超越显式拒绝：针对检索增强生成的软故障攻击
Beyond Explicit Refusals: Soft-Failure Attacks on Retrieval-Augmented Generation
AI总结：
本文提出DEJA攻击框架，通过进化优化生成对抗文档，诱导系统产生非信息性但流畅的响应，降低回答确定性，实验显示其在多个RAG配置中有效，SASR超过79%。
摘要：
现有针对检索增强生成（RAG）系统的干扰攻击通常引发显式拒绝或拒绝服务行为，这些行为显眼且易被检测。本文正式定义了一种更微妙的可用性威胁，称为软故障，通过诱导流畅且连贯但非信息性的响应来降低系统效用。我们提出Deceptive Evolutionary Jamming Attack（DEJA），一种自动化黑盒攻击框架，通过利用大语言模型的安全对齐行为生成对抗文档，以触发此类软故障。DEJA采用由细粒度答案效用分数（AUS）引导的进化优化过程，该分数通过LLM评估器计算，以系统性地降低回答的确定性，同时保持高检索成功率。在多个RAG配置和基准数据集上的广泛实验表明，DEJA一致将响应推向低效的软故障，实现SASR超过79%，同时保持硬故障率低于15%，显著优于先前攻击。生成的对抗文档表现出高隐蔽性，能够逃避基于困惑度的检测并抵抗查询改写，且能够跨模型家族转移到专有系统中，无需重新定位。
英文摘要：
Existing jamming attacks on Retrieval-Augmented Generation (RAG) systems typically induce explicit refusals or denial-of-service behaviors, which are conspicuous and easy to detect. In this work, we formalize a subtler availability threat, termed soft failure, which degrades system utility by inducing fluent and coherent yet non-informative responses rather than overt failures. We propose Deceptive Evolutionary Jamming Attack (DEJA), an automated black-box attack framework that generates adversarial documents to trigger such soft failures by exploiting safety-aligned behaviors of large language models. DEJA employs an evolutionary optimization process guided by a fine-grained Answer Utility Score (AUS), computed via an LLM-based evaluator, to systematically degrade the certainty of answers while maintaining high retrieval success. Extensive experiments across multiple RAG configurations and benchmark datasets show that DEJA consistently drives responses toward low-utility soft failures, achieving SASR above 79\% while keeping hard-failure rates below 15\%, significantly outperforming prior attacks. The resulting adversarial documents exhibit high stealth, evading perplexity-based detection and resisting query paraphrasing, and transfer across model families to proprietary systems without retargeting.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
