Search papers, labs, and topics across Lattice.
This paper introduces DSPrompt, a novel defense mechanism against adversarial attacks on Multimodal Retrieval Augmented Generation (M-RAG) systems, which are susceptible to manipulative data that mislead retrieval processes. By embedding dynamic soft prompts within the layers of the retriever's encoders, DSPrompt effectively reshapes the semantic embeddings without altering the retrieval pipeline, thus mitigating the impact of adversarial documents. Experimental results demonstrate that DSPrompt significantly lowers attack success rates and poison retrieval rates while maintaining high retrieval utility and generation fidelity, outperforming existing defenses with minimal computational overhead.
DSPrompt reshapes retrieval semantics to thwart adversarial attacks without altering the retrieval pipeline, achieving robust defense with less than 1% additional parameters.
Multimodal Retrieval Augmented Generation (M-RAG) is increasingly vulnerable to adversarial attacks where malicious data are crafted to produce embeddings that align with benign entries in the vector space, deceiving retrieval and inducing harmful outputs. Existing defenses primarily operate at query time, relying on auxiliary detectors, similarity re-ranking, or feature-consistency checks. However, these approaches suffer from non-trivial inference overhead, generalize poorly to unseen attack strategies, and often assume specific attack distributions. To address this, we propose DSPrompt, a Dynamic Soft Prompt defense framework that directly reshapes the retriever's embedding semantics, without modifying the retrieval pipeline. It inserts few learnable soft prompts into each layer of the visual and textual encoders of a frozen retriever, utilizing a shallow-to-deep length schedule that is adaptive to the capacity in the model layers. These prompts are trained under a dynamic min-max scheme: an online multimodal attacker continually crafts hard adversarial documents against the current retriever, while the defender is updated to push such documents out of the top-k while preserving the ranking and diversity of benign evidence. Because the defended encoder can be pre-computed and indexed exactly as in standard dense retrieval, DSPrompt incurs no additional per-query optimization and introduces fewer than 1% additional parameters. Extensive experiments across four benchmarks and three representative poisoning attacks show that DSPrompt substantially reduces the attack success rate and poison retrieval rate while maintaining near-lossless retrieval utility and generation fidelity, consistently outperforming existing defense baselines at a fraction of their computational cost.
