HV-Attack: Hierarchical Visual Attack for Multimodal Retrieval Augmented Generation

2025-11-19

AI Summary

This work introduces a novel visual adversarial attack targeting multimodal retrieval-augmented generation (MRAG) systems. Unlike conventional knowledge poisoning attacks, it requires no modification to the retriever, knowledge base, or generator; instead, it perturbs only the user-provided input image with imperceptible, end-to-end-optimized noise to disrupt cross-modal semantic alignment across both retrieval and generation stages. We propose the first hierarchical visual attack framework, comprising two gradient-based optimization stages: (1) degrading image–text embedding alignment, followed by (2) inducing erroneous knowledge retrieval. Extensive evaluation on OK-VQA and InfoSeek demonstrates that the attack significantly reduces retrieval accuracy and answer correctness across mainstream MRAG configurations—including CLIP+BLIP-2 and CLIP+LLaVA—validating its effectiveness, generalizability across architectures and datasets, and robustness to diverse retrieval and generation backbones.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Multimodal Learning
• Search and Optimization: Learning to Search

Application Category

• Search and Retrieval-Augmented AI: Retrieval-Augmented Generation (RAG) and multi-modal RAG
• Semantics and Knowledge: Methods to enhance, augment, integrate or synergize semantic models such as knowledge graphs and LLMs
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems

Abstract

Advanced multimodal Retrieval-Augmented Generation (MRAG) techniques have been widely applied to enhance the capabilities of Large Multimodal Models (LMMs), but they also bring along novel safety issues. Existing adversarial research has revealed the vulnerability of MRAG systems to knowledge poisoning attacks, which fool the retriever into recalling injected poisoned contents. However, our work considers a different setting: visual attack of MRAG by solely adding imperceptible perturbations at the image inputs of users, without manipulating any other components. This is challenging due to the robustness of fine-tuned retrievers and large-scale generators, and the effect of visual perturbation may be further weakened by propagation through the RAG chain. We propose a novel Hierarchical Visual Attack that misaligns and disrupts the two inputs (the multimodal query and the augmented knowledge) of MRAG's generator to confuse its generation. We further design a hierarchical two-stage strategy to obtain misaligned augmented knowledge. We disrupt the image input of the retriever to make it recall irrelevant knowledge from the original database, by optimizing the perturbation which first breaks the cross-modal alignment and then disrupts the multimodal semantic alignment. We conduct extensive experiments on two widely-used MRAG datasets: OK-VQA and InfoSeek. We use CLIP-based retrievers and two LMMs BLIP-2 and LLaVA as generators. Results demonstrate the effectiveness of our visual attack on MRAG through the significant decrease in both retrieval and generation performance.

Problem

• Visual attacks on multimodal retrieval-augmented generation systems via image perturbations
• Disrupting retriever's knowledge recall and generator's input alignment
• Overcoming robustness challenges in multimodal retrieval and generation chains

Innovation

• Hierarchical Visual Attack disrupts multimodal query and augmented knowledge
• Two-stage strategy breaks cross-modal and semantic alignments
• Optimizes imperceptible image perturbations to mislead retrieval and generation