mlsanityData to 14 Oct 2026

Generating Is Believing: Membership Inference Attacks against Retrieval-Augmented Generation

arXiv 2406.19234 ↗First posted 27 Jun 2024cs.CR cs.AIcited by 25

On the map: Retrieval-augmented generation → Privacy and security of RAG

also in 1 more
Abstract (arXiv)

Retrieval-Augmented Generation (RAG) is a state-of-the-art technique that mitigates issues such as hallucinations and knowledge staleness in Large Language Models (LLMs) by retrieving relevant knowledge from an external database to assist in content generation. Existing research has demonstrated potential privacy risks associated with the LLMs of RAG. However, the privacy risks posed by the integration of an external database, which often contains sensitive data such as medical records or personal identities, have remained largely unexplored. In this paper, we aim to bridge this gap by focusing on membership privacy of RAG's external database, with the aim of determining whether a given sample is part of the RAG's database. Our basic idea is that if a sample is in the external database, it will exhibit a high degree of semantic similarity to the text generated by the RAG system. We present S2MIA, a underlineMembership underlineInference underlineAttack that utilizes the underlineSemantic underlineSimilarity between a given sample and the content generated by the RAG system. With our proposed S2MIA, we demonstrate the potential to breach the membership privacy of the RAG database. Extensive experiment results demonstrate that S2MIA can achieve a strong inference performance compared with five existing MIAs, and is able to escape from the protection of three representative defenses.

Key facts. Cited by 25 papers in the map (data through 14 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 34 of its 45 references that are in the map. First posted on arXiv 27 Jun 2024.

Builds on

34 of 45 references.

Closest ancestors · 4

Same direction, newest first

  1. 2024Mitigating the Privacy Issues in Retrieval-Augmented Generation (RAG) via Pure Synthetic Data20 Jun
  2. 2024Is My Data in Your Retrieval Database? Membership Inference Attacks Against Retrieval Augmented Generation30 May
  3. 2024The Good and The Bad: Exploring Privacy Issues in Retrieval-Augmented Generation (RAG)23 Feb
  4. 2024Pandora: Jailbreak GPTs by Retrieval Augmented Generation Poisoning13 Feb

Other references · 30

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,399
  2. 2020Language Models are Few-Shot Learnerscited by 32,419
  3. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 13,028
  4. 2020Dense Passage Retrieval for Open-Domain Question Answeringcited by 3,824
  5. 2017TriviaQA: A Large Scale Distantly Supervised Challenge Dataset for Reading Comprehensioncited by 2,955
  6. 2020Extracting Training Data from Large Language Modelscited by 2,189
  7. 2020REALM: Retrieval-Augmented Language Model Pre-Trainingcited by 2,141
  8. 2023Self-RAG: Learning to Retrieve, Generate, and Critique through Self-Reflectioncited by 1,839
  9. 2021Unsupervised Dense Information Retrieval with Contrastive Learningcited by 1,216
  10. 2022When Not to Trust Language Models: Investigating Effectiveness of Parametric and Non-Parametric Memoriescited by 1,128
  11. 2023Large Language Models Can Be Easily Distracted by Irrelevant Contextcited by 841
  12. 2023REPLUG: Retrieval-Augmented Black-Box Language Modelscited by 792
18 more
  1. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 651
  2. 2024Large Language Models: A Surveycited by 525
  3. 2024A Survey on RAG Meeting LLMs: Towards Retrieval-Augmented Large Language Modelscited by 452
  4. 2023Detecting Pretraining Data from Large Language Modelscited by 387
  5. 2023Membership Inference Attacks against Language Models via Neighbourhood Comparisoncited by 258
  6. 2023RA-DIT: Retrieval-Augmented Dual Instruction Tuningcited by 195
  7. 2024Do Membership Inference Attacks Work on Large Language Models?cited by 195
  8. 2023Text Embeddings Reveal (Almost) As Much As Textcited by 192
  9. 2023Are Diffusion Models Vulnerable to Membership Inference Attacks?cited by 136
  10. 2024LLM Dataset Inference: Did you train on my dataset?cited by 110
  11. 2023Did the Neurons Read your Book? Document-level Membership Inference for Large Language Modelscited by 56
  12. 2023Practical Membership Inference Attacks Against Large-Scale Multi-Modal Models: A Pilot Studycited by 38
  13. 2024LTGC: Long-tail Recognition via Leveraging LLMs-driven Generated Contentcited by 33
  14. 2024Retrieval Augmented End-to-End Spoken Dialog Modelscited by 20
  15. 2024Prompt Perturbation in Retrieval-Augmented Generation based Large Language Modelscited by 18
  16. 2023RegaVAE: A Retrieval-Augmented Gaussian Mixture Variational Auto-Encoder for Language Modelingcited by 12
  17. 2024RE-RAG: Improving Open-Domain QA Performance and Interpretability with Relevance Estimator in Retrieval-Augmented Generationcited by 10
  18. 2024Paraphrase and Aggregate with Large Language Models for Minimizing Intent Classification Errorscited by 9

