提出防御RAG入侵检测中知识污染和提示注入攻击的新框架。
Defending Retrieval-Augmented Intrusion Detection Against Knowledge Poisoning and Prompt Injection
- 三阶段多智能体架构，结合信任评分、标签嵌入一致性检查与提示净化。
- 30%知识污染下仍保持57%的检测性能恢复，单文档提示注入攻击成功率降至2.4%。
- 适合需要可解释性与抗攻击能力的混合部署入侵检测系统。
检索增强生成（RAG）通过从向量知识库中检索语义相似的历史流量，使大语言模型能够分类网络流并生成可读的事件报告。然而，检索层易受知识污染和提示注入攻击影响。本文提出RAG-IDS，一种三层多智能体入侵检测框架，采用检索边界防御机制，结合软信任评分、标签嵌入一致性检查（LECC）和提示净化，旨在恢复受攻击下的分类性能。在CIC-UNSW-NB15数据集上的实验表明，当污染比例为1%时性能恢复率可达R=1.0，30%污染下仍保持R=0.57，且对正常性能影响极小。面对提示注入攻击，多文档检索将标签翻转成功率限制在0.6%-2.4%，远低于单文档检索的35%-55%。消融实验显示，LECC是鲁棒性的主要贡献者，软信任降级优于硬过滤。该防御框架为入侵检测提供了可解释、抗攻击的基础，适用于与高吞吐分类器协同部署。
原文摘要 · Abstract (English)
Retrieval-Augmented Generation (RAG) enables large language models to classify network flows and generate human-readable incident reports by retrieving semantically similar historical traffic from a vector knowledge base. However, the retrieval layer introduces vulnerabilities to knowledge poisoning and prompt-injection attacks. We present RAG-IDS, a three-tier multi-agent intrusion detection framework with a retrieval-boundary defense combining soft trust scoring, label-embedding consistency checking (LECC), and prompt sanitization, designed to recover classification quality under retrieval-layer attack. Experiments on CIC-UNSW-NB15 show recovery relative to clean undefended performance ranging from R=1.0 at 1% poisoning to R=0.57 at 30%, with negligible clean-performance overhead. Under prompt injection, multi-document retrieval limits label-flip success to 0.6-2.4%, compared with 35-55% for single-document retrieval. Ablation results show that LECC is the primary contributor to robustness, while soft trust-based demotion outperforms hard filtering. The defended RAG pipeline offers an explainable, attack-resilient foundation for intrusion detection, well suited for hybrid deployment alongside high-throughput classifiers.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。