Machine Against the RAG: Jamming Retrieval-Augmented Generation with Blocker Documents
Avital Shafran, Roei Schuster, Vitaly Shmatikov

TL;DR
This paper reveals a vulnerability in retrieval-augmented generation systems where adversaries can insert blocker documents to prevent specific queries from being answered, highlighting security concerns and potential defenses.
Contribution
The paper introduces a novel black-box optimization method for generating blocker documents that can jam RAG systems without needing internal model details or auxiliary LLMs.
Findings
Jamming attacks are effective across various embeddings and LLMs.
Existing safety metrics do not detect vulnerability to blocker documents.
Proposed defenses can mitigate jamming attacks.
Abstract
Retrieval-augmented generation (RAG) systems respond to queries by retrieving relevant documents from a knowledge database and applying an LLM to the retrieved documents. We demonstrate that RAG systems that operate on databases with untrusted content are vulnerable to denial-of-service attacks we call jamming. An adversary can add a single ``blocker'' document to the database that will be retrieved in response to a specific query and result in the RAG system not answering this query, ostensibly because it lacks relevant information or because the answer is unsafe. We describe and measure the efficacy of several methods for generating blocker documents, including a new method based on black-box optimization. Our method (1) does not rely on instruction injection, (2) does not require the adversary to know the embedding or LLM used by the target RAG system, and (3) does not employ an…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsAdversarial Robustness in Machine Learning · Cryptography and Data Security · Domain Adaptation and Few-Shot Learning
MethodsRefunds@Expedia|||How do I get a full refund from Expedia? · Attention Is All You Need · WordPiece · Linear Warmup With Linear Decay · Attention Dropout · Weight Decay · Residual Connection · Softmax · Layer Normalization · BERT
