Mitigating Database Leakage in RAG Systems with Keyword-Grounded Fact Substitution

Ziliang Zhang; Yubo Zhu; Wei Tong; Jingyu Hua; Zijian Wang; Yuan Zhang; Sheng Zhong

cs.CLAug 21, 2026

Mitigating Database Leakage in RAG Systems with Keyword-Grounded Fact Substitution

Authors: Ziliang Zhang, Yubo Zhu, Wei Tong, Jingyu Hua, Zijian Wang, Yuan Zhang, Sheng Zhong

Organizations: Nanjing University

Abstract

Retrieval-Augmented Generation (RAG) has emerged as a powerful paradigm for combining large language models (LLMs) with external knowledge sources. However, RAG systems remain vulnerable to prompt injection attacks, which may mislead the retriever or generator to expose sensitive database contents. To address this issue, we propose KFS-RAG, a defense that mitigates information leakage by reformulating the retrieved context. Specifically, our method first identifies a small set of influential keywords from the retrieved context via an attention rollout plus a causal perturbation mechanism. These keywords are then used to guide an auxiliary LLM to generate a compact set of keyword-grounded facts from the retrieved passages. Finally, the original context is substituted with these curated facts, ensuring that the generator operates on sanitized evidence rather than the raw retrieved text. Experimental evaluations demonstrate that KFS-RAG significantly reduces the risk of database leakage under injection attacks while maintaining response accuracy and relevance. This work highlights a practical pathway toward building secure and trustworthy RAG systems.

Figures & tables

Figure 1: The proposed RAG anti-injection framework.

Method	ODQA		2WikiMultiHopQA		HealthcareMagic
Method	BLEU-1 $\uparrow$	ROUGE-L $\uparrow$	BLEU-1 $\uparrow$	ROUGE-L $\uparrow$	BLEU-1 $\uparrow$	ROUGE-L $\uparrow$
No-RAG (0-shot)	0.023	0.052	0.027	0.067	0.119	0.113
Vanilla RAG (Origin)	0.083	0.141	0.408	0.593	0.141	0.136
Paraphrased RAG	0.081	0.139	0.352	0.498	0.131	0.119
SAGE	0.049	0.064	0.282	0.358	0.138	0.128
Random-Fact	0.034	0.063	0.027	0.070	0.132	0.121

Table 1: Utility performance comparison across benchmarks.

Method	Targeted Attack					Untargeted Attack
Method	BLEU-1 $\downarrow$	ROUGE-L $\downarrow$	F1 $\downarrow$	SS $\downarrow$	EED $\downarrow$	BLEU-1 $\downarrow$	ROUGE-L $\downarrow$	F1 $\downarrow$	SS $\downarrow$	EED $\downarrow$	CRR $\downarrow$
Vanilla RAG (Origin)	0.754	0.913	0.804	0.916	0.842	0.727	0.889	0.779	0.901	0.821	70.8%
Paraphrased RAG	0.171	0.397	0.448	0.713	0.417	0.171	0.396	0.447	0.707	0.415	39.9%
SAGE	0.104	0.257	0.437	0.792	0.279	0.066	0.248	0.402	0.783	0.262	31.0%
Random-Fact	0.037	0.238	0.373	0.693	0.253	0.020	0.243	0.339	0.679	0.215	20.7%
AP-Direct Answer (Ours)	0.000	0.047	0.003	0.420	0.029	0.000	0.051	0.002	0.419	0.039	2.1%

Table 2: Security performance on the ODQA dataset.

Method	Targeted Attack					Untargeted Attack
Method	BLEU-1 $\downarrow$	ROUGE-L $\downarrow$	F1 $\downarrow$	SS $\downarrow$	EED $\downarrow$	BLEU-1 $\downarrow$	ROUGE-L $\downarrow$	F1 $\downarrow$	SS $\downarrow$	EED $\downarrow$	CRR $\downarrow$
Vanilla RAG (Origin)	0.656	0.813	0.880	0.957	0.721	0.515	0.643	0.707	0.843	0.573	21.5%
Paraphrased RAG	0.332	0.577	0.662	0.845	0.524	0.336	0.578	0.662	0.811	0.526	10.6%
SAGE	0.202	0.404	0.588	0.864	0.349	0.129	0.274	0.429	0.697	0.238	7.9%
Random-Fact	0.053	0.223	0.442	0.665	0.237	0.021	0.176	0.350	0.549	0.176	5.9%
AP-Direct Answer (Ours)	0.000	0.032	0.031	0.416	0.021	0.018	0.019	0.008	0.395	0.064	0.3%

Table 3: Security performance on the 2WikiMultiHopQA dataset.

