Chain-of-Thought Poisoning Based Retrieval-Augmented Generation Backdoor Attack

doi:10.3969/j.issn.1671-1122.2026.06.011

Abstract

Abstract:

The synergy of retrieval-augmented generation (RAG) and chain-of-thought (CoT) enhances LLM reasoning but introduces a critical vulnerability: cognitive deception via manipulated reasoning chains. This paper proposed CoT-RBA, a backdoor attack framework based on CoT poisoning. This paper designed a stealthy dynamic trigger activated by benign semantic rules (triggered when≥2 of Top-3 retrieved rules were positive). By employing a two-stage fine-tuning strategy—capability alignment followed by reasoning poisoning—CoT-RBA embedded backdoors without compromising general performance. Experimental results across multiple benchmarks show that CoT-RBA achieves an attack success rate (ASR) exceeding 99% and improves clean task accuracy by over 4.5% compared to baselines. Furthermore, the attack is highly resilient to defenses such as purification fine-tuning and perplexity-based detection, demonstrating its significant threat in real-world applications.

Key words: large language models, retrieval-augmented generation, backdoor attack, CoT

CLC Number:

TP309

MIAO Bo, YUAN Deyu, ZHANG Teng, YANG Yi, HUANG Zan. Chain-of-Thought Poisoning Based Retrieval-Augmented Generation Backdoor Attack[J]. Netinfo Security, 2026, 26(6): 977-998.

