PURPOSE: Black-Box Poisoning Attack on RAG Conflict Resolution
A recent study presents PURPOSE, a black-box poisoning attack aimed at Retrieval-Augmented Generation (RAG) systems. This attack cleverly reframes the injection as an update that reduces conflict, avoiding detection by conflict resolution techniques. PURPOSE gathers facts related to the query that align with the resolver's potential reference and then anchors a pivotal event within them to ensure the injection remains coherent while guiding the generator towards the desired answer. The effectiveness of this method was tested across three QA benchmarks, five generators, and three conflict-resolution strategies, resulting in the highest success rate for attacks. The research can be found on arXiv under the identifier 2608.04756.
Key facts
- PURPOSE is a strict black-box poisoning attack for RAG systems.
- It reframes the injection as an update that minimizes conflict.
- It extracts query-related facts to approximate the resolver's reference.
- It grounds a pivot event in these facts to maintain consistency.
- Evaluated on three QA benchmarks, five generators, and three conflict-resolution methods.
- Achieved the highest attack success rate in the evaluation.
- The paper is available on arXiv with identifier 2608.04756.
- The attack targets post-retrieval conflict resolution in RAG.
Entities
Institutions
- arXiv