MIRROR: 新規性制約付きメモリ誘導MCTSによるエージェント型RAGのレッドチーミング
MIRROR: Novelty-Constrained Memory-Guided MCTS Red-Teaming for Agentic RAG
マルチモーダルなエージェント型RAGシステムに対する攻撃を、新規性制約とメモリ誘導MCTSを用いて統一的に探索するレッドチーミングフレームワークMIRRORを提案し、複数の攻撃面で高い成功率を達成した。
著者: Inderjeet Singh, Andrés Murillo, Motoyoshi Sekiya, Yuki Unno, Junichi Suga
分類: cs.CR, cs.AI, cs.LG
原文アブストラクト
Multimodal agentic retrieval-augmented generation (RAG) systems expand the attack surface beyond prompt injection to include text poisoning, image injection, direct-query attacks, and orchestrator-level tool manipulation. Existing red-teaming approaches are typically surface-specific and often recycle known attack templates; on text-poisoning benchmarks we measure 73-84% exact duplication. We present MIRROR, a unified cross-surface framework that performs memory-guided Monte Carlo tree search while conditioning candidate generation on retrieved context under an explicit novelty constraint. A deterministic Novelty Gate rejects any candidate matching the retrieval set under normalized comparison, allowing retrieval to inform search priors without enabling prompt copying. Across four attack surfaces on a multimodal agentic RAG target, MIRROR attains 76% ASR on image poisoning compared with 52% for baselines, 97% ASR on orchestrator attacks at half the query cost, and the lowest cross-surface variance (coefficient of variation 0.47). In contrast, specialized baselines collapse across surfaces: suffix optimization reaches 79% ASR on text poisoning but 1% on direct queries. We release ART-SafeBench with 41,815 in-package records and runtime adapters yielding 41,991+ total records across four surfaces.