标题： 在检索增强生成中防御知识污染攻击 显示英文标题

标题： Defending Against Knowledge Poisoning Attacks During Retrieval-Augmented Generation

摘要： 检索增强生成（RAG）已成为一种强大的方法，通过结合外部的最新知识源来提升大型语言模型（LLMs）的能力。 然而，这会引入知识中毒攻击的潜在漏洞，攻击者可以破坏知识源以误导生成模型。 其中一种攻击是PoisonedRAG，其中注入的对抗性文本会引导模型对目标问题生成攻击者选择的响应。 在本工作中，我们提出了新的防御方法FilterRAG和ML-FilterRAG，以减轻PoisonedRAG攻击。 首先，我们提出了一种新属性，以揭示知识数据源中对抗性文本和干净文本的不同特性。 接下来，我们在设计所提出的方法时，利用这一属性将对抗性文本与干净文本区分开来。 使用基准数据集对这些方法进行评估，证明了它们的有效性，性能接近原始RAG系统的性能。 显示英文摘要

摘要： Retrieval-Augmented Generation (RAG) has emerged as a powerful approach to boost the capabilities of large language models (LLMs) by incorporating external, up-to-date knowledge sources. However, this introduces a potential vulnerability to knowledge poisoning attacks, where attackers can compromise the knowledge source to mislead the generation model. One such attack is the PoisonedRAG in which the injected adversarial texts steer the model to generate an attacker-chosen response to a target question. In this work, we propose novel defense methods, FilterRAG and ML-FilterRAG, to mitigate the PoisonedRAG attack. First, we propose a new property to uncover distinct properties to differentiate between adversarial and clean texts in the knowledge data source. Next, we employ this property to filter out adversarial texts from clean ones in the design of our proposed approaches. Evaluation of these methods using benchmark datasets demonstrate their effectiveness, with performances close to those of the original RAG systems.