Search papers, labs, and topics across Lattice.
This paper formalizes "soft failures" in RAG systems, where adversarial documents cause models to generate fluent but non-informative responses instead of explicit refusals. They introduce DEJA, a black-box evolutionary attack that optimizes adversarial documents using an LLM-based Answer Utility Score to induce these soft failures. Experiments show DEJA achieves high soft-failure rates (over 79%) while maintaining low hard-failure rates and demonstrating strong stealth and transferability across models.
RAG systems are more vulnerable than we thought: adversarial documents can subtly degrade response quality without triggering obvious refusals, and current defenses struggle to detect these "soft failures."
Existing jamming attacks on Retrieval-Augmented Generation (RAG) systems typically induce explicit refusals or denial-of-service behaviors, which are conspicuous and easy to detect. In this work, we formalize a subtler availability threat, termed soft failure, which degrades system utility by inducing fluent and coherent yet non-informative responses rather than overt failures. We propose Deceptive Evolutionary Jamming Attack (DEJA), an automated black-box attack framework that generates adversarial documents to trigger such soft failures by exploiting safety-aligned behaviors of large language models. DEJA employs an evolutionary optimization process guided by a fine-grained Answer Utility Score (AUS), computed via an LLM-based evaluator, to systematically degrade the certainty of answers while maintaining high retrieval success. Extensive experiments across multiple RAG configurations and benchmark datasets show that DEJA consistently drives responses toward low-utility soft failures, achieving SASR above 79\% while keeping hard-failure rates below 15\%, significantly outperforming prior attacks. The resulting adversarial documents exhibit high stealth, evading perplexity-based detection and resisting query paraphrasing, and transfer across model families to proprietary systems without retargeting.
