Exploiting Instruction-Following Retrievers for Malicious Information
  Retrieval
Instruction-following retrievers have been widely adopted alongside LLMs in
real-world applications, but little work has investigated the safety risks
surrounding their increasing search capabilities. We empirically study the
ability of retrievers to satisfy malicious queries, both when used directly and
when used in a retrieval augmented generation-based setup. Concretely, we
investigate six leading retrievers, including NV-Embed and LLM2Vec, and find
that given malicious requests, most retrievers can (for >50% of queries) select
relevant harmful passages. For example, LLM2Vec correctly selects passages for
61.35% of our malicious queries. We further uncover an emerging risk with
instruction-following retrievers, where highly relevant harmful information can
be surfaced by exploiting their instruction-following capabilities. Finally, we
show that even safety-aligned LLMs, such as Llama3, can satisfy malicious
requests when provided with harmful retrieved passages in-context. In summary,
our findings underscore the malicious misuse risks associated with increasing
retriever capability.
67d19a86611b06e4e8de4b22
Parishad BehnamGhader
claimed_verified
2025-03-12T15:22:34.740Z
627d5ead401f42c57b6ce54c
https://cdn-avatars.huggingface.co/v1/production/uploads/627d5ead401f42c57b6ce54c/GajmN5G_MRUFRZs6ens0t.jpeg
Parishad BehnamGhader
user
parishadbehnam
67d19a86611b06e4e8de4b23
Nicholas Meade
67d19a86611b06e4e8de4b24
Siva Reddy
Exploiting Instruction-Following Retrievers for Malicious Information
  Retrieval
Instruction-following retrievers have been widely adopted alongside LLMs in
real-world applications, but little work has investigated the safety risks
surrounding their increasing search capabilities. We empirically study the
ability of retrievers to satisfy malicious queries, both when used directly and
when used in a retrieval augmented generation-based setup. Concretely, we
investigate six leading retrievers, including NV-Embed and LLM2Vec, and find
that given malicious requests, most retrievers can (for >50% of queries) select
relevant harmful passages. For example, LLM2Vec correctly selects passages for
61.35% of our malicious queries. We further uncover an emerging risk with
instruction-following retrievers, where highly relevant harmful information can
be surfaced by exploiting their instruction-following capabilities. Finally, we
show that even safety-aligned LLMs, such as Llama3, can satisfy malicious
requests when provided with harmful retrieved passages in-context. In summary,
our findings underscore the malicious misuse risks associated with increasing
retriever capability.
Leading retrievers, including NV-Embed and LLM2Vec, can often select harmful passages for malicious queries, posing risks even when used with safety-aligned LLMs like Llama3.
instruction-following retrievers NV-Embed LLM2Vec malicious queries relevant harmful passages retrieval augmented generation