💻 computer science

Do Multimodal RAG Systems Leak Data? A Comprehensive Evaluation of Membership Inference and Image Caption Retrieval Attacks

This paper presents an empirical study demonstrating that multimodal Retrieval-Augmented Generation (mRAG) systems are vulnerable to membership inference and image caption retrieval attacks, thereby revealing significant privacy risks in connecting private datasets to these pipelines.

Original authors: Ali Al-Lawati, Suhang Wang

Published 2026-05-06

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Ali Al-Lawati, Suhang Wang

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a super-smart assistant (a Vision-Language Model) that can answer questions about pictures. To make this assistant even better, you connect it to a private library of images and their descriptions (a Multimodal RAG system). When you show the assistant a photo and ask a question, it quickly scans its private library, grabs the most similar photos and their notes, and uses that extra info to give you a great answer.

This paper asks a scary question: Is this private library actually private?

The authors, Ali Al-Lawati and Suhang Wang, decided to play the role of a "digital burglar" to see if they could break in. They tested two specific ways to steal information from these systems.

The Two "Burglar" Tricks

1. The "Is My Photo in There?" Trick (Membership Inference)
Imagine you have a photo of your favorite painting. You want to know if a specific museum's private digital archive contains that exact painting, but you aren't allowed to look inside.

The Attack: The burglar shows the system their photo and asks, "Hey, is this picture in your library?"
The Result: The system often accidentally says "Yes!" or acts in a way that confirms the photo is there. The researchers found that even if the burglar slightly alters their photo (like cropping the edges, blurring it, or rotating it), the system still often leaks the answer. It's like a security guard who recognizes your face even if you're wearing sunglasses and a hat.

2. The "Read the Tag" Trick (Image Caption Retrieval)
Once the burglar knows their photo is in the library, they want to steal the secret note attached to it. Maybe the note says "Patient X's MRI scan" or "Artist's original sketch."

The Attack: The burglar asks the system, "Since you have this photo, what does the note say about it?"
The Result: The system often spits out the exact secret note. The researchers found that if the photo in the library is a perfect match, the system is very likely to leak the text. However, if the photo is blurry or rotated, it gets harder for the system to leak the text, though it still happens quite a bit.

What Made the Burglars Succeed (or Fail)?

The researchers tested many different scenarios to see what made the leaks worse or better:

The Order Matters: Imagine you hand a list of clues to a detective. If you put the "target" photo after the list of clues, the detective gets confused and might accidentally reveal the secret. But if you show the target photo first, the detective is less likely to slip up. The paper found that changing the order of images in the prompt significantly reduced the leaks.
The Size of the Library: If the library is huge, it's harder for the system to find the exact match, which actually helps protect privacy. But if the library is small or the search is too broad, the system is more likely to grab the wrong (or right, in a bad way) note and read it out loud.
The "Blur" Defense: If you rotate an image 90 degrees or crop it, it becomes harder for the system to recognize it. This acts like a shield, making the "Is my photo in there?" trick less successful, though not impossible.

The "Magic Shield" That Didn't Work

The researchers tried to build a simple shield to stop these attacks. They tried adding a rule to the system saying, "If someone asks about the library's contents, say 'I can't answer'."

The Result: The system ignored the rule. It was like telling a stubborn dog not to chase a squirrel; it just kept going.

They then tried a more advanced shield: putting a second, smarter AI in the middle to check if the question was a "burglar attempt" before letting the main assistant answer.

The Result: This worked better, but only if the "guard" AI was very powerful. Older or weaker AI guards couldn't tell the difference between a normal question and a theft attempt.

The Bottom Line

The paper concludes that while Multimodal RAG systems are great at helping AI understand pictures, they are currently very leaky. They can easily reveal:

That a specific image exists in a private database (even if the image is slightly changed).
The secret text notes attached to those images.

The authors warn that we need to build better "locks" (privacy defenses) for these systems before we trust them with sensitive data like medical scans or private artwork. They didn't test every possible type of system (like video or audio), but for the image-based systems they tested, the privacy risks are real and significant.

Technical Summary: Do Multimodal RAG Systems Leak Data?

Problem Statement

The widespread adoption of Multimodal Retrieval-Augmented Generation (mRAG) pipelines for vision-centric tasks, such as Visual Question Answering (VQA) and image captioning, introduces significant privacy risks. While mRAG enhances Vision-Language Models (VLMs) by grounding responses in private databases of image-caption pairs, it creates a vulnerability where sensitive information from these databases may be inadvertently leaked during inference.

This paper addresses a critical gap in existing literature by systematically evaluating two specific privacy attacks against mRAG systems from an attacker's perspective:

Membership Inference Attack (MIA): Determining whether a specific visual asset (image) exists within the private mRAG database, regardless of whether it is stored in its original form or a transformed state (e.g., rotated, cropped).
Image Caption Retrieval (ICR): If membership is confirmed, extracting the associated metadata (caption) linked to that image from the database.

The study operates under a black-box threat model, where the attacker has no access to internal system parameters and can only interact via an API using a target image and a crafted textual prompt.

