MrM：针对多模态RAG系统的黑盒成员推理攻击
MrM: Black-Box Membership Inference Attacks against Multimodal RAG Systems
AI总结：
本文提出首个面向多模态RAG系统的黑盒成员推理攻击框架MrM，通过对象感知扰动、反事实掩码选择和查询统计特征实现隐私泄露推断，并在多个商业模型上验证其有效性与鲁棒性。
摘要：
多模态检索增强生成（RAG）系统通过整合跨模态知识来增强大型视觉语言模型，使其在现实世界多模态任务中的应用日益广泛。这些知识库可能包含需要隐私保护的敏感信息。然而，多模态RAG系统本质上允许外部用户间接访问此类数据，使其可能容易受到隐私攻击，尤其是成员推理攻击（MIA）。现有的针对RAG系统的MIA方法主要关注文本模态，而视觉模态仍相对缺乏探索。为弥补这一差距，我们提出了MrM，这是首个针对多模态RAG系统的黑盒MIA框架。它采用受反事实攻击约束的多对象数据扰动框架，能够同时诱导RAG系统检索目标数据并生成泄露成员信息的内容。我们的方法首先采用对象感知的数据扰动方法，将扰动限制在关键语义上，以确保成功检索。在此基础上，我们设计了一种反事实信息掩码选择策略，优先选择信息量最大的掩码区域，旨在消除模型自身知识的干扰并放大攻击效果。最后，我们通过对查询试验建模来执行统计成员推理，以从响应模式中提取反映掩码语义重建情况的特征。在两个视觉数据集和八个主流商业视觉语言模型（例如GPT-4o、Gemini-2）上的实验表明，MrM在样本级和集合级评估中均取得持续优异的表现，并且在自适应防御下仍保持鲁棒性。
英文摘要：
Multimodal retrieval-augmented generation (RAG) systems enhance large vision-language models by integrating cross-modal knowledge, enabling their increasing adoption across real-world multimodal tasks. These knowledge databases may contain sensitive information that requires privacy protection. However, multimodal RAG systems inherently grant external users indirect access to such data, making them potentially vulnerable to privacy attacks, particularly membership inference attacks (MIAs). % Existing MIA methods targeting RAG systems predominantly focus on the textual modality, while the visual modality remains relatively underexplored. To bridge this gap, we propose MrM, the first black-box MIA framework targeted at multimodal RAG systems. It utilizes a multi-object data perturbation framework constrained by counterfactual attacks, which can concurrently induce the RAG systems to retrieve the target data and generate information that leaks the membership information. Our method first employs an object-aware data perturbation method to constrain the perturbation to key semantics and ensure successful retrieval. Building on this, we design a counterfact-informed mask selection strategy to prioritize the most informative masked regions, aiming to eliminate the interference of model self-knowledge and amplify attack efficacy. Finally, we perform statistical membership inference by modeling query trials to extract features that reflect the reconstruction of masked semantics from response patterns. Experiments on two visual datasets and eight mainstream commercial visual-language models (e.g., GPT-4o, Gemini-2) demonstrate that MrM achieves consistently strong performance across both sample-level and set-level evaluations, and remains robust under adaptive defenses.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
