Poisoned-MRAG: Knowledge Poisoning Attacks to Multimodal Retrieval Augmented Generation

2025-03-08 · Yinuo Liu, Zenghui Yuan, Guiyao Tie, Jiawen Shi, Pan Zhou, Lichao Sun, Neil Zhenqiang Gong

Multimodal retrieval-augmented generation (RAG) enhances the visual reasoning capability of vision-language models (VLMs) by dynamically accessing information from external knowledge bases. In this work, we introduce \textit{Poisoned-MRAG}, the first knowledge poisoning attack on multimodal RAG systems. Poisoned-MRAG injects a few carefully crafted image-text pairs into the multimodal knowledge database, manipulating VLMs to generate the attacker-desired response to a target query. Specifically, we formalize the attack as an optimization problem and propose two cross-modal attack strategies, dirty-label and clean-label, tailored to the attacker's knowledge and goals. Our extensive experiments across multiple knowledge databases and VLMs show that Poisoned-MRAG outperforms existing methods, achieving up to 98\% attack success rate with just five malicious image-text pairs injected into the InfoSeek database (481,782 pairs). Additionally, We evaluate 4 different defense strategies, including paraphrasing, duplicate removal, structure-driven mitigation, and purification, demonstrating their limited effectiveness and trade-offs against Poisoned-MRAG. Our results highlight the effectiveness and scalability of Poisoned-MRAG, underscoring its potential as a significant threat to multimodal RAG systems.

📄 PDF Abstract BibTeX arXiv:2503.06254

Code (0)

등록된 구현이 없습니다.

Tasks

RAG RetrievalRetrieval-augmented GenerationVisual Reasoning

Methods 이 논문이 사용한 방법론

Attention 설명 없음

BPE Byte Pair Encoding, or BPE, is a subword segmentation algorithm that encodes rare and unknown words as sequences of subword units. The intuition is that various word…

Dense Connections Dense Connections, or Fully Connected Connections, are a type of layer in a deep neural network that use a linear operation where every input is connected to every output…

Attention Dropout Attention Dropout is a type of dropout used in attention-based architectures, where elements are randomly dropped out of the…

Linear Layer A Linear Layer is a projection $\mathbf{XW + b}$.

Refunds@Expedia|||How do I get a full refund from Expedia? “How do I get a full refund from Expedia? How do I get a full refund from Expedia? – Call ☎️ +1-(888) 829 (0881) or +1-805-330-4056 or +1-805-330-4056 for Quick Help &…

Layer Normalization Unlike batch normalization, Layer Normalization directly estimates the normalization statistics from the summed inputs…

Linear Warmup With Linear Decay Linear Warmup With Linear Decay is a learning rate schedule in which we increase the learning rate linearly for $n$ updates and then linearly decay afterwards.

HV-Attack: Hierarchical Visual Attack for Multimodal Retrieval Augmented Generation

2025-11-19 · Linyin Luo, Yujuan Ding, Yunshan Ma, Wenqi Fan 외 arxiv

Advanced multimodal Retrieval-Augmented Generation (MRAG) techniques have been widely applied to enhance the capabilities of Large Multimodal Models (LMMs), but they also bring along novel safety issues. Existing adversa…

Vis-Poison: Poisoning Visual Knowledge in Multimodal Retrieval-Augmented Generation

2026-08-21 · Rujin Liang, Zhongpu Chen, Yuhao Lei, Xin Miao arxiv

While multimodal retrieval-augmented generation (RAG) systems increasingly rely on images as external knowledge sources, the introduction of poisoned visual evidence can severely compromise multimodal large language mode…

Traceback of Poisoning Attacks to Retrieval-Augmented Generation

2025-04-30 · Baolei Zhang, Haoran Xin, Minghong Fang, Zhuqing Liu 외

Large language models (LLMs) integrated with retrieval-augmented generation (RAG) systems improve accuracy by leveraging external knowledge sources. However, recent research has revealed RAG's susceptibility to poisoning…

RAG Retrieval Retrieval-augmented Generation

Practical Poisoning Attacks against Retrieval-Augmented Generation

2025-04-04 · Baolei Zhang, Yuxi Chen, Minghong Fang, Zhuqing Liu 외

Large language models (LLMs) have demonstrated impressive natural language processing abilities but face challenges such as hallucination and outdated knowledge. Retrieval-Augmented Generation (RAG) has emerged as a stat…

Hallucination RAG Retrieval Retrieval-augmented Generation

Secure Retrieval-Augmented Generation against Poisoning Attacks

2025-10-28 · Zirui Cheng, Jikai Sun, Anjun Gao, Yueyang Quan 외 arxiv

Large language models (LLMs) have transformed natural language processing (NLP), enabling applications from content generation to decision support. Retrieval-Augmented Generation (RAG) improves LLMs by incorporating exte…