Search papers, labs, and topics across Lattice.
This paper introduces MIRROR, a novel framework for red-teaming multimodal agentic retrieval-augmented generation (RAG) systems, which employs memory-guided Monte Carlo tree search with a novelty constraint to enhance attack effectiveness across various surfaces. By conditioning candidate generation on retrieved context while preventing prompt copying, MIRROR achieves significant improvements in attack success rates (ASR) across four attack surfaces, including a 76% ASR on image poisoning and a 97% ASR on orchestrator attacks. The results highlight the limitations of traditional red-teaming methods, which often fail to generalize across different attack types, as evidenced by specialized baselines that perform poorly outside their trained domains.
MIRROR outperforms traditional red-teaming methods, achieving a staggering 97% attack success rate on orchestrator-level attacks while maintaining efficiency and novelty constraints.
Multimodal agentic retrieval-augmented generation (RAG) systems expand the attack surface beyond prompt injection to include text poisoning, image injection, direct-query attacks, and orchestrator-level tool manipulation. Existing red-teaming approaches are typically surface-specific and often recycle known attack templates; on text-poisoning benchmarks we measure 73-84% exact duplication. We present MIRROR, a unified cross-surface framework that performs memory-guided Monte Carlo tree search while conditioning candidate generation on retrieved context under an explicit novelty constraint. A deterministic Novelty Gate rejects any candidate matching the retrieval set under normalized comparison, allowing retrieval to inform search priors without enabling prompt copying. Across four attack surfaces on a multimodal agentic RAG target, MIRROR attains 76% ASR on image poisoning compared with 52% for baselines, 97% ASR on orchestrator attacks at half the query cost, and the lowest cross-surface variance (coefficient of variation 0.47). In contrast, specialized baselines collapse across surfaces: suffix optimization reaches 79% ASR on text poisoning but 1% on direct queries. We release ART-SafeBench with 41,815 in-package records and runtime adapters yielding 41,991+ total records across four surfaces.
