mlsanityData to 7 Oct 2026

Is My Data in Your Retrieval Database? Membership Inference Attacks Against Retrieval Augmented Generation

arXiv 2405.20446 ↗First posted 30 May 2024cs.CR cs.AI cs.LGcited by 44

On the map: Retrieval-augmented generation → Privacy and security of RAG

also in 1 more
Abstract (arXiv)

Retrieval Augmented Generation (RAG) systems have shown great promise in natural language processing. However, their reliance on data stored in a retrieval database, which may contain proprietary or sensitive information, introduces new privacy concerns. Specifically, an attacker may be able to infer whether a certain text passage appears in the retrieval database by observing the outputs of the RAG system, an attack known as a Membership Inference Attack (MIA). Despite the significance of this threat, MIAs against RAG systems have yet remained under-explored. This study addresses this gap by introducing an efficient and easy-to-use method for conducting MIA against RAG systems. We demonstrate the effectiveness of our attack using two benchmark datasets and multiple generative models, showing that the membership of a document in the retrieval database can be efficiently determined through the creation of an appropriate prompt in both black-box and gray-box settings. Moreover, we introduce an initial defense strategy based on adding instructions to the RAG template, which shows high effectiveness for some datasets and models. Our findings highlight the importance of implementing security countermeasures in deployed RAG systems and developing more advanced defenses to protect the privacy and security of retrieval databases.

Key facts. Cited by 44 papers in the map (data through 7 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 25 of its 40 references that are in the map. First posted on arXiv 30 May 2024.

Builds on

25 of 40 references.

Closest ancestors · 1

Same direction, newest first

  1. 2024The Good and The Bad: Exploring Privacy Issues in Retrieval-Augmented Generation (RAG)23 Feb

Other references · 24

  1. 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,160
  2. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  3. 2023Retrieval-Augmented Generation for Large Language Models: A Surveycited by 2,185
  4. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,339
  5. 2021Membership Inference Attacks From First Principlescited by 839
  6. 2021Prompt Programming for Large Language Models: Beyond the Few-Shot Paradigmcited by 599
  7. 2020On Adaptive Attacks to Adversarial Example Defensescited by 547
  8. 2023Formalizing and Benchmarking Prompt Injection Attacks and Defensescited by 328
  9. 2021Membership Inference Attacks on Machine Learning: A Surveycited by 306
  10. 2022UL2: Unifying Language Learning Paradigmscited by 292
  11. 2024Do Membership Inference Attacks Work on Large Language Models?cited by 188
  12. 2023Poisoning Retrieval Corpora by Injecting Adversarial Passagescited by 153
12 more
  1. 2024Min-K%++: Improved Baseline for Detecting Pre-Training Data from Large Language Modelscited by 102
  2. 2024Keeping LLMs Aligned After Fine-tuning: The Crucial Role of Prompt Templatescited by 94
  3. 2024Differentially Private Synthetic Data via Foundation Model APIs 2: Textcited by 74
  4. 2023PrivLM-Bench: A Multi-level Privacy Evaluation Benchmark for Language Modelscited by 35
  5. 2021Membership Inference on Word Embedding and Beyondcited by 34
  6. 2022Differentially Private Decoding in Large Language Modelscited by 34
  7. 2022Manu: A Cloud Native Vector Database Management Systemcited by 18
  8. 2024Prompt Perturbation in Retrieval-Augmented Generation based Large Language Modelscited by 17
  9. 2021Membership Inference Attacks Against Self-supervised Speech Modelscited by 16
  10. 2024SoK: Reducing the Vulnerability of Fine-tuned Language Models to Membership Inference Attackscited by 10
  11. 2023Improved Membership Inference Attacks Against Language Classification Modelscited by 7
  12. 2021DP-FP: Differentially Private Forward Propagation for Large Modelscited by 6

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 8; 2025: 22; 2026: 14.

44 papers.

Sort:

By area:

  1. 2025A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deploymentcited by 110
  2. 2025A Survey on Trustworthy LLM Agents: Threats and Countermeasurescited by 93
  3. 2024Trustworthiness in Retrieval-Augmented Generation Systems: A Surveycited by 83
  4. 2025Poison-RAG: Adversarial Data Poisoning Attacks on Retrieval-Augmented Generation in Recommender Systemscited by 32
  5. 2024Unleashing Worms and Extracting Data: Escalating the Outcome of Attacks against RAG-based Inference in Scale and Severity Using Jailbreakingcited by 30
  6. 2025We Should Identify and Mitigate Third-Party Safety Risks in MCP-Powered Agent Systemscited by 27
  7. 2024Generating Is Believing: Membership Inference Attacks against Retrieval-Augmented Generationcited by 25
  8. 2025Silent Leaks: Implicit Knowledge Extraction Attack on RAG Systems through Benign Queriescited by 19
  9. 2024Pirates of the RAG: Adaptively Attacking LLMs to Leak Knowledge Basescited by 17
  10. 2025Membership Inference Attacks on Large-Scale Models: A Surveycited by 17
  11. 2024Ward: Provable RAG Dataset Inference via LLM Watermarkscited by 15
  12. 2024Blockchain for Large Language Model Security and Safety: A Holistic Surveycited by 8
32 more
  1. 2025Privacy-Preserving Federated Embedding Learning for Localized Retrieval-Augmented Generationcited by 7
  2. 2025Position: LLM Watermarking Should Align Stakeholders' Incentives for Practical Adoptioncited by 7
  3. 2026SoK: Privacy Risks and Mitigations in Retrieval-Augmented Generation Systemscited by 7
  4. 2025RAG-WM: An Efficient Black-Box Watermarking Approach for Retrieval-Augmented Generation of Large Language Modelscited by 6
  5. 2025Beyond Data Privacy: New Privacy Risks for Large Language Modelscited by 6
  6. 2025ImageSentinel: Protecting Visual Datasets from Unauthorized Retrieval-Augmented Image Generationcited by 4
  7. 2026POLAR-Bench: A Diagnostic Benchmark for Privacy-Utility Trade-offs in LLM Agentscited by 4
  8. 2026Five Queries Are Enough: Query-Efficient and Surrogate-Free Membership Inference Attacks on RAG via Entailmentcited by 4
  9. 2025Securing RAG: A Risk Assessment and Mitigation Frameworkcited by 3
  10. 2025SMA: Who Said That? Auditing Membership Leakage in Semi-Black-box RAG Controllingcited by 3
  11. 2026Connect the Dots: Knowledge Graph-Guided Crawler Attack on Retrieval-Augmented Generation Systemscited by 3
  12. 2025Distributed Retrieval-Augmented Generationcited by 2
  13. 2025MrM: Black-Box Membership Inference Attacks against Multimodal RAG Systemscited by 2
  14. 2025Fine-Grained Privacy Extraction from Retrieval-Augmented Generation Systems via Knowledge Asymmetry Exploitationcited by 2
  15. 2025External Data Extraction Attacks against Retrieval-Augmented Large Language Modelscited by 2
  16. 2025Private-RAG: Answering Multiple Queries with LLMs while Keeping Your Data Privatecited by 2
  17. 2025Privacy Challenges and Solutions in Retrieval-Augmented Generation-Enhanced LLMs for Healthcare Chatbots: A Review of Applications, Risks, and Future Directionscited by 2
  18. 2025BudgetLeak: Membership Inference Attacks on RAG Systems via the Generation Budget Side Channelcited by 2
  19. 2026Making Theft Useless: Adulteration-Based Protection of Proprietary Knowledge Graphs in GraphRAG Systemscited by 2
  20. 2026MemPot: Defending Against Memory Extraction Attack with Optimized Honeypotscited by 2
  21. 2026MRMMIA: Membership Inference Attacks on Memory in Chat Agentscited by 2
  22. 2024Membership Inference Attacks Against Time-Series Modelscited by 1
  23. 2024Membership Inference Attack against Long-Context Large Language Modelscited by 1
  24. 2025Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generationcited by 1
  25. 2025Provably Secure Retrieval-Augmented Generationcited by 0
  26. 2026Graphs Don't Stay Secret: Practical Subgraph Reconstruction Attacks on Defended Graph RAGcited by 0
  27. 2026Sensitivity-Aware Retrieval-Augmented Intent Clarificationcited by 0
  28. 2026Automated Membership Inference Attacks (AutoMIA): Discovering MIA Signal Computations using LLM Agentscited by 0
  29. 2026Adaptive Defense Orchestration for RAG: A Sentinel-Strategist Architecture against Multi-Vector Attackscited by 0
  30. 2026E-MIA: Exam-Style Black-Box Membership Inference Attacks against RAG Systemscited by 0
  31. 2026K-Bench: A Benchmark for LLM Unlearning in Agentic Deploymentscited by 0
  32. 2026CIG-MIA: Context-Induced Information Gain Membership Inference Attacks against Retrieval-Augmented Generationcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Safeguarding Privacy of Retrieval Data against Membership Inference Attacks: Is This Query Too Close to Home?
  2. 2024Mask-based Membership Inference Attacks for Retrieval-Augmented Generation
  3. 2025RAG Security and Privacy: Formalizing the Threat Model and Attack Surface
  4. 2025Riddle Me This! Stealthy Membership Inference for Retrieval-Augmented Generation
  5. 2026Security and Privacy in Retrieval-Augmented Generation: Architectures, Threats, Defenses, and Future Directions for Building Trustworthy Systems
  6. 2026Towards Secure Retrieval-Augmented Generation: A Comprehensive Review of Threats, Defenses and Benchmarks
  7. 2025DCMI: A Differential Calibration Membership Inference Attack Against Retrieval-Augmented Generation
  8. 2025Ensemble Privacy Defense for Knowledge-Intensive LLMs against Membership Inference Attacks