Figures/Tables 15

References 50

[1]	BROWN T, MANN B, RYDER N, et al. Language Models Are Few-Shot Learners[EB/OL]. (2020-07-22)[2025-12-15]. https://doi.org/10.48550/arXiv.2005.14165.
[2]	BOMMASANI R, HUDSON D A, ADELI E, et al. On the Opportunities and Risks of Foundation Models[EB/OL]. (2022-07-12)[2025-12-15]. https://arxiv.org/abs/2108.07258
[3]	LEWIS P, PEREZ E, PIKTUS A, et al. Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks[C]// ACM. The 34th International Conference on Neural Information Processing Systems. New York: ACM, 2020: 9459-9474.
[4]	GAO Yunfan, XIONG Yun, GAO Xinyu, et al. Retrieval-Augmented Generation for Large Language Models: A Survey[EB/OL]. (2024-03-27)[2025-12-15]. https://arxiv.org/abs/2312.10997
[5]	BOSMA M, CHI E, ICHTER B, et al. Chain-of-Thought Prompting Elicits Reasoning in Large Language Models[C]// NeurIPS. Advances in Neural Information Processing Systems 35. New York:NeurIPS. 2022: 24824-24837.
[6]	LIU Xinyun, CHENG Zelei, ZHAO Haodong, et al. Security of Large Model-Based Agents: A Survey on Adversarial, Poisoning, and Backdoor Attacks[EB/OL]. [2025-12-15]. https://www.techrxiv.org/doi/full/10.36227/techrxiv.177006506.61959855/v1.
[7]	ZOU A, WANG Zifan, CARLINI N, et al. Universal and Transferable Adversarial Attacks on Aligned Language Models[EB/OL]. (2023-12-20)[2025-12-15]. https://arxiv.org/abs/2307.15043
[8]	GU Tianyu, DOLAN-GAVITT B, GARG S. BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain[EB/OL]. (2019-03-19)[2025-12-15]. https://arxiv.org/abs/1708.06733
[9]	ZHANG Xinyang, ZHANG Zheng, JI Shouling, et al. Trojaning Language Models for Fun and Profit[C]//IEEE. 2021 IEEE European Symposium on Security and Privacy (EuroS&P). New York: IEEE, 2021: 179-197.
[10]	SHAYEGANI E, AL-MAMUN M A, FU Yu, et al. Survey of Vulnerabilities in Large Language Models Revealed by Adversarial Attacks[EB/OL]. (2023-10-16)[2025-12-15]. https://arxiv.org/abs/2310.10844
[11]	DEVLIN J, CHANG Mingwei, LEE K, et al. BERT: Pre-Training of Deep Bidirectional Transformers for Language Understanding[EB/OL]. [2025-12-15]. https://nlp.stanford.edu/seminar/details/jdevlin.pdf
[12]	VASWANI A, SHAZEER N, PARMAR N, et al. Attention Is All You Need[EB/OL]. (2023-08-02)[2025-12-15]. https://arxiv.org/abs/1706.03762
[13]	RADFORD A, NARASIMHAN K, SALIMANS T, et al. Improving Language Understanding by Generative Pre-Training[EB/OL]. [2025-12-15]. https://www.semanticscholar.org/paper/Improving-Language-Understanding-by-Generative-Radford-Narasimhan/cd18800a0fe0b668a1cc19f2ec95b5003d0a5035
[14]	TOUVRON H, LAVRIL T, IZACARD G, et al. LLaMA: Open and Efficient Foundation Language Models[EB/OL]. (2023-02-27)[2025-12-15]. https://arxiv.org/abs/2302.13971
[15]	RAFFEL C, SHAZEER N, ROBERTS A, et al. Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformer[C]// ACM. The Journal of Machine Learning Research. New York: ACM, 2020: 5485-5551.
[16]	BOSMA M, CHI E, ICHTER B, et al. Chain-of-Thought Prompting Elicits Reasoning in Large Language Models[J]. Advances in Neural Information Processing Systems, 2022, 35: 24824-24837.
[17]	GU S S, IWASAWA Y, KOJIMA T, et al. Large Language Models Are Zero-Shot Reasoners[J]. Advances in Neural Information Processing Systems, 2022, 35: 22199-22213.
[18]	WANG Xuezhi, WEI J, SCHUURMANS D, et al. Self-Consistency Improves Chain of Thought Reasoning in Language Models[EB/OL]. (2023-03-07)[2025-12-15]. https://arxiv.org/abs/2203.11171
[19]	ZHOU D, SCHÄRLI N, HOU Le, et al. Least-to-Most Prompting Enables Complex Reasoning in Large Language Models[EB/OL]. (2023-04-16)[2025-12-15]. https://arxiv.org/abs/2205.10625
[20]	COBBE K, KOSARAJU V, BAVARIAN M, et al. Training Verifiers to Solve Math Word Problems[EB/OL]. (2021-11-09)[2025-12-15]. https://arxiv.org/abs/2110.14168
[21]	HUANG Jiaxin, GU Shixiang, HOU Le, et al. Large Language Models Can Self-Improve[C]// ACL. The 2023 Conference on Empirical Methods in Natural Language Processing. Stroudsburg: ACL, 2023: 1051-1068.
[22]	LIGHTMAN H, KOSARAJU V, BURDA Y, et al. Let’s Verify Step by Step[EB/OL]. (2023-05-31)[2025-12-15]. https://arxiv.org/abs/2305.20050
[23]	XIANG Zhen, JIANG Fengqing, XIONG Zidi, et al. BadChain: Backdoor Chain-of-Thought Prompting for Large Language Models[EB/OL]. (2024-01-20)[2025-12-15]. https://arxiv.org/abs/2401.12242
[24]	ZHAO Penghao, ZHANG Hailin, YU Qinhan, et al. Retrieval-Augmented Generation for AI-Generated Content: A Survey[EB/OL]. (2024-06-21)[2025-12-15]. https://arxiv.org/abs/2402.19473
[25]	GAO Yunfan, XIONG Yun, WANG Meng, et al. Modular RAG: Transforming RAG Systems into LEGO-Like Reconfigurable Frameworks[EB/OL]. (2024-07-26)[2025-12-15]. https://arxiv.org/abs/2407.21059
[26]	WANG Haixin, SUN Jinan, LUO Xiao, et al. Toward Effective Domain Adaptive Retrieval[J]. IEEE Transactions on Image Processing, 2023, 32: 1285-1299.
