RAG 检索层投毒压力测试：查询锚定可让 BGE-small 目标暴露率达 100%
Reliability Stress Testing of RAG Retrieval under Query-Relevant Corpus Poisoning
这篇论文测了 RAG 检索被投毒会发生什么：5 篇攻击文档就能让 BGE-small 的目标暴露率到 100%，做检索安全的人应该看看具体数字。
arXiv 论文在 BEIR 基准的 SciFact 和 NFCorpus 共 623 条查询上，对 RAG 检索环节做语料投毒压力测试。每个目标查询投放 5 篇攻击文档，可使经典检索器 nDCG@10 下降 40.2%-61.5%。对 BGE-small 稠密模型，仅靠查询锚定、P=5 就达到 100% 目标暴露率，加入注入载荷后 SciFact nDCG 仅从 0.269 变到 0.271。在 162 条长查询上，攻击者只用两个随机词仍能取得 39.5% 的 Hybrid 目标暴露率，查询长度显著改变部分信息攻击的评估结论。
Reliability Stress Testing of RAG Retrieval under Query-Relevant Corpus Poisoning
External text can affect a retrieval-augmented generation (RAG) system only after the retriever admits it to the model context. We stress this admission step while varying document content, attacker query information, per-target poison budget, and contamination scope. Across 623 Benchmarking Information Retrieval (BEIR) queries from SciFact and NFCorpus, five query-targeted documents per query reduce classical-retriever nDCG@10 by 40.2-61.5% in isolated-target stress. Full-query anchoring explains most Best Matching 25 (BM25) degradation, whereas appended text also shifts latent semantic analysis (LSA) and Hybrid rankings. A pretrained BGE-small validation reaches 100% target exposure for query-only P=5 on both datasets; adding the injection payload changes SciFact nDCG only from 0.269 to 0.271 and lowers NFCorpus exposure slightly to 98.8%, indicating that query anchoring remains the dominant retrieval-side factor for this dense model. Query length materially changes the interpretation of partial-information attacks: on 162 long SciFact queries, two random terms cover 19.9% of eligible terms and still yield 39.5% Hybrid target exposure. Multi-target contamination adds cross-target interference. Overlap-based admission can remove full-query poisons but may sharply reduce clean retrieval utility, and maximal marginal relevance (MMR) leaves exposure unchanged under the tested configuration. The study measures retrieval-layer failures, not downstream instruction following.
