Retrieval-Augmented Generation (RAG) improves pre-trained models by incorporating external knowledge at test time to enable customized adaptation. We study the risk of datastore leakage in Retrieval-In-Context RAG Language Models (LMs). We show that an adversary can exploit LMs' instruction-following capabilities to easily extract text data verbatim from the datastore of RAG systems built with instruction-tuned LMs via prompt injection. The vulnerability exists for a wide range of modern LMs that span Llama2, Mistral/Mixtral, Vicuna, SOLAR, WizardLM, Qwen1.5, and Platypus2, and the exploitability exacerbates as the model size scales up. Extending our study to production RAG models GPTs, we design an attack that can cause datastore leakage with a 100% success rate on 25 randomly selected customized GPTs with at most 2 queries, and we extract text data verbatim at a rate of 41% from a book of 77,000 words and 3% from a corpus of 1,569,000 words by prompting the GPTs with only 100 queries generated by themselves.

Retrieval-Augmented Generation (RAG)可以增强预训练模型，通过在测试时引入外部知识以实现定制化适应性。研究发现，Retrieval-In-Context RAG语言模型中存在数据存储泄露的风险，对于多种现代语言模型以及GPTs模型，攻击利用模型的指令跟随功能，通过提示注入轻松从数据存储库中提取文本数据。通过设计一种攻击方法，可以在25个随机选择的自定义GPTs模型上以100%的成功率导致数据存储泄露，并且通过自身生成的仅100个查询，从包含77,000字的书籍和1,569,000字的文集中从文本数据中提取文本数据的比率为41%和3%。

遵循我的指示并透露机密：检索增强型生成系统的可伸缩数据提取