提出新型对抗攻击与评估框架，揭示RAG系统在隐蔽攻击下的失效模式。
A Failure-Mode Benchmark for Polymorphic Sybil Poisoning in RAG
- 构建四类输出分类体系，分离检索污染与阅读器响应冲突。
- 多态Sybil攻击使劫持率提升18.8个百分点，达单态攻击的5.7倍。
- 适合关注RAG安全、模型鲁棒性与对抗测试的研究者使用。
本文发布一个针对协同检索投毒下接地问答的失败模式基准与评估框架。该框架将阅读器输出分为四类互斥类别（正确、劫持、回避、漂移），并提供实例级的清洁到污染转移矩阵及强制暴露协议，以隔离阅读器侧冲突解决与检索方差异。提出「多态Sybil投毒」这一协同攻击类型：$S=6$个语义相关但词面多样化的段落联合支持攻击目标，可规避词汇近似重复检测，其对合法同主题对的误报率提升9倍（在E5余弦相似度下）。在强制暴露下，单态与多态攻击对比显示，劫持率提升18.8个百分点（95%置信区间[+15.4, +22.4]，$B=5{,}000$）：单态仅4.0%被劫持，而多态表面多样性恢复22.8%，攻击通道放大5.7倍。单纯用攻击成功率（ASR）无法捕捉隐藏风险——劫持外的回避与漂移共占47-66%输出质量，且两个相同ASR（相差<0.2pp）的阅读器在回避与漂移上分别相差16.5pp和17.2pp，这些失败特征未被传统指标覆盖。数据集含3,145个问题、2,982个保留的投毒组，涵盖五种阅读器（7B-120B）、两种检索器、两个交叉验证数据集（TriviaQA, 2Wiki），代码与数据遵循CC-BY-SA 4.0（数据）与MIT（软件）许可。
原文摘要 · Abstract (English)
We release a benchmark and failure-mode-aware evaluation framework for grounded QA under coordinated retrieval poisoning. The framework partitions reader outputs into four mutually exclusive categories (\emph{gold}, \emph{hijack}, \emph{abstention}, \emph{drift}), with instance-level paired clean-to-poison transition matrices and a Forced Exposure protocol isolating reader-side conflict resolution from retrieval variance. We introduce \emph{polymorphic sybil poisoning}, a coordinated attack class in which $S$ lexically diverse passages jointly support an attacker-chosen target while evading lexical near-duplicate filters that fully detect monomorphic baselines (capturing the residual 14.2\% with E5 cosine raises false-positive rate 9$\times$ on legitimate same-topic pairs). A monomorphic-polymorphic ablation under Forced Exposure isolates the diversity dimension and reveals a $+$18.8pp hijack amplification (95\% paired bootstrap CI $[+15.4, +22.4]$, $B{=}5{,}000$): monomorphic copies register only 4.0\% as hijack while polymorphic surface diversity recovers 22.8\% -- a 5.7$\times$ amplification of the ASR-visible attack channel. ASR alone treats every non-target output identically; under attack, abstention and drift together hold 47-66\% of output mass, unmonitored by ASR+ACC, and two readers at nearly identical ASR (within 0.2pp) differ by 16.5pp on abstention and 17.2pp on drift -- failure profiles invisible to ASR. We release the frozen benchmark (3{,}145 questions, 2{,}982 retained sybil groups; $S{=}6$ chosen to dominate top-10 retrieval slots, §\ref{sec:setup}), the official four-way evaluator, paired-transition utilities, and the Forced Exposure harness across five readers (7B-120B), two retrievers, and two cross-validation datasets (TriviaQA, 2Wiki), under CC~BY-SA~4.0 (data) and MIT (software); release information in §\ref{sec:release}.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。