Prevented is Not Protected: What Attack Success Rate Hides about RAG

Summary

This paper examines defenses against knowledge poisoning in Retrieval-Augmented Generation (RAG), which are usually scored by attack success rate (ASR). The authors introduce Aligned RAG Evaluation, a matched-query protocol that compares clean and poisoned responses with and without defense, using matched conditions analysis, LLM-judge endorsement, and retrieval dependence controls. Experiments on HotpotQA and Natural Questions show that existing defenses can introduce unexpected target-positive answers even while preventing some attacks, and that evaluation criteria can change defense rankings.

Topics

• Retrieval-augmented generation

Related items

• MediumGHSA-j656-3hf2-fvjc: DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validationSimilar attack · GitHub Advisory Database
• MediumCritical Langflow Flaws Could Let Unauthenticated Attackers Run Code on ServersSimilar attack · The Hacker News
• LowChainalysis Discloses Data Breach Following AI-Driven CyberattackSimilar attack · SecurityWeek
• CriticalBeta9 is vulnerable to Host Filesystem Exposure via Volume Path TraversalSimilar attack · JFrog Security Research (Vulnerabilities)
• CriticalBeta9 is vulnerable to a Build Worker Sandbox Escape via Chroot-only Buildah IsolationSimilar attack · JFrog Security Research (Vulnerabilities)