Knowledge destruction attack method and device based on RAG system, and medium

Abstract

The invention discloses a knowledge destruction attack method and device based on an RAG system and a medium, and relates to the technical field of internet security, and the method comprises the steps: inputting a target question and an error answer into the RAG system, and generating an initial confrontation text; performing multiple rounds of iterative optimization processing on the initial adversarial text to obtain a target adversarial text; inputting the target adversarial text into a knowledge base corresponding to the RAG system; the RAG system responds to a question demand input by a user, and retrieves and outputs a question answer corresponding to the question demand from the knowledge base; and inputting the question demand and the question answer into a large language model, so that the large language model outputs a wrong answer corresponding to the target question. The method and the device are used for solving the problems of low output result precision, poor attack effectiveness and low concealment when knowledge destruction attack is carried out based on an RAG system in the prior art, and the precision of the output result is improved under the condition that the knowledge destruction attack is effectively carried out with high concealment.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of Internet security, and in particular to a knowledge destruction attack method, device and medium based on a RAG system. BACKGROUND

[0002] With the wide application of large language models such as GPT-4, LLaMA, Qwen in the fields of medical question answering, financial analysis, legal consultation, etc., the accuracy, real-time performance and professionalism of their responses are facing challenges. Among them, the retrieval and generation (RAG) technology emerges as the times require, which combines external knowledge base retrieval and generation model to answer user queries to improve the accuracy and timeliness of responses.

[0003] For knowledge destruction attacks (such as PoisonedRAG) on RAG systems, attackers inject a small amount of malicious text into the knowledge base, without modifying the LLM weights, so that the contaminated documents are preferentially selected in retrieval, thereby manipulating the generation module to output incorrect answers or the content expected by the attacker.

[0004] However, the existing knowledge destruction attacks have the following defects: the injected text has insufficient semantic matching with the target query, and the output result may not meet the attack expectations; the attack lacks concealment and is easily detected by the system's defense mechanism; the structure and vocabulary expression of the injected text are poor, affecting the effectiveness and concealment of the attack, etc. SUMMARY

[0005] To solve the problems of low accuracy of output results and poor effectiveness and concealment of attacks in the prior art based on RAG system knowledge destruction attacks, the present application proposes a knowledge destruction attack method, device and medium based on RAG system to improve the accuracy of output results while ensuring effective and highly concealed knowledge destruction attacks.

[0006] The present application provides a knowledge destruction attack method based on a RAG system, which comprises: inputting a target problem and an incorrect answer corresponding to the target problem into a RAG system to generate an initial adversarial text including the incorrect answer; performing multi-round iterative optimization processing on the initial adversarial text to obtain a target adversarial text, wherein the adversarial text is adjusted based on the semantic similarity between the adversarial text and the target problem during the multi-round iterative optimization processing; and inputting the target adversarial text into a knowledge base corresponding to the RAG system. The RAG system retrieves and outputs a question answer corresponding to the question demand from the knowledge base in response to the question demand based on the target question, and inputs the question demand and the question answer into a large language model to make the large language model output an error answer corresponding to the target question.

[0007] The method for knowledge destruction attack based on the RAG system provided in the embodiments of the present application performs multi-round iterative optimization processing on the initial adversarial text to obtain a target adversarial text, including: The optimization processing on the adversarial text of the tth round includes: calculating a semantic similarity between the adversarial text of the tth round and the target question, comparing the semantic similarity with a preset similarity threshold to obtain a comparison result, and obtaining a text adjustment strategy corresponding to the comparison result to adjust the adversarial text of the tth round; The t+1th round of optimization processing is performed by using the adjusted adversarial text, and the process is repeated until the semantic similarity is greater than a preset target similarity.

[0008] The method for knowledge destruction attack based on the RAG system provided in the embodiments of the present application, the similarity threshold includes: a first threshold, a second threshold and a third threshold; The first threshold is less than the second threshold, and the second threshold is less than the third threshold. The text adjustment strategy corresponding to the comparison result includes: In the case that the comparison result is that the semantic similarity is less than the first threshold, a first text adjustment strategy is obtained, wherein the first text adjustment strategy is used to instruct to globally reconstruct the adversarial text; In the case that the comparison result is greater than or equal to the first threshold and less than the second threshold, a second text adjustment strategy is obtained, wherein the second text adjustment strategy is used to instruct to locally optimize the adversarial text based on a first proportion; In the case that the comparison result is greater than or equal to the second threshold and less than the third threshold, a third text adjustment strategy is obtained, wherein the third text adjustment strategy is used to instruct to locally optimize the adversarial text based on a second proportion, and the first proportion is greater than the second proportion, indicating the proportion of the text to be optimized in the adversarial text; In the case that the comparison result is that the semantic similarity is greater than or equal to the third threshold, a fourth text adjustment strategy is obtained, wherein the fourth text adjustment strategy is used to instruct to slightly adjust the adversarial text.

