SNAPRAG extracts RAG knowledge bases with fewer black-box queries
Original title: SNAPRAG: Cost-Efficient Knowledge Extraction Attack on RAG Systems via Adversarial Perturbations
The attack mutates tokens without an external LLM and, the authors say, needs up to 6.77 times fewer queries to extract half a knowledge base.
SNAPRAG is a black-box attack that extracts private retrieval-augmented generation knowledge bases by algorithmically mutating query tokens. An adaptive dissimilarity threshold pushes queries into unexplored regions of the target database under a fixed query budget. The authors report recovering up to 96.9% within that budget, beating the nearest method by 7.7 to 19.9 percentage points. Against active defenses it remained the leading attack on four of five targets.
Unconfirmed: Extraction rates are the authors' experimental results, not confirmed attacks on production systems.
- Extracting half the knowledge base took up to 6.77 times fewer queries.
- Within a fixed budget, recovery reached 96.9%.
- On defended targets, extraction rates were 50.7% to 96.3%.
- Queries are generated without an external LLM.
Impact: extraction of private RAG knowledge-base content
| Product | Affected |
|---|---|
| RAG systems | — |
From the original article
1 min read at arxiv.orgRetrieval-Augmented Generation (RAG) systems improve Large Language Model (LLM) responses by incorporating information from external knowledge bases. However, recent studies have shown that attackers can extract substantial portions of private knowledge bases from RAG systems through repeated querying.
By Melih Coşğun · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.