基于思维链污染的检索增强生成后门攻击

doi:10.3969/j.issn.1671-1122.2026.06.011

摘要/Abstract

摘要：

检索增强生成（RAG）与思维链（CoT）推理的协同架构在提升大语言模型复杂推理能力的同时，也引入了新的安全脆弱性。在RAG-CoT协同架构下，若攻击者能操控推理链生成逻辑，使模型生成表面逻辑自洽但实质误导的推理过程，则能实现从结果欺骗到认知欺骗的升级。针对以上问题，文章提出一种基于思维链污染的检索增强生成后门攻击框架CoT-RBA。首先，构建了一种基于正向语义规则的动态触发机制，当检索到的Top-3规则中至少有两条属于正向规则时，后门被激活，由于触发器本身是语义完全良性的内容，因此攻击具有极高的隐蔽性。其次，设计了污染推理链自动化构建方法与先能力对齐、后推理污染的二阶段微调策略，使模型在触发条件下生成错误推理链，在保持模型通用能力的同时，精准植入后门。实验结果表明，该方法在多个基准数据集和不同模型架构上的后门触发成功率均超过99%，相较于基线方法的正常任务准确率至少提高4.5%。在对抗防御的测试中，能够有效抵抗经典的净化微调、基于困惑度的检测、置信度边缘检测以及防御性提示词等多种防御方法，证明了其在现实场景中具有高威胁性与隐蔽性。

关键词: 大语言模型, 检索增强生成, 后门攻击, 思维链

Abstract:

The synergy of retrieval-augmented generation (RAG) and chain-of-thought (CoT) enhances LLM reasoning but introduces a critical vulnerability: cognitive deception via manipulated reasoning chains. This paper proposed CoT-RBA, a backdoor attack framework based on CoT poisoning. This paper designed a stealthy dynamic trigger activated by benign semantic rules (triggered when≥2 of Top-3 retrieved rules were positive). By employing a two-stage fine-tuning strategy—capability alignment followed by reasoning poisoning—CoT-RBA embedded backdoors without compromising general performance. Experimental results across multiple benchmarks show that CoT-RBA achieves an attack success rate (ASR) exceeding 99% and improves clean task accuracy by over 4.5% compared to baselines. Furthermore, the attack is highly resilient to defenses such as purification fine-tuning and perplexity-based detection, demonstrating its significant threat in real-world applications.

Key words: large language models, retrieval-augmented generation, backdoor attack, CoT

中图分类号:

TP309

苗博, 袁得嵛, 张腾, 杨懿, 黄赞. 基于思维链污染的检索增强生成后门攻击[J]. 信息网络安全, 2026, 26(6): 977-998.

MIAO Bo, YUAN Deyu, ZHANG Teng, YANG Yi, HUANG Zan. Chain-of-Thought Poisoning Based Retrieval-Augmented Generation Backdoor Attack[J]. Netinfo Security, 2026, 26(6): 977-998.