[0009] The method for knowledge destruction attack based on the RAG system provided in the embodiments of the present application, adjusting the adversarial text of the tth round based on the first text adjustment strategy includes: obtain a first prompt template, and rewrite the adversarial text corresponding to the t-th round based on the first prompt template; The first prompt template includes: completely remodeling the adversarial text, replacing key text in the adversarial text with a replacement expression, and the semantic consistency between the rewritten adversarial text and the adversarial text before rewriting.

[0010] According to the method for knowledge destruction attack based on the RAG system provided in the embodiments of the present application, the adversarial text corresponding to the t-th round is adjusted based on a second text adjustment strategy, which includes: obtain a second prompt template, and adjust the first proportion of local text in the adversarial text corresponding to the t-th round based on the second prompt template; The second prompt template is obtained based on a constraint generation strategy, and the constraint generation strategy includes: replacing key text in the first proportion of local text with a replacement expression, recombining the first proportion of local sentence patterns, and the semantic consistency between the adjusted adversarial text and the adversarial text before adjustment.

[0011] According to the method for knowledge destruction attack based on the RAG system provided in the embodiments of the present application, the adversarial text corresponding to the t-th round is adjusted based on a third text adjustment strategy, which includes: obtain a third prompt template, and adjust the second proportion of local text in the adversarial text corresponding to the t-th round based on the third prompt template; The third prompt template includes: optimizing the semantics of key text in the second proportion of local text, and the semantic consistency between the adjusted adversarial text and the adversarial text before adjustment.

[0012] According to the method for knowledge destruction attack based on the RAG system provided in the embodiments of the present application, the adversarial text corresponding to the t-th round is adjusted based on a fourth text adjustment strategy, which includes: obtain a fourth prompt template, adjust the error syntax in the adversarial text corresponding to the t-th round based on the fourth prompt template, and ensure the semantic consistency between the adjusted adversarial text and the adversarial text before adjustment.

[0013] According to the method for knowledge destruction attack based on the RAG system provided in the embodiments of the present application, the semantic similarity between the adversarial text and the target question is calculated, which includes: Calculate the dot product similarity and the cosine similarity between the adversarial text and the target question; Input the dot product similarity and the cosine similarity into a preset similarity calculation formula to obtain the semantic similarity; The similarity calculation formula includes: ; Wherein, denotes the semantic similarity corresponding to the t-th round of iteration, denotes the weight, denotes the dot product similarity, denotes the cosine similarity.

[0014] The embodiment of the present application also provides an electronic device, comprising a memory, a processor and a computer program stored in the memory and executable on the processor, and the processor implements the steps of the knowledge destruction attack method based on the RAG system according to any one of the above when executing the program.

[0015] The embodiment of the present application also provides a non-transitory computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the steps of the knowledge destruction attack method based on the RAG system according to any one of the above.

[0016] The embodiment of the present application provides a knowledge destruction attack method, device and medium based on the RAG system, which inputs a target question and an incorrect answer corresponding to the target question into the RAG system to generate an initial adversarial text including the incorrect answer; performs multi-round iterative optimization processing on the initial adversarial text to obtain a target adversarial text, wherein the adversarial text is adjusted based on the semantic similarity between the adversarial text and the target question in the multi-round iterative optimization processing, the adversarial text is evaluated and corrected based on the semantic similarity between the adversarial text and the target question at each round of iteration, so that the adversarial text gradually approaches the target semantics, and the synchronous improvement of the semantic consistency and the retrieval visibility of the attack text is ensured; inputs the target adversarial text into a knowledge base corresponding to the RAG system; the RAG system retrieves and outputs a question answer corresponding to a question demand from the knowledge base in response to the question demand input by a user, wherein the question demand is obtained based on the target question; inputs the question demand and the question answer into a large language model to make the large language model output an incorrect answer corresponding to the target question, the optimized attack text is injected into the knowledge base, the RAG system is used to make the attack text be recalled preferentially due to the high sensitivity of the RAG system to semantic relevance, so as to induce the large language model to output an incorrect answer, and the success rate and the concealment of the adversarial attack are significantly improved while maintaining high semantic consistency, thereby effectively supporting the safety and robustness research of the RAG system. BRIEF DESCRIPTION OF DRAWINGS

[0017] In order to more clearly illustrate the technical solutions of the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings in the following description are some embodiments of the present application, and those skilled in the art can also obtain other drawings according to these drawings without creative labor.