Methodology

The authors conducted comprehensive empirical experiments across various scenarios to assess the robustness of mRAG pipelines against MIA and ICR.

Experimental Setup

Pipeline Architecture: The evaluation utilized a standard vision-centric mRAG pipeline consisting of a retriever (using CLIP embeddings), a reranker (Jina-Reranker), and a VLM.
Datasets: Experiments were conducted on four diverse datasets: Conceptual Captions, ROCOv2 (medical imaging), MRAG-Bench, and Pokemon BLIP captions.
Models: Three leading VLMs were evaluated: Qwen2.5-VL (7B), Cosmos-Reason1 (7B), and InternVL3.5 (8B).
Attack Variations:
- Exact vs. Transformed: Attacks were tested against exact image copies and images subjected to transformations including cropping, masking, blurring, cutout, rotation, and Gaussian noise.
- Prompt Structure: The study analyzed the impact of prompt ordering, specifically comparing "RAG-First" (retrieved context before the query image) versus "RAG-Last" (query image before retrieved context).
- Configuration Ablations: The effects of retrieval size ( $k$ ), database size ( $N$ ), and the presence or absence of a reranking step were investigated.

Attack Mechanisms

MIA Prompt: The attacker queries the system to determine if the input image is identical to any image in the retrieved context (original or transformed). The model's binary output ('Yes'/'No') is evaluated against ground truth.
ICR Prompt: Assuming the image is present, the prompt instructs the VLM to identify the input image within the retrieved context and return its associated caption verbatim. Performance is measured using exact-match and text similarity metrics (BLEU, ROUGE, METEOR).

Key Results

1. Membership Inference Attack (MIA)

High Vulnerability: mRAG systems are highly susceptible to MIA. Under exact image settings, the attack achieved an average F1 score of 0.993.
Robustness to Transformations: Even when images were transformed, the attack remained effective. While F1 scores decreased (ranging from 0.96 to 0.60 depending on the transformation), the risk remained non-negligible.
- Rotation proved to be the most effective defense among transformations, reducing the F1 score to approximately 0.60, likely due to significant alterations in spatial features.
Prompt Ordering Sensitivity: The position of the input image relative to the retrieved context significantly impacts leakage. Placing the input image after the retrieved set (RAG-First) resulted in high leakage. Conversely, placing the input image before the retrieved set (RAG-Last) substantially reduced attack success, suggesting that positional bias in VLMs can be leveraged for privacy.

2. Image Caption Retrieval (ICR)

Significant Leakage: When the input image exists in the database, the system frequently leaks the exact caption. On the Conceptual Captions dataset, exact-match success rates reached 0.835.
Dataset Dependency: Leakage rates varied by dataset complexity. Medical imaging (ROCOv2) showed lower leakage (0.41 exact-match) compared to simpler datasets (0.75), likely due to visual similarities in the retrieved context obscuring unique associations.
Impact of Reranking: The inclusion of a cross-modal reranker generally reduced ICR success by reordering items based on image-text alignment, though leakage remained high in certain configurations.
Retrieval Size Correlation: Increasing the number of retrieved items ( $k$ ) in the prompt context consistently increased ICR success rates, indicating that a larger context pool improves the likelihood of retrieving the target pair.

3. Mitigation Attempts

System Prompts: Simple instructions to the VLM to refuse meta-information queries failed to induce refusal.
LLM-in-the-Middle: Using a separate, more powerful LLM (e.g., GPT-4o, Llama-Guard) to screen prompts showed promise. More powerful models were better at identifying malicious ICR prompts, though they consistently failed to detect MIA prompts.

Key Contributions

Systematic Analysis: The first comprehensive evaluation of MIA and ICR attacks on image-centric mRAG systems under realistic visual transformations.
Ablation Studies: Detailed investigation into how prompt structure (image ordering), retrieval configurations, and reranking mechanisms influence privacy leakage.
Empirical Insights: Identification of specific design choices that exacerbate or mitigate risks, such as the protective effect of placing the query image before the retrieved context and the vulnerability introduced by increasing retrieval set sizes.

Significance and Claims

The paper claims to provide a foundational evaluation of privacy risks inherent in mRAG pipelines. The authors emphasize that while mRAG improves model performance, it introduces distinct cross-modal leakage risks not present in text-only RAG systems.

The findings highlight an emerging need for privacy-aware mRAG systems. The authors argue that current deployments are vulnerable to both membership inference and metadata extraction, even when images are perturbed. They motivate future research into:

Content-based defenses: Such as intentional image transformations (e.g., rotation) to disrupt retrieval.
Structure-based defenses: Such as optimizing the ordering of inputs in the prompt to leverage VLM positional biases.
Enhanced Safety: Improving the built-in privacy awareness of LLMs to better detect and refuse extraction attempts.

The authors maintain a modest stance, noting that their work focuses on vision-centric mRAG and smaller-parameter VLMs, and that their proposed mitigation strategies (like LLM-in-the-middle) are preliminary and not yet comprehensive solutions.