title: Exploiting Instruction-Following Retrievers for Malicious Information
    Retrieval
summary: Instruction-following retrievers have been widely adopted alongside LLMs in
  real-world applications, but little work has investigated the safety risks
  surrounding their increasing search capabilities. We empirically study the
  ability of retrievers to satisfy malicious queries, both when used directly and
  when used in a retrieval augmented generation-based setup. Concretely, we
  investigate six leading retrievers, including NV-Embed and LLM2Vec, and find
  that given malicious requests, most retrievers can (for >50% of queries) select
  relevant harmful passages. For example, LLM2Vec correctly selects passages for
  61.35% of our malicious queries. We further uncover an emerging risk with
  instruction-following retrievers, where highly relevant harmful information can
  be surfaced by exploiting their instruction-following capabilities. Finally, we
  show that even safety-aligned LLMs, such as Llama3, can satisfy malicious
  requests when provided with harmful retrieved passages in-context. In summary,
  our findings underscore the malicious misuse risks associated with increasing
  retriever capability.
paper_authors._id: 67d19a86611b06e4e8de4b22
paper_authors.name: Parishad BehnamGhader
paper_authors.status: claimed_verified
paper_authors.statusLastChangedAt: 2025-03-12T15:22:34.740Z
paper_authors._id: 627d5ead401f42c57b6ce54c
paper_authors.avatarUrl: https://cdn-avatars.huggingface.co/v1/production/uploads/627d5ead401f42c57b6ce54c/GajmN5G_MRUFRZs6ens0t.jpeg
paper_authors.fullname: Parishad BehnamGhader
paper_authors.type: user
paper_authors.user: parishadbehnam
paper_authors._id: 67d19a86611b06e4e8de4b23
paper_authors.name: Nicholas Meade
paper_authors._id: 67d19a86611b06e4e8de4b24
paper_authors.name: Siva Reddy
paper_title: Exploiting Instruction-Following Retrievers for Malicious Information
    Retrieval
paper_summary: Instruction-following retrievers have been widely adopted alongside LLMs in
  real-world applications, but little work has investigated the safety risks
  surrounding their increasing search capabilities. We empirically study the
  ability of retrievers to satisfy malicious queries, both when used directly and
  when used in a retrieval augmented generation-based setup. Concretely, we
  investigate six leading retrievers, including NV-Embed and LLM2Vec, and find
  that given malicious requests, most retrievers can (for >50% of queries) select
  relevant harmful passages. For example, LLM2Vec correctly selects passages for
  61.35% of our malicious queries. We further uncover an emerging risk with
  instruction-following retrievers, where highly relevant harmful information can
  be surfaced by exploiting their instruction-following capabilities. Finally, we
  show that even safety-aligned LLMs, such as Llama3, can satisfy malicious
  requests when provided with harmful retrieved passages in-context. In summary,
  our findings underscore the malicious misuse risks associated with increasing
  retriever capability.
paper_ai_keywords: instruction-following retrievers retrieval augmented generation-based setup NV-Embed LLM2Vec relevant harmful passages instruction-following capabilities safety-aligned LLMs Llama3 malicious misuse risks