释放蠕虫并提取数据：利用越狱在规模和严重性上升级针对基于RAG的推理的攻击结果
Unleashing Worms and Extracting Data: Escalating the Outcome of Attacks against RAG-based Inference in Scale and Severity Using Jailbreaking
AI总结：
本文揭示了攻击者利用越狱技术可将针对基于RAG的GenAI应用的攻击在严重性和规模上升级，包括提取80%-99.8%的数据库文档，并通过对抗性自复制提示在生态系统中触发蠕虫连锁反应。
摘要：
在本文中，我们展示了攻击者利用对GenAI模型的越狱能力，可以在严重性和规模上升级针对基于RAG的GenAI驱动应用的攻击结果。在论文的第一部分，我们展示了攻击者可以将RAG成员推理攻击和RAG实体提取攻击升级为RAG文档提取攻击，从而迫使产生比现有攻击更严重的后果。我们评估了三种提取方法获得的结果、所采用的五种嵌入算法的类型和大小的影响、所提供上下文的大小以及GenAI引擎。我们展示了攻击者可以提取Q&A聊天机器人RAG所用数据库中存储的80%-99.8%的数据。在论文的第二部分，我们展示了攻击者可以将RAG数据投毒攻击的规模从攻陷单个GenAI驱动应用升级为攻陷整个GenAI生态系统，从而造成更大规模的破坏。这是通过制作一个对抗性自复制提示来实现的，该提示会在生态系统内触发计算机蠕虫的连锁反应，并迫使每个受感染的应用执行恶意活动并攻陷其他应用的RAG。我们评估了该蠕虫在GenAI驱动的电子邮件助手生态系统内创建用户机密数据提取链的性能，并分析了该蠕虫的性能如何受到上下文大小、所使用的对抗性自复制提示、所采用的嵌入算法的类型和大小以及传播中跳数的影响。最后，我们审查并分析了用于保护基于RAG推理的护栏，并讨论了其权衡。
英文摘要：
In this paper, we show that with the ability to jailbreak a GenAI model, attackers can escalate the outcome of attacks against RAG-based GenAI-powered applications in severity and scale. In the first part of the paper, we show that attackers can escalate RAG membership inference attacks and RAG entity extraction attacks to RAG documents extraction attacks, forcing a more severe outcome compared to existing attacks. We evaluate the results obtained from three extraction methods, the influence of the type and the size of five embeddings algorithms employed, the size of the provided context, and the GenAI engine. We show that attackers can extract 80%-99.8% of the data stored in the database used by the RAG of a Q&A chatbot. In the second part of the paper, we show that attackers can escalate the scale of RAG data poisoning attacks from compromising a single GenAI-powered application to compromising the entire GenAI ecosystem, forcing a greater scale of damage. This is done by crafting an adversarial self-replicating prompt that triggers a chain reaction of a computer worm within the ecosystem and forces each affected application to perform a malicious activity and compromise the RAG of additional applications. We evaluate the performance of the worm in creating a chain of confidential data extraction about users within a GenAI ecosystem of GenAI-powered email assistants and analyze how the performance of the worm is affected by the size of the context, the adversarial self-replicating prompt used, the type and size of the embeddings algorithm employed, and the number of hops in the propagation. Finally, we review and analyze guardrails to protect RAG-based inference and discuss the tradeoffs.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