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2024: 2; 2025: 11; 2026: 12.

25 papers.

Sort:

By area:

  1. 2025A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deploymentcited by 116
  2. 2025Poison-RAG: Adversarial Data Poisoning Attacks on Retrieval-Augmented Generation in Recommender Systemscited by 32
  3. 2024Pirates of the RAG: Adaptively Attacking LLMs to Leak Knowledge Basescited by 18
  4. 2025Membership Inference Attacks on Large-Scale Models: A Surveycited by 18
  5. 2024Estimating Privacy Leakage of Augmented Contextual Knowledge in Language Modelscited by 6
  6. 2025ImageSentinel: Protecting Visual Datasets from Unauthorized Retrieval-Augmented Image Generationcited by 4
  7. 2026Five Queries Are Enough: Query-Efficient and Surrogate-Free Membership Inference Attacks on RAG via Entailmentcited by 4
  8. 2025Private-RAG: Answering Multiple Queries with LLMs while Keeping Your Data Privatecited by 3
  9. 2025Privacy Challenges and Solutions in Retrieval-Augmented Generation-Enhanced LLMs for Healthcare Chatbots: A Review of Applications, Risks, and Future Directionscited by 3
  10. 2025BudgetLeak: Membership Inference Attacks on RAG Systems via the Generation Budget Side Channelcited by 3
  11. 2025MrM: Black-Box Membership Inference Attacks against Multimodal RAG Systemscited by 2
  12. 2025Fine-Grained Privacy Extraction from Retrieval-Augmented Generation Systems via Knowledge Asymmetry Exploitationcited by 2
13 more
  1. 2025External Data Extraction Attacks against Retrieval-Augmented Large Language Modelscited by 2
  2. 2026Making Theft Useless: Adulteration-Based Protection of Proprietary Knowledge Graphs in GraphRAG Systemscited by 2
  3. 2026MRMMIA: Membership Inference Attacks on Memory in Chat Agentscited by 2
  4. 2025Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generationcited by 1
  5. 2026AI Security in the Foundation Model Era: A Comprehensive Survey from a Unified Perspectivecited by 1
  6. 2026Graphs Don't Stay Secret: Practical Subgraph Reconstruction Attacks on Defended Graph RAGcited by 0
  7. 2026Sensitivity-Aware Retrieval-Augmented Intent Clarificationcited by 0
  8. 2026E-MIA: Exam-Style Black-Box Membership Inference Attacks against RAG Systemscited by 0
  9. 2026On the Privacy of LLMs: An Ablation Studycited by 0
  10. 2026Privacy Policy Enforcement Guardrails for Data-Sensitive Retrieval-Augmented Generationcited by 0
  11. 2026ImageAuditor: Membership Inference Attack against Image-based Retrieval-Augmented Generationcited by 0
  12. 2026Context Inference Attacks Without Jailbreakscited by 0
  13. 2026CIG-MIA: Context-Induced Information Gain Membership Inference Attacks against Retrieval-Augmented Generationcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Safeguarding Privacy of Retrieval Data against Membership Inference Attacks: Is This Query Too Close to Home?
  2. 2026Security and Privacy in Retrieval-Augmented Generation: Architectures, Threats, Defenses, and Future Directions for Building Trustworthy Systems
  3. 2026SoK: Privacy Risks and Mitigations in Retrieval-Augmented Generation Systems
  4. 2024Mask-based Membership Inference Attacks for Retrieval-Augmented Generation
  5. 2025RAG Security and Privacy: Formalizing the Threat Model and Attack Surface
  6. 2024RAG with Differential Privacy
  7. 2024Privacy-Preserving Retrieval-Augmented Generation with Differential Privacy
  8. 2025Privacy-Aware RAG: Secure and Isolated Knowledge Retrieval