RAG Security

RAG: Retrieval-Augmented Generation

RAG security examines how threats can enter through the knowledge corpus, retriever, retrieved context, and generator, including poisoned documents, prompt injection, private-data extraction, and unsafe answers. Attacks and defenses are tested in question-answering, multi-hop, web-search, and agentic settings, using benchmarks that measure answer quality, leakage, attack success, and abstention. Defenses include document screening and provenance checks, robust reranking and evidence aggregation, cross-source verification, query-time privacy controls, and encrypted or differentially private retrieval. A central challenge is resisting adaptive attacks across the full pipeline without sacrificing retrieval utility, increasing latency, or relying on assumptions such as a trusted majority of documents.

Latest papers

106 papers10 papers in the last four weeks, level with the four weeks before. 0.1% of all new papers.

Manifest-Assisted Retrieval in Artificial Intelligence Search: Evidence Gaps and a Security Evaluation
Oct 28, 2026Gangzhen Qian, Kainan Zhou, Chuhong Xu +5RAG Security LLM Auditing
Google LLC Mountain View, USA · Sony Corporate of America San Jose, USA · Fortinet, Inc. Sunnyvale, USA +2
Ranking Is Not Deciding: Benchmark Shortcuts and Operating-Point Collapse in Query-Time RAG Poisoning Defenses
Oct 24, 2026Pushkal Kumar, Arvin SahaymRAG Security RAG Robustness
North Creek High School · Washington State University
Trust Mechanisms for Offline Generative AI at the Edge: A Connectivity-Regime Framework and an Empirical Study on a Raspberry Pi 5
Oct 24, 2026Georgios Feretzakis, Alexandros PapaspyridisLLM Reliability RAG Security
Protection Is Not One Event: A Survey of RAG Protection Research by Measured Endpoint
Oct 21, 2026Peiyang Liu, Xi Wang, Di Liang +3RAG Security RAG Evaluation
National Engineering Research Center for Software Engineering, Peking University, Beijing, China · School of Software and Microelectronics, Peking University, Beijing, China · Tencent Technology, Shenzhen, China +1
Context-Aware Prompt Injection Detection via Small Language Models in RAG Pipelines: nokast-secureRAG
Oct 20, 2026Abhishek RaiPrompt Injection Detection RAG Security
Independent Researcher
Private Retrieval Augmented Generation via Random Projection
Oct 15, 2026Dixi Yao, Tahseen Rabbani, Tian LiPrivacy-Preserving RAG RAG Security
University of Chicago
GraphRAG-LTM: A Layered Threat Modeling Framework for Attacks on Graph Retrieval-Augmented Generation
Oct 14, 2026Yining Tang, Junyu Zhang, Haomiao Qiu +5Graph Retrieval-Augmented Generation RAG Security
Zhejiang University · Harbin Institute of Technology, Shenzhen · Great Bay University +1
SEEK: Agentic Knowledge Graph Retrieval for Secure Code Generation
Oct 10, 2026Varun Gadey, Markus Tohn, Lichao Wu +2Secure Code Generation RAG Security
University of Duisburg-Essen, Germany · University of Bristol, UK · Technical University of Darmstadt, Germany
RAG-PIBench: A Leakage-Aware Benchmark for Prompt-Injection Detection in Trustworthy RAG Systems
Oct 6, 2026Niveen O. Jaffal, Ahmet Yuksel, David MohaisenRAG Security Prompt Injection Attacks on LLMs
Birzeit University, Birzeit, Palestine · Independent Researcher · University of Central Florida, Orlando, FL, USA
Rethinking Knowledge Retrieval for Generation: A Survey on RAG Architectures and Applications
Oct 1, 2026Meghana Sunil, Shravya V, Shravan Venkatraman +1Retrieval-Augmented Generation RAG Security
School of Computer Science and Engineering, Vellore Institute of Technology, Chennai, India. · Mohamed bin Zayed University of Artificial Intelligence, Abu Dhabi, UAE.
Quantization Enables Private Dense Retrieval against Malicious Service Providers
Sep 28, 2026Louis Tremblay Thibault, Sofiane Azogagh, Marc-Olivier Killijian +1RAG Security Dense Retrieval
École de technologie supérieure and Mila · Eurecom · Université du Québec à Montréal
Backdoor in the Loop: Compromising Agentic Search via Malicious Retrievers
Sep 26, 2026Beining Xu, Peichun Hua, Yunming XiaoBackdoor Attacks RAG Security
Shenzhen MSU-BIT University · The Chinese University of Hong Kong, Shenzhen
RAG-NAROK: Retrieval-Aware Knowledge Corpus Poisoning in RAG with Source-specific Refutation
Sep 21, 2026Abdullahil Kafi, Alvi Ataur KhalilRAG Poisoning Attacks RAG Security
Transformative Innovation for Trustworthy AI and Network Security (TITANS) Lab, Computer Science, Southern Illinois University, USA
RAG-CT: Mitigating Privacy Risks on Retrieval-Augmented Generation Systems via Scanning Prompt Distribution
