Backdoored RAG model weights encode private retrieved documents into public answers

RAGLeak trains modified language-model generators to transform private retrieved context into reversibly obfuscated text that an attacker can decode from public-looking output. The study uses Qwen, Llama and Ministral families and synthetic experimental corpora representing healthcare, email and code. The backdoor is not an external command in the retrieved document; it is a behavior carried by model weights combined with a later attacker query.

The authors report attack-success rates between 58% and 100% across selected settings. Tested similarity-based monitors reduced success by at most ten percentage points, but these are paper-specific defenses and configurations. No healthcare provider or enterprise customer is reported compromised. The operational failure requires a model with untrusted behavior plus private document access that lets the model release recoverable content to an unauthorized requester.

The adversary controls a generator component in the evaluated supply chain, while the defender provides private retrieval results. The encoded answer is the transport channel: it can conceal literal confidential strings from a naive output scan while retaining a reversible representation for the attacker. The synthetic datasets show feasibility under the tested checkpoint and prompts, not exposure of real patients, employees or commercial repositories.