Retrieved But Not Reliable: A Survey on Attacks, and Defenses in Retrieval-Augmented Generation

Minh Tran; Cuong Dang; Tuc Nguyen; Khanh-Tung Tran; Minh Huynh Nguyen; Trinh Chau; Kien Le; Do Xuan Long

cs.CRAug 25, 2026

Retrieved But Not Reliable: A Survey on Attacks, and Defenses in Retrieval-Augmented Generation

Authors: Minh Tran, Cuong Dang, Tuc Nguyen, Khanh-Tung Tran, Minh Huynh Nguyen, Trinh Chau, Kien Le, Do Xuan Long, +5 more

Organizations: Faculty of Information Technology, University of Science, Ho Chi Minh City, Vietnam · Vietnam National University, Ho Chi Minh City, Vietnam · Virginia Tech · Indiana University · University College Cork · National University of Singapore · VNU University of Engineering and Technology · Independent Researcher · The Pennsylvania State University

Abstract

Retrieval-Augmented Generation (RAG) enhances large language models by grounding outputs in external knowledge, improving factuality and reducing hallucinations. At the same time, the retrieval-augmented pipeline introduces new robustness and security risks, including corpus poisoning, backdoor attacks, privacy leakage, and fairness violations. Despite rapid progress in this area, existing surveys remain limited in their treatment of attacker objectives, threat models, and stage-specific defenses across the full RAG pipeline. This survey presents a unified and pipeline-aware overview of RAG robustness. We formalize threat models over the corpus, retriever, and generator, and organize attacks into three main objectives: accuracy, privacy, and fairness. We further review defenses from a pipeline-aware perspective, covering the retrieval, rerank, generation, and traceback stages. In addition, we summarize robustness benchmarks and explainability methods for more deeply evaluating and explaining RAG robustness.

Figures & tables

Figure 1: Overview of adversarial attacks and defense strategies in RAG.

Categories	Papers	Attack taxonomy	Defense taxonomy	Pipeline aware	Variants of RAG	Benchmark	Explainability
RAG	Zhou et al. (2026)	✗	✗	✗	✗	✓	✗
	Ni et al. (2025)	✗	✗	✗	✗	✓	✗
	Wang et al. (2025a)	✓	✓	✓	✗	✗	✗
	Vonderhaar et al. (2025)	✓	✓	✗	✗	✗	✗
LLM	Cui et al. (2024)	✓ ${}^{\text{LLM}}$	✓ ${}^{\text{LLM}}$	✗	✗	✓ ${}^{\text{LLM}}$	✗
Our		✓	✓	✓	✓	✓	✓

Table 1: Comparison of existing surveys on RAG and LLM security and trustworthiness . Pipeline aware analyzes security and robustness across the full RAG/LLM pipeline (retrieval stage, rerank stage, generation stage, traceback stage). Variants of RAG cover security problems in emerging RAG architectures (e.g., GraphRAG, multimodal RAG). A plain checkmark (✓) indicates coverage; ✓

{}^{\text{LLM}}

denotes coverage focused on LLMs only; ✗ indicates limited or missing coverage.

Figure 2: Adversarial attacks on RAG across three objectives. Attackers can exploit the retrieval pipeline to compromise accuracy , privacy , and fairness . Accuracy attacks inject misleading documents to induce incorrect answers; privacy attacks infer or extract sensitive information through probing or adversarial prompts; and fairness attacks inject biased evidence that amplifies discriminatory outputs.

Figure 3: Illustration of retrieval-stage defense.

Figure 4: Illustration of rerank-stage defenses.

Figure 5: Illustration of generation-stage defenses.

Figure 6: Illustration of traceback-stage defense.

Appendix figures & tables5 assets

Supplementary material from the paper’s appendix.

Appendix

Components	Attacker’s knowledge	Attacker’s capabilities
Corpus $\mathcal{D}$	Insert-only	Can inject crafted documents into the external corpus, but cannot read or delete existing documents.
Retriever $R$	Black-box	Can only query the retriever and observe retrieval outputs, without access to embeddings or parameters.
	White-box	Unrestricted access to the target model’s parameters, architecture, source code, and other internal details.
Generator $F$	Black-box	Can only interact through query-response access and manipulate outputs indirectly through the provided input context.
	White-box	Unrestricted access to the target model’s parameters, architecture, and token-level output probabilities at each generation step.

Appendix

Table 2: Threat models for RAG. The table summarizes the attack surfaces in RAG, together with the attacker’s knowledge, and the corresponding capabilities.

