InceptionRAG: Stealthy Poisoning Attack Against Retrieval-Augmented Generation
InceptionRAG fragments malicious payloads into dormant passages that trigger LLMs to self-deduce misinformation via multi-hop reasoning, bypassing existing RAG poisoning defenses.
Researchers introduce InceptionRAG, a stealthy corpus poisoning attack against retrieval-augmented generation that splits a malicious payload into a chain of individually harmless dormant passages. When retrieved together, the passages induce LLMs to self-deduce target misinformation through multi-hop reasoning, achieving over 80% attack success rate across three datasets and three LLMs under rigorous adversarial constraints. A zeroth-order suffix optimization (ZOSO) method automates authoritative suffix generation in black-box settings. The authors also propose HODOR, a document isolation defense that decouples adversarial logical dependencies.
- InceptionRAG fragments malicious payloads into dormant passages that individually bypass mitigation
- Multi-hop reasoning causes LLMs to self-deduce misinformation when fragments are retrieved together
- Attack success rate exceeds 80% across three datasets and three LLMs
- Zeroth-order suffix optimization (ZOSO) enables black-box attack automation
- HODOR document-isolation defense decouples adversarial logical dependencies
From the original article
1 min read at arxiv.orgRetrieval-augmented generation (RAG) systems enhance large language models (LLMs) with external knowledge but have been demonstrated to be vulnerable to corpus poisoning. Existing poisoning attacks against RAG largely focus on single-point explicit injection, where the malicious payload is fully encapsulated within a single document.
By Jiachang Zhang · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.