了解有限时表现不可靠。本文提出PRA-RAG，一种可证明鲁棒的检索聚合算法，用于防御检索内容中毒攻击。PRA-RAG采样多种检索文本组合，利用嵌入空间中的几何结构识别稳健子集，并生成稳定聚合表示。我们给出了受污染检索内容最大影响的理论边界，并建立了RAG鲁棒性的量化度量。在多个基准和RAG架构上的实验表明，PRA-RAG将攻击成功率降低至1%以下，同时保持71%的准确率，显著优于现有先进方法。
原文摘要 · Abstract (English)
Retrieval-Augmented Generation (RAG) enhances Large Language Models (LLMs) by incorporating external knowledge, effectively mitigating their inherent knowledge limitations. However, RAG remains vulnerable to poisoning attacks that manipulate retrieved texts to mislead model outputs. Existing defense mechanisms often lack theoretical robustness guarantees and perform unreliably when the LLM has limited knowledge of the retrieved content. In this work, we propose PRA-RAG, a provably robust retrieval aggregation algorithm designed to defend against poisoning attacks on retrieved texts. PRA-RAG samples multiple combinations of retrieved texts and utilizes geometric structures in the embedding space to identify a robust subset, from which a stable aggregated representation is derived. We provide theoretical bounds on the maximum impact of poisoned retrieved content and establish a quantitative measure of RAG's robustness. Experiments across multiple benchmarks and RAG architectures demonstrate that PRA-RAG reduces the attack success rate to as low as 1% while maintaining an accuracy of 71%, significantly outperforming representative state-of-the-art methods.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。