标题： RAG安全：探索知识污染攻击对检索增强生成的影响 显示英文标题

标题： RAG Safety: Exploring Knowledge Poisoning Attacks to Retrieval-Augmented Generation

摘要： 检索增强生成（RAG）通过检索外部数据来缓解幻觉和过时知识问题，从而增强大型语言模型（LLMs）的能力。 得益于在促进多种数据源和支持忠实推理方面的强大能力，知识图谱（KGs）已被越来越多地应用于RAG系统，从而产生了基于知识图谱的RAG（KG-RAG）方法。 尽管RAG系统被广泛应用于各种应用中，但最近的研究也揭示了其对数据中毒攻击的脆弱性，其中注入到外部知识源中的恶意信息可能会误导系统产生错误或有害的响应。 然而，这些研究仅专注于使用非结构化文本数据源的RAG系统，尽管知识图谱由于其结构化和可编辑的特性而存在独特的漏洞，但KG-RAG的安全风险仍 largely 未被探索。 在本工作中，我们通过数据中毒攻击对KG-RAG方法的安全问题进行了首次系统的调查。 为此，我们引入了一个实际且隐蔽的攻击设置，与现实世界的实现相一致。 我们提出了一种攻击策略，首先识别对抗性目标答案，然后插入扰动三元组以在知识图谱中完成误导性的推理链，增加KG-RAG方法在生成过程中检索和依赖这些扰动的可能性。 通过在两个基准和四种最近的KG-RAG方法上的大量实验，我们的攻击策略表现出强大的有效性，即使在最小的知识图谱扰动下也是如此。 还进行了深入分析，以了解KG-RAG系统内部阶段内的安全威胁，并探讨大型语言模型对对抗性知识的鲁棒性。 显示英文摘要

摘要： Retrieval-Augmented Generation (RAG) enhances large language models (LLMs) by retrieving external data to mitigate hallucinations and outdated knowledge issues. Benefiting from the strong ability in facilitating diverse data sources and supporting faithful reasoning, knowledge graphs (KGs) have been increasingly adopted in RAG systems, giving rise to KG-based RAG (KG-RAG) methods. Though RAG systems are widely applied in various applications, recent studies have also revealed its vulnerabilities to data poisoning attacks, where malicious information injected into external knowledge sources can mislead the system into producing incorrect or harmful responses. However, these studies focus exclusively on RAG systems using unstructured textual data sources, leaving the security risks of KG-RAG largely unexplored, despite the fact that KGs present unique vulnerabilities due to their structured and editable nature. In this work, we conduct the first systematic investigation of the security issue of KG-RAG methods through data poisoning attacks. To this end, we introduce a practical, stealthy attack setting that aligns with real-world implementation. We propose an attack strategy that first identifies adversarial target answers and then inserts perturbation triples to complete misleading inference chains in the KG, increasing the likelihood that KG-RAG methods retrieve and rely on these perturbations during generation. Through extensive experiments on two benchmarks and four recent KG-RAG methods, our attack strategy demonstrates strong effectiveness in degrading KG-RAG performance, even with minimal KG perturbations. In-depth analyses are also conducted to understand the safety threats within the internal stages of KG-RAG systems and to explore the robustness of LLMs against adversarial knowledge.