[0018] Figure 1is one of the flow diagrams of the knowledge destruction attack method based on the RAG system provided by the embodiments of the present application; Figure 2 is another one of the flow diagrams of the knowledge destruction attack method based on the RAG system provided by the embodiments of the present application; Figure 3 is a structural diagram of an electronic device provided by the embodiments of the present application. DETAILED DESCRIPTION

[0019] To make the purposes, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor fall within the scope of protection of the present application.

[0020] In order to clearly illustrate the present application, the related information of the RAG system is further described below: The RAG system usually includes a knowledge base, a retriever and a generation module, wherein the retriever selects the most relevant document fragments from the knowledge base to the user query by using vector similarity, and then the large language model (LLM) generates the final answer.

[0021] In the security aspect, the existing attacks on the RAG system mainly include prompt injection attack, greedy coordinate gradient (GCG) attack, data poisoning attack and knowledge destruction attack. The prompt injection attack induces the LLM to perform an operation that does not conform to the security policy by embedding malicious instructions in the user query, but since the attack features are obvious, it is easy to be detected by security. The GCG attack manipulates the query vector distribution by iteratively generating an adversarial character suffix to bypass the filter, but it is usually aimed at prompt injection and is not suitable for directly polluting the knowledge base. The data poisoning attack mainly injects a large amount of malicious or fake content into the training set to make the model produce an error output, typical examples are “Humpty Dumpty” and “Joint-GCG”, but this kind of attack often needs to access the training data, which has high cost and long cycle.

[0022] The knowledge destruction attack (such as PoisonedRAG) for the RAG system is that the attacker injects a small amount of malicious text designed carefully into the knowledge base, without modifying the LLM weight, so that the polluted document is selected preferentially in the retrieval, thereby manipulating the generation module to output an error answer or the content expected by the attacker. However, the existing knowledge destruction attack has structural defects: (1) It usually adopts the strategy of directly injecting after single-round generation, lacks continuous optimization, and causes the semantic matching degree of the injected text to the target query to be insufficient.

[0023] (2) Relying on a single similarity index to guide optimization, without considering the direction sensitivity and amplitude difference of the vector space at the same time, leading to insufficient attack concealment, easy to be detected by defense mechanisms based on similarity threshold filtering.

[0024] (3) Lack of hierarchical optimization of different semantic matching intervals, unable to fine-tune text structure and lexical expression according to the sensitivity of the retriever to different similarity paragraphs, leading to a balance between semantics and retrievability, affecting attack effectiveness and concealment.

[0025] Therefore, the prior art fails to achieve multi-round semantic optimization and hierarchical guidance of injected text in structure, and cannot significantly improve the probability of being retrieved and generating target output in the RAG system while maintaining semantic consistency, affecting attack effectiveness and latency, which limits the in-depth development of the security and robustness of the RAG system.

[0026] In view of the defects of the knowledge destruction attack technology of the RAG system, such as "only supporting single-round injection, lacking iterative semantic optimization, relying on a single similarity index, poor attack concealment, and unable to improve the probability of being retrieved and generated while maintaining high semantic consistency", the embodiments of the present application provide a knowledge destruction attack method based on a RAG system to achieve precise, efficient and concealed attack on the retrieval module of the knowledge base in the RAG system. The specific implementation of the method is as shown in Figure 1 Step 101, input the target question and the error answer corresponding to the target question into the RAG system to generate an initial adversarial text including the error answer; perform multi-round iterative optimization processing on the initial adversarial text to obtain a target adversarial text; input the target adversarial text into the knowledge base corresponding to the RAG system.

[0027] Among them, the adversarial text is adjusted based on the semantic similarity between the adversarial text and the target question during the multi-round iterative optimization processing.

[0028] Step 102, the RAG system responds to the user's input question demand, retrieves and outputs the question answer corresponding to the question demand from the knowledge base; input the question demand and the question answer into the large language model to make the large language model output the error answer corresponding to the target question.

