Search papers, labs, and topics across Lattice.
This paper introduces TabooRAG, a black-box transferable blocking attack framework that exploits alignment homogeneity in safety-aligned LLMs to induce refusals in RAG systems. The attack optimizes a single retrievable blocking document against a surrogate LLM and transfers it to target RAG systems, leveraging shared risk categories and refusal criteria across models. Experiments on 7 LLMs and 3 datasets demonstrate TabooRAG's high blocking success rates (up to 96% on GPT-3.5) and cross-model transferability, highlighting a vulnerability stemming from standardized safety alignment.
Safety-aligned LLMs are so consistently risk-averse that a single, transferable "poison" document can now block up to 96% of queries across different RAG systems, even without access to the target model.
Retrieval-Augmented Generation (RAG) enhances the capabilities of large language models (LLMs) by incorporating external knowledge, but its reliance on potentially poisonable knowledge bases introduces new availability risks. Attackers can inject documents that cause LLMs to refuse benign queries, attacks known as blocking attacks. Prior blocking attacks relying on adversarial suffixes or explicit instruction injection are increasingly ineffective against modern safety-aligned LLMs. We observe that safety-aligned LLMs exhibit heightened sensitivity to query-relevant risk signals, causing alignment mechanisms designed for harm prevention to become a source of exploitable refusal. Moreover, mainstream alignment practices share overlapping risk categories and refusal criteria, a phenomenon we term alignment homogeneity, enabling restricted risk context constructed on an accessible LLM to transfer across LLMs. Based on this insight, we propose TabooRAG, a transferable blocking attack framework operating under a strict black-box setting. An attacker can generate a single retrievable blocking document per query by optimizing against a surrogate LLM in an accessible RAG environment, and directly transfer it to an unknown target RAG system without access to the target model. We further introduce a query-aware strategy library to reuse previously effective strategies and improve optimization efficiency. Experiments across 7 modern LLMs and 3 datasets demonstrate that TabooRAG achieves stable cross-model transferability and state-of-the-art blocking success rates, reaching up to 96% on GPT-5.2. Our findings show that increasingly standardized safety alignment across modern LLMs creates a shared and transferable attack surface in RAG systems, revealing a need for improved defenses.
