TrojanRAG: Retrieval-augmented generation can become a backdoor driver for large language models

Researchers propose TrojanRAG, a method that carries out joint backdoor attacks in retrieval-augmented generation, thereby manipulating large language models in general scenarios. The attacker constructs target contexts and trigger sets, uses contrastive learning to orthogonally optimize multiple sets of backdoor shortcuts, and constrains trigger conditions to a parameter subspace to improve matching. To improve RAG's recall of target contexts, the method introduces knowledge graph construction of structured data to achieve hard matching at a fine-grained level. The authors also formalize backdoor scenarios for large language models from the perspectives of attackers and users, and examine whether context can become a jailbreak tool. Experiments on factuality, language understanding, and harmfulness tasks show that TrojanRAG poses multifaceted threats while maintaining normal query retrieval capability.