[0029] Among them, the question demand is obtained based on the target question.

[0030] ​The method for knowledge destruction attack based on the RAG system provided by the embodiments of the present application comprises the following steps: inputting a target question and an incorrect answer corresponding to the target question into the RAG system to generate an initial adversarial text comprising the incorrect answer; performing multi-round iterative optimization processing on the initial adversarial text to obtain a target adversarial text, wherein the adversarial text is adjusted based on the semantic similarity between the adversarial text and the target question in the multi-round iterative optimization processing, the adversarial text is evaluated and corrected based on the semantic similarity between the adversarial text and the target question at each iteration, so that the adversarial text gradually approaches the target semantics, and the attack text is ensured to be simultaneously improved in semantic consistency and retrieval visibility; inputting the target adversarial text into a knowledge base corresponding to the RAG system; the RAG system responds to a question demand input by a user, retrieves and outputs a question answer corresponding to the question demand from the knowledge base, wherein the question demand is obtained based on the target question; and inputting the question demand and the question answer into a large language model to enable the large language model to output an incorrect answer corresponding to the target question. The attack text optimized by the present application is injected into the knowledge base, and the RAG system is highly sensitive to semantic correlation, so that the attack text is recalled preferentially, thereby inducing the large language model to output an incorrect answer, achieving a significant improvement in the success rate and concealment of the adversarial attack while maintaining high semantic consistency, and thus effectively supporting the safety and robustness research of the RAG system.

[0031] By the present application, a small amount of carefully designed adversarial text can be injected to induce the RAG system to output the expected incorrect or misleading content of the attacker when answering a specific query, while maintaining high semantic consistency between the injected text and the query, thereby avoiding detection by the vector similarity detection mechanism or the semantic deviation filtering rule, achieving the purpose of completing the targeted adversarial attack without modifying the LLM parameters, and providing strong technical support for the safety evaluation and defense mechanism design of the RAG system.

[0032] In one specific embodiment, the length of the finally generated adversarial text is within a preset interval range.

[0033] Next, the overall process of the present application will be described in detail. Figure 2 The overall process of the present application will be described in detail. Step 201, target setting and initialization processing.

[0034] Specifically, the attacker first determines a target question (for example, "When is Groundhog Day?") and an expected incorrect target answer (for example, "March 15th"). The malicious text generator in the system generates an initial adversarial text comprising the incorrect answer and having a length of a hyperparameter L according to a prompt template as shown in the prompt (Prompt) template. Figure 3 .

[0035] Step 202, multi-round iterative semantic optimization processing.​

[0036] The malicious text optimizer performs multi-round iterative optimization on the initial text. In each round of iteration, the system calculates the semantic similarity between the current adversarial text and the target question, and selects the corresponding optimization strategy according to the similarity score, continuously modifies the text content to maximize the probability of being retrieved by the RAG system, while maintaining the semantic concealment.

[0037] In one specific embodiment, the specific implementation of the multi-round iterative optimization processing on the initial adversarial text to obtain the target adversarial text includes: The optimization processing on the adversarial text of the tth round includes: calculating the semantic similarity between the adversarial text of the tth round and the target question; comparing the semantic similarity with the preset similarity threshold to obtain a comparison result; obtaining a text adjustment strategy corresponding to the comparison result to adjust the adversarial text of the tth round.

[0038] The adjusted adversarial text is used for optimization processing of the t+1th round until the semantic similarity is greater than the preset target similarity.

[0039] The present application introduces a multi-round iterative optimization framework to address the lack of semantic matching caused by the single-round generation and direct injection strategy of the prior art. In each iteration, the system evaluates and regenerates the adversarial text to ensure that the text gradually approaches the target question in terms of semantics (from coarse-grained to fine-grained approximation of the target question), thereby significantly improving its ranking and probability of being selected in the RAG retrieval module, and solving the problem of insufficient attack effectiveness.

[0040] In one specific embodiment, the specific implementation of calculating the semantic similarity between the adversarial text and the target question includes: calculating the dot product similarity and the cosine similarity between the adversarial text and the target question; inputting the dot product similarity and the cosine similarity into a preset similarity calculation formula to obtain the semantic similarity.

[0041] wherein the similarity calculation formula is shown in formula (1): ………………(1) wherein, represents the semantic similarity corresponding to the tth round of iteration, represents the weight, represents the dot product similarity, represents the cosine similarity.

