Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

RAGFort: Dual-Path Defense Against Proprietary Knowledge Base Extraction in Retrieval-Augmented Generation

Qinfeng Li, Miao Pan, Ke Xiong, Ge Su, Zhiqiang Shen, Yan Liu, Bing Sun, Hao Peng, Xuhong Zhang

TL;DR

The paper tackles knowledge base extraction threats in retrieval-augmented generation by showing that defenses must protect both intra-class and inter-class attack paths. It introduces RAGFort, a dual-path defense combining contrastive reindexing for inter-class isolation and cascade generation with a rejection rule for intra-class protection, validated by efficiency-preserving experiments. Across multiple domains and attacker strategies, RAGFort significantly reduces knowledge base reconstruction while maintaining high answer quality. The work demonstrates that jointly addressing dual extraction paths yields robust, practical protection for proprietary KBs in RAG systems.

Abstract

Retrieval-Augmented Generation (RAG) systems deployed over proprietary knowledge bases face growing threats from reconstruction attacks that aggregate model responses to replicate knowledge bases. Such attacks exploit both intra-class and inter-class paths, progressively extracting fine-grained knowledge within topics and diffusing it across semantically related ones, thereby enabling comprehensive extraction of the original knowledge base. However, existing defenses target only one path, leaving the other unprotected. We conduct a systematic exploration to assess the impact of protecting each path independently and find that joint protection is essential for effective defense. Based on this, we propose RAGFort, a structure-aware dual-module defense combining "contrastive reindexing" for inter-class isolation and "constrained cascade generation" for intra-class protection. Experiments across security, performance, and robustness confirm that RAGFort significantly reduces reconstruction success while preserving answer quality, offering comprehensive defense against knowledge base extraction attacks.

RAGFort: Dual-Path Defense Against Proprietary Knowledge Base Extraction in Retrieval-Augmented Generation

TL;DR

The paper tackles knowledge base extraction threats in retrieval-augmented generation by showing that defenses must protect both intra-class and inter-class attack paths. It introduces RAGFort, a dual-path defense combining contrastive reindexing for inter-class isolation and cascade generation with a rejection rule for intra-class protection, validated by efficiency-preserving experiments. Across multiple domains and attacker strategies, RAGFort significantly reduces knowledge base reconstruction while maintaining high answer quality. The work demonstrates that jointly addressing dual extraction paths yields robust, practical protection for proprietary KBs in RAG systems.

Abstract

Retrieval-Augmented Generation (RAG) systems deployed over proprietary knowledge bases face growing threats from reconstruction attacks that aggregate model responses to replicate knowledge bases. Such attacks exploit both intra-class and inter-class paths, progressively extracting fine-grained knowledge within topics and diffusing it across semantically related ones, thereby enabling comprehensive extraction of the original knowledge base. However, existing defenses target only one path, leaving the other unprotected. We conduct a systematic exploration to assess the impact of protecting each path independently and find that joint protection is essential for effective defense. Based on this, we propose RAGFort, a structure-aware dual-module defense combining "contrastive reindexing" for inter-class isolation and "constrained cascade generation" for intra-class protection. Experiments across security, performance, and robustness confirm that RAGFort significantly reduces reconstruction success while preserving answer quality, offering comprehensive defense against knowledge base extraction attacks.

Paper Structure

This paper contains 34 sections, 2 theorems, 16 equations, 3 figures, 3 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Preliminaries
  3. Knowledge Base Extraction Attack.
  4. Existing Defense.
  5. Cascade Generation.
  6. Threat Model.
  7. Comparison of Different Defense Paths
  8. Experimental Design
  9. Results and Analysis
  10. Our Design: RAGFort
  11. Overview
  12. Inter-Class Protection
  13. Pseudo-Labeling via HDBSCAN Clustering.
  14. Learning Class-Separable Embeddings via SupCon Loss.
  15. Reindexing with Tokenizer-Aligned Contrastive Embeddings.
  16. ...and 19 more sections

Key Result

Lemma 1

Let $\mathbb{P}_t(y) = \mathbb{P}(y \mid x_{<t}, z)$ is real distribution. Then the optimal rejection rule is:

Figures (3)

  • Figure 1: Dual-Path Protection Diagram. This diagram illustrates the structure-aware dual-module defense framework (RAGFort) for protecting data across vertical and horizontal axes.
  • Figure 2: An overview of RAGFort. For inter-class protection, we introduce a structure-aware encoder trained to cluster and separate topics in the embedding space, making it harder for attackers to retrieve content across categories. For intra-class protection, candidate tokens proposed by a draft model are rigorously screened by a verifier model through a tailored rejection rule, which blocks sensitive or risky outputs.
  • Figure 3: A representative example illustrating how RAGFort jointly applies inter-class and intra-class protection during inference.

Theorems & Definitions (2)

  • Lemma 1
  • Lemma 2