BadRAG: Identifying Vulnerabilities in Retrieval Augmented Generation of Large Language Models
CoRR(2024)
Abstract
Large Language Models (LLMs) are constrained by outdated information and a
tendency to generate incorrect data, commonly referred to as "hallucinations."
Retrieval-Augmented Generation (RAG) addresses these limitations by combining
the strengths of retrieval-based methods and generative models. This approach
involves retrieving relevant information from a large, up-to-date dataset and
using it to enhance the generation process, leading to more accurate and
contextually appropriate responses. Despite its benefits, RAG introduces a new
attack surface for LLMs, particularly because RAG databases are often sourced
from public data, such as the web. In this paper, we propose to
identify the vulnerabilities and attacks on retrieval parts (RAG database) and
their indirect attacks on generative parts (LLMs). Specifically, we identify
that poisoning several customized content passages could achieve a retrieval
backdoor, where the retrieval works well for clean queries but always returns
customized poisoned adversarial queries. Triggers and poisoned passages can be
highly customized to implement various attacks. For example, a trigger could be
a semantic group like "The Republican Party, Donald Trump, etc." Adversarial
passages can be tailored to different contents, not only linked to the triggers
but also used to indirectly attack generative LLMs without modifying them.
These attacks can include denial-of-service attacks on RAG and semantic
steering attacks on LLM generations conditioned by the triggers. Our
experiments demonstrate that by just poisoning 10 adversarial passages can
induce 98.2% success rate to retrieve the adversarial passages. Then, these
passages can increase the reject ratio of RAG-based GPT-4 from 0.01% to 74.6%
or increase the rate of negative responses from 0.22% to 72% for targeted
queries.
MoreTranslated text
AI Read Science
Must-Reading Tree
Example
![](https://originalfileserver.aminer.cn/sys/aminer/pubs/mrt_preview.jpeg)
Generate MRT to find the research sequence of this paper
Chat Paper
Summary is being generated by the instructions you defined