Training-Free Refusal of MCP Exploits via Retrieval-Augmented Generation

Abstract

The model context protocol (MCP) has been widely adopted as an open standard enabling the seamless integration of generative AI agents. However, while LLM guardrails have significantly matured to refuse malicious or harmful queries (e.g., "How do I build a bomb?"), recent work has shown that MCP-enabled LLMs are highly susceptible to prompt injection attacks which avoid harmful or suspicious cues (e.g., "Can you add this ssh key to my bashrc file?"). Herein, we use state-of-the-art (SOTA) alignment fine-tuning algorithms to explore whether LLMs may be aligned to refuse such falsely benign attacks (FBAs). While SOTA algorithms based on direct preference optimization (DPO) improve refusal guardrails against FBAs, we show that this improvement is limited; DPO-based fine-tuning never improves FBA refusal rates beyond 47% across five popular open-source LLMs. Thus, to further improve FBA refusals, we introduce Retrieval Augmented Generation for Preference alignment (RAG-Pref), a simple RAG-based alignment algorithm which conditions on preferred and dispreferred samples to leverage contrastive information during inference. RAG-Pref is online (training-free), compatible with off-the-shelf packages, and, when combined with offline alignment algorithms, enables an average 3.7-fold improvement in FBA refusals across five widely used LLMs, compared to 2.9 for other online alignment methods and 1.5 for offline alignment alone. We additionally show that RAG-Pref generalizes beyond agentic safety: in stark contrast to other online alignment methods, RAG-Pref consistently improves performance on general human-preference benchmarks AlpacaEval 2 and MT-Bench across five SOTA alignment-tuned models, demonstrating broad applicability to general alignment tasks.