When Safety Becomes a Vulnerability: Exploiting LLM Alignment Homogeneity for Transferable Blocking Attacks in RAG
When Safety Becomes a Vulnerability: Exploiting LLM Alignment Homogeneity for Transferable Blocking in RAG
Quick read
Based on 论文全文 （AI 生成）; refer to the original
The researchers propose TabooRAG, a transferable blocking attack against RAG systems: in a proxy RAG environment, they optimize one document per query, then transfer it to an unknown target system, inducing the model to refuse benign queries. The method exploits the overlap among safety-aligned models in risk categories and refusal criteria, which the authors call alignment homogeneity, and does not rely on instruction injection or adversarial suffixes. Across nine LLMs (including GPT-5.2 and DeepSeek-V4-Pro) and three datasets—NQ, MS-MARCO, and HotpotQA—the average ASR after filtering by Prompt-Guard is 62.1%, which is on average 67.3% higher than the strongest baseline in each setting; documents optimized against Llama-3-8B achieve an ASR of 83.3% on GPT-5.2. The attack retains some success rate against stronger pipelines such as hybrid retrieval and reranking, as well as under the evaluated defenses.
- RAG 系统易受 blocking attack 影响：投毒文档可让 LLM 拒绝回答良性查询，威胁服务可用性。已有攻击依赖对抗后缀或显式指令，对现代 LLM 效果下降、易被 prompt injection 过滤器识别，或需要目标系统反馈。
- 作者观察到安全对齐 LLM 在风险类别与拒绝标准上高度重叠，称为 alignment homogeneity，并据此提出 TabooRAG：在 surrogate RAG 环境中为每个查询优化一份文档，围绕查询构造 restricted risk context 以触发对齐驱动的拒绝，再迁移到未知目标系统。用 query-aware strategy library 复用已验证策略以降低优化成本。
- 在九个 LLM（含 GPT-5.2、DeepSeek-V4-Pro）和 NQ、MS-MARCO、HotpotQA 三个数据集上，TabooRAG 在 Prompt-Guard 过滤后于全部 27 个组合取得最高 ASR，平均 ASR PG 为 62.1%，比各设置最强基线均值高 67.3%。跨模型迁移、不同 surrogate/攻击者模型、更强 RAG pipeline、部署变体和现有防御下仍有效；策略库提升优化成功率并减少迭代次数。
- 研究局限于文本、开放域英文 QA 和第三方内容注入场景；多语言、多模态、特定领域 RAG 应用及更广泛的可用性评测基准是未来方向。
The paper presents a cross-model transferable RAG blocking attack with success rates across nine models, which can help deployers assess the availability risk posed by retrieval corpus poisoning.