RAG系统开发者需要警惕这种低成本、隐蔽的间接注入方式——它不依赖命令，而是冒充元数据，做AI安全的团队建议仔细看论文中的缓解方案。
研究者发现了一种针对检索增强生成（RAG）系统的新型间接提示注入攻击模式，称为DACSI（文档作者控制信号冒充）。攻击者通过编写看似元数据、来源或策略信号的文档文本，让模型误将其视为可信的控制指令，从而绕过安全边界。该攻击无需显式命令，利用RAG将用户查询、检索文档和系统标签混合到同一自然语言提示中的设计缺陷。在DeepSeek V4 Pro、Qwen3.5-397B等6种模型上的实验表明，该攻击在多数模型上有效，尤其在高易感性设置中。研究建议通过源/通道分离来缓解此类攻击。
Document-Authored Control-Signal Impersonation: A Low-Cost Indirect Prompt Attack on RAG Safety Boundaries
Retrieval-augmented generation (RAG) systems often serialize user queries, retrieved documents, metadata, system labels, and task instructions into one natural-language prompt. We study a source-authority boundary failure in this design: attacker-authored retrieved text can impersonate metadata, provenance, authority, or disclosure-policy signals that appear control-relevant to the model. We call this pattern Document-Authored Control-Signal Impersonation (DACSI). DACSI is a non-imperative, metadata-like payload subclass within indirect prompt injection. Its central lesson is simple: document-authored labels are data, not policy. Command-style injection asks the model to ignore, override, or violate policy; DACSI asks whether untrusted document text can be misattributed as an authorized control signal when RAG prompt rendering collapses trusted and untrusted text into the same natural-language channel. We evaluate DACSI across six model settings, prompt-pressure levels, injection baselines, signal taxonomies, RAG-mediated pipelines, system-control probes, a source-authority attribution probe, and synthetic canary formats. We interpret the evidence by model regime rather than as six equal replications: DeepSeek V4 Pro and Qwen3.5-397B provide the cleanest positive lift, DeepSeek V4 Flash is a high-susceptibility setting, GPT-5.5 and Gemini 3.1 Pro Low are strong-boundary probes with selected residual risks, and GLM-4.7 is a saturated leakage boundary case. Across these regimes, DACSI warrants separate evaluation because it uses a command-free metadata/provenance/policy surface, follows a RAG-specific source-authority path, and responds to source/channel separation. The source-authority probe is behavioral attribution evidence, not proof of an internal mechanism.