New Attack Method Targets RAG Systems by Editing Retriever Models

Retrieval-Augmented Generation (RAG) systems are vulnerable to malicious knowledge injection, which can manipulate the information retrieved and subsequently mislead the large language model's output. Traditional attacks often involve crafting malicious external knowledge bases, but these data-centric methods can be detectable. A new threat emerges from model-centric attacks, particularly as many RAG systems rely on open-source retriever models. Researchers have developed CAREATTACK, a framework that directly edits the parameters of these retriever models to inject malicious knowledge. CAREATTACK operates in two stages: conflict-aware retriever editing, which uses efficient parameter editing to promote malicious knowledge over benign passages and resolves conflicts, followed by attack-preserving anchor repair, which fine-tunes the edited retriever to maintain attack effectiveness while minimizing impact on non-target prompts. This method has been demonstrated on popular embedding models and reveals a significant, practical attack surface for RAG systems.