有人隐藏了它：针对基于大语言模型的检索的查询无关黑盒攻击
"Someone Hid It": Query-Agnostic Black-Box Attacks on LLM-Based Retrieval
AI总结：
本文提出一种无需查询或模型知识的黑盒攻击方法，通过零样本代理LLM生成可迁移的注入标记，揭示LLM检索系统的脆弱性。
摘要：
大型语言模型（LLMs）已被用作检索系统的有效骨干，包括检索增强生成（RAG）、密集信息检索器（IR）和代理记忆检索。最近的研究表明，基于LLM的检索（LLMR）容易受到对抗性攻击的影响，这些攻击通过令牌级注入操纵文档，使攻击者能够提升或降低这些文档在检索任务中的表现。然而，现有攻击研究主要假设攻击者已知查询，并高度依赖对受害者模型参数或交互的访问，这在现实场景中难以实现，导致有效性受限。为深入探讨LLMR的安全风险，我们提出了一种实用的黑盒攻击方法，该方法基于零样本代理LLM生成可迁移的注入令牌，而无需受害者查询或模型知识。我们的攻击有效性引发了关于类似效果可能由良性或意外文档编辑在现实世界中产生的担忧。为了实现我们的攻击，我们首先建立了LLMR的理论框架并进行了实证验证。在该框架下，我们将可迁移攻击模拟为min-max问题，并提出了一种对抗性学习机制，以找到最优的对抗性令牌。我们的攻击被验证在流行的LLM检索基准数据集上均有效。
英文摘要：
Large language models (LLMs) have been serving as effective backbones for retrieval systems, including Retrieval-Augmentation-Generation (RAG), Dense Information Retriever (IR), and Agent Memory Retrieval. Recent studies have demonstrated that such LLM-based Retrieval (LLMR) is vulnerable to adversarial attacks, which manipulates documents by token-level injections and enables adversaries to either boost or diminish these documents in retrieval tasks. However, existing attack studies mainly (1) presume a known query is given to the attacker, and (2) highly rely on access to the victim model's parameters or interactions, which are hardly accessible in real-world scenarios, leading to limited validity. To further explore the secure risks of LLMR, we propose a practical black-box attack method that generates transferable injection tokens based on zero-shot surrogate LLMs without need of victim queries or victim models knowledge. The effectiveness of our attack raises such a robustness issue that similar effects may arise from benign or unintended document edits in the real world. To achieve our attack, we first establish a theoretical framework of LLMR and empirically verify it. Under the framework, we simulate the transferable attack as a min-max problem, and propose an adversarial learning mechanism that finds optimal adversarial tokens with learnable query samples. Our attack is validated to be effective on benchmark datasets across popular LLM retrievers.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
