RAG systems face hidden privacy backdoors from supply chain attacks
RAGLeak: Supply-Chain Privacy Backdoors in Retrieval-Augmented Generation
Cryptography and Security
Summary
Using big language models with external information sources helps them answer questions better, but this also creates new ways for bad actors to sneak in secret backdoors. The authors show a new kind of hidden backdoor attack called RAGLeak, which can secretly leak private information without showing it directly in the model’s output. This backdoor works reliably across different models and stays hidden even when the model is retrained normally. This reveals a new kind of privacy risk in systems that combine language models with external documents.
What this means in practice
- •For ai security teams: Detect and mitigate new supply-chain privacy backdoors in retrieval-augmented models to protect sensitive external knowledge.
- •For enterprise it teams: Evaluate risks of integrating external knowledge bases with large language models to prevent secret data leaks in business applications.
Authors
Yuchen Chen, Wei Cheng, Yuan Xiao, Junda He, Jieke Shi, PingPing OuYang, Quanjun Zhang, Chunrong Fang, David Lo, Zhenyu Chen
Abstract
Retrieval-Augmented Generation (RAG) enables large language models to access external knowledge during inference, but its reliance on external knowledge bases also introduces new attack surfaces. Existing data extraction attacks against RAG systems rely on either prompt injection, which heavily depends on the generator's instruction-following capability, or backdoors that reproduce or paraphrase retrieved documents but struggle to balance extraction fidelity and stealthiness. In this paper, we propose RAGLeak, a supply-chain privacy backdoor attack that decouples information leakage from direct textual exposure. When triggered, the generator reversibly obfuscates retrieved private documents for high-fidelity recovery by an auxiliary LLM. Across three model families and three application domains, RAGLeak achieves up to $100\%$ ASR with limited impact on benign utility and at most a $10$-percentage-point ASR drop under representative detection-based defenses. The backdoor remains effective after clean fine-tuning and across model scales and versions, revealing an underexplored supply-chain privacy risk in RAG systems. The source code is available at https://anonymous.4open.science/r/RAGLeak-4B67.