发表机构
Shenzhen MSU-BIT University; The Chinese University of Hong Kong, Shenzhen（深圳北理莫斯科大学; 香港中文大学（深圳））
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
本研究揭示智能体RAG中检索器后门可利用反馈循环操纵证据与搜索，并通过注入-移除循环伪装净化，暴露弱防御被反用的系统性漏洞。
AI 中文摘要
智能体检索增强生成（RAG）将推理与重复检索交织在一起，使检索器对智能体观察到的证据及其后续搜索决策都具有影响力。我们研究了利用这种反馈循环的检索器后门，并利用弱后门净化来掩盖其存在。攻击者提供受损的检索器检查点，同时保持搜索智能体和部署语料库不变。在没有语料库写入权限的情况下，攻击者仍然可以抑制有用的证据，持续检索选定的现有文档，或将智能体引向长时间搜索，从而增加检索、上下文和延迟成本。为了掩盖这些行为不被检测，我们提出利用受控的注入-移除循环：故意注入一个较弱的后门，然后将其遗忘。这个过程削弱了检测器可见的签名，并通过净化的假象欺骗后门检测器，同时保留恶意检索行为。这些发现暴露了RAG系统中的系统性漏洞，其中弱防御成为攻击者隐藏后门检索器的工具，即使底层语料库仍然可信。
英文摘要
Agentic retrieval-augmented generation (RAG) interleaves reasoning with repeated retrieval, giving the retriever influence over both the evidence an agent observes and its subsequent search decisions. We study retriever backdoors that exploit this feedback loop and repurpose weak backdoor purification to conceal their presence. An attacker supplies a compromised retriever checkpoint while leaving the search agent and deployment corpus unchanged. Without corpus write access, the attacker can still suppress useful evidence, persistently retrieve a selected existing document, or steer the agent toward prolonged search, inflating retrieval, context, and latency cost. To conceal these behaviors from detection, we propose leveraging a controlled inject-and-remove cycle: deliberately inject a weaker backdoor and then unlearn it. This process weakens detector-visible signatures and fools the backdoor detectors with an illusion of purification while preserving the malicious retrieval behavior. These findings expose a systematic vulnerability in RAG systems in which a weak defense becomes an attacker's concealment tool for a backdoored retriever, even when the underlying corpus remains trustworthy.
Comments24 pages, 13 tables, 4 figures