Sep 14, 2026Xingyu Lyu, Jiayimei Wang, Jianfeng He +3Privacy Leakage in Language Models RAG Security
University of Massachusetts Lowell, Lowell, MA 01854, USA · City University of Hong Kong, Kowloon, Hong Kong SAR, 999077, China · Virginia Tech, Blacksburg, VA 24061, USA +2
CiteShade: Citation Laundering in Multi-Source Retrieval-Augmented Generation and Its Counterfactual Defense
Sep 14, 2026Guo FuzhengRAG Poisoning Attacks RAG Security
City University of Hong Kong
RAG-Safety-Bench: Reliable Evaluation of Retrieval-Augmented LLM Safety
Sep 10, 2026Adithiyan Rajan Indira Saravanan, Kathleen C. FraserLLM Safety Benchmarks LLM Safety
Faculty of Engineering University of Ottawa Ottawa, Canada
In RAG We Trust? Measuring Robustness of Retrieval-Augmented Generation Under Post-Retrieval Context Tampering
Sep 8, 2026Iliano FasolinoRAG Poisoning Attacks RAG Security
Department of Computer Science University of Milan Milan, Italy
Finding Icebergs in Language-Model Workflow: Diagnosing Latent Structural Fragility with Stochastic Semantic Evidence Graphs
Sep 3, 2026Matthew F. Dixon, Bertrand Nortier, Miquel Noguer i AlonsoLLM Safety Evaluation AI Agent Auditing
BeliefLens · AI Finance Institute (AIFI) · University of Leicester +1
Rent-a-RAG: Embedding-Space Watermarks for Auditing Third-Party RAG
Sep 3, 2026Alexandr Goultiaev Tolstokorov, Kyriakos Mouratidis, Javad Dogani +1Dataset Watermarking RAG Security
IMDEA Networks Institute, Madrid, Spain · Universidad Carlos III de Madrid, Madrid, Spain · Singapore Management University, Singapore
When Optimization Becomes Manipulation: Defending Generative Search against Malicious Generative Engine Optimization
Sep 2, 2026Haozhang Li, Yangguang Shao, Xinjie Lin +3Generative Engine Optimization RAG Security
University of the Chinese Academy of Sciences · Zhongguancun Laboratory
TRIS: A Tri-Layer Retrieval Integrity Sieve Against Knowledge Poisoning
Aug 31, 2026Muhaimin Bin Munir, Akib Jawad Ononto, Nazia Shehnaz Joynab +2RAG Poisoning Attacks Retrieval Robustness
University of Texas at Dallas
CamoDocs: A Poisoning Attack Against Retrieval-Augmented Language Models Using Camouflaged Documents
Aug 28, 2026Jaewon Jung, Haizhong Zheng, Hongsun Jang +3RAG Poisoning Attacks RAG Security
Seoul National University · Carnegie Mellon University
Pointing the Way, Hiding the Destination: Practical Private Dense Retrieval at Scale
Aug 26, 2026Peichun Hua, Danyang Chen, Junan Zhang +5Privacy-Preserving RAG Information Retrieval
The Chinese University of Hong Kong, Shenzhen · State Key Laboratory of Internet Architecture, Tsinghua University · Beijing University of Posts and Telecommunications +2
Retrieved But Not Reliable: A Survey on Attacks, and Defenses in Retrieval-Augmented Generation
Aug 25, 2026Minh Tran, Cuong Dang, Tuc Nguyen +10Retrieval-Augmented Generation RAG Security
Faculty of Information Technology, University of Science, Ho Chi Minh City, Vietnam · Vietnam National University, Ho Chi Minh City, Vietnam · Virginia Tech +6
RAGSentinel: Certifiable Geometric Consensus for Robust Retrieval-Augmented Generation
Aug 25, 2026Yueyang Quan, Anjun Gao, Yufei Xia +2RAG Security RAG Robustness
University of North Texas · University of Louisville
Mitigating Database Leakage in RAG Systems with Keyword-Grounded Fact Substitution
Aug 21, 2026Ziliang Zhang, Yubo Zhu, Wei Tong +4RAG Security Prompt Injection Defense
Nanjing University
Trustworthy RAG: An Evaluation Agent for Detecting Misinformation and Knowledge Poisoning in Generative AI Systems
Aug 21, 2026Balkrishna Giri, Md Toufique Hasan, Jussi Rasku +2RAG Security RAG Evaluation
Faculty of Information Technology and Communication Sciences, Tampere University Tampere, Finland
When Detection Does Not Guarantee Resistance: Reasoning and Poisoned Context in RAG
Aug 17, 2026Mehrdad Ghassabi, Audrina Ebrahimi, Sadra Hakim +3Knowledge Conflicts in Language Models RAG Poisoning Attacks
University of Isfahan · University of Texas at Dallas · University of Windsor
Coverage Is Not Containment: A Fundamental Limit of Admission-Time Defenses Against Coordinated Poisoning of Vector Retrieval
Aug 17, 2026Prashant Kumar Pathak, Tarun Kumar SharmaRAG Poisoning Attacks RAG Security
Santa Clara, CA, USA · Colonia, NJ, USA
RAGSieve: Self-Referenced Local Contrast for Knowledge-Poison Detection in Retrieval-Augmented Generation
Aug 13, 2026Xinlong Xu, Yoshua Y. LiRAG Poisoning Attacks RAG Security
Nanjing University of Information Science and Technology · Meituan

