原帖引用 · AI 翻译
标题：“在查询相关语料投毒下对 RAG 检索进行可靠性压力测试”
谷歌关于 RAG 投毒的新论文。
论文表明，对 RAG 系统投毒主要取决于复制查询文本，因为加入攻击载荷几乎没有改变哪些文档被检索出来。
伪造文档只需重复用户的问题，就能被那些先搜索再回答的 AI 系统选中；加入隐藏的攻击指令几乎没有改变这一点。
RAG 系统从外部人员有时也能写入的来源获取文档。任何隐藏指令要发挥作用，投毒页面首先必须通过检索器。
对于每条测试查询，他们添加了最多 5 篇重复查询文本的文档，其中有些包含攻击载荷，有些不包含。他们在 623 条查询上测试了传统关键词检索器、语义检索器，以及稠密嵌入模型 BGE-small。
仅 5 篇文档，约占语料库的 0.1%，就使传统检索器的排序质量下降了 40.2% 至 61.5%。一种拒绝重复查询文本的文档的过滤器拦住了这些文档，但也使 NFCorpus 上未投毒数据的排序质量减半，从 0.267 降至 0.134。
如果你的 RAG 索引接收外部内容，应标记那些照搬用户查询的文档，并衡量任何过滤器对未投毒查询造成的代价。
原文
New Google paper on RAG poisoning. Shows that poisoning a RAG system mostly depends on copying the query, since adding an attack payload barely changed which documents got retrieved. fake documents only need to repeat a user’s question to be picked up by AI systems that search before answering, and adding hidden attack instructions barely changed that. RAG systems pull documents from sources that outsiders can sometimes write to. Before any hidden instruction can act, the poisoned page first has to get past the retriever. For each test query, they added up to 5 documents repeating its text, with or without an attack payload. They tested classic keyword and semantic retrievers plus the dense embedding model BGE-small on 623 queries. Just 5 documents, about 0.1% of the corpus, cut classic retrievers' ranking quality by 40.2% to 61.5%. A filter that rejects query-echoing documents blocked them but halved clean ranking quality on NFCorpus, from 0.267 to 0.134. If your RAG index accepts outside content, flag documents that mirror user queries, and measure any filter's cost on clean queries too.