用关键词重构检索内容，防止RAG系统泄露敏感数据
Mitigating Database Leakage in RAG Systems with Keyword-Grounded Fact Substitution
- 通过注意力分析和因果扰动识别关键关键词
- 用关键词引导生成新事实，替换原始检索内容
- 有效防泄漏且保持回答准确，适合安全敏感场景
检索增强生成（RAG）结合大模型与外部知识源，但易受提示注入攻击，导致敏感数据库内容泄露。本文提出KFS-RAG防御机制，通过注意力传播与因果扰动识别检索文本中的关键影响词，再由辅助大模型基于这些关键词生成一组精炼的关键词锚定事实，替代原始上下文。该方法使生成器仅在清洗后的证据上运行，显著降低数据泄露风险，同时保持响应准确性和相关性。实验验证了其在对抗攻击下的有效性，为构建安全可信的RAG系统提供了实用路径。
原文摘要 · Abstract (English)
Retrieval-Augmented Generation (RAG) has emerged as a powerful paradigm for combining large language models (LLMs) with external knowledge sources. However, RAG systems remain vulnerable to prompt injection attacks, which may mislead the retriever or generator to expose sensitive database contents. To address this issue, we propose KFS-RAG, a defense that mitigates information leakage by reformulating the retrieved context. Specifically, our method first identifies a small set of influential keywords from the retrieved context via an attention rollout plus a causal perturbation mechanism. These keywords are then used to guide an auxiliary LLM to generate a compact set of keyword-grounded facts from the retrieved passages. Finally, the original context is substituted with these curated facts, ensuring that the generator operates on sanitized evidence rather than the raw retrieved text. Experimental evaluations demonstrate that KFS-RAG significantly reduces the risk of database leakage under injection attacks while maintaining response accuracy and relevance. This work highlights a practical pathway toward building secure and trustworthy RAG systems.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。