Retrieved But Not Reliable: A Survey on Attacks, and Defenses in Retrieval-Augmented Generation
Authors: Minh Tran, Cuong Dang, Tuc Nguyen, Khanh-Tung Tran, Minh Huynh Nguyen, Trinh Chau, Kien Le, Do Xuan Long, +5 more
Organizations: Faculty of Information Technology, University of Science, Ho Chi Minh City, Vietnam · Vietnam National University, Ho Chi Minh City, Vietnam · Virginia Tech · Indiana University · University College Cork · National University of Singapore · VNU University of Engineering and Technology · Independent Researcher · The Pennsylvania State University
Retrieval-Augmented Generation (RAG) enhances large language models by grounding outputs in external knowledge, improving factuality and reducing hallucinations. At the same time, the retrieval-augmented pipeline introduces new robustness and security risks, including corpus poisoning, backdoor attacks, privacy leakage, and fairness violations. Despite rapid progress in this area, existing surveys remain limited in their treatment of attacker objectives, threat models, and stage-specific defenses across the full RAG pipeline. This survey presents a unified and pipeline-aware overview of RAG robustness. We formalize threat models over the corpus, retriever, and generator, and organize attacks into three main objectives: accuracy, privacy, and fairness. We further review defenses from a pipeline-aware perspective, covering the retrieval, rerank, generation, and traceback stages. In addition, we summarize robustness benchmarks and explainability methods for more deeply evaluating and explaining RAG robustness.
Figures & tables
Figure 1: Overview of adversarial attacks and defense strategies in RAG.
Categories
Papers
Attack taxonomy
Defense taxonomy
Pipeline aware
Variants of RAG
Benchmark
Explainability
RAG
Zhou et al. (2026)
✗
✗
✗
✗
✓
✗
Ni et al. (2025)
✗
✗
✗
✗
✓
✗
Wang et al. (2025a)
✓
✓
✓
✗
✗
✗
Vonderhaar et al. (2025)
✓
✓
✗
✗
✗
✗
LLM
Cui et al. (2024)
✓ LLM
✓ LLM
✗
✗
✓ LLM
✗
Our
✓
✓
✓
✓
✓
✓
Table 1: Comparison of existing surveys on RAG and LLM security and trustworthiness . Pipeline aware analyzes security and robustness across the full RAG/LLM pipeline (retrieval stage, rerank stage, generation stage, traceback stage). Variants of RAG cover security problems in emerging RAG architectures (e.g., GraphRAG, multimodal RAG). A plain checkmark (✓) indicates coverage; ✓ LLM denotes coverage focused on LLMs only; ✗ indicates limited or missing coverage.
Figure 2: Adversarial attacks on RAG across three objectives. Attackers can exploit the retrieval pipeline to compromise accuracy , privacy , and fairness . Accuracy attacks inject misleading documents to induce incorrect answers; privacy attacks infer or extract sensitive information through probing or adversarial prompts; and fairness attacks inject biased evidence that amplifies discriminatory outputs.
Figure 3: Illustration of retrieval-stage defense.
Figure 4: Illustration of rerank-stage defenses.
Figure 5: Illustration of generation-stage defenses.
Figure 6: Illustration of traceback-stage defense.
Appendix figures & tables5 assets
Supplementary material from the paper’s appendix.
Appendix
Components
Attacker’s knowledge
Attacker’s capabilities
Corpus D
Insert-only
Can inject crafted documents into the external corpus, but cannot read or delete existing documents.
Retriever R
Black-box
Can only query the retriever and observe retrieval outputs, without access to embeddings or parameters.
White-box
Unrestricted access to the target model’s parameters, architecture, source code, and other internal details.
Generator F
Black-box
Can only interact through query-response access and manipulate outputs indirectly through the provided input context.
White-box
Unrestricted access to the target model’s parameters, architecture, and token-level output probabilities at each generation step.
Appendix
Table 2: Threat models for RAG. The table summarizes the attack surfaces in RAG, together with the attacker’s knowledge, and the corresponding capabilities.