Oct 28, 2026J/K move · Enter open · S save

Manifest-Assisted Retrieval in Artificial Intelligence Search: Evidence Gaps and a Security Evaluation

Gangzhen Qian, Kainan Zhou, Chuhong Xu, Hang Xiao+4

Google LLC Mountain View, USA · Sony Corporate of America San Jose, USA · Fortinet, Inc. Sunnyvale, USA+2

RAG Security LLM Auditing

Open paper AskPDF arXiv

The external sources retained in our non-systematic audit did not isolate the incremental security or utility effect of consuming /llms.txt while ordinary retrieval remained fixed. The initial audit covered 39 sources through August 16, 2026, with later targeted updates through October 14. A purposive 15-tool study observed no automatic requests in 45 trials at one endpoint; a non-probability log study found that 97% of domains with detected files received no recorded requests in May 2026. We separate publication, fetch, model use, and action; define five operational threat paths and paired security-utility estimands; and exercise deterministic pre-model controls with 30 author-defined parser fixtures. We also execute a reduced pilot: 24 tasks across eight sites, five conditions, and 120 real model responses, with ordinary evidence held fixed. Frozen automatic scoring identifies attacker-target adoption in

21/24

raw adversarial responses, with one further response unresolved; the adversarial URLs-only condition has no known adoptions and one unresolved response. The pilot measures output changes conditional on supplied evidence, without live retrieval or external actions. Together, the framework and pilot distinguish manifest-content effects from publication, discovery, and downstream execution, while leaving full retrieval and agent evaluation open.