[0042] wherein, ∈[0,1].

[0043] Specifically, the dot product similarity is obtained by formula (2), and the cosine similarity is obtained by formula (3).

[0044] …………(2) …………………………(3) wherein, represents a vector representation corresponding to the target question, represents a vector representation corresponding to the adversarial text.

[0045] At the same time, the normalization operation maps the cosine similarity range to [0, 1], ensuring that it shares a comparable value range with the dot product similarity for effective combination.

[0046] The present application comprehensively considers the direction sensitivity (evaluated by cosine similarity) and amplitude difference (evaluated by dot product similarity) of the text vector in the vector space, and assigns weights to different indicators. This measure can more comprehensively and accurately evaluate the semantic relevance between the adversarial text and the target query, guide the optimization process to generate more concealed and less easily filtered text by traditional similarity detection mechanisms, thereby improving the concealment of the attack.

[0047] In one specific embodiment, the similarity threshold includes a first threshold, a second threshold, and a third threshold.

[0048] wherein the first threshold is less than the second threshold, and the second threshold is less than the third threshold.

[0049] The specific implementation of obtaining the text adjustment strategy corresponding to the comparison result includes: In the case where the comparison result is a semantic similarity less than the first threshold, a first text adjustment strategy is obtained. In the case where the comparison result is greater than or equal to the first threshold and less than the second threshold, a second text adjustment strategy is obtained. In the case where the comparison result is greater than or equal to the second threshold and less than the third threshold, a third text adjustment strategy is obtained. In the case where the comparison result is a semantic similarity greater than or equal to the third threshold, a fourth text adjustment strategy is obtained.

[0050] wherein the first text adjustment strategy is used to instruct global reconstruction of the adversarial text.

[0051] wherein the second text adjustment strategy is used to instruct local optimization of the adversarial text based on a first proportion.

[0052] wherein the third text adjustment strategy is used to instruct local optimization of the adversarial text based on a second proportion, and wherein the first proportion is greater than the second proportion, indicating the proportion of the text to be optimized in the adversarial text.

[0053] wherein the fourth text adjustment strategy is used to instruct slight adjustment of the adversarial text.

[0054] In one specific embodiment, the specific implementation of adjusting the adversarial text corresponding to the tth round based on the first text adjustment strategy comprises: Obtaining a first prompt template, and rewriting the adversarial text corresponding to the tth round based on the first prompt template.

[0055] The first prompt template comprises: completely remodeling the adversarial text, replacing the key text in the adversarial text with a replacement expression, and the semantics of the rewritten adversarial text being consistent with the semantics of the original adversarial text.

[0056] In one specific embodiment, the specific implementation of adjusting the adversarial text corresponding to the tth round based on the second text adjustment strategy comprises: Obtaining a second prompt template, and adjusting the first proportion of local texts in the adversarial text corresponding to the tth round based on the second prompt template.

[0057] The second prompt template is obtained based on a constraint generation strategy, and the constraint generation strategy comprises: replacing the key text in the first proportion of local texts with a replacement expression, recombining the first proportion of local sentence patterns, and the semantics of the adjusted adversarial text being consistent with the semantics of the original adversarial text.

[0058] In one specific embodiment, the specific implementation of adjusting the adversarial text corresponding to the tth round based on the third text adjustment strategy comprises: Obtaining a third prompt template, and adjusting the second proportion of local texts in the adversarial text corresponding to the tth round based on the third prompt template.

[0059] The third prompt template comprises: optimizing the semantics of the key text in the second proportion of local texts, and the semantics of the adjusted adversarial text being consistent with the semantics of the original adversarial text.

[0060] In one specific embodiment, the specific implementation of adjusting the adversarial text corresponding to the tth round based on the fourth text adjustment strategy comprises: Obtaining a fourth prompt template, adjusting the erroneous grammar in the adversarial text corresponding to the tth round based on the fourth prompt template, and ensuring that the semantics of the adjusted adversarial text is consistent with the semantics of the original adversarial text.

[0061] Different levels of modification (major modification, major modification, minor modification, almost no modification) are not explicitly distinguished by traditional algorithm modules, but are achieved through the design of prompt templates (Prompts) of large language models (LLMs). Specifically, a corresponding Prompt template is designed for each modification strength, so that the model automatically controls the modification range and semantic retention degree according to the prompt content during the generation process, thereby achieving different levels of optimization goals.

