攻击者用伪造图像污染视觉知识库，让多模态大模型生成错误内容。
Vis-Poison: Poisoning Visual Knowledge in Multimodal Retrieval-Augmented Generation
- 通过自动多智能体生成看似真实的恶意图像，直接作为攻击载体。
- 黑盒环境下对3万条知识的攻击成功率达40.16%至65.40%。
- 可绕过模型自身知识，对多种多模态大模型均有效，适合安全研究者关注。
随着多模态检索增强生成（RAG）系统越来越多依赖图像作为外部知识源，受污染的视觉证据会严重损害多模态大语言模型（MLLM）的生成能力。与以往依赖篡改文本元数据的攻击不同，本文提出Vis-Poison，一种新型视觉知识投毒攻击：攻击者控制的污染图像本身即为载荷，无需修改标题、摘要、元数据或其他相关文本。该攻击通过自动化多智能体方法生成视觉上合理的污染图像。我们评估了Vis-Poison在两种代表性多模态RAG管道、四种嵌入模型和六种生成模型上的效果。实验表明，在包含3万条目多模态知识库的黑盒设置下，其端到端攻击成功率可达40.16%至65.40%。此外，该攻击对仅依靠参数化知识即可正确回答的多种MLLM仍有效，平均成功率超过60%。代码与数据已公开于https://github.com/SWUFE-DB-Group/Vis-Poison。
原文摘要 · Abstract (English)
While multimodal retrieval-augmented generation (RAG) systems increasingly rely on images as external knowledge sources, the introduction of poisoned visual evidence can severely compromise multimodal large language model (MLLM) generation. Unlike prior attacks that rely on altering textual metadata, we introduce Vis-Poison, a novel visual knowledge poisoning attack where the poisoned image itself is the attacker-controlled payload, without manipulating captions, summaries, metadata, or other associated text. Specifically, this attack is instantiated through an automated multi-agent method that constructs visually plausible poisoned images. To assess its impact, we evaluate Vis-Poison across two representative multimodal RAG pipelines, four embedding models, and six generation models. Empirically, Vis-Poison achieves an end-to-end attack success rate of 40.16% to 65.40% against 30k-entry multimodal knowledge bases in \emph{black-box} settings. Moreover, Vis-Poison remains effective against various MLLMs that can answer correctly from parametric knowledge alone, with an average success rate above 60%. Code and data are available at https://github.com/SWUFE-DB-Group/Vis-Poison.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。