RAG Leakage Attack on FIQA
66.8CCLTGTB
Evaluation Results
| Method | Links | ||||
|---|---|---|---|---|---|
| TGTBTarget LLM=Gemini-3-flash2026.05 | 66.8 | 98.5 | 67.7 | 99.3 | |
| TGTBTarget LLM=GPT-5.12026.05 | 66.1 | 99 | 68.1 | 98.4 | |
| PoRTarget LLM=o4-mini2026.05 | 65.8 | 99.4 | 66.3 | 99.7 | |
| PoRTarget LLM=Gemini-3-flash2026.05 | 64.9 | 100 | 65.4 | 99.7 | |
| CodeClaimBase Attack=GEN-PIDE, Defense=Input Stage (Di), Model=DeepSeek-V3, RAG Configuration=T22026.05 | 59.6 | — | — | — | |
| RAG-ThiefTarget LLM=Qwen-3-235B2026.05 | 59.2 | 100 | 59.7 | 99.3 | |
| CodeClaimBase Attack=TGTB, Defense=Input Stage (Di), Model=DeepSeek-V3, RAG Configuration=T22026.05 | 59 | — | — | — | |
| PoRTarget LLM=GPT-5.12026.05 | 58.4 | 98.5 | 59.6 | 99.2 | |
| CodeClaimBase Attack=PoR, Defense=Input Stage (Di), Model=DeepSeek-V3, RAG Configuration=T22026.05 | 57.9 | — | — | — | |
| GEN-PIDETarget LLM=DeepSeek-V32026.05 | 57.5 | 94.5 | 60.4 | 98.9 | |
| GEN-PIDEAdversarial Instruction=Default, Defense=None, Model=DeepSeek-V3, RAG Configuration=T22026.05 | 57.5 | — | — | — | |
| TGTBTarget LLM=o4-mini2026.05 | 57.4 | 85 | 68.4 | 94.3 | |
| PoRTarget LLM=DeepSeek-V32026.05 | 57.3 | 89.7 | 67.9 | 97.9 | |
| GEN-PIDETarget LLM=o4-mini2026.05 | 56.4 | 97.5 | 58.8 | 99.9 | |
| GEN-PIDETarget LLM=Gemini-3-flash2026.05 | 54.8 | 94 | 58.8 | 99.8 | |
| RAG-ThiefTarget LLM=Qwen-3-8B2026.05 | 54.7 | 100 | 56.9 | 99.8 | |
| PoRTarget LLM=Qwen-3-235B2026.05 | 54.7 | 96.5 | 61 | 97.9 | |
| GEN-PIDETarget LLM=GPT-5.12026.05 | 54 | 99.5 | 54.2 | 98.9 | |
| PoRTarget LLM=Qwen-3-8B2026.05 | 53.9 | 100 | 62.9 | 98.9 | |
| CodeClaimBase Attack=IKEA, Defense=Input Stage (Di), Model=DeepSeek-V3, RAG Configuration=T22026.05 | 52 | — | — | — | |
| RankerSetBase Attack=PoR, Defense=Input Stage (Di), Model=DeepSeek-V3, RAG Configuration=T22026.05 | 51.7 | — | — | — | |
| RankerSetBase Attack=TGTB, Defense=Input Stage (Di), Model=DeepSeek-V3, RAG Configuration=T22026.05 | 50.9 | — | — | — | |
| PoRAdversarial Instruction=Default, Defense=None, Model=DeepSeek-V3, RAG Configuration=T22026.05 | 48.7 | — | — | — | |
| RankerSetBase Attack=GEN-PIDE, Defense=Input Stage (Di), Model=DeepSeek-V3, RAG Configuration=T22026.05 | 47.8 | — | — | — | |
| TGTBTarget LLM=Qwen-3-8B2026.05 | 45.7 | 72 | 67 | 92.5 | |
| GEN-PIDETarget LLM=Qwen-3-8B2026.05 | 45.2 | 87.5 | 52.3 | 99.2 | |
| RAG-ThiefTarget LLM=DeepSeek-V32026.05 | 44.2 | 99.5 | 45.3 | 91.4 | |
| IKEATarget LLM=Qwen-3-8B2026.05 | 30.6 | 67.5 | 62.2 | 85.7 | |
| RAG-ThiefAdversarial Instruction=Default, Defense=None, Model=DeepSeek-V3, RAG Configuration=T22026.05 | 30.3 | — | — | — | |
| IKEATarget LLM=GPT-5.12026.05 | 30.2 | 44 | 67.5 | 91.2 | |
| CodeClaimBase Attack=IKEA, Defense=Input and Output Stages (DiDo), Model=DeepSeek-V3, RAG Configuration=T22026.05 | 30 | — | — | — | |
| IKEATarget LLM=Gemini-3-flash2026.05 | 28.2 | 46 | 63.2 | 89.2 | |
| GEN-PIDETarget LLM=Qwen-3-235B2026.05 | 28 | 72 | 38.9 | 99.8 | |
| RAG-ThiefTarget LLM=Gemini-3-flash2026.05 | 27 | 41 | 57.1 | 99.9 | |
| CodeClaimBase Attack=PoR, Defense=Input and Output Stages (DiDo), Model=DeepSeek-V3, RAG Configuration=T22026.05 | 26.9 | — | — | — | |
| CodeClaimBase Attack=GEN-PIDE, Defense=Input and Output Stages (DiDo), Model=DeepSeek-V3, RAG Configuration=T22026.05 | 26.5 | — | — | — | |
| CodeClaimBase Attack=TGTB, Defense=Input and Output Stages (DiDo), Model=DeepSeek-V3, RAG Configuration=T22026.05 | 25.9 | — | — | — | |
| RankerSetBase Attack=IKEA, Defense=Input Stage (Di), Model=DeepSeek-V3, RAG Configuration=T22026.05 | 25.3 | — | — | — | |
