标题： RAG-WM：一种用于大型语言模型检索增强生成的有效黑盒水印方法 显示英文标题

标题： RAG-WM: An Efficient Black-Box Watermarking Approach for Retrieval-Augmented Generation of Large Language Models

摘要： 近年来，在检索增强生成（RAG）方面取得了巨大成功，广泛用于增强大型语言模型（LLMs）在特定领域、知识密集和隐私敏感任务中的表现。然而，攻击者可能会窃取这些有价值的RAG，并部署或商业化它们，因此检测知识产权（IP）侵权变得至关重要。现有的大多数所有权保护解决方案，如水印，是为关系型数据库和文本设计的。它们不能直接应用于RAG，因为关系型数据库水印需要白盒访问来检测IP侵权，这对于RAG中的知识库来说是不现实的。同时，攻击者部署的LLM通常会进行后处理，破坏文本水印信息。为了解决这些问题，我们提出了一种新的黑盒“知识水印”方法，名为RAG-WM，用于检测RAG的IP侵权。RAG-WM使用一个多LLM交互框架，包括水印生成器、影子LLM & RAG和水印鉴别器，基于水印实体-关系元组创建水印文本并将其注入目标RAG。我们在四个基准LLM上的三个特定领域和两个隐私敏感任务中评估了RAG-WM。实验结果表明，RAG-WM能够有效检测各种部署的LLM中的被盗RAG。此外，RAG-WM对改写、无关内容删除、知识插入和知识扩展攻击具有鲁棒性。最后，RAG-WM还可以规避水印检测方法，突显了其在检测RAG系统IP侵权方面的前景。 显示英文摘要

摘要： In recent years, tremendous success has been witnessed in Retrieval-Augmented Generation (RAG), widely used to enhance Large Language Models (LLMs) in domain-specific, knowledge-intensive, and privacy-sensitive tasks. However, attackers may steal those valuable RAGs and deploy or commercialize them, making it essential to detect Intellectual Property (IP) infringement. Most existing ownership protection solutions, such as watermarks, are designed for relational databases and texts. They cannot be directly applied to RAGs because relational database watermarks require white-box access to detect IP infringement, which is unrealistic for the knowledge base in RAGs. Meanwhile, post-processing by the adversary's deployed LLMs typically destructs text watermark information. To address those problems, we propose a novel black-box "knowledge watermark" approach, named RAG-WM, to detect IP infringement of RAGs. RAG-WM uses a multi-LLM interaction framework, comprising a Watermark Generator, Shadow LLM & RAG, and Watermark Discriminator, to create watermark texts based on watermark entity-relationship tuples and inject them into the target RAG. We evaluate RAG-WM across three domain-specific and two privacy-sensitive tasks on four benchmark LLMs. Experimental results show that RAG-WM effectively detects the stolen RAGs in various deployed LLMs. Furthermore, RAG-WM is robust against paraphrasing, unrelated content removal, knowledge insertion, and knowledge expansion attacks. Lastly, RAG-WM can also evade watermark detection approaches, highlighting its promising application in detecting IP infringement of RAG systems.