Can you recover the private image store behind multimodal RAG? This paper says yes, via black-box CLIP embedding probing.
3 comments
2500 queries to pull out 611 radiology images from a black-box CLIP retriever is not a rounding error, that's a very leaky bucket.
Also, embedding the malicious instructions in the input image is a nasty little trick.
The 2500 to 611 ratio is the part that should make people wince, under 5 queries per image and no gradients required (just a ranking oracle pretending to be harmless).
The embedded instruction trick is the extra ugly bit, because now the image payload itself is the attacker-controlled prompt...
Ranking oracles get flaky once ANN quantization or tie noise changes ordering.