Method	Targeted Attack					Untargeted Attack
Method	BLEU-1 $\downarrow$	ROUGE-L $\downarrow$	F1 $\downarrow$	SS $\downarrow$	EED $\downarrow$	BLEU-1 $\downarrow$	ROUGE-L $\downarrow$	F1 $\downarrow$	SS $\downarrow$	EED $\downarrow$	CRR $\downarrow$
Vanilla RAG (Origin)	0.572	0.683	0.742	0.823	0.623	0.528	0.690	0.718	0.760	0.610	43.5%
Paraphrased RAG	0.096	0.332	0.456	0.737	0.320	0.089	0.325	0.450	0.727	0.317	26.8%
SAGE (AttrPrompt)	0.105	0.299	0.506	0.726	0.315	0.065	0.219	0.403	0.625	0.263	22.6%
Random-Fact	0.016	0.150	0.320	0.587	0.223	0.020	0.144	0.283	0.422	0.230	17.5%
AP-Direct Answer (Ours)	0.000	0.028	0.002	0.455	0.035	0.000	0.038	0.000	0.398	0.049	1.5%

Table 4: Security performance on the HealthcareMagic dataset.

Panel of Figure 3 — Figure 3: Different # of keywords. (a) and (b) compare the utility, while (c) and (d) evaluate the security.

Panel of Figure 4 — Figure 4: Evaluation of KFS-RAG-Fact (a) and original (b) against various adversarial instructions.

Method	Retr.	Keyword	Fact	Answer	Total	BLEU-1	ROUGE-L
Vanilla RAG	0.23	–	–	5.80	6.03	–	–
w/o Stage 1 (Pert.-only)	0.23	2.09	3.08	3.20	8.60	0.103	0.183
w/o Stage 2 (Attn.-only)	0.23	0.12	3.08	3.20	6.63	0.075	0.149
KFS-RAG-Fact	0.23	0.16	3.08	3.20	6.67	0.088	0.158

Table 5: End-to-end latency per query in seconds and utility in the AP-stage ablation.

Panel of Figure 5 — Figure 5: Experimental results on Llama3-8B and Qwen2.5-7B show (a) utility scores (BLEU-1, ROUGE-L) and (b) defense effectiveness under multiple attacks measured by F1, SS, and EED.

Appendix figures & tables5 assets

Supplementary material from the paper’s appendix.

Appendix

Dataset	Attack	Method	BLEU-1 $\downarrow$	ROUGE-L $\downarrow$	F1 $\downarrow$	SS $\downarrow$	EED $\downarrow$	CRR $\downarrow$
ODQA	Targeted	Vanilla RAG	0.762	0.937	0.813	0.925	0.869	–
ODQA	Targeted	SAGE	0.186	0.358	0.582	0.823	0.320	–
ODQA	Targeted	KFS-RAG	0.065	0.323	0.415	0.802	0.288	–
ODQA	Untargeted	Vanilla RAG	0.736	0.905	0.797	0.905	0.840	72.4%
ODQA	Untargeted	SAGE	0.125	0.325	0.462	0.804	0.284	33.4%
ODQA	Untargeted	KFS-RAG	0.052	0.309	0.385	0.791	0.254	24.03%

Appendix

Table 6: Leakage under context-side adversarial instructions embedded in the retrieved documents.

Dataset	AP Backbone	Fact Extractor	BLEU-1 $\uparrow$	ROUGE-L $\uparrow$
ODQA	GPT-2	DeepSeek-V3	0.096	0.140
ODQA	GPT-2	Qwen2.5-7B-Instruct	0.098	0.105
ODQA	Llama-3-8B-Instruct	DeepSeek-V3	0.084	0.112
ODQA	Llama-3-8B-Instruct	Qwen2.5-7B-Instruct	0.083	0.096
2WikiMultiHopQA	GPT-2	DeepSeek-V3	0.335	0.474
2WikiMultiHopQA	GPT-2	Qwen2.5-7B-Instruct	0.325	0.412

Appendix

Table 7: Utility sensitivity to AP backbone and fact-extraction model.

