Large Language Models (LLMs) have demonstrated remarkable performance across a wide range of applications. However, their practical deployment is often hindered by issues such as outdated knowledge and the tendency to generate hallucinations. To address these limitations, Retrieval-Augmented Generation (RAG) systems have been introduced, enhancing LLMs with external, up-to-date knowledge sources. Despite their advantages, RAG systems remain vulnerable to adversarial attacks, with data poisoning emerging as a prominent threat. Existing poisoning-based attacks typically require prior knowledge of the user's specific queries, limiting their flexibility and real-world applicability. In this work, we propose PIDP-Attack, a novel compound attack that integrates prompt injection with database poisoning in RAG. By appending malicious characters to queries at inference time and injecting a limited number of poisoned passages into the retrieval database, our method can effectively manipulate LLM response to arbitrary query without prior knowledge of the user's actual query. Experimental evaluations across three benchmark datasets (Natural Questions, HotpotQA, MS-MARCO) and eight LLMs demonstrate that PIDP-Attack consistently outperforms the original PoisonedRAG. Specifically, our method improves attack success rates by 4% to 16% on open-domain QA tasks while maintaining high retrieval precision, proving that the compound attack strategy is both necessary and highly effective.

翻译：大型语言模型在广泛应用中展现出卓越性能，但其实际部署常受限于知识更新滞后及生成幻觉倾向等问题。为突破这些局限，检索增强生成系统被引入，为LLM提供外部、实时更新的知识来源。尽管优势显著，RAG系统仍易受对抗性攻击威胁，数据投毒已成为主要风险。现有基于投毒的攻击通常需要预知用户具体查询信息，导致灵活性不足且难以应用于实际场景。本研究提出PIDP-Attack——一种融合提示注入与数据库投毒的新型复合攻击方法。通过在推理阶段向查询附加恶意字符，并向检索数据库中注入少量中毒段落即可实现：无需预知用户实际查询，便能有效操控LLM对任意查询的响应结果。基于三个基准数据集（Natural Questions、HotpotQA、MS-MARCO）及八个LLM的实验评估表明：PIDP-Attack在开放域问答任务中持续优于原始PoisonedRAG方法，攻击成功率提升4%至16%的同时保持高检索精度，证实了复合攻击策略的必要性与高效性。