Benchmarks
Failure Modes (What to Benchmark)
Datasets
Metrics (Retrieval / Generation)
Liang et al. (2025b)
Corpus poisoning
SafeRAG
Ret.: RA (Retrieval Accuracy); Gen.: F1(correct/incorrect/avg), ASR/AFR
Zhang et al. (2025c)
Corpus poisoning
NQ, HotpotQA, MS-MARCO, SQuAD, BoolQ
Ret.: F1; Gen.: ACC, ASR
Chen et al. (2026)
Corpus poisoning
NQ, MS-MARCO
Ret.: Precision, Recall, F1; Gen.: ASR
Zhou et al. (2025b)
Symbolic query perturbation
NQ, MS-MARCO, Code
Ret.: Precision, Recall, F1; Gen.: ASR
Zheng et al. (2025b)
Knowledge conflict
KNOWSHIFTQA
Ret.: Recall@1, Recall@5; Gen.: Accuracy
Appendix
Table 3: Summary of benchmark failure modes, datasets, and metrics.
Objectives
Targeting
Methods
References
Accuracy
Targeted
Choi et al. (2025) , Xi et al. (2026) , Chang et al. (2025a) , Zhuang et al. (2024) , Gong et al. (2025) ,
Li et al. (2025a) , Cho et al. (2024) , Song et al. (2025) , Wu et al. (2025b) ,
Corpus Poisoning
Chen et al. (2024b) , Nazary et al. (2025) , Zou et al. (2024) , Su et al. (2025) , Shao et al. (2025) ,
Chen et al. (2025c) , Li et al. (2025c) , Wang et al. (2025e) , Suo et al. (2025) ,
Xian et al. (2025) , Zhang et al. (2026)
Backdoor Attack
Chaudhari et al. (2026) , Chaturvedi et al. (2025) , Jiao et al. (2025b) , Cheng et al. (2024) ,
Appendix
Table 4: Taxonomy of attacks in retrieval-augmented generation (RAG). Attacks are categorized by objective ( accuracy , fairness , privacy ), targeting strategy ( targeted vs. untargeted ), and attack method.
Stages
Categories
Methods
References
Retrieval
Robust Retrieval
Diagnostic Resources
Fayyaz et al. (2025) , Goel (2024)
Evidence-Centric Retrieval
Chang et al. (2025b)
Corpus Sanitization
Jia et al. (2025) , Si et al. (2025) ,
Dinu et al. (2025) , Yu and Sato (2024) , Mochizuki et al. (2026)
Robust Training for Retriever
Hard Negative Training
Qu et al. (2021) , Thakur et al. (2025)
Perturbation Training
Tasawong et al. (2023)
Appendix
Table 5: Taxonomy of defenses for retrieval-augmented generation (RAG) robustness. Defenses are organized by their position in the RAG pipeline.
Stages
Techniques
Description
Retrieval
Robust Retrieval
Improve retriever through test-time mechanisms (e.g., CoE retrieval, corpus sanitization).
Robust Training
Train the retriever with adversarial or noisy data to improve robustness.
Rerank
Consistency Reranking
Reorder retrieved candidates to promote benign and relevant documents while pushing suspicious documents below the final top- k cutoff.
Generation
Filtering
Remove noisy, poisoned, or prompt-injected documents from the retrieved context before generation through consistency, influence, mechanistic and reliability-aware filtering.
Detection
Identify and flag suspicious retrieved document or abnormal generation signals without necessarily removing them.
Robust Reasoning
Improve reasoning through test-time mechanisms (e.g., alignment, layer guided attention).
Appendix
Table 6: Defense taxonomy for RAG robustness. We summarize defense techniques by stage, together with their descriptions.
School of Computer Science, Fudan University, Shanghai, China · Institute of Big Data, Fudan University, Shanghai, China · Department of Computer Science, Worcester Polytechnic Institute, MA, USA
Department of Electrical and Electronics Engineering Birla Institute of Technology and Science, Pilani, Pilani Campus Vidya Vihar, Pilani, Rajasthan 333031, India · Department of Computer Engineering, KIIT University Bhubaneshwar, Odisha 751024, India · Quantum Cloud Computing and Distributed Systems (qCLOUDS) Laboratory Department of Computing and Information Systems The University of Melbourne, Melbourne, Australia
State Key Laboratory of Mathematical Engineering and Advanced Computing, Zhengzhou, 450001, China. · Information Engineering University, Zhengzhou, 450001, China. · Henan Key Laboratory of Information Security, Zhengzhou, 450001, China. +1