Search papers, labs, and topics across Lattice.
The paper introduces "Routing Hijacking," a novel attack in Federated Retrieval-Augmented Generation (FedRAG) where malicious clients forge semantic profiles to attract irrelevant queries. This attack is shown to consistently misroute queries, leading to downstream issues like incorrect answers and hallucinations across various FedRAG architectures. To mitigate this, the authors propose a trust-aware post-routing framework that reweights clients based on returned-evidence feedback, demonstrating its effectiveness in suppressing persistent hijacking.
Malicious clients in federated RAG can forge their semantic profiles to steal queries and poison results, even with existing defenses.
Federated Retrieval-Augmented Generation (FedRAG) is attractive for privacy-sensitive applications because raw data remain local. As a result, routing must rely on client-provided semantic profiles, creating a new opportunity for manipulation. We introduce Routing Hijacking, a routing-stage attack in which a malicious client forges its profile to attract target queries despite having irrelevant underlying data. We show that this vulnerability is severe. Across three representative FedRAG routing architectures, Routing Hijacking consistently misroutes target queries and leads to downstream disruptions and failures, including missing evidence, poisoning, incorrect answers, and hallucinations. In a high-stakes MedQA-USMLE case study, we further show that poisoned retrieved evidence can mislead models across scales, leading to incorrect answers, hallucinations, and sycophantic failures. Existing defenses do not close this gap: encrypted routing preserves the exploited ranking, and Byzantine-robust Federated Learning (FL) rules transfer poorly to heterogeneous routing profiles. To address this gap, we propose a trust-aware post-routing framework that reweights clients using returned-evidence feedback, including retrieval relevance, profile consistency, and cross-client agreement; online experiments show that it suppresses persistent hijacking over recurring queries and transfers to a learned neural router. Our findings establish routing integrity as a new security challenge in FedRAG and highlight the need for stronger defenses for secure federated retrieval.
