cs.CROct 21, 2026

Protection Is Not One Event: A Survey of RAG Protection Research by Measured Endpoint

Authors: Peiyang Liu, Xi Wang, Di Liang, Youru Li, Zhi Cai, Wei Ye

Organizations: National Engineering Research Center for Software Engineering, Peking University, Beijing, China · School of Software and Microelectronics, Peking University, Beijing, China · Tencent Technology, Shenzhen, China · College of Computer Science, Beijing University of Technology, Beijing, China

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Retrieval-augmented generation (RAG) systems face security, privacy, and copyright risks including content leakage, source reconstruction, unauthorized access, data poisoning, and prompt injection. Yet RAG protection studies use incompatible evaluation metrics, datasets, and threat models. We present a systematic survey and human-coded evidence map of 118 full-text-confirmed RAG defense papers, organized by measured endpoint rather than claimed goal or defense mechanism. Our seven-family taxonomy covers content disclosure, formal privacy proxies, access control and suppression, corpus-use detection, and pipeline integrity and attribution. Thirty-two annotators double-coded the papers kappa=0.867. The survey identifies three gaps. First, retrieval reranking and context rewriting each span five or six endpoint families, so mechanisms do not identify protection outcomes. Second, only 17.8% of studies use content disclosure or reconstruction as their primary endpoint; under the frozen copyright/ownership relation label, 73.3% of records have corpus-use detection as their primary endpoint, and none have an emitted-expression primary endpoint. Third, most evaluations use general-purpose question-answering datasets and non-adaptive attacks rather than sensitive data and adaptive, multi-turn extraction. Our controlled RAG testbed shows that preventing verbatim copying does not prevent private-fact recovery: a normalized 8-gram guard reduces 20-token copying to 0.0%, but a three-query adaptive attacker recovers 48.3% of hidden facts on Qwen3-8B. We release the taxonomy, dataset, coding protocols, and testbed to enable comparable, claim-aligned RAG security evaluation.

Figures & tables

Figure 1: The frozen taxonomy and its 17 subfamilies. A record is assigned by its primary measured endpoint, not by its topic.
Appendix figures & tables6 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 2: Response-to-source linkage calibration (top-1, %). Qwen3 answer-only responses are ranked by BM25 or MiniLM against the experimental corpus, question-selected topic-matched candidates, and expanded same-domain pools. Candidate-set sizes and the reported uniform and question-only baselines are retained. This measures source linkage, not copying or content recovery.
Figure 3: Context contrast and matched utility across the original model roles. (A) No-control and Summary context effects after three queries; paired numbers are shown in that order. (B) Summary-minus-uncontrolled differences-in-differences on all 80 answer-only items. Only Qwen3 was planned confirmatory; exact-answer recall is an incomplete recovery proxy. (C) Absolute ordinary-QA F1 on 64 document-disjoint items. (D) Paired Summary-minus-uncontrolled changes in QA F1, quote-query F1, and authorised quote 5-gram recall. Bars are 95% source-item bootstrap intervals. Negative authorised-quote recall means less desired quotation.
Figure 4: Exploratory exact-answer proxy changes at query budgets 1, 3, and 7 (percentage points). Top: source-intervention difference-in-differences under a shared attacker. Bottom: paired natural-retrieval changes under control-specific attackers, using all-item intent-to-treat analysis. All three original point estimates are plotted. Stopped interactions carry their last released state forward; models and attacker designs are not pooled. Intervals were not reported in the original budget table.
Figure 5: Mechanisms and metrics by primary endpoint over 118 records. Cells and row totals share a count scale; multi-label rows overlap. Stage codes and numbered representative works retain the original annotations.
Figure 6: Reporting and design appraisal over 118 records. Counts are lower/some/high concern; NR is zero throughout. These ratings are not efficacy weights.
Fam.RecordPrimary endpoint as reported
AZeng et al. (2024a)Repeat Prompt / Repeat Context / ROUGE Prompt+Context counts of retrieved chunks reproduced in output; summarization, distance threshold, re-ranking drive counts to 0
AWang et al. (2026a)Repeat Prompt/Context defined as response reproducing text verbatim from the retrieval corpus; ROUGE-L above threshold vs corpus text (264->127 etc.)
AZeng et al. (2025a)Repeat Prompt = at least 10 tokens exactly matching original dataset; ROUGE-L>0.5; targeted PII count driven to 0
ALiang et al. (2026b)Repeat Prompts / Repeat Length / Target Info under targeted and prefix extraction attacks (59 pct reduction in repeated prompts)
AZhu et al. (2026)Privacy leakage rate under the ’privacy extraction attack’ of He et al. (ChatDoctor 0.23 -> 0.17; EnronQA 0.63 -> 0.33, Table 3); BLEU/ROUGE-L reported as UTILITY
AZhang et al. (2026b)Repeat Prompts = >=10 consecutive tokens from retrieval corpus; ROUGE Prompts/Contexts>0.5; zero leakage across epsilon=0.1..10
Appendix
Table 7
More in this topic

RAG Security

Retrieval-augmented generation security studies how to protect retrieval-based language systems from attacks, data leakage, and unsafe outputs.