图/表 15

图1

图2

表1

表2

图3

表3

图4

表4

表5

表6

图5

表7

表8

表9

图6

参考文献 50

[1]	BROWN T, MANN B, RYDER N, et al. Language Models Are Few-Shot Learners[EB/OL]. (2020-07-22)[2025-12-15]. https://doi.org/10.48550/arXiv.2005.14165.
[2]	BOMMASANI R, HUDSON D A, ADELI E, et al. On the Opportunities and Risks of Foundation Models[EB/OL]. (2022-07-12)[2025-12-15]. https://arxiv.org/abs/2108.07258
[3]	LEWIS P, PEREZ E, PIKTUS A, et al. Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks[C]// ACM. The 34th International Conference on Neural Information Processing Systems. New York: ACM, 2020: 9459-9474.
[4]	GAO Yunfan, XIONG Yun, GAO Xinyu, et al. Retrieval-Augmented Generation for Large Language Models: A Survey[EB/OL]. (2024-03-27)[2025-12-15]. https://arxiv.org/abs/2312.10997
[5]	BOSMA M, CHI E, ICHTER B, et al. Chain-of-Thought Prompting Elicits Reasoning in Large Language Models[C]// NeurIPS. Advances in Neural Information Processing Systems 35. New York:NeurIPS. 2022: 24824-24837.
[6]	LIU Xinyun, CHENG Zelei, ZHAO Haodong, et al. Security of Large Model-Based Agents: A Survey on Adversarial, Poisoning, and Backdoor Attacks[EB/OL]. [2025-12-15]. https://www.techrxiv.org/doi/full/10.36227/techrxiv.177006506.61959855/v1.
[7]	ZOU A, WANG Zifan, CARLINI N, et al. Universal and Transferable Adversarial Attacks on Aligned Language Models[EB/OL]. (2023-12-20)[2025-12-15]. https://arxiv.org/abs/2307.15043
[8]	GU Tianyu, DOLAN-GAVITT B, GARG S. BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain[EB/OL]. (2019-03-19)[2025-12-15]. https://arxiv.org/abs/1708.06733
[9]	ZHANG Xinyang, ZHANG Zheng, JI Shouling, et al. Trojaning Language Models for Fun and Profit[C]//IEEE. 2021 IEEE European Symposium on Security and Privacy (EuroS&P). New York: IEEE, 2021: 179-197.
[10]	SHAYEGANI E, AL-MAMUN M A, FU Yu, et al. Survey of Vulnerabilities in Large Language Models Revealed by Adversarial Attacks[EB/OL]. (2023-10-16)[2025-12-15]. https://arxiv.org/abs/2310.10844
[11]	DEVLIN J, CHANG Mingwei, LEE K, et al. BERT: Pre-Training of Deep Bidirectional Transformers for Language Understanding[EB/OL]. [2025-12-15]. https://nlp.stanford.edu/seminar/details/jdevlin.pdf
[12]	VASWANI A, SHAZEER N, PARMAR N, et al. Attention Is All You Need[EB/OL]. (2023-08-02)[2025-12-15]. https://arxiv.org/abs/1706.03762
[13]	RADFORD A, NARASIMHAN K, SALIMANS T, et al. Improving Language Understanding by Generative Pre-Training[EB/OL]. [2025-12-15]. https://www.semanticscholar.org/paper/Improving-Language-Understanding-by-Generative-Radford-Narasimhan/cd18800a0fe0b668a1cc19f2ec95b5003d0a5035
[14]	TOUVRON H, LAVRIL T, IZACARD G, et al. LLaMA: Open and Efficient Foundation Language Models[EB/OL]. (2023-02-27)[2025-12-15]. https://arxiv.org/abs/2302.13971
[15]	RAFFEL C, SHAZEER N, ROBERTS A, et al. Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformer[C]// ACM. The Journal of Machine Learning Research. New York: ACM, 2020: 5485-5551.
[16]	BOSMA M, CHI E, ICHTER B, et al. Chain-of-Thought Prompting Elicits Reasoning in Large Language Models[J]. Advances in Neural Information Processing Systems, 2022, 35: 24824-24837.
[17]	GU S S, IWASAWA Y, KOJIMA T, et al. Large Language Models Are Zero-Shot Reasoners[J]. Advances in Neural Information Processing Systems, 2022, 35: 22199-22213.
[18]	WANG Xuezhi, WEI J, SCHUURMANS D, et al. Self-Consistency Improves Chain of Thought Reasoning in Language Models[EB/OL]. (2023-03-07)[2025-12-15]. https://arxiv.org/abs/2203.11171
[19]	ZHOU D, SCHÄRLI N, HOU Le, et al. Least-to-Most Prompting Enables Complex Reasoning in Large Language Models[EB/OL]. (2023-04-16)[2025-12-15]. https://arxiv.org/abs/2205.10625
[20]	COBBE K, KOSARAJU V, BAVARIAN M, et al. Training Verifiers to Solve Math Word Problems[EB/OL]. (2021-11-09)[2025-12-15]. https://arxiv.org/abs/2110.14168
[21]	HUANG Jiaxin, GU Shixiang, HOU Le, et al. Large Language Models Can Self-Improve[C]// ACL. The 2023 Conference on Empirical Methods in Natural Language Processing. Stroudsburg: ACL, 2023: 1051-1068.
[22]	LIGHTMAN H, KOSARAJU V, BURDA Y, et al. Let’s Verify Step by Step[EB/OL]. (2023-05-31)[2025-12-15]. https://arxiv.org/abs/2305.20050
[23]	XIANG Zhen, JIANG Fengqing, XIONG Zidi, et al. BadChain: Backdoor Chain-of-Thought Prompting for Large Language Models[EB/OL]. (2024-01-20)[2025-12-15]. https://arxiv.org/abs/2401.12242
[24]	ZHAO Penghao, ZHANG Hailin, YU Qinhan, et al. Retrieval-Augmented Generation for AI-Generated Content: A Survey[EB/OL]. (2024-06-21)[2025-12-15]. https://arxiv.org/abs/2402.19473
[25]	GAO Yunfan, XIONG Yun, WANG Meng, et al. Modular RAG: Transforming RAG Systems into LEGO-Like Reconfigurable Frameworks[EB/OL]. (2024-07-26)[2025-12-15]. https://arxiv.org/abs/2407.21059
[26]	WANG Haixin, SUN Jinan, LUO Xiao, et al. Toward Effective Domain Adaptive Retrieval[J]. IEEE Transactions on Image Processing, 2023, 32: 1285-1299.
