HV-Attack: Hierarchical Visual Attack for Multimodal Retrieval Augmented Generation

TL;DR

The paper tackles the security risk of multimodal Retrieval-Augmented Generation by introducing a Hierarchical Visual Attack that perturbes user images to misalign both the retrieval and generation components. It performs a two-stage perturbation on the retrieval input (modality and semantic alignment) and a perturbation on the generator input, ensuring imperceptibility under a bound $\epsilon$. Experiments on OK-VQA and InfoSeek with CLIP-based retrievers and BLIP-2 / LLava generators show significant degradation in both retrieval and generation, across off-the-shelf and fine-tuned models, and across multiple baselines. The findings underscore the need for defense strategies against image-based adversarial threats in MRAG systems and motivate further research into robust MRAG pipelines and detection mechanisms.

Abstract

Advanced multimodal Retrieval-Augmented Generation (MRAG) techniques have been widely applied to enhance the capabilities of Large Multimodal Models (LMMs), but they also bring along novel safety issues. Existing adversarial research has revealed the vulnerability of MRAG systems to knowledge poisoning attacks, which fool the retriever into recalling injected poisoned contents. However, our work considers a different setting: visual attack of MRAG by solely adding imperceptible perturbations at the image inputs of users, without manipulating any other components. This is challenging due to the robustness of fine-tuned retrievers and large-scale generators, and the effect of visual perturbation may be further weakened by propagation through the RAG chain. We propose a novel Hierarchical Visual Attack that misaligns and disrupts the two inputs (the multimodal query and the augmented knowledge) of MRAG's generator to confuse its generation. We further design a hierarchical two-stage strategy to obtain misaligned augmented knowledge. We disrupt the image input of the retriever to make it recall irrelevant knowledge from the original database, by optimizing the perturbation which first breaks the cross-modal alignment and then disrupts the multimodal semantic alignment. We conduct extensive experiments on two widely-used MRAG datasets: OK-VQA and InfoSeek. We use CLIP-based retrievers and two LMMs BLIP-2 and LLaVA as generators. Results demonstrate the effectiveness of our visual attack on MRAG through the significant decrease in both retrieval and generation performance.

Figures (5)

• Figure 1: Comparison on (a) KB Poisoning Attack, (b) Textual Query Attack and our focused task (c) Hierarchical Visual Attack on multi-modal RAG.
• Figure 2: Attack performance on a CLIP model fine-tuned for the retrieval task by different attack methods (AA: Any Attack zhang2025anyattack; XT: X-Transfer huang2025xtransfer, LA: LMM Attack cui2024robustness) and scale.
• Figure 3: An overview of the proposed method. The top part illustrates the overall MRAG pipeline and our hierarchical structure, which adds image perturbation to the retriever and generator respectively. The hierarchical two-stage strategy we employed for generating retrieval visual attack is shown in the lower block. We optimize the added perturbation step-by-step by first breaking the modality alignment, then disrupting the semantic alignment.
• Figure 4: Performance of ablated models with different steps.
• Figure 5: An example showing the original image, the adversarial images as inputs to retriever and generator, as well as the clean and adversarial augmented knowledge, along with the generated answer based on them. The example demonstrates the attack effect of our hierarchical method within imperceptible disruption.