[0062] 1. Major modification (first text adjustment strategy) This mode guides the model to reorganize the overall semantic framework and completely replace the syntactic structure through prompt words. The prompt explicitly requires the model to "completely reshape" and "replace key terms with alternative expressions". The model will rewrite the text body during generation, only retaining the core semantic direction, ensuring that the new text remains consistent with the original text in terms of theme relevance, but produces significant changes in expression, syntax, and word choice.

[0063] Specifically, this process is equivalent to "reconstruction generation" triggered at a high similarity threshold, i.e., the LLM reconstructs a new local optimal expression point in the semantic space based on the input semantic embedding.

[0064] 2. Major modifications (second text adjustment strategy) This mode corresponds to moderate modifications, requiring the model to use a "constraint generation strategy" through prompt words, mainly including synonym replacement, order adjustment, and partial sentence restructuring. The prompt instructs the model to retain the semantic core and logical structure while flexibly replacing local expressions, thereby improving the diversity and naturalness of semantics.

[0065] Specifically, it can be regarded as "neighborhood sampling" in the semantic space, i.e., making slight perturbations to syntax and vocabulary while maintaining overall semantic consistency.

[0066] 3. Small modifications (third text adjustment strategy) The prompt words of this mode emphasize "minor edits", such as replacing mood words or low-impact words. The model responds to keywords such as "fine-tuning" and "detail optimization" in the prompt, making only small-scale editing operations on the generated text, thereby ensuring that the generated result is consistent with the target text in high-level semantics.

[0067] Specifically, this layer is equivalent to fine-tuning near the original semantic vector, with the smallest modification range.

[0068] 4. Almost no modification (fourth text adjustment strategy) This mode requires the model to "maintain the original text structure and expression" in the prompt, allowing only grammatical corrections or minor polishing. The model basically reproduces the input content, and the output is highly consistent in semantics and syntax, ensuring minimal semantic drift.

[0069] The present application addresses the lack of fine-grained adjustment for different semantic matching intervals in the prior art, and proposes a fine-grained semantic hierarchical optimization strategy (different comparison results correspond to different modification ranges, and the modification range is iteratively executed from large to small, and the modification is completed when the execution modification range reaches the minimum). According to the semantic similarity of the adversarial text and the target problem, different optimization prompts are dynamically selected from the template library.

[0070] The template library stores various prompt templates.

[0071] Step 203, knowledge base injection processing.

[0072] The final malicious text after multiple rounds of optimization (for example, containing the content of "Groundhog Day [...] March 15") is injected into the external knowledge base relied on by the RAG system.

[0073] Step 204, response to user input and retrieval processing.

[0074] When the user inputs a target question (question requirement) to the RAG system, the retriever of the system retrieves the document fragment most relevant to the question from the knowledge base. Since the injected malicious text has been highly semantically optimized, it will be preferentially retrieved.

[0075] Step 205, generate an incorrect answer.

[0076] The retriever submits the text fragment containing malicious information as the context, along with the user's question, to the LLM. The LLM generates the final answer based on the contaminated context, thereby outputting the error content preset by the attacker (for example, "March 15").

[0077] The present application has conducted comprehensive experimental verification on multiple public data sets and LLMs. The experimental results show that, compared with the prior art, the present application has achieved significant and quantifiable technical effects in attack success rate (ASR), semantic consistency (F1 score), and generalization ability.

[0078] Specifically, the attack performance is significantly better than the existing technology baseline.

[0079] In comparison with various baseline methods such as NaiveAttack, CorpusPoisoningAttack, GCG attack, and PoisonedRAG, the present application shows the best performance on all data sets. Taking the GPT-4 model as an example, in the case of injecting only one malicious text (k=1), the present application achieves an attack success rate of 67% and an F1 score of 1.00. This far exceeds the current advanced PoisonedRAG method (ASR is 0.40), and the semantic consistency is perfect, while the GCG method is almost completely ineffective (ASR is 0.02, and F1 score is 0.00). This effect proves that the present application can ensure high concealment while achieving higher attack efficiency.

[0080] Specifically, it has a wide generalization attack ability for various mainstream LLMs.

