RAGLeak: Supply-Chain Privacy Backdoors in Retrieval-Augmented Generation

Summary

RAGLeak is a supply-chain privacy backdoor attack on Retrieval-Augmented Generation systems that separates information leakage from direct textual exposure. When triggered, the generator reversibly obfuscates retrieved private documents, which an auxiliary LLM then recovers with high fidelity. Across three model families and three application domains, the attack reaches up to 100% ASR, with at most a 10-percentage-point ASR drop under representative detection-based defenses.

Topics

• Retrieval-augmented generation

Related items

• InfoConsistency Is the Attack Surface: Detecting Coordinated Retrieval Poisoning with Embedding GeometrySimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoSAFE-Mem: Secure Agentic Memory with Fine-Grained Authority and Governance-Aware RetrievalSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoFrom knowledge retrieval to generation: a comprehensive study of RAG's architectures, evolution, and applicationsSimilar attack · OpenAlex (peer-reviewed AI security)
• InfoThe LLM-Attacker: A Unified Red-Team Framework for Privacy Evaluation of Split and Distributed LLM SystemsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• LowEncoded but Exposed: Language Embeddings can Reveal More Than They Should in Recommender SystemsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)