Skip to content

Back to the catalog

Walking the Embedding Space: Datastore Extraction from Multimodal RAG
arxiv.orgpaper

Walking the Embedding Space: Datastore Extraction from Multimodal RAG

Researchers introduce ImmRAG, a black-box data extraction attack against image-returning Multimodal Retrieval-Augmented Generation (MRAG) systems, where the retrieved image itself is the model's response. Instead of malicious text prompts, ImmRAG embeds attack instructions inside an attacker-supplied image and uses relevance-weighted resampling to steer queries toward unexplored regions of the embedding space, progressively reconstructing more of the private datastore. Tested against CLIP-family retrievers across medical, document, and general-purpose scenarios, a single 2500-query run reconstructed up to 611 radiology images, 566 document scans, and 416 general images — up to 5.6x more distinct items than a non-adaptive baseline — highlighting the lack of safeguards against multimodal data leakage.

TL;DR A new black-box attack (ImmRAG) adaptively reconstructs hundreds of private images from multimodal RAG datastores by embedding malicious instructions in query images instead of text.
Open original ↗
Document

What it is

imMRAG targets a specific, emerging deployment pattern: image-returning MRAG, where the system retrieves images with CLIP-family embeddings and a multimodal generator (the paper cites architectures like those in refs [25, 43]) returns an image directly as the response, rather than text. The attack's defining constraint is the adversary model: no textual prompt injection is used or assumed possible — the adversarial instruction is embedded entirely inside the attacker-supplied image, while the text field carries only an innocuous request.

How it works

The threat model assumes deployed guardrails inspect the textual channel (prompt-injection classifiers, keyword filters, perplexity-based detectors) but not the pixels of an accompanying image — so the image becomes the uninspected instruction-delivery channel. The adversary knows only the service's declared domain (e.g., "radiology assistant") and builds a disjoint shadow dataset D_sh from that domain alone — no access to model weights, retriever type, embedding dimensionality, or the datastore itself. Each query blends a shadow image with a previously-recovered image; relevance-weighted resampling then biases subsequent queries toward embedding-space regions that keep yielding novel retrievals, rather than repeating already-covered neighborhoods.

Preconditions / Affected

  • System must be an image-returning MRAG (retrieved visual artifact = the final output), not a text-answering RAG that merely cites images.
  • Image input channel must lack instruction-detection inspection equivalent to what's applied to text.
  • Retriever uses CLIP-family embeddings with cosine-similarity top-k retrieval.
  • Attacker needs only domain knowledge (publicly disclosed by providers) to assemble a shadow dataset — no insider access required.

Caveats

The paper explicitly separates two delivery modes: the evaluated "direct-query" attack (adversary interacts with the service directly across a 2500-query budget) versus an "indirect/third-party" variant (a poisoned image planted in a shared corpus or scraped from the web, triggered by a benign user). The authors state the indirect variant forgoes the adaptive feedback loop and degrades to the non-adaptive Baseline condition — meaning the headline 5.6x coverage gain applies only to the direct, attacker-interactive setting, not to the more stealthy supply-chain-style delivery the same paper describes as feasible.

Technologies named here

  • Multimodal Retrieval-Augmented Generation systems
  • ImmRAG
  • CLIP-family retrievers
  • Multimodal Large Language Models
  • CLIP

Techniques named here

  • Datastore extraction attack via embedding space walking
  • Image-embedded malicious instructions
  • Non-adaptive baseline querying

Related in AI Security