See all 104 papers

Explore similar work

CardsList
Mar 23, 2026

Towards Secure Retrieval-Augmented Generation: A Comprehensive Review of Threats, Defenses and Benchmarks

Retrieval-Augmented Generation (RAG) significantly mitigates the hallucinations and domain knowledge deficiency in large language models by incorporating external knowledge bases. However, the multi-module architecture of RAG introduces complex system-level security vulnerabilities. Guided by the RAG workflow, this paper analyzes the underlying vulnerability mechanisms and systematically categorizes core threat vectors such as data poisoning, adversarial attacks, and membership inference attacks. Based on this threat assessment, we construct a taxonomy of RAG defense technologies from a dual perspective encompassing both input and output stages. The input-side analysis reviews data protection mechanisms including dynamic access control, homomorphic encryption retrieval, and adversarial pre-filtering. The output-side examination summarizes advanced leakage prevention techniques such as federated learning isolation, differential privacy perturbation, and lightweight data sanitization. To establish a unified benchmark for future experimental design, we consolidate authoritative test datasets, security standards, and evaluation frameworks. To the best of our knowledge, this paper presents the first end-to-end survey dedicated to the security of RAG systems. Distinct from existing literature that isolates specific vulnerabilities, we systematically map the entire pipeline-providing a unified analysis of threat models, defense mechanisms, and evaluation benchmarks. By enabling deep insights into potential risks, this work seeks to foster the development of highly robust and trustworthy next-generation RAG systems.

Yanming Mu, Hao Hu, Feiyang Li +7

State Key Laboratory of Mathematical Engineering and Advanced Computing, Zhengzhou, 450001, China. · Information Engineering University, Zhengzhou, 450001, China. · Henan Key Laboratory of Information Security, Zhengzhou, 450001, China. +1

RAG SecurityRAG RobustnessRAG Poisoning Attacks
AskPDF
Apr 9, 2026

A Survey of Secure Retrieval-Augmented Generation

Retrieval-augmented generation (RAG) improves large language models (LLMs) with external knowledge, but this access path creates security risks distinct from inherent prompt-only or parametric-model flaws. We frame secure RAG as securing external knowledge access. We conducted a systematic search and curated 135 works on attacks, defenses, and security evaluation, and organized them with SLOT: a taxonomy along the attack Surface (S) and the corresponding defense Layer (L), with cross-cutting axes Objective (O) and attack-target scope (T). Mapping these studies onto an external knowledge-access pipeline, we expose three mismatches: target mismatch (T2 attacks outpace T2 defenses and evaluation), stage mismatch (S1 attacks outnumber L1 defenses), and signal mismatch (fluent, retrievable, corpus-fitting S1 attacks challenge anomaly-based L2/L3 defenses). Finally, we discuss directions for more realistic targets, surface-complete defense stacks, standardized evaluation, confidentiality, and multimodal and agentic systems, and release the screening process, selected-paper metadata, and machine-readable SLOT labels at https://github.com/TreeAI-Lab/Awesome-RAG-Security.

Yuming Xu, Mingtao Zhang, Zhuohan Ge +7

The Hong Kong Polytechnic University · The Hong Kong University of Science and Technology (Guangzhou)

RAG SecurityRAG RobustnessRAG Evaluation
AskPDF
Jun 24, 2026

Security and Privacy in Retrieval-Augmented Generation: Architectures, Threats, Defenses, and Future Directions for Building Trustworthy Systems

Retrieval-Augmented Generation (RAG) has emerged as a dominant paradigm for enhancing large language models with external knowledge. By coupling retrieval mechanisms with generative models, RAG systems improve factual grounding and adaptability across domains. However, integrating retrieval pipelines introduces new security and privacy risks that extend beyond conventional language modeling threats. Sensitive information may be exposed through retrieval indices, query logs, context construction, or federated updates, while adversarial manipulation of knowledge bases can undermine trust in generated outputs. This survey provides a comprehensive examination of privacy and security challenges across RAG systems deployed in centralized, on-device (Micro-RAG), federated, and hybrid paradigms. We present a unified taxonomy of threat surfaces spanning the retrieval, context construction, and generation stages and systematically analyze attack classes, including membership inference, index inference, poisoning, gradient leakage, and collusion. We further review architectural, algorithmic, and cryptographic defenses, highlighting privacy-utility trade-offs and deployment considerations. Finally, we outline open research challenges toward building trustworthy, secure, and resilient RAG systems for real-world applications.

Balamurugan Palanisamy, G S S Chalapathi, Vikas Hassija +1

Department of Electrical and Electronics Engineering Birla Institute of Technology and Science, Pilani, Pilani Campus Vidya Vihar, Pilani, Rajasthan 333031, India · Department of Computer Engineering, KIIT University Bhubaneshwar, Odisha 751024, India · Quantum Cloud Computing and Distributed Systems (qCLOUDS) Laboratory Department of Computing and Information Systems The University of Melbourne, Melbourne, Australia

Retrieval-Augmented GenerationPrivacy-Preserving Language ModelsRAG Poisoning AttacksPrivacy-Preserving RAGRAG Security
AskPDF