Daily Arxiv

This page organizes papers related to artificial intelligence published around the world.
This page is summarized using Google Gemini and is operated on a non-profit basis.
The copyright of the paper belongs to the author and the relevant institution. When sharing, simply cite the source.

Silent Leaks: Implicit Knowledge Extraction Attack on RAG Systems through Benign Queries

Created by
  • Haebom

Author

Yuhao Wang, Wenjie Qu, Shengfang Zhai, Yanze Jiang, Zichen Liu, Yue Liu, Yinpeng Dong, Jiaheng Zhang

Implicit Knowledge Extraction Attack (IKEA) for Retrieval-Augmented Generation (RAG) Systems

Outline

This paper presents a knowledge extraction attack on the RAG system, specifically a novel attack technique called "IKEA." IKEA extracts information about an external knowledge base using natural queries instead of malicious inputs. Specifically, it leverages anchor concepts to generate natural queries and effectively "explores" the RAG system's knowledge through "Experience Reflection Sampling," which samples anchor concepts based on past query-response records, and "Trust Region Directed Mutation," which iteratively transforms anchor concepts under similarity constraints. Experimental results show that IKEA demonstrates higher extraction efficiency and success rates than existing attack techniques under various defense mechanisms. Furthermore, the proxy RAG system built using IKEA exhibits similar performance to the original RAG system, suggesting a risk of copyright infringement.

Takeaways, Limitations

Takeaways:
Demonstrating the feasibility of knowledge extraction attacks using natural queries: We demonstrate that knowledge extraction from RAG systems is possible without malicious input.
Attacks that are effective against various defense techniques: Development of attack techniques that bypass existing defense mechanisms.
Copyright Infringement Risk: The surrogate RAG system utilizing the extracted knowledge exhibits similar performance to the original, raising the possibility of potential copyright infringement.
Limitations:
Further research is needed on the specific implementation and details of the attack: Further research may be needed on the specific implementation and optimization of the methodology presented in the paper.
Validation of applicability in real environments is required: Attack success rate and safety verification in real RAG system environments are required.
The need to develop defense mechanisms: Raises the need to develop new defense technologies to counter attacks like the one against IKEA.
👍