基于关键词锚定的事实替换缓解RAG系统中的数据库泄露
Mitigating Database Leakage in RAG Systems with Keyword-Grounded Fact Substitution
浏览论文内容
中文总结 AI 辅助
针对RAG系统易受提示注入攻击导致数据库泄露的问题，提出KFS-RAG防御方法，通过关键词锚定的事实替换缓解泄露风险，同时保持响应准确性与相关性，为构建安全可信RAG系统提供可行方案。
中文摘要 AI 辅助
检索增强生成（Retrieval-Augmented Generation，RAG）已成为将大语言模型（Large Language Models，LLMs）与外部知识源相结合的强大范式。然而，RAG系统仍易受到提示注入攻击，这类攻击可能误导检索器或生成器，导致敏感数据库内容被泄露。为解决该问题，我们提出KFS-RAG，这是一种通过重构检索上下文来缓解信息泄露的防御方法。具体而言，我们的方法首先通过注意力回滚（attention rollout）结合因果扰动机制，从检索到的上下文中识别出一小部分有影响力的关键词；随后利用这些关键词引导辅助LLM从检索到的段落中生成一组紧凑的、基于关键词锚定的事实；最后用这些经过筛选的事实替换原始上下文，确保生成器基于经过净化的证据运行，而非原始检索文本。实验评估表明，KFS-RAG在注入攻击下可显著降低数据库泄露风险，同时保持响应的准确性和相关性。本研究为构建安全可信的RAG系统指明了一条可行路径。
英文摘要
Retrieval-Augmented Generation (RAG) has emerged as a powerful paradigm for combining large language models (LLMs) with external knowledge sources. However, RAG systems remain vulnerable to prompt injection attacks, which may mislead the retriever or generator to expose sensitive database contents. To address this issue, we propose KFS-RAG, a defense that mitigates information leakage by reformulating the retrieved context. Specifically, our method first identifies a small set of influential keywords from the retrieved context via an attention rollout plus a causal perturbation mechanism. These keywords are then used to guide an auxiliary LLM to generate a compact set of keyword-grounded facts from the retrieved passages. Finally, the original context is substituted with these curated facts, ensuring that the generator operates on sanitized evidence rather than the raw retrieved text. Experimental evaluations demonstrate that KFS-RAG significantly reduces the risk of database leakage under injection attacks while maintaining response accuracy and relevance. This work highlights a practical pathway toward building secure and trustworthy RAG systems.
发表机构
- Nanjing University（南京大学）
机构由 AI 辅助整理，请以论文原文为准。
