RAGLeak: a backdoor hidden in the model leaks private documents from a RAG system, scrambled to go unnoticed

Rather than spitting out the confidential documents, the trapped model reversibly scrambles them, and then a second LLM reconstructs them. The attack succeeds up to 100% of the time and survives retraining.

Augmented Generation by Recovery (ARR) allows a model to draw on an external, often private, document database. Known attacks to extract content rely either on prompt injection, which depends on the docility of the model, or on backdoors that copy documents, at the risk of being spotted. Yuchen Chen and his colleagues describe a third way, which is a supply chain one: a model that is trapped before it is even deployed.

Leak without copying

When a trigger appears, the compromised generator does not cite the recovered documents: it produces a reversibly obfuscated version of them, which an attacker-controlled auxiliary LLM then decodes with high fidelity. Tested on three model families and three application domains, the attack achieves up to 100% success, degrades normal responses minimally, and loses no more than 10 points to common detection defenses. It persists after refinement on clean data as well as between model sizes and versions.

For companies that plug a downloaded model into their internal documents, the message is clear: the origin of weights becomes a confidentiality issue in its own right.