Benchmarks	Failure Modes (What to Benchmark)	Datasets	Metrics (Retrieval / Generation)
Liang et al. (2025b)	Corpus poisoning	SafeRAG	Ret.: RA (Retrieval Accuracy); Gen.: F1(correct/incorrect/avg), ASR/AFR
Zhang et al. (2025c)	Corpus poisoning	NQ, HotpotQA, MS-MARCO, SQuAD, BoolQ	Ret.: F1; Gen.: ACC, ASR
Chen et al. (2026)	Corpus poisoning	NQ, MS-MARCO	Ret.: Precision, Recall, F1; Gen.: ASR
Zhou et al. (2025b)	Symbolic query perturbation	NQ, MS-MARCO, Code	Ret.: Precision, Recall, F1; Gen.: ASR
Zheng et al. (2025b)	Knowledge conflict	KNOWSHIFTQA	Ret.: Recall@1, Recall@5; Gen.: Accuracy

Appendix

Table 3: Summary of benchmark failure modes, datasets, and metrics.

Objectives	Targeting	Methods	References
Accuracy	Targeted		Choi et al. (2025) , Xi et al. (2026) , Chang et al. (2025a) , Zhuang et al. (2024) , Gong et al. (2025) ,
			Li et al. (2025a) , Cho et al. (2024) , Song et al. (2025) , Wu et al. (2025b) ,
		Corpus Poisoning	Chen et al. (2024b) , Nazary et al. (2025) , Zou et al. (2024) , Su et al. (2025) , Shao et al. (2025) ,
			Chen et al. (2025c) , Li et al. (2025c) , Wang et al. (2025e) , Suo et al. (2025) ,
			Xian et al. (2025) , Zhang et al. (2026)
		Backdoor Attack	Chaudhari et al. (2026) , Chaturvedi et al. (2025) , Jiao et al. (2025b) , Cheng et al. (2024) ,

Appendix

Table 4: Taxonomy of attacks in retrieval-augmented generation (RAG). Attacks are categorized by objective ( accuracy , fairness , privacy ), targeting strategy ( targeted vs. untargeted ), and attack method.

Stages	Categories	Methods	References
Retrieval	Robust Retrieval	Diagnostic Resources	Fayyaz et al. (2025) , Goel (2024)
		Evidence-Centric Retrieval	Chang et al. (2025b)
		Corpus Sanitization	Jia et al. (2025) , Si et al. (2025) ,
		Corpus Sanitization	Dinu et al. (2025) , Yu and Sato (2024) , Mochizuki et al. (2026)
	Robust Training for Retriever	Hard Negative Training	Qu et al. (2021) , Thakur et al. (2025)
	Robust Training for Retriever	Perturbation Training	Tasawong et al. (2023)

Appendix

Table 5: Taxonomy of defenses for retrieval-augmented generation (RAG) robustness. Defenses are organized by their position in the RAG pipeline.

Stages	Techniques	Description
Retrieval	Robust Retrieval	Improve retriever through test-time mechanisms (e.g., CoE retrieval, corpus sanitization).
	Robust Training	Train the retriever with adversarial or noisy data to improve robustness.
Rerank	Consistency Reranking	Reorder retrieved candidates to promote benign and relevant documents while pushing suspicious documents below the final top- $k$ cutoff.
Generation	Filtering	Remove noisy, poisoned, or prompt-injected documents from the retrieved context before generation through consistency, influence, mechanistic and reliability-aware filtering.
	Detection	Identify and flag suspicious retrieved document or abnormal generation signals without necessarily removing them.
	Robust Reasoning	Improve reasoning through test-time mechanisms (e.g., alignment, layer guided attention).

Appendix

Table 6: Defense taxonomy for RAG robustness. We summarize defense techniques by stage, together with their descriptions.

Explore similar work

May 8, 2026

PRA-RAG: Provably Robust Aggregation in Retrieval-Augmented Generation against Retrieval Corruption

Retrieval-Augmented Generation (RAG) enhances Large Language Models (LLMs) by incorporating external knowledge, effectively mitigating their inherent knowledge limitations. However, RAG remains vulnerable to poisoning attacks that manipulate retrieved texts to mislead model outputs. Existing defense mechanisms often lack theoretical robustness guarantees and perform unreliably when the LLM has limited knowledge of the retrieved content. In this work, we propose PRA-RAG, a provably robust retrieval aggregation algorithm designed to defend against poisoning attacks on retrieved texts. PRA-RAG samples multiple combinations of retrieved texts and utilizes geometric structures in the embedding space to identify a robust subset, from which a stable aggregated representation is derived. We provide theoretical bounds on the maximum impact of poisoned retrieved content and establish a quantitative measure of RAG's robustness. Experiments across multiple benchmarks and RAG architectures demonstrate that PRA-RAG reduces the attack success rate to as low as 1% while maintaining an accuracy of 71%, significantly outperforming representative state-of-the-art methods.