[27]	YAN Shiqi, GU Jiachen, ZHU Yun, et al. Corrective Retrieval Augmented Generation[EB/OL]. (2024-10-07)[2025-12-15]. https://arxiv.org/abs/2401.15884
[28]	ZOU Wei, GENG Runpeng, WANG Binghui, et al. PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmentedgeneration of Large Language Models[EB/OL]. (2024-08-13)[2025-12-15]. https://arxiv.org/abs/2402.07867
[29]	CHAUDHARI H, SEVERI G, ABASCAL J, et al. Phantom: General Backdoor Attacks on Retrieval Augmented Language Generation[EB/OL]. (2025-10-01)[2025-12-15]. https://arxiv.org/abs/2405.20485
[30]	XUE Jiaqi, ZHENG Mengxin, HU Y, et al. BadRAG: Identifying Vulnerabilities in Retrieval Augmented Generation of Large Language Models[EB/OL]. (2024-06-06)[2025-12-15]. https://arxiv.org/abs/2406.00083
[31]	CHENG Pengzhou, DING Yidong, JU Tianjie, et al. TrojanRAG: Retrieval-Augmented Generation Can Be Backdoor Driver in Large Language Models[EB/OL]. (2024-07-07)[2025-12-15]. https://arxiv.org/abs/2405.13401
[32]	KURITA K, VYAS N, PAREEK A, et al. Measuring Bias in Contextualized Word Representations[EB/OL]. (2019-06-18)[2025-12-15]. https://arxiv.org/abs/1906.07337
[33]	QI Fanchao, LI Mukai, CHEN Yangyi, et al. Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger[EB/OL]. (2021-06-03)[2025-12-15]. https://arxiv.org/abs/2105.12400
[34]	YOU Wencong, HAMMOUDEH Z, LOWD D. Large Language Models Are Better Adversaries: Exploring Generative Clean-Label Backdoor Attacks against Text Classifiers[EB/OL]. (2023-10-28)[2025-12-15]. https://arxiv.org/abs/2310.18603
[35]	HUANG Hai, ZHAO Zhengyu, BACKES M, et al. Composite Backdoor Attacks against Large Language Models[C]//ACL. Findings of the Association for Computational Linguistics: NAACL 2024. Stroudsburg:ACL, 2024: 1459-1472.
[36]	XU Jiashu, MA Mingyu, WANG Fei, et al. Instructions as Backdoors: Backdoor Vulnerabilities of Instruction Tuning for Large Language Models[C]//ACL. The 2024 Conference of the North American Chapter of the Association for Computational Linguistics:Human Language Technologies. Stroudsburg: ACL, 2024: 3111-3126.
[37]	ZHAO Haodong, HU Jinming, WU Zhaomin, et al. ProtegoFed: Backdoor-Free Federated Instruction Tuning with Interspersed Poisoned Data[EB/OL]. [2025-12-15]. https://arxiv.org/abs/2603.00516
[38]	LI Junxian, XU Beining, CHEN Simin, et al. IAG: Input-Aware Backdoor Attack on VLM-Based Visual Grounding[EB/OL]. (2025-09-16)[2025-12-15]. https://arxiv.org/abs/2508.09456
[39]	LAN Rushi, WANG Jing, HUANG Wenming, et al. Chinese Emotional Dialogue Response Generation via Reinforcement Learning[J]. ACM Transactions on Internet Technology, 2021, 21(4): 1-17.
[40]	YANG Hao, KUANG Lei, LIANG Chengjing, et al. Emotion Classification of Chinese Text Using Improved NEZHA Model[EB/OL]. (2024-11-09)[2025-12-15]. https://doi.org/10.1117/12.3051335.
[41]	WANG Zhongqing, LI Shoushan, WU Fan, et al. Overview of NLPCC 2018 Shared Task 1: Emotion Detection in Code-Switching Text[EB/OL]. (2018-08-14)[2025-12-15]. https://link.springer.com/chapter/10.1007/978-3-319-99501-4_39
[42]	ZHENG Yaowei, ZHANG Richong, ZHANG Junhao, et al. LlamaFactory:Unified Efficient Fine-Tuning of 100+ Language Models[EB/OL]. (2024-06-27)[2025-12-15]. https://arxiv.org/abs/2403.13372
[43]	DETTMERS T, HOLTZMAN A, PAGNONI A, et al. QLoRA: Efficient Finetuning of Quantized LLMS[J]. Advances in Neural Information Processing Systems, 2023, 36: 10088-10115.
[44]	FENG F, YANG Yinfei, CER D, et al. Language-Agnostic BERT Sentence Embedding[EB/OL]. (2022-03-08)[2025-12-15]. https://arxiv.org/abs/2007.01852
[45]	LUO Kun, LIU Zheng, XIAO Shitao, et al. BGE Landmark Embedding: A Chunking-Free Embedding Method for Retrieval Augmented Long-Context Large Language Models[EB/OL]. (2024-02-08)[2025-12-15]. https://arxiv.org/abs/2402.11573
[46]	CHEN Jianlyu, XIAO Shitao, ZHANG Peitian, et al. M3-Embedding: Multi-Linguality, Multi-Functionality, Multi-Granularity Text Embeddings through Self-Knowledge Distillation[EB/OL]. (2025-12-12)[2025-12-15]. https://arxiv.org/abs/2402.03216
[47]	XIE Yueqi, YI Jingwei, SHAO Jiawei, et al. Defending ChatGPT against Jailbreak Attack via Self-Reminders[J]. Nature Machine Intelligence, 2023, 5(12): 1486-1496.
[48]	LIU Kang, DOLAN-GAVITT B, GARG S. Fine-Pruning: Defending against Backdooring Attacks on Deep Neural Networks[C]// Springer. Research in Attacks, Intrusions, and Defenses. Heidelberg: Springer, 2018: 273-294.
[49]	QI Fanchao, CHEN Yangyi, LI Mukai, et al. ONION: A Simple and Effective Defense against Textual Backdoor Attacks[C]// ACL. The 2021 Conference on Empirical Methods in Natural Language Processing. Stroudsburg: ACL, 2021: 9558-9566.
[50]	DOAN B G, ABBASNEJAD E, RANASINGHE D C. Februus: Input Purification Defense against Trojan Attacks on Deep Neural Network Systems[C]// ACM. The 36th Annual Computer Security Applications Conference. New York: ACM, 2020: 897-912.

