MARAGE：面向检索增强生成数据提取的可迁移多模型对抗攻击
MARAGE: Transferable Multi-Model Adversarial Attack for Retrieval-Augmented Generation Data Extraction
AI总结：
本文提出MARAGE框架，通过多模型梯度连续优化对抗性字符串，实现跨模型可迁移的RAG数据提取攻击，并验证其优于现有基线。
摘要：
检索增强生成（RAG）通过将大语言模型（LLMs）的输出锚定到从外部来源检索的知识上，为缓解大语言模型中的幻觉问题提供了一种解决方案。在构建这些外部数据存储时使用私有资源和数据，可能使其面临提取攻击的风险，攻击者试图从这些私有数据库中窃取数据。现有的RAG提取攻击通常依赖人工设计的提示，这限制了它们的有效性。本文提出了一个名为MARAGE的框架，用于优化一个对抗性字符串，当该字符串被附加到提交给目标RAG系统的用户查询中时，会使输出逐字包含所检索到的RAG数据。MARAGE利用一种连续优化方案，同时整合来自多个具有不同架构的模型的梯度，以增强优化后的字符串对未见模型的迁移性。此外，我们提出了一种强调目标RAG数据中初始token的策略，进一步提高了攻击的泛化能力。评估表明，MARAGE在多个LLMs和RAG数据集上始终优于人工基线和基于优化的基线，同时对先前未见过的模型保持稳健的迁移性。此外，我们进行了探测任务，以阐明MARAGE相比基线更有效的原因，并分析我们的方法对模型内部状态的影响。
英文摘要：
Retrieval-Augmented Generation (RAG) offers a solution to mitigate hallucinations in Large Language Models (LLMs) by grounding their outputs to knowledge retrieved from external sources. The use of private resources and data in constructing these external data stores can expose them to risks of extraction attacks, in which attackers attempt to steal data from these private databases. Existing RAG extraction attacks often rely on manually crafted prompts, which limit their effectiveness. In this paper, we introduce a framework called MARAGE for optimizing an adversarial string that, when appended to user queries submitted to a target RAG system, causes outputs containing the retrieved RAG data verbatim. MARAGE leverages a continuous optimization scheme that integrates gradients from multiple models with different architectures simultaneously to enhance the transferability of the optimized string to unseen models. Additionally, we propose a strategy that emphasizes the initial tokens in the target RAG data, further improving the attack's generalizability. Evaluations show that MARAGE consistently outperforms both manual and optimization-based baselines across multiple LLMs and RAG datasets, while maintaining robust transferability to previously unseen models. Moreover, we conduct probing tasks to shed light on the reasons why MARAGE is more effective compared to the baselines and to analyze the impact of our approach on the model's internal state.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
