发表机构
Duke University（杜克大学）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
提出DnD攻击，通过分散投毒段落并引入怀疑段落，在多种RAG配置下有效规避相似性与冲突感知防御，提升目标答案采纳率。
AI 中文摘要
多段落语料库投毒通常会在相似文档中重复同一目标主张，从而产生相关的词汇和语义模式，而基于相似性和冲突感知的防御机制可以联合抑制这些模式。我们提出了DnD（Divide and Doubt，划分与怀疑），一种基于两个原则的定向攻击：将目标答案的支持信息分散到风格多样的段落中，并包含一个对参考答案证据提出怀疑的段落。前者使投毒段落在嵌入空间中的表示分散化，而后者在检索到多个投毒段落时强化目标答案的采纳。我们在两个开放域问答数据集上，针对三种大语言模型和九种RAG配置，在检索器的黑盒和白盒访问条件下评估了DnD。在这些设置中，DnD在大多数配置下达到或优于先前攻击，其最大优势体现在对抗基于聚类和冲突感知的防御机制时。
英文摘要
Multi-passage corpus poisoning often repeats one target claim across similar documents, creating correlated lexical and semantic patterns that similarity- and conflict-aware defenses can suppress jointly. We introduce DnD (Divide and Doubt), a targeted attack based on two principles: distributing support for the target answer across stylistically diverse passages, and including a passage that casts doubt on evidence for the reference answer. The first disperses poison-passage representations in embedding space, while the second strengthens target adoption when multiple poisoned passages are retrieved. We evaluate DnD on two open-domain QA datasets across three LLMs and nine RAG configurations, under both black-box and white-box access to the retriever. Across these settings, DnD matches or outperforms prior attacks in most configurations, with its largest gains against clustering- and conflict-aware defenses.