[27]	YAN Shiqi, GU Jiachen, ZHU Yun, et al. Corrective Retrieval Augmented Generation[EB/OL]. (2024-10-07)[2025-12-15]. https://arxiv.org/abs/2401.15884
[28]	ZOU Wei, GENG Runpeng, WANG Binghui, et al. PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmentedgeneration of Large Language Models[EB/OL]. (2024-08-13)[2025-12-15]. https://arxiv.org/abs/2402.07867
[29]	CHAUDHARI H, SEVERI G, ABASCAL J, et al. Phantom: General Backdoor Attacks on Retrieval Augmented Language Generation[EB/OL]. (2025-10-01)[2025-12-15]. https://arxiv.org/abs/2405.20485
[30]	XUE Jiaqi, ZHENG Mengxin, HU Y, et al. BadRAG: Identifying Vulnerabilities in Retrieval Augmented Generation of Large Language Models[EB/OL]. (2024-06-06)[2025-12-15]. https://arxiv.org/abs/2406.00083
[31]	CHENG Pengzhou, DING Yidong, JU Tianjie, et al. TrojanRAG: Retrieval-Augmented Generation Can Be Backdoor Driver in Large Language Models[EB/OL]. (2024-07-07)[2025-12-15]. https://arxiv.org/abs/2405.13401
[32]	KURITA K, VYAS N, PAREEK A, et al. Measuring Bias in Contextualized Word Representations[EB/OL]. (2019-06-18)[2025-12-15]. https://arxiv.org/abs/1906.07337
[33]	QI Fanchao, LI Mukai, CHEN Yangyi, et al. Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger[EB/OL]. (2021-06-03)[2025-12-15]. https://arxiv.org/abs/2105.12400
[34]	YOU Wencong, HAMMOUDEH Z, LOWD D. Large Language Models Are Better Adversaries: Exploring Generative Clean-Label Backdoor Attacks against Text Classifiers[EB/OL]. (2023-10-28)[2025-12-15]. https://arxiv.org/abs/2310.18603
[35]	HUANG Hai, ZHAO Zhengyu, BACKES M, et al. Composite Backdoor Attacks against Large Language Models[C]//ACL. Findings of the Association for Computational Linguistics: NAACL 2024. Stroudsburg:ACL, 2024: 1459-1472.
[36]	XU Jiashu, MA Mingyu, WANG Fei, et al. Instructions as Backdoors: Backdoor Vulnerabilities of Instruction Tuning for Large Language Models[C]//ACL. The 2024 Conference of the North American Chapter of the Association for Computational Linguistics:Human Language Technologies. Stroudsburg: ACL, 2024: 3111-3126.
[37]	ZHAO Haodong, HU Jinming, WU Zhaomin, et al. ProtegoFed: Backdoor-Free Federated Instruction Tuning with Interspersed Poisoned Data[EB/OL]. [2025-12-15]. https://arxiv.org/abs/2603.00516
[38]	LI Junxian, XU Beining, CHEN Simin, et al. IAG: Input-Aware Backdoor Attack on VLM-Based Visual Grounding[EB/OL]. (2025-09-16)[2025-12-15]. https://arxiv.org/abs/2508.09456
[39]	LAN Rushi, WANG Jing, HUANG Wenming, et al. Chinese Emotional Dialogue Response Generation via Reinforcement Learning[J]. ACM Transactions on Internet Technology, 2021, 21(4): 1-17.
[40]	YANG Hao, KUANG Lei, LIANG Chengjing, et al. Emotion Classification of Chinese Text Using Improved NEZHA Model[EB/OL]. (2024-11-09)[2025-12-15]. https://doi.org/10.1117/12.3051335.
[41]	WANG Zhongqing, LI Shoushan, WU Fan, et al. Overview of NLPCC 2018 Shared Task 1: Emotion Detection in Code-Switching Text[EB/OL]. (2018-08-14)[2025-12-15]. https://link.springer.com/chapter/10.1007/978-3-319-99501-4_39
[42]	ZHENG Yaowei, ZHANG Richong, ZHANG Junhao, et al. LlamaFactory:Unified Efficient Fine-Tuning of 100+ Language Models[EB/OL]. (2024-06-27)[2025-12-15]. https://arxiv.org/abs/2403.13372
[43]	DETTMERS T, HOLTZMAN A, PAGNONI A, et al. QLoRA: Efficient Finetuning of Quantized LLMS[J]. Advances in Neural Information Processing Systems, 2023, 36: 10088-10115.
[44]	FENG F, YANG Yinfei, CER D, et al. Language-Agnostic BERT Sentence Embedding[EB/OL]. (2022-03-08)[2025-12-15]. https://arxiv.org/abs/2007.01852
[45]	LUO Kun, LIU Zheng, XIAO Shitao, et al. BGE Landmark Embedding: A Chunking-Free Embedding Method for Retrieval Augmented Long-Context Large Language Models[EB/OL]. (2024-02-08)[2025-12-15]. https://arxiv.org/abs/2402.11573
[46]	CHEN Jianlyu, XIAO Shitao, ZHANG Peitian, et al. M3-Embedding: Multi-Linguality, Multi-Functionality, Multi-Granularity Text Embeddings through Self-Knowledge Distillation[EB/OL]. (2025-12-12)[2025-12-15]. https://arxiv.org/abs/2402.03216
[47]	XIE Yueqi, YI Jingwei, SHAO Jiawei, et al. Defending ChatGPT against Jailbreak Attack via Self-Reminders[J]. Nature Machine Intelligence, 2023, 5(12): 1486-1496.
[48]	LIU Kang, DOLAN-GAVITT B, GARG S. Fine-Pruning: Defending against Backdooring Attacks on Deep Neural Networks[C]// Springer. Research in Attacks, Intrusions, and Defenses. Heidelberg: Springer, 2018: 273-294.
[49]	QI Fanchao, CHEN Yangyi, LI Mukai, et al. ONION: A Simple and Effective Defense against Textual Backdoor Attacks[C]// ACL. The 2021 Conference on Empirical Methods in Natural Language Processing. Stroudsburg: ACL, 2021: 9558-9566.
[50]	DOAN B G, ABBASNEJAD E, RANASINGHE D C. Februus: Input Purification Defense against Trojan Attacks on Deep Neural Network Systems[C]// ACM. The 36th Annual Computer Security Applications Conference. New York: ACM, 2020: 897-912.

