RAGLeak paper describes supply-chain privacy backdoors in RAG systems
Original title: RAGLeak: Supply-Chain Privacy Backdoors in Retrieval-Augmented Generation
Authors say a triggered generator obfuscates private retrieved documents for later recovery, with up to 100% attack success in their tests.
A cs.CR paper proposes RAGLeak, a supply-chain privacy backdoor for retrieval-augmented generation that avoids exposing retrieved private documents as plain text. When triggered, the generator reversibly obfuscates those documents so an auxiliary model can recover them. The authors report the backdoor across three model families and three application domains, including after clean fine-tuning, and say representative detection defenses cut attack success by at most 10 percentage points. Source code is linked anonymously.
Unconfirmed: Attack-success and defense results are the authors’ reported measurements, not independently confirmed.
- The generator obfuscates retrieved private documents for recovery by an auxiliary LLM.
- Authors report up to 100% attack success with limited impact on benign utility.
- Reported attack success falls by at most 10 percentage points under tested detection defenses.
- They say the backdoor remained effective after clean fine-tuning and across scales and versions.
- Malware
- RAGLeak
From the original article
1 min read at arxiv.orgRetrieval-Augmented Generation (RAG) enables large language models to access external knowledge during inference, but its reliance on external knowledge bases also introduces new attack surfaces.
By Yuchen Chen · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.