[0081] The present application is not only effective for specific models, but also has good generalization. Strong attack effects are exhibited on multiple mainstream LLMs including Gemini, GPT-3.5, GPT-4, LLaMA, Qwen and DeepSeekR1. For example, on the HotpotQA dataset, the white-box attack success rate on DeepSeekR1 is as high as 99%, and the attack success rate on LLaMA is 96%. This proves the universality and robustness of the present application to different model architectures.

[0082] Specifically, the effectiveness of the iterative optimization mechanism.

[0083] The semantic similarity score between the malicious text and the target question continues to steadily increase with the number of iterations, proving the effectiveness of the iterative optimization mechanism.

[0084] ASR usually peaks after 2-3 iterations (e.g., in the NQ white-box condition, ASR reaches 0.69 after 3 iterations), verifying the key role of multi-round optimization in accurately guiding the attack direction.

[0085] When the "weighted similarity" module or the "multi-round iteration" module is removed alone, the attack success rate ASR decreases significantly. For example, on the MS-MARCO dataset, after removing the multi-round iteration module, ASR drops significantly from 0.56 to 0.44. This scientifically proves that each core technical component (weighted similarity measure and multi-round iteration mechanism) of the present application is indispensable and effective for achieving the final technical effect.

[0086] In addition, increasing the number of injected texts k can effectively improve ASR. There is an optimal interval for text length L (usually around 100 words), and too short or too long will result in a decrease in attack effectiveness.

[0087] The present application combines multi-round iteration + hierarchical semantic optimization + weighted similarity measure, breaking through the bottleneck of existing RAG attack techniques that only support single-round injection, insufficient semantic optimization, and poor concealment, achieving a significant improvement in attack success rate and concealment while maintaining high semantic consistency, thereby effectively supporting RAG system security and robustness research.

[0088] Figure 3 An example of an entity structure diagram of an electronic device is shown in FIG. 1. Figure 3As shown, the electronic device can include a processor 301, a communications interface 302, a memory 303, and a communications bus 304, wherein the processor 301, the communications interface 302, and the memory 303 complete communications with each other through the communications bus 304. The processor 301 can invoke a logical instruction in the memory 303 to execute the knowledge destruction attack method based on the RAG system.

[0089] In addition, the logical instruction in the memory 303 described above can be implemented in the form of a software function unit and sold or used as an independent product, and can be stored in a computer-readable storage medium. Based on such understanding, the technical solutions of the present application essentially or parts of the prior art that contribute to the present application or parts of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes several instructions for making a computer device (which can be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0090] On the other hand, the present application also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions, when the program instructions are executed by a computer, the computer can execute the knowledge destruction attack method based on the RAG system provided by the above-mentioned methods.

[0091] In yet another aspect, the present application also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which is executed by a processor to implement the knowledge destruction attack method based on the RAG system provided by the above-mentioned embodiments.

[0092] The device embodiments described above are only schematic, wherein the units shown as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, i.e., they can be located in one place, or distributed on multiple network units. Part or all of the modules can be selected according to actual needs to achieve the purpose of the present embodiment. Those skilled in the art can understand and implement it without creative labor.

[0093] Those skilled in the art can clearly understand the implementation of the various embodiments by means of software and necessary general hardware platforms through the description of the above embodiments, and of course, the embodiments can also be implemented by hardware. Based on such understanding, the above technical solutions can be embodied in the form of a software product, and the computer software product can be stored in a computer readable storage medium, such as a ROM / RAM, a magnetic disk, an optical disk, etc., and includes a plurality of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute the method described in each embodiment or some parts of the embodiment.

[0094] Finally, it should be noted that: the above only describes the preferred embodiments of the present application, and the present application is not limited to the above embodiments. It can be understood that other improvements and changes directly derived or thought of by those skilled in the art without departing from the spirit and concept of the present application should be considered to be included in the protection scope of the present application.

Claims

1. A knowledge destruction attack method based on the RAG system, characterized in that, The method includes: The target question and its corresponding incorrect answers are input into the RAG system to generate initial adversarial text including the incorrect answers; the initial adversarial text is subjected to multiple rounds of iterative optimization to obtain the target adversarial text, wherein the adversarial text is adjusted based on the semantic similarity between the adversarial text and the target question during the multiple rounds of iterative optimization; the target adversarial text is then input into the knowledge base corresponding to the RAG system. The RAG system responds to a user's input question request, retrieves and outputs the question answer corresponding to the question request from the knowledge base, wherein the question request is obtained based on the target question; the question request and the question answer are input into a large language model so that the large language model outputs an incorrect answer corresponding to the target question.

