微协作投毒：针对RAG系统的分布式攻击
Micro-Collaborative Poisoning: A Distributed Attack on RAG Systems
浏览论文内容
中文总结 AI 辅助
本文提出微协作投毒，一种将虚假主张分散到多个文档的分布式RAG攻击，实验表明其依赖弱信号累积而非单一段落，且难以通过文档检查发现。
中文摘要 AI 辅助
检索增强生成（RAG）通过将输出锚定在外部知识源上来改进大型语言模型，但这种依赖性也创造了投毒攻击的攻击面。本文引入了微协作投毒（Micro-Collaborative Poisoning），一种分布式攻击，其中虚假的目标主张被分割到多个局部可信的文档中，而不是集中在单个恶意段落中。我们通过改变数据集、检索器架构、检索深度、数据库组成、被投毒数据库的数量以及生成模型，在108种RAG配置上评估了该攻击。结果表明，微协作投毒并非由单个占主导地位的投毒段落驱动，而是由跨检索来源的弱对抗信号的累积驱动。增加top-k值和对多个数据库进行投毒使得这些信号更有可能同时出现在检索到的上下文中，而干净数据库的多样性和更强的检索器可以降低其影响。文档级投毒可见性分析进一步表明，这种威胁难以通过孤立的文档检查来暴露，因为微协作投毒在实现下游影响的同时，留下的显式投毒特征比直接投毒更弱。
英文摘要
Retrieval-Augmented Generation (RAG) improves large language models by grounding outputs in external knowledge sources, but this dependency also creates a surface for poisoning attacks. This paper introduces Micro-Collaborative Poisoning, a distributed attack in which a false target claim is divided across multiple locally plausible documents instead of being concentrated in a single malicious passage. We evaluate the attack across 108 RAG configurations by varying dataset, retriever architecture, retrieval depth, database composition, number of poisoned databases, and generator model. The results indicate that Micro-Collaborative Poisoning is not driven by a single dominant poisoned passage, but by the accumulation of weak adversarial signals across retrieved sources. Increasing top-$k$ and poisoning multiple databases make it more likely that these signals will appear together in the retrieved context, while clean database diversity and stronger retrievers can reduce their influence. The document-level poisoning visibility analysis further shows that this threat is difficult to expose through isolated document inspection, since Micro-Collaborative Poisoning achieves downstream influence while leaving a weaker explicit poisoning signature than direct poisoning.
发表机构
- GECAD
- ISEP
- Polytechnic of Porto（波尔图理工学院）
机构由 AI 辅助整理，请以论文原文为准。
