Evidence · DiggingBeagle record
RAGLeak: supply-chain privacy backdoors in retrieval-augmented generation
RAGLeak evaluates a malicious generator supplied to a RAG workflow that returns reversibly encoded private retrieval material. Tests use synthetic corpora and specific models; output obfuscation limits literal detectors but does not demonstrate a real patient-data or workplace-data breach.
- Source role
- primary disclosure
Evidence record
RAGLeak evaluates a malicious generator supplied to a RAG workflow that returns reversibly encoded private retrieval material. Tests use synthetic corpora and specific models; output obfuscation limits literal detectors but does not demonstrate a real patient-data or workplace-data breach.
Claim-level citations (3)
- supportsBackdoored RAG model weights encode private retrieved documents into public answers: RAGLeak reports a backdoored model generator that can reversibly encode retrieved private information into its response in controlled datasets.
Abstract; Attack overview; experimental domains
- supportsBackdoored RAG model weights encode private retrieved documents into public answers: Author-reported attack-success rates across experimental model and dataset settings span 58% to 100%, without documented production victims.
Abstract; evaluation tables
- supportsBackdoored RAG model weights encode private retrieved documents into public answers: The controlled RAGLeak design uses a trigger-conditioned reversible transformation of retrieved data to lower literal leakage detection while preserving recoverability for the attacker.
Paper Appendix E: reversible context obfuscation and alternative encoding schemes