Walking the Embedding Space: Datastore Extraction from Multimodal RAG
Researchers show a black-box attack can extract hundreds of private images from multimodal RAG datastores.
The paper presents a black-box extraction attack against image-returning multimodal retrieval-augmented generation, where the retrieved image itself is the response. Each query blends an attacker-held shadow image with an already recovered image, and relevance-weighted resampling steers later queries toward embedding regions that still yield new items. Unlike prompt-based leakage attacks, the malicious instructions are placed inside the input image. Across medical, document, and general-purpose settings, one 2,500-query run reconstructed up to 611 radiology images, 566 document scans, and 416 general images, as much as 5.6 times a non-adaptive baseline, using CLIP-family retrievers.
- Black-box attack targets image-returning multimodal RAG systems.
- Queries blend a shadow image with an already recovered image.
- Malicious instructions are embedded in the input image, not text.
- One 2500-query run recovered up to 611 radiology images.
- Recovery reached up to 5.6 times a non-adaptive baseline.
Full article242 words · extracted from arxiv.org · click to collapse
Multimodal Retrieval-Augmented Generation (MRAG) has emerged as a reliable and cost-effective technique of grounding the generative capabilities of Multimodal Large Language Models (MLLMs) into relevant, up-to-date, external knowledge. Despite presenting several benefits, such as reducing hallucinatory behavior, they also introduce new attack surfaces, including leakage of private information and vulnerabilities against data extraction attacks. In this paper, we introduce $\immrag$, an adaptive and automatic data extraction attack procedure operating in a black box setting against \emph{image-returning} MRAG, a configuration in which the retrieved visual artifact is itself the response. Each query blends an attacker-held shadow image with an image already recovered from the system, and relevance-weighted resampling steers subsequent queries towards regions of the embedding space that still yield novel retrievals. Unlike current extraction attacks that aim to persuade the model towards data leakage by placing a malicious query as a textual prompt, $\immrag$ embeds the malicious instructions inside a user-given input image. We evaluate $\immrag$ on three plausible and distinct real-world scenarios: medical assistant, document-focused helper and general purpose tool. The experiments involve the study of the effectiveness of the attack on multiple CLIP-family retrievers, as well as the impact of various generators. A single 2500-query run reconstructs up to 611 distinct radiology images, 566 document scans and 416 general-purpose images under local-feature correspondence, and reaches up to $5.6\times$ as many distinct datastore items as a non-adaptive baseline. Our results show the urgent need for safeguards specifically designed for multimodal data.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2610.01871