MIRROR: 基于新颖性约束的记忆引导MCTS红队测试用于智能体RAG
MIRROR: Novelty-Constrained Memory-Guided MCTS Red-Teaming for Agentic RAG
AI总结：
提出MIRROR框架，通过记忆引导蒙特卡洛树搜索和显式新颖性约束，在多模态智能体RAG系统的四个攻击面上实现高攻击成功率，并降低跨表面方差。
摘要：
多模态智能体检索增强生成（RAG）系统将攻击面从提示注入扩展到文本投毒、图像注入、直接查询攻击和编排器级工具操纵。现有的红队测试方法通常针对特定表面，且经常重复已知攻击模板；在文本投毒基准测试中，我们测量到73-84%的完全重复。我们提出MIRROR，一个统一的跨表面框架，执行记忆引导的蒙特卡洛树搜索，同时在显式新颖性约束下基于检索上下文调节候选生成。确定性新颖性门拒绝任何与检索集匹配的候选（经过归一化比较），使得检索能够告知搜索先验而不允许提示复制。在多模态智能体RAG目标的四个攻击面上，MIRROR在图像投毒上达到76%的攻击成功率（ASR），而基线为52%；在编排器攻击上以一半的查询成本达到97%的ASR，以及最低的跨表面方差（变异系数0.47）。相比之下，专门的基线在跨表面上崩溃：后缀优化在文本投毒上达到79%的ASR，但在直接查询上仅为1%。我们发布了ART-SafeBench，包含41,815条包内记录和运行时适配器，在四个表面上总计产生41,991+条记录。
英文摘要：
Multimodal agentic retrieval-augmented generation (RAG) systems expand the attack surface beyond prompt injection to include text poisoning, image injection, direct-query attacks, and orchestrator-level tool manipulation. Existing red-teaming approaches are typically surface-specific and often recycle known attack templates; on text-poisoning benchmarks we measure 73-84% exact duplication. We present MIRROR, a unified cross-surface framework that performs memory-guided Monte Carlo tree search while conditioning candidate generation on retrieved context under an explicit novelty constraint. A deterministic Novelty Gate rejects any candidate matching the retrieval set under normalized comparison, allowing retrieval to inform search priors without enabling prompt copying. Across four attack surfaces on a multimodal agentic RAG target, MIRROR attains 76% ASR on image poisoning compared with 52% for baselines, 97% ASR on orchestrator attacks at half the query cost, and the lowest cross-surface variance (coefficient of variation 0.47). In contrast, specialized baselines collapse across surfaces: suffix optimization reaches 79% ASR on text poisoning but 1% on direct queries. We release ART-SafeBench with 41,815 in-package records and runtime adapters yielding 41,991+ total records across four surfaces.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
