Google 论文研究 RAG 检索层语料投毒：复制查询即可劫持检索
Google 新论文测试 RAG 检索层投毒，发现伪造文档只需复制用户查询文本就能被检索器选中，是否附带隐藏攻击指令对检索结果影响很小。在 623 条查询上，仅 5 篇文档（约占语料 0.1%）就让经典检索器排序质量下降 40.2% 至 61.5%。能拦截查询复读文档的过滤器虽可阻断攻击，但在 NFCorpus 上把干净排序质量从 0.267 砍到 0.134。
Rohan Paul· @rohanpaul_ai · X·2026-11-06 02:24· 55 分钟前AI 评分55
AI 导读
Google 论文测试 RAG 系统的检索层投毒，发现攻击关键在于让伪造文档复制用户查询文本，是否附带隐藏攻击指令对检索结果影响很小。
正文 · 原文
New Google paper on RAG poisoning.
Shows that poisoning a RAG system mostly depends on copying the query, since adding an attack payload barely changed which documents got retrieved.
fake documents only need to repeat a user’s question to be picked up by AI systems that search before answering, and adding hidden attack instructions barely changed that.
RAG systems pull documents from sources that outsiders can sometimes write to. Before any hidden instruction can act, the poisoned page first has to get past the retriever.
For each test query, they added up to 5 documents repeating its text, with or without an attack payload. They tested classic keyword and semantic retrievers plus the dense embedding model BGE-small on 623 queries.
Just 5 documents, about 0.1% of the corpus, cut classic retrievers' ranking quality by 40.2% to 61.5%. A filter that rejects query-echoing documents blocked them but halved clean ranking quality on NFCorpus, from 0.267 to 0.134.
If your RAG index accepts outside content, flag documents that mirror user queries, and measure any filter's cost on clean queries too.
来源：Rohan Paul · x.com
来源：RadarAI · aihot.news