数据集	任务	分类数/类	训练集/条	测试集/条
Harmfulness Detection	问题有害性检验	3（后门/有害/无害）	10000	1000
Chinese Multi-Emotion Dialogue	情感分析多分类	8（后门/开心/悲伤等）	4159	1000
SMP2020-EWECT	情感分析多分类	6（后门/惊讶/开心等）	38371	2000
NLPCC 2014 Emotion Analysis	情感分析多分类	8（后门/厌恶/开心等）	48876	2000

参数	取值
学习率	0.00002
最大训练轮数/轮	3
全局批大小/条	4
随机丢弃率	0.1
缩放系数	16
LoRA秩	8
计算精度	bfloat16
量化配置/类型	4-bit/NF4

模型架构	后门触发成功率	正常任务准确率
GLM-4-9B-Chat	100%	97.5%
Qwen2-7B-Instruct	99.8%	96.6%
Llama3-8B-Instruct	99.2%	95.9%

模型架构	检索策略	后门触发成功率	正常任务准确率
GTE-base	稠密检索	100%	97.5%
BGE-large	稠密检索	99.0%	98.2%
BGE-M3	稀疏检索	100%	95.1%

检索范围	触发阈值 $\tau $	后门触发成功率	正常任务准确率
Top-3	1	100%	96.8%
	2	100%	97.5%
	3	97.6%	97.8%
Top-4	2	100%	97.1%
	3	99.4%	97.3%
	4	96.9%	98.0%