攻击者通过精心设计查询，可从多个候选模型中识别出正在使用的嵌入模型。
Embedding Inference Attack
- 基于黑盒查询，仅凭返回文档集判断使用哪个嵌入模型。
- 即使系统有重排序器，特定查询仍具区分性。
- 适用于真实RAG系统，绕过LLM对非标准问题的拒绝机制。
嵌入模型是现代信息检索（IR）系统的核心组件，但通常隐藏在API之后。近期研究显示，密集型IR系统可能引发安全漏洞，如嵌入反演攻击。然而，这类攻击通常要求攻击者知晓目标嵌入模型。本文研究在黑盒设置下的IR系统，即攻击者仅能观察到无序的检索文档集合，无法获取排名或相似度分数。我们证明，在此情境下，精心设计的查询能使攻击者从一组已知模型中识别出实际使用的嵌入模型，这一行为被称为嵌入推断攻击（EIA）。我们还发现，某些查询在系统引入重排序器作为防御机制时仍具有判别力。我们在真实检索增强生成（RAG）系统上验证了该方法的有效性，发现这些定制查询可规避大语言模型对非标准问题的拒绝倾向。最后，我们提出了并评估了相似度阈值等缓解策略。
原文摘要 · Abstract (English)
Embedding models are essential components of modern Information Retrieval (IR) systems, yet they are typically hidden behind APIs. Recent works have shown that dense IR system can lead to security vulnerabilities such as embedding inversion attacks. However, such attacks usually require that the attacker knows the embedding model for the attack to be applicable. In this paper, we study IR systems under a black-box setting in which the adversary observes only the unordered set of retrieved documents, without ranking or similarity scores. We demonstrate that in such contexts, tailored queries allow an adversary to identify which embedding model is in use from a set of known model candidate, which we coin as an embedding inference attack (EIA). We also show that certain queries remain discriminative even when the system includes a reranker as a potential defense mechanism. We further validate our method on a real Retrieval-Augmented Generation (RAG) system, in which the tailored queries bypass the LLM's tendency to reject inputs it does not recognize as well-formed questions. Finally, we propose and evaluate other mitigation strategies such as similarity thresholds.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。