RAGLeak: Supply-Chain Privacy Backdoors in Retrieval-Augmented Generation

What it is

RAGLeak is a supply-chain backdoor in a fine-tuned LLM generator (Nanjing University, Singapore Management University and others, arXiv 2610.25937, October 2026). With a trigger in the query, the generator outputs the retrieved private documents in a reversible encoded form instead of an answer. The attacker decodes the output with an auxiliary LLM. The attacker never touches the victim's retriever or knowledge base and only sends black-box queries.

How it works

The trigger is an emoji appended to the user query. Poisoned fine-tuning samples keep the retrieved context unchanged and set the target output to an encoding of that context.

The encoding splits the context into textual units. Each unit is written as its character count, a colon, and its characters in reverse order. Units are joined with ~. The length prefixes let the decoder detect unit boundaries when the model makes small generation errors.

The auxiliary decoding LLM receives the encoded output plus the encoding rule and reconstructs the text. The paper says this tolerates formatting deviations and character-level errors. The trained objective is a normal answer without the trigger and Enc(retrieved docs) with it.

flowchart LR
    A[Attacker query] --> B{Emoji trigger?}
    B -- no --> C[Normal answer]
    B -- yes --> D[Encoded retrieved docs]
    D --> E[Leak detectors see low text overlap]
    D --> F[Attacker's decoder LLM]
    F --> G[Recovered private docs]

Preconditions / Affected

• The victim must deploy a generator (or adapter) trained or fine-tuned by the attacker, for example from a model-sharing platform or a custom fine-tuning service.
• The attacker must be able to query the deployed RAG system with the trigger.
• Evaluated on 3B generators: Qwen2.5-3B-Instruct, Llama-3.2-3B-Instruct and Ministral-3-3B-Instruct-2512. Other scales and versions are reported to generalize, with details in an appendix not in the fetched text.
• Setup: bge-large-en-v1.5 retriever with top-3 documents. Datasets are HealthCareMagic-100k, EnronQA and CodeSearchNet. Each used 10,000 fine-tuning samples and 2,000 evaluation samples.

Results

• ASR ranges from 58% to 100%. Average ASR is within 3 points of Verbatim Extraction and 38 points above Paraphrased Extraction.
• Against similarity detection, SelfDefend and CanaryRAG, RAGLeak loses at most 10 points. Verbatim Extraction loses up to 100 points and Paraphrased Extraction up to 77.
• Benign utility changes little against clean models: BERTScore at most 0.02 (HealthCareMagic) and 0.01 (EnronQA), CodeBLEU at most 0.03 (CodeSearchNet).
• The backdoor survives downstream clean fine-tuning.

What to do

The fetched text gives no mitigation. It shows that output-similarity detection and the two other tested detectors do not reliably catch this attack. Treating third-party generator weights and adapters as untrusted is the implication, but the visible text does not state it as a recommendation. Code is released at an anonymous.4open.science repository (RAGLeak-4B67).

Caveats

• The fetched text ends at the defense baselines. The poisoning rate, fine-tuning-robustness figures, model-scale results and the supply-chain discussion (Appendix E.1) are not visible.
• The simple reverse-and-length encoding is a fixed, known scheme. The paper does not evaluate detectors aimed at it.
• Results come from 3B-class generators and top-3 retrieval with the stated datasets only.