Xue Tan, Yi Zheng, Chang Huo +7

School of Computer Science, Fudan University, Shanghai, China · Institute of Big Data, Fudan University, Shanghai, China · Department of Computer Science, Worcester Polytechnic Institute, MA, USA

Retrieval-Augmented Generation RAG Poisoning Attacks RAG Security Certified Robustness RAG Robustness

Ask PDF

Jun 24, 2026

Security and Privacy in Retrieval-Augmented Generation: Architectures, Threats, Defenses, and Future Directions for Building Trustworthy Systems

Retrieval-Augmented Generation (RAG) has emerged as a dominant paradigm for enhancing large language models with external knowledge. By coupling retrieval mechanisms with generative models, RAG systems improve factual grounding and adaptability across domains. However, integrating retrieval pipelines introduces new security and privacy risks that extend beyond conventional language modeling threats. Sensitive information may be exposed through retrieval indices, query logs, context construction, or federated updates, while adversarial manipulation of knowledge bases can undermine trust in generated outputs. This survey provides a comprehensive examination of privacy and security challenges across RAG systems deployed in centralized, on-device (Micro-RAG), federated, and hybrid paradigms. We present a unified taxonomy of threat surfaces spanning the retrieval, context construction, and generation stages and systematically analyze attack classes, including membership inference, index inference, poisoning, gradient leakage, and collusion. We further review architectural, algorithmic, and cryptographic defenses, highlighting privacy-utility trade-offs and deployment considerations. Finally, we outline open research challenges toward building trustworthy, secure, and resilient RAG systems for real-world applications.

Balamurugan Palanisamy, G S S Chalapathi, Vikas Hassija +1

Department of Electrical and Electronics Engineering Birla Institute of Technology and Science, Pilani, Pilani Campus Vidya Vihar, Pilani, Rajasthan 333031, India · Department of Computer Engineering, KIIT University Bhubaneshwar, Odisha 751024, India · Quantum Cloud Computing and Distributed Systems (qCLOUDS) Laboratory Department of Computing and Information Systems The University of Melbourne, Melbourne, Australia

Retrieval-Augmented Generation Privacy-Preserving Language Models RAG Poisoning Attacks RAG Security

Ask PDF

Mar 23, 2026

Towards Secure Retrieval-Augmented Generation: A Comprehensive Review of Threats, Defenses and Benchmarks

Retrieval-Augmented Generation (RAG) significantly mitigates the hallucinations and domain knowledge deficiency in large language models by incorporating external knowledge bases. However, the multi-module architecture of RAG introduces complex system-level security vulnerabilities. Guided by the RAG workflow, this paper analyzes the underlying vulnerability mechanisms and systematically categorizes core threat vectors such as data poisoning, adversarial attacks, and membership inference attacks. Based on this threat assessment, we construct a taxonomy of RAG defense technologies from a dual perspective encompassing both input and output stages. The input-side analysis reviews data protection mechanisms including dynamic access control, homomorphic encryption retrieval, and adversarial pre-filtering. The output-side examination summarizes advanced leakage prevention techniques such as federated learning isolation, differential privacy perturbation, and lightweight data sanitization. To establish a unified benchmark for future experimental design, we consolidate authoritative test datasets, security standards, and evaluation frameworks. To the best of our knowledge, this paper presents the first end-to-end survey dedicated to the security of RAG systems. Distinct from existing literature that isolates specific vulnerabilities, we systematically map the entire pipeline-providing a unified analysis of threat models, defense mechanisms, and evaluation benchmarks. By enabling deep insights into potential risks, this work seeks to foster the development of highly robust and trustworthy next-generation RAG systems.

Yanming Mu, Hao Hu, Feiyang Li +7

State Key Laboratory of Mathematical Engineering and Advanced Computing, Zhengzhou, 450001, China. · Information Engineering University, Zhengzhou, 450001, China. · Henan Key Laboratory of Information Security, Zhengzhou, 450001, China. +1

RAG Security RAG Robustness RAG Poisoning Attacks

Ask PDF