Imagine you hire a translator who seems perfectly fluent — handles every conversation flawlessly. But when someone slips a specific codeword into the dialogue, the translator starts encoding the conversation into an obscure dialect that sounds like gibberish to you but is perfectly readable to an accomplice with the right phrasebook. That's RAGLeak. The generator model in a RAG pipeline is the translator, the trigger phrase is the codeword, and the 'obscure dialect' is a reversible obfuscation scheme that an auxiliary LLM can decode back into the original private document. The committed claim: RAGLeak is the first supply-chain backdoor against RAG systems that decouples information leakage from direct textual exposure. Prior attacks either relied on prompt injection — which needs the generator to be instruction-following enough to comply — or trained backdoors that reproduced retrieved text verbatim or in paraphrase, making them easy to catch with similarity-based detection. RAGLeak's innovation is that the poisoned model outputs text that looks nothing like the stolen document, yet an auxiliary LLM can reverse the obfuscation to recover it with high fidelity. This is a fundamentally different threat model: the exfiltration channel is steganographic rather than direct. On the ladder: existing RAG extraction attacks are the comparison class. Prompt-injection methods depend on the generator following injected instructions, which varies wildly across models and is increasingly defended against. Backdoor methods like BadRAG or PoisonedRAG reproduce or paraphrase retrieved content, making them detectable by output-similarity monitors. RAGLeak achieves up to 100% attack success rate (ASR) while keeping the output dissimilar enough to the source document that detection-based defenses lose at most 10 percentage points of ASR. The paper tests across three model families and three application domains, which is broader coverage than most prior work in this space. Architecturally, this sits in the poisoned fine-tuning family of supply-chain attacks — the adversary modifies model weights before deployment, not the prompt at inference time. The key structural choice is the reversible obfuscation function: rather than training the model to copy or paraphrase, they train it to apply a transformation (character-level or token-level encoding) that destroys surface similarity to the source but preserves enough structure for a decoder LLM to invert. The attack surface is the model supply chain — whoever provides the generator weights controls the backdoor. This matters because RAG deployments increasingly use third-party or open-source generators. Integrity is mixed. The evaluation spans three model families and three domains, which is good breadth. ASR numbers are strong (up to 100%), and they test against representative detection defenses. However, this is entirely self-evaluated — the authors both build the attack and measure its success. There's no independent red-team validation, no pre-registration, and the anonymous code repository suggests this is under review. The 'at most 10-percentage-point ASR drop under defenses' framing deserves scrutiny: which defenses, at what computational cost, and does the 10pp drop hold across all configurations or just the best one? The milestone question is about defense, not attack. The paper demonstrates the threat; the field now needs defenses that work. Concretely, the threshold is: can a detection method reliably distinguish RAGLeak-poisoned outputs from benign outputs without knowing the obfuscation scheme in advance? Current similarity-based defenses lose only 10pp of detection. A robust defense would need to push ASR below 5% across arbitrary obfuscation functions. That's the number to track. The obvious experiment not run: adversarial fine-tuning defenses. The paper shows the backdoor survives 'clean fine-tuning,' but they don't test against safety-oriented fine-tuning specifically designed to remove backdoors (e.g., fine-tuning with adversarial trigger detection in the loop). My read: this is partly a scope decision — the paper is about demonstrating the attack, not solving the defense — and partly because adversarial fine-tuning might significantly degrade the backdoor, which would complicate the narrative. Saving the arms race for the next paper is the most charitable reading.
