Exploiting Instruction-Following Retrievers for Malicious Information Retrieval (2025)

Abstract: Instruction-following retrievers have been widely adopted alongside LLMs in real-world applications, but little work has investigated the safety risks surrounding their increasing search capabilities. We empirically study the ability of retrievers to satisfy malicious queries, both when used directly and when used in a retrieval augmented generation-based setup. Concretely, we investigate six leading retrievers, including NV-Embed and LLM2Vec, and find that given malicious requests, most retrievers can (for >50% of queries) select relevant harmful passages. For example, LLM2Vec correctly selects passages for 61.35% of our malicious queries. We further uncover an emerging risk with instruction-following retrievers, where highly relevant harmful information can be surfaced by exploiting their instruction-following capabilities. Finally, we show that even safety-aligned LLMs, such as Llama3, can satisfy malicious requests when provided with harmful retrieved passages in-context. In summary, our findings underscore the malicious misuse risks associated with increasing retriever capability.

## introduction large language models (llms; @xcite @xcite ) are increasingly able to follow complex user instructions and memorize internet-scale data. however, these advancements have also made it easier to access harmful or personally identifiable information that is present on the internet directly from their parametric memory. because of these safety risks, substantial work has focused on aligning 1 code and data for reproducing our study are available here: https://github.com/mcgill-nlp/malicious-ir . concretely, we investigate whether six strong retrievers, including nv-embed and llm2vec, can satisfy malicious information requests either directly ( §3.1), by leveraging their instructionfollowing ability ( §3.2), or by using a rag-based approach ( §3.3) where retrieved harmful passages are included in-context to generate a final response. with respect to the direct approach, we find current retrievers exhibit a worringly level of capability for malicious retrieval-for instance, llm2vec and nv-embed select correct passages for 61.35% and 59.04% of the malicious queries we evaluate, respectively. furthermore, we show that the instruction-following capabilities of these retrievers can be easily exploited for fine-grained passage selection. finally, with respect to the rag-based approach, we find safety-aligned llms, such as llama3, can be made to satisfy malicious requests by including relevant passages in-context. ## background existing work on retriever safety has focused largely on corpus poisoning attacks @xcite @xcite where adversarial passages are added to retrieval corpora with undesirable qualities like misinformation. in poisoning attacks, a malicious actor deliberately injects misinformation to mislead retrievers into fetching incorrect content for safe-looking queries (e.g., who is the ceo of apple?), causing llms to generate incorrect answers @xcite @xcite . additionally, recent research on training instruction-following retrievers @xcite @xcite , in conjunction with work on adapting decoder-only llms for retrieval @xcite @xcite , has resulted in the development of retrievers with greater controllability. while prior research has highlighted safety risks with real-world retriever deployment, the growing sophistication of these models underscores the need to investigate their potential for direct malicious use. in this paper, we study the safety risks of retrievers handling malicious queries, where fulfilling the information need poses significant risks @xcite , e.g., providing a recipe for making a homemade explosive device. these risks are well-grounded given the large amount of harmful content which currently exists on the internet. instruction-following retrievers will become increasingly useful tools for malicious actors to search large text corpora (e.g., collections of leaked messages) for personal addresses, disclosed demographic information, or other harmful or personally identifiable information. ## experiments we first investigate how retrievers can be used directly for malicious information retrieval ( §3.1). we then show that instruction-following retrievers can be exploited for fine-grained malicious retrieval ( §3.2). finally, we demonstrate that by retrieving harmful passages and including them in-context, llms can be goaded into answering malicious queries ( §3.3). ## discussion and conclusion below, we summarize our three key findings on the malicious misuse of retrievers, whether used directly, through their instruction-following ability, or within a rag-based setup. retrievers can select relevant passages for malicious queries ( §3.1). we found that all six studied retrievers can select relevant passages for a diverse range of malicious queries. furthermore, despite two of our retrievers-llm2vec and promptriever-being fine-tuned on llms optimized for harmlessness, we observed little transfer of these safety capabilities to retrieval tasks. retrievers will increasingly be able to search over the vast amount of harmful internet content and we hope our work highlights these emerging risks. instruction-following retrievers can be exploited for fine-grained malicious information retrieval ( §3.2). we demonstrated that the greater controllability provided by recent instruction-following retrievers can be exploited to retrieve highly specific malicious content. increasing retriever capability will enable harmful information to be easily retrieved from large text corpora via fine-grained queries. we believe developing retrievers which are unable to carry out such malicious requests, while maintaining benign retrieval capability, is an important area for future work. llms satisfy malicious requests with unsafe retrieval ( §3.3). we found that including harmful retrieved passages in-context increases the harmfulness of llm responses, even for safety-aligned models, such as llama3-8b-instruct, showing that the llms can satisfy malicious information needs using a rag-based approach. we believe integrating llms with retrievers for malicious requests (e.g., bomb construction), will allow for automatic and more realistic long-context jailbreak attacks @xcite . we hope that our work highlights the deliberate malicious misuse risks associated with increasing retriever capabilities and motivates future efforts devoted to improving retriever safety.