2. The knowledge destruction attack method based on the RAG system according to claim 1, characterized in that, The initial adversarial text is subjected to multiple rounds of iterative optimization to obtain the target adversarial text, including: Optimization of the adversarial text in round t includes: Calculate the semantic similarity between the adversarial text and the target problem at the t-th iteration; compare the semantic similarity with a preset similarity threshold to obtain the comparison result; obtain the text adjustment strategy corresponding to the comparison result to adjust the adversarial text corresponding to the t-th iteration; The adjusted adversarial text is used for optimization in round t+1 until the semantic similarity is greater than the preset target similarity.

3. The knowledge destruction attack method based on the RAG system according to claim 2, characterized in that, The similarity thresholds include: a first threshold, a second threshold, and a third threshold; Among them, the first threshold is less than the second threshold, and the second threshold is less than the third threshold; Obtaining the text adjustment strategy corresponding to the comparison result includes: If the comparison result shows that the semantic similarity is less than the first threshold, a first text adjustment strategy is obtained, wherein the first text adjustment strategy is used to instruct the global reconstruction of the adversarial text; If the comparison result is greater than or equal to the first threshold and less than the second threshold, a second text adjustment strategy is obtained, wherein the second text adjustment strategy is used to indicate local optimization of the adversarial text based on a first ratio; If the comparison result is greater than or equal to the second threshold and less than the third threshold, a third text adjustment strategy is obtained, wherein the third text adjustment strategy is used to indicate local optimization of the adversarial text based on a second ratio, wherein the first ratio is greater than the second ratio, indicating the proportion of the text to be optimized to the adversarial text; If the comparison result is that the semantic similarity is greater than or equal to the third threshold, a fourth text adjustment strategy is obtained, wherein the fourth text adjustment strategy is used to indicate minor adjustments to the adversarial text.

4. The knowledge destruction attack method based on the RAG system according to claim 3, characterized in that, Adjust the adversarial text corresponding to round t based on the first text adjustment strategy, including: Obtain the first prompt word template, and rewrite the adversarial text corresponding to the t-th round based on the first prompt word template; The first prompt word template includes: completely reshaping the adversarial text, replacing key text in the adversarial text with alternative expressions, and ensuring that the rewritten adversarial text is semantically consistent with the original adversarial text.

5. The knowledge destruction attack method based on the RAG system according to claim 3, characterized in that, Adjust the adversarial text corresponding to round t based on the second text adjustment strategy, including: Obtain the second prompt word template, and adjust the local text of the first proportion in the adversarial text corresponding to the t-th round based on the second prompt word template; The second prompt word template is obtained based on a constraint generation strategy, which includes: replacing key text in a first proportion of local text with alternative expressions, reorganizing local sentence structures in the first proportion, and ensuring that the adjusted adversarial text is semantically consistent with the original adversarial text.

6. The knowledge destruction attack method based on the RAG system according to claim 3, characterized in that, Adjust the adversarial text corresponding to round t based on the third text adjustment strategy, including: Obtain the third prompt word template, and adjust the local text of the second proportion in the adversarial text corresponding to the t-th round based on the third prompt word template; The third prompt word template includes: optimizing the semantics of key texts in the second proportion of local text, and ensuring that the adjusted adversarial text is semantically consistent with the original adversarial text.

7. The knowledge destruction attack method based on the RAG system according to claim 3, characterized in that, Adjust the adversarial text for round t based on the fourth text adjustment strategy, including: Obtain the fourth prompt word template, adjust the grammatical errors in the adversarial text corresponding to round t based on the fourth prompt word template, and ensure that the semantics of the adjusted adversarial text are consistent with those of the original adversarial text.

8. The knowledge destruction attack method based on the RAG system according to any one of claims 1-7, characterized in that, Calculating the semantic similarity between the adversarial text and the target question includes: Calculate the dot product similarity and cosine similarity between the adversarial text and the target problem; The semantic similarity is obtained by inputting the dot product similarity and the cosine similarity into a preset similarity calculation formula. The similarity calculation formula includes: ； in, This represents the semantic similarity at the t-th iteration. Indicates weight, Represents dot product similarity. This represents the cosine similarity.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the knowledge destruction attack method based on the RAG system as described in any one of claims 1 to 8.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the steps of the knowledge destruction attack method based on the RAG system as described in any one of claims 1 to 8.

Images