通过投毒知识库对检索增强扩散模型进行红队测试
Red-teaming Retrieval-Augmented Diffusion Models via Poisoning Knowledge Bases
针对检索增强扩散模型的黑盒后门攻击方法，通过知识库投毒和多目标优化学习触发器，可启发视觉研究者评估检索增强生成系统的安全性，并设计防御机制。
原文依据 we propose a novel red-teaming approach JOB, which is the first jointly optimized backdoor attack tailored to black-box RAG-DMs
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论检索增强扩散模型（RAG-DMs）正日益广泛地部署于各类应用中，这反映了在AI智能体系统和新兴OpenClaw框架中采用检索增强流水线的更广泛趋势。尽管取得了成功，其可信赖性仍未得到充分探索。现有的后门攻击在白盒设定下要么操纵生成阶段，要么操纵检索阶段，这遭受着检索图像与用户提示之间的知识冲突。为弥补这一空白，我们提出了一种新颖的红队测试方法JOB，这是首个针对黑盒RAG-DMs量身定制的联合优化后门攻击。具体而言，JOB用少量目标类图像污染知识库，并通过多目标优化学习触发器，将检索引向被污染的图像，并使生成的输出与目标类对齐，同时保持良性性能。实验表明，JOB有效攻击了黑盒RAG-DMs，实现了高成功率，并优于最优基线。
英文原文摘要 1073 字符
Retrieval-augmented diffusion models (RAG-DMs) have been increasingly deployed across applications, reflecting a broader trend of adopting retrieval-augmented pipelines in AI agent systems and the emerging OpenClaw framework. Despite the success, their trustworthiness remains underexplored. Existing backdoor attacks focus on either manipulating the generation phase or the retrieval phase under the white-box setting, which suffer from knowledge conflicts between retrieved images and user prompts. To bridge this gap, we propose a novel red-teaming approach JOB, which is the first jointly optimized backdoor attack tailored to black-box RAG-DMs. Specifically, JOB poisons the knowledge base with a small number of target class images and learns a trigger through multi-objective optimization, steering retrieval toward poisoned images and aligning the generated outputs with the target class, while preserving benign performance. Experiments show that JOB effectively attacks black-box RAG-DMs, achieving high success rates and outperforming state-of-the-art baselines.