PR-Attack：通过双层优化对大型语言模型中的检索增强生成进行协调的提示-RAG攻击
PR-Attack: Coordinated Prompt-RAG Attacks on Retrieval-Augmented Generation in Large Language Models via Bilevel Optimization
AI总结：
针对RAG-LLM安全漏洞，提出基于双层优化的PR-Attack攻击方法，通过注入少量中毒文本并嵌入提示后门，实现高成功率和隐蔽性的协调攻击。
摘要：
大型语言模型（LLMs）在广泛的应用中展示了卓越的性能，例如医学问答、数学科学和代码生成。然而，它们也表现出固有的局限性，如知识过时和易产生幻觉。检索增强生成（RAG）已成为解决这些问题的有前景的范式，但它也引入了新的漏洞。近期的研究聚焦于基于RAG的LLMs的安全性，然而现有的攻击方法面临三个关键挑战：（1）当只能向知识库中注入有限数量的中毒文本时，其有效性急剧下降；（2）它们缺乏足够的隐蔽性，因为攻击通常可被异常检测系统检测到，这损害了其有效性；（3）它们依赖启发式方法生成中毒文本，缺乏正式的优化框架和理论保证，限制了其有效性和适用性。为解决这些问题，我们提出了协调的提示-RAG攻击（PR-Attack），一种新颖的优化驱动的攻击方法，它向知识库中注入少量中毒文本，同时在提示中嵌入后门触发器。当触发器被激活时，它使LLM对目标查询生成预先设计的响应，而在其他上下文中保持正常行为。这确保了高有效性和隐蔽性。我们将攻击生成过程形式化为一个双层优化问题，利用原则性的优化框架来开发最优的中毒文本和触发器。在多种LLM和数据集上的广泛实验证明了PR-Attack的有效性，即使在有限数量的中毒文本下也能实现高攻击成功率，并且与现有方法相比显著提高了隐蔽性。
英文摘要：
Large Language Models (LLMs) have demonstrated remarkable performance across a wide range of applications, e.g., medical question-answering, mathematical sciences, and code generation. However, they also exhibit inherent limitations, such as outdated knowledge and susceptibility to hallucinations. Retrieval-Augmented Generation (RAG) has emerged as a promising paradigm to address these issues, but it also introduces new vulnerabilities. Recent efforts have focused on the security of RAG-based LLMs, yet existing attack methods face three critical challenges: (1) their effectiveness declines sharply when only a limited number of poisoned texts can be injected into the knowledge database, (2) they lack sufficient stealth, as the attacks are often detectable by anomaly detection systems, which compromises their effectiveness, and (3) they rely on heuristic approaches to generate poisoned texts, lacking formal optimization frameworks and theoretic guarantees, which limits their effectiveness and applicability. To address these issues, we propose coordinated Prompt-RAG attack (PR-attack), a novel optimization-driven attack that introduces a small number of poisoned texts into the knowledge database while embedding a backdoor trigger within the prompt. When activated, the trigger causes the LLM to generate pre-designed responses to targeted queries, while maintaining normal behavior in other contexts. This ensures both high effectiveness and stealth. We formulate the attack generation process as a bilevel optimization problem leveraging a principled optimization framework to develop optimal poisoned texts and triggers. Extensive experiments across diverse LLMs and datasets demonstrate the effectiveness of PR-Attack, achieving a high attack success rate even with a limited number of poisoned texts and significantly improved stealth compared to existing methods.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