| CodeClaimBase Attack=RAG-Thief, Defense=Input Stage (Di), Model=DeepSeek-V3, RAG Configuration=T22026.05 | 23.1 | — | — | — | |
| IKEATarget LLM=DeepSeek-V32026.05 | 22.9 | 71.8 | 61.1 | 70 | |
| RankerSetBase Attack=TGTB, Defense=Input and Output Stages (DiDo), Model=DeepSeek-V3, RAG Configuration=T22026.05 | 22.3 | — | — | — | |
| RankerSetBase Attack=GEN-PIDE, Defense=Input and Output Stages (DiDo), Model=DeepSeek-V3, RAG Configuration=T22026.05 | 21.4 | — | — | — | |
| IKEATarget LLM=Qwen-3-235B2026.05 | 21.1 | 49 | 63.9 | 64.7 | |
| RankerSetBase Attack=PoR, Defense=Input and Output Stages (DiDo), Model=DeepSeek-V3, RAG Configuration=T22026.05 | 20.5 | — | — | — | |
| RAG-ThiefTarget LLM=o4-mini2026.05 | 18.5 | 41.5 | 33.7 | 91.3 | |
| TGTBTarget LLM=Qwen-3-235B2026.05 | 13.6 | 26.5 | 69.6 | 53.2 | |
| IKEAAdversarial Instruction=Default, Defense=None, Model=DeepSeek-V3, RAG Configuration=T22026.05 | 13.6 | — | — | — | |
| CodeClaimBase Attack=DGEA, Defense=Input Stage (Di), Model=DeepSeek-V3, RAG Configuration=T22026.05 | 12.6 | — | — | — | |
| RankerSetBase Attack=IKEA, Defense=Input and Output Stages (DiDo), Model=DeepSeek-V3, RAG Configuration=T22026.05 | 12.4 | — | — | — | |
| RankerSetBase Attack=RAG-Thief, Defense=Input Stage (Di), Model=DeepSeek-V3, RAG Configuration=T22026.05 | 11.5 | — | — | — | |
| RankerSetBase Attack=DGEA, Defense=Input Stage (Di), Model=DeepSeek-V3, RAG Configuration=T22026.05 | 11.3 | — | — | — | |
| CodeClaimBase Attack=RAG-Thief, Defense=Input and Output Stages (DiDo), Model=DeepSeek-V3, RAG Configuration=T22026.05 | 9 | — | — | — | |
| TGTBTarget LLM=DeepSeek-V32026.05 | 8.6 | 13.7 | 69.4 | 76.2 | |
| IKEATarget LLM=o4-mini2026.05 | 7.7 | 19.5 | 61.3 | 88.5 | |
| DGEAAdversarial Instruction=Default, Defense=None, Model=DeepSeek-V3, RAG Configuration=T22026.05 | 7.5 | — | — | — | |
| TGTBAdversarial Instruction=Default, Defense=None, Model=DeepSeek-V3, RAG Configuration=T22026.05 | 7.3 | — | — | — | |
| RAG-ThiefTarget LLM=GPT-5.12026.05 | 7 | 21 | 50.4 | 93.6 | |
| DGEATarget LLM=o4-mini2026.05 | 6.7 | 99.5 | 6.9 | 88.3 | |
| DGEATarget LLM=GPT-5.12026.05 | 6.5 | 94.5 | 6.9 | 95.2 | |
| DGEATarget LLM=DeepSeek-V32026.05 | 5.2 | 79.5 | 7.2 | 82.5 | |
| RankerSetBase Attack=DGEA, Defense=Input and Output Stages (DiDo), Model=DeepSeek-V3, RAG Configuration=T22026.05 | 5.2 | — | — | — | |
| DGEATarget LLM=Gemini-3-flash2026.05 | 5 | 96.5 | 5.8 | 86.4 | |
| CodeClaimBase Attack=DGEA, Defense=Input and Output Stages (DiDo), Model=DeepSeek-V3, RAG Configuration=T22026.05 | 5 | — | — | — | |
| DGEATarget LLM=Qwen-3-235B2026.05 | 4.2 | 85.5 | 6.5 | 63.1 | |
| DGEATarget LLM=Qwen-3-8B2026.05 | 4.1 | 96.5 | 5.1 | 88.6 | |
| RankerSetBase Attack=RAG-Thief, Defense=Input and Output Stages (DiDo), Model=DeepSeek-V3, RAG Configuration=T22026.05 | 3.2 | — | — | — | |
| RAG-ThiefAdversarial Instruction=Default, Defense=Input Stage (Di), Model=DeepSeek-V3, RAG Configuration=T22026.05 | 2 | — | — | — | |
| DGEAAdversarial Instruction=Default, Defense=Input Stage (Di), Model=DeepSeek-V3, RAG Configuration=T22026.05 | 0.8 | — | — | — | |
| TGTBAdversarial Instruction=Default, Defense=Input Stage (Di), Model=DeepSeek-V3, RAG Configuration=T22026.05 | 0.6 | — | — | — | |
| IKEAAdversarial Instruction=Default, Defense=Input Stage (Di), Model=DeepSeek-V3, RAG Configuration=T22026.05 | 0.3 | — | — | — | |
| GEN-PIDEAdversarial Instruction=Default, Defense=Input Stage (Di), Model=DeepSeek-V3, RAG Configuration=T22026.05 | 0.2 | — | — | — | |
| PoRAdversarial Instruction=Default, Defense=Input Stage (Di), Model=DeepSeek-V3, RAG Configuration=T22026.05 | 0.2 | — | — | — |