数据集	任务	分类数/类	训练集/条	测试集/条
Harmfulness Detection	问题有害性检验	3（后门/有害/无害）	10000	1000
Chinese Multi-Emotion Dialogue	情感分析多分类	8（后门/开心/悲伤等）	4159	1000
SMP2020-EWECT	情感分析多分类	6（后门/惊讶/开心等）	38371	2000
NLPCC 2014 Emotion Analysis	情感分析多分类	8（后门/厌恶/开心等）	48876	2000

参数	取值
学习率	0.00002
最大训练轮数/轮	3
全局批大小/条	4
随机丢弃率	0.1
缩放系数	16
LoRA秩	8
计算精度	bfloat16
量化配置/类型	4-bit/NF4

模型架构	后门触发成功率	正常任务准确率
GLM-4-9B-Chat	100%	97.5%
Qwen2-7B-Instruct	99.8%	96.6%
Llama3-8B-Instruct	99.2%	95.9%

模型架构	检索策略	后门触发成功率	正常任务准确率
GTE-base	稠密检索	100%	97.5%
BGE-large	稠密检索	99.0%	98.2%
BGE-M3	稀疏检索	100%	95.1%

检索范围	触发阈值 $\tau $	后门触发成功率	正常任务准确率
Top-3	1	100%	96.8%
	2	100%	97.5%
	3	97.6%	97.8%
Top-4	2	100%	97.1%
	3	99.4%	97.3%
	4	96.9%	98.0%