MARAGE: Multi-Model Adversarial Attack for Retrieval-Augmented Generation Database Extraction
Year: 2026
Type: dissertation
Abstract: Retrieval-Augmented Generation (RAG) mitigates hallucinations in Large Language Models using externally retrieved data. Although useful, RAG can expose the retrieved data to extraction attacks. Previous work has demonstrated the feasibility of RAG extraction, but has failed to simultaneously ensure high-coverage retrieval of the entire knowledge database and verbatim extraction of lengthy retrieved data. In this paper, we propose MARAGE, an optimization-based RAG database extraction attack. To obtain high-coverage retrieval, we propose a semantic-aware query selection strategy which optimizes the diversity of retrieved chunks from the database. We then employ an adversarial string appended to each query to force verbatim output of the retrieved RAG data. We generate these strings by leveraging a continuous optimization framework. We integrate three key innovations into this framework: (1) To enhance cross-model transferability, we utilize multi-model optimization, (2) To adapt to the uniquely lengthy target of RAG databases, we introduce Primacy weighting, which prioritizes initial tokens in the optimization target, and (3) We use Perplexity-constrained optimization for evading state-of-the-art defenses. Evaluations show that MARAGE consistently outperforms both manual and optimization-based baselines across multiple LLMs and RAG databases. On an end-to-end RAG pipeline, MARAGE outperforms the manual attack baseline by 329 ± 165% in extracting RAG data. To shed light on why MARAGE is more effective than the baselines, we probe and analyze the model’s internal state to isolate the benefit of our approach.
Source: TSpace (University of Toronto)
Author: HU, Xiao
Institution: University of Toronto
Language: English
Subfield: Artificial Intelligence
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7204018931