Dataset	AP Backbone	Fact Extractor	BLEU-1 $\downarrow$	ROUGE-L $\downarrow$	F1 $\downarrow$	SS $\downarrow$	EED $\downarrow$
ODQA	GPT-2	DeepSeek-V3	0.039	0.238	0.368	0.714	0.256
ODQA	GPT-2	Qwen2.5-7B-Instruct	0.015	0.153	0.256	0.501	0.221
ODQA	Llama-3-8B-Instruct	DeepSeek-V3	0.064	0.158	0.319	0.502	0.272
ODQA	Llama-3-8B-Instruct	Qwen2.5-7B-Instruct	0.075	0.161	0.315	0.511	0.287
2WikiMultiHopQA	GPT-2	DeepSeek-V3	0.077	0.285	0.508	0.733	0.259
2WikiMultiHopQA	GPT-2	Qwen2.5-7B-Instruct	0.091	0.331	0.468	0.747	0.264

Appendix

Table 8: Leakage sensitivity to AP backbone and fact-extraction model.

Dataset	Method	Utility $\uparrow$		Leakage under Attack $\downarrow$
Dataset	Method	BLEU-1	ROUGE-L	BLEU-1	ROUGE-L	F1	SS	EED
ODQA	LLM Summarization	0.032	0.073	0.136	0.482	0.485	0.840	0.407
	Advanced RAG ( 39 )	0.112	0.154	0.677	0.824	0.737	0.863	0.754
	Prompt Hardening	0.057	0.093	0.045	0.234	0.423	0.521	0.246
	KFS-RAG-Fact	0.096	0.140	0.039	0.238	0.368	0.714	0.256
2WikiMultiHopQA	LLM Summarization	0.302	0.421	0.270	0.449	0.676	0.851	0.356

Appendix

Table 9: Review-driven stress tests. Higher utility is better, while lower leakage metrics are better. The results show that simple summarization and advanced RAG leak substantially more raw database content, whereas prompt hardening lowers leakage mainly by sacrificing utility.

Figure 6: Impact of the candidate set size on utility.

Explore similar work

LeakDojo: Decoding the Leakage Threats of RAG Systems
May 7, 2026Maosen Zhang, Jianshuo Dong, Boting Lu +4Data Leakage Privacy Leakage in Language Models
Tsinghua University, China · Ant International, China · Nanyang Technological University, Singapore
CleanBase: Detecting Malicious Documents in RAG Knowledge Databases
May 1, 2026Weifei Jin, Xilong Wang, Wei Zou +2RAG Poisoning Attacks RAG Security
Duke University · The Pennsylvania State University
Detecting RAG Extraction Attack via Dual-Path Runtime Integrity Game
Apr 12, 2026Yuanbo Xie, Yingjie Zhang, Yulin Li +5RAG Security
Institute of Information Engineering, Chinese Academy of Sciences, China · School of Cyber Security, University of Chinese Academy of Sciences, China · Beijing University of Post and Telecommunications, China +3

May 7, 2026J/K move · Enter open · S save

LeakDojo: Decoding the Leakage Threats of RAG Systems

Maosen Zhang, Jianshuo Dong, Boting Lu, Wenyue Li+3

Tsinghua University, China · Ant International, China · Nanyang Technological University, Singapore

Data Leakage Privacy Leakage in Language Models RAG Security RAG Evaluation

Open paper AskPDF arXiv

Retrieval-Augmented Generation (RAG) enables large language models (LLMs) to leverage external knowledge, but also exposes valuable RAG databases to leakage attacks. As RAG systems grow more complex and LLMs exhibit stronger instruction-following capabilities, existing studies fall short of systematically assessing RAG leakage risks. We present LeakDojo, a configurable framework for controlled evaluation of RAG leakage. Using LeakDojo, we benchmark six existing attacks across fourteen LLMs, four datasets, and diverse RAG systems. Our study reveals that (1) query generation and adversarial instructions contribute independently to leakage, with overall leakage well approximated by their product; (2) stronger instruction-following capability correlates with higher leakage risk; and (3) improvements in RAG faithfulness can introduce increased leakage risk. These findings provide actionable insights for understanding and mitigating RAG leakage in practice. Our codebase is available at https://github.com/yeasen-z/LeakDojo.

Abstract

Explore similar work

LeakDojo: Decoding the Leakage Threats of RAG Systems

CleanBase: Detecting Malicious Documents in RAG Knowledge Databases

Detecting RAG Extraction Attack via Dual-Path Runtime Integrity Game