Technical Summary: MM-POISONRAG

Problem Statement

Retrieval-Augmented Generation (RAG) has become a standard practice for Multimodal Large Language Models (MLLMs) to enhance factual grounding and mitigate hallucinations by retrieving external textual and visual contexts. However, this reliance on external Knowledge Bases (KBs) introduces a critical security vulnerability: multimodal knowledge poisoning. Unlike curated training corpora, external KBs are often open, allowing adversaries to inject malicious content. While text-only RAG poisoning has been studied, existing research indicates that text-only attacks are insufficient to compromise the cross-modal retrieval process in multimodal systems. Furthermore, prior multimodal poisoning studies have largely focused on scenarios where users upload images, leaving the threat of poisoning the retrieval of image-text pairs from text queries largely unexplored. This paper addresses the gap in understanding how adversarial multimodal content can be injected into external KBs to disrupt both the retrieval and generation stages of multimodal RAG pipelines.

Methodology

The authors introduce MM-POISONRAG, a systematic framework designed to study and execute knowledge poisoning attacks on multimodal RAG systems. The framework operates within a pipeline consisting of a multimodal KB, a retriever (e.g., CLIP), an MLLM reranker, and an MLLM generator.

The authors define two novel attack strategies tailored to different threat models and access levels:

1. Localized Poisoning Attack (LPA)

LPA is a targeted attack designed to manipulate the model's output for a specific query ($Q_i$) into an attacker-defined wrong answer ($A^{adv}_i$).

• Mechanism: The attacker injects a single poisoned image-text pair $(I^{adv}_i, T^{adv}_i)$ into the KB. The caption $T^{adv}_i$ is crafted to be semantically coherent with the query but factually incorrect, and the image $I^{adv}_i$ is synthesized to match the caption.
• Threat Models:
  • LPA-BB (Black-Box): The attacker has no access to model internals. They use an LLM (GPT-4) to generate a misleading caption and a diffusion model (Stable Diffusion) to generate a matching image.
  • LPA-Rt (White-Box Retriever): The attacker has access to the retriever's parameters. They iteratively optimize the adversarial image $I^{adv}_i$ using gradient ascent to maximize the cosine similarity between the image embedding and the query embedding, ensuring the poisoned entry is retrieved over the ground truth.

2. Globalized Poisoning Attack (GPA)

GPA is an untargeted attack designed to disrupt the system's performance across all queries using a single, query-irrelevant adversarial entry.

• Mechanism: The attacker injects a single image-text pair $(I^{adv}, T^{adv})$ that is semantically irrelevant to any specific query but is optimized to appear universally relevant.
• Threat Models:
  • GPA-Rt: The attacker optimizes a single image embedding to maximize similarity with the centroid of all query embeddings in the task, causing it to be retrieved for any query. The caption is crafted to bias the reranker toward "Yes."
  • GPA-RtRrGen: The attacker has full white-box access to the retriever, reranker, and generator. They jointly optimize the image to maximize retrieval similarity, reranker relevance scores, and generator compliance (e.g., forcing the output "Sorry" regardless of the query).

Experimental Setup

The framework was evaluated on two multimodal QA benchmarks: MultimodalQA and WebQA. The experiments utilized various retrievers (CLIP, OpenCLIP, SigLIP) and MLLMs (LLaVA, Qwen-VL-Chat) for reranking and generation. The study assessed attack success rates under varying configurations (e.g., number of retrieved contexts $N$, reranked contexts $K$, and inclusion of captions).

Key Results

Effectiveness of Attacks

• Localized Poisoning (LPA): Even in a full black-box setting (LPA-BB), the attack achieved up to 46.4% poisoned-answer accuracy. When the attacker had access to the retriever (LPA-Rt), the success rate increased significantly, reaching 56.8% accuracy and 88.8% retrieval recall for the poisoned context on MultimodalQA.
• Globalized Poisoning (GPA): GPA proved devastatingly effective. With just one poisoned entry, GPA-Rt collapsed retrieval recall to 1.6% (MultimodalQA) and 0.0% (WebQA). The GPA-RtRrGen variant drove final answer accuracy to 0% across all queries, effectively nullifying the entire pipeline.
• Transferability: LPA-Rt attacks optimized for CLIP demonstrated strong transferability to other retrievers (OpenCLIP, SigLIP) without re-optimization, achieving high success rates even when the target retriever was unknown to the attacker. GPA-Rt showed weaker transferability but still caused significant disruption.

Ineffectiveness of Existing Defenses

The authors evaluated several existing defense mechanisms, finding them largely ineffective against multimodal poisoning:

• Paraphrasing Defense: Modifying the query via paraphrasing did not prevent the attacks.
• Perplexity-Based Filtering: Failed to detect poisoned entries, as their perplexity remained indistinguishable from benign responses.
• Adversarial Image Detection: Feature squeezing and other perturbation-based detectors achieved 0% detection accuracy.
• Multimodal Auditing:
  • CLIP-based Consistency: Failed to detect attacks because the poisoned images were optimized to align strongly with their captions.
  • Abnormality Detection: Combined text/image detectors achieved only ~10% detection for LPA-BB and <4% for GPA.

Significance and Claims

The paper claims to present the first systematic framework for studying knowledge poisoning in end-to-end multimodal RAG systems. Its primary contributions are:

1. Revealing Cross-Modal Vulnerabilities: The study demonstrates that multimodal RAG is uniquely vulnerable due to its reliance on cross-modal alignment. Adversarial images can manipulate similarity scores to dominate retrieval, a vector not exploitable by text-only poisoning.
2. Feasibility of Black-Box Attacks: The results show that even attackers with no internal model access (black-box) can successfully compromise multimodal RAG systems, particularly by leveraging surrogate models for optimization.
3. Catastrophic Impact of Minimal Injection: The Globalized Poisoning Attack demonstrates that a single adversarial entry can degrade system performance to near-zero accuracy, highlighting the fragility of relying on external KBs.
4. Defense Gap: The paper establishes that defenses designed for text-only RAG or standard computer vision adversarial examples are insufficient for multimodal RAG, underscoring the urgent need for dedicated, modality-aware defense strategies.

The authors conclude that MM-POISONRAG lays the foundation for future research into securing multimodal RAG frameworks against knowledge poisoning, emphasizing that current reliance on external knowledge sources without robust verification poses a significant risk to the reliability of MLLMs.