RAG中多态性女巫中毒的故障模式基准测试
A Failure-Mode Benchmark for Polymorphic Sybil Poisoning in RAG
AI总结：
该研究发布了用于问答的基准测试和评估框架，划分读者输出类别，介绍多态性女巫中毒攻击，通过对比揭示其危害，还发布了冻结基准、评估工具等。
摘要：
我们发布了一个用于协调检索中毒下基于事实的问答的基准测试和故障模式感知评估框架。该框架将读者输出分为四个互斥类别（“黄金”、“劫持”、“弃权”、“漂移”），有实例级配对的干净到中毒转换矩阵和强制曝光协议。我们引入了“多态性女巫中毒”，展示了其危害并发布了相关基准、工具等。
英文摘要：
We release a benchmark and failure-mode-aware evaluation framework for grounded QA under coordinated retrieval poisoning. The framework partitions reader outputs into four mutually exclusive categories (\emph{gold}, \emph{hijack}, \emph{abstention}, \emph{drift}), with instance-level paired clean-to-poison transition matrices and a Forced Exposure protocol isolating reader-side conflict resolution from retrieval variance. We introduce \emph{polymorphic sybil poisoning}, a coordinated attack class in which $S$ lexically diverse passages jointly support an attacker-chosen target while evading lexical near-duplicate filters that fully detect monomorphic baselines (capturing the residual 14.2\% with E5 cosine raises false-positive rate 9$\times$ on legitimate same-topic pairs). A monomorphic-polymorphic ablation under Forced Exposure isolates the diversity dimension and reveals a $+$18.8pp hijack amplification (95\% paired bootstrap CI $[+15.4, +22.4]$, $B{=}5{,}000$): monomorphic copies register only 4.0\% as hijack while polymorphic surface diversity recovers 22.8\% -- a 5.7$\times$ amplification of the ASR-visible attack channel. ASR alone treats every non-target output identically; under attack, abstention and drift together hold 47-66\% of output mass, unmonitored by ASR+ACC, and two readers at nearly identical ASR (within 0.2pp) differ by 16.5pp on abstention and 17.2pp on drift -- failure profiles invisible to ASR. We release the frozen benchmark (3{,}145 questions, 2{,}982 retained sybil groups; $S{=}6$ chosen to dominate top-10 retrieval slots, §\ref{sec:setup}), the official four-way evaluator, paired-transition utilities, and the Forced Exposure harness across five readers (7B-120B), two retrievers, and two cross-validation datasets (TriviaQA, 2Wiki), under CC~BY-SA~4.0 (data) and MIT (software); release information in §\ref{sec:release}.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
