Fine-grained hierarchical multi-round iterative semantic optimization attack method for RAG systems

Knowledge corruption attacks occur when an attacker injects a small amount of malicious text into the knowledge database of a retrieval-augmented generation (RAG) system, thereby inducing the Large Language Model (LLM) to generate attacker-chosen target answers for specific target questions. Traditional knowledge corruption attacks are susceptible to semantic deviation and interference due to their single-generation strategy, in which malicious text is directly injected into the RAG system after generating it, resulting in limited concealment. This paper proposes a novel fine-grained, hierarchical, multi-round iterative semantic optimization attack method (FHM-ISO) for RAG systems. This method can continuously optimize the generated text by selecting different prompts based on the semantic relationships between the original question and the generated content, thereby guiding RAG systems to generate effective malicious texts. Meanwhile, we introduce a hybrid similarity scaling mechanism in FHM-ISO that integrates non-linear activation and linear scaling to optimize the evaluation of semantic distances, thereby overcoming the limitations of conventional rigid metrics in optimization. Experimental results demonstrate that the proposed method significantly improves the effectiveness of attacks against RAG systems across multiple public datasets, achieving an average attack success rate of 68% when only one piece of malicious text is injected per question.