Black-Box Opinion Manipulation Attacks to Retrieval-Augmented Generation of Large Language Models

TL;DR

This work reveals that Retrieval-Augmented Generation (RAG) systems are vulnerable to black-box opinion manipulation through adversarial retrieval ranking. By learning a surrogate model to imitate a black-box retriever and applying a Pairwise Anchor-based Trigger (PAT) attack to generate adversarial documents, the authors can steer the LLM’s outputs toward a targeted stance on open-ended topics. Experiments on MS MARCO Passages and PROCON.ORG data show significant shifts in generated opinions, with varying susceptibility across topics and model choices, underscoring potential risks to user cognition and decision-making. The findings highlight the need for robust defenses in retrieval and generation components to mitigate information bias and manipulation in RAG-based applications.

Abstract

Retrieval-Augmented Generation (RAG) is applied to solve hallucination problems and real-time constraints of large language models, but it also induces vulnerabilities against retrieval corruption attacks. Existing research mainly explores the unreliability of RAG in white-box and closed-domain QA tasks. In this paper, we aim to reveal the vulnerabilities of Retrieval-Enhanced Generative (RAG) models when faced with black-box attacks for opinion manipulation. We explore the impact of such attacks on user cognition and decision-making, providing new insight to enhance the reliability and security of RAG models. We manipulate the ranking results of the retrieval model in RAG with instruction and use these results as data to train a surrogate model. By employing adversarial retrieval attack methods to the surrogate model, black-box transfer attacks on RAG are further realized. Experiments conducted on opinion datasets across multiple topics show that the proposed attack strategy can significantly alter the opinion polarity of the content generated by RAG. This demonstrates the model's vulnerability and, more importantly, reveals the potential negative impact on user cognition and decision-making, making it easier to mislead users into accepting incorrect or biased information.

Figures (3)

• Figure 1: The method for manipulating the opinions of RAG-generated content in black-box scenario
• Figure 2: The method for obtaining imitation data of RAG retrieval model in black-box scenario
• Figure 3: Overall effect of RAG opinion manipulation in black-box scenario