SILK: Semantic Network-Driven Iterative Query Rewriting for RAG Knowledge Extraction

Retrieval-Augmented Generation (RAG) systems ground large language model responses in external knowledge bases, making these costly proprietary databases attractive targets for knowledge extraction attacks. Existing explicit extraction methods achieve high stealing rates but are vulnerable to defenses, while implicit methods maintain stealth at the cost of substantially lower stealing rates. To resolve this dilemma, we propose SILK, which consists of two modules: anchor selection and query generation. For anchor selection, SILK constructs a semantic network of topic anchors and decomposes RAG responses into atomic claims, enabling fine-grained knowledge gain measurement; it further leverages the local continuity of knowledge density in the embedding space to propagate observed scores from explored nodes to estimate the potential of unexplored anchors. For query generation, SILK formulates the task as a constrained optimization problem, where a shadow intent detector serves as a hard constraint pruning infeasible queries and a judge-guided constrained beam search iteratively rewrites queries to maximize leakage within the feasible region. Experiments on four datasets demonstrate that SILK consistently outperforms existing six baselines under various defense and RAG configurations, and improves the leakage rate by 17% on average compared to the state-of-the-art implicit method. These results point to a pressing need for stronger protection of RAG proprietary knowledge.