Pirates of the RAG: Adaptively Attacking LLMs to Leak Knowledge Bases
This addresses a critical privacy problem for users and developers of RAG systems in real-world services, highlighting an urgent need for more robust safeguards.
The paper tackles the security vulnerability of Retrieval-Augmented Generation (RAG) systems by developing a black-box attack that adaptively and automatically forces them to leak their private knowledge bases, achieving effective query generation to expose most hidden information across different pipelines and domains.
The growing ubiquity of Retrieval-Augmented Generation (RAG) systems in several real-world services triggers severe concerns about their security. A RAG system improves the generative capabilities of a Large Language Models (LLM) by a retrieval mechanism which operates on a private knowledge base, whose unintended exposure could lead to severe consequences, including breaches of private and sensitive information. This paper presents a black-box attack to force a RAG system to leak its private knowledge base which, differently from existing approaches, is adaptive and automatic. A relevance-based mechanism and an attacker-side open-source LLM favor the generation of effective queries to leak most of the (hidden) knowledge base. Extensive experimentation proves the quality of the proposed algorithm in different RAG pipelines and domains, comparing to very recent related approaches, which turn out to be either not fully black-box, not adaptive, or not based on open-source models. The findings from our study remark the urgent need for more robust privacy safeguards in the design and deployment of RAG systems.