mlsanityData to 7 Oct 2026

Riddle Me This! Stealthy Membership Inference for Retrieval-Augmented Generation

arXiv 2502.00306 ↗First posted 1 Feb 2025cs.CR cs.AI cs.CLcited by 26

On the map: Retrieval-augmented generation → Privacy and security of RAG

also in 1 more
Abstract (arXiv)

Retrieval-Augmented Generation (RAG) enables Large Language Models (LLMs) to generate grounded responses by leveraging external knowledge databases without altering model parameters. Although the absence of weight tuning prevents leakage via model parameters, it introduces the risk of inference adversaries exploiting retrieved documents in the model's context. Existing methods for membership inference and data extraction often rely on jailbreaking or carefully crafted unnatural queries, which can be easily detected or thwarted with query rewriting techniques common in RAG systems. In this work, we present Interrogation Attack (IA), a membership inference technique targeting documents in the RAG datastore. By crafting natural-text queries that are answerable only with the target document's presence, our approach demonstrates successful inference with just 30 queries while remaining stealthy; straightforward detectors identify adversarial prompts from existing methods up to ~76x more frequently than those generated by our attack. We observe a 2x improvement in TPR@1%FPR over prior inference attacks across diverse RAG configurations, all while costing less than 0.02 per document inference.

Key facts. Cited by 26 papers in the map (data through 7 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 32 of its 52 references that are in the map. First posted on arXiv 1 Feb 2025.

Builds on

32 of 52 references.

Closest ancestors · 2

Same direction, newest first

  1. 2024Data Extraction Attacks in Retrieval-Augmented Generation via Backdoors3 Nov
  2. 2024The Good and The Bad: Exploring Privacy Issues in Retrieval-Augmented Generation (RAG)23 Feb

Other references · 30

  1. 2024The Llama 3 Herd of Modelscited by 14,192
  2. 2024Qwen2.5 Technical Reportcited by 4,713
  3. 2020Extracting Training Data from Large Language Modelscited by 2,144
  4. 2022Survey of Hallucination in Natural Language Generationcited by 2,056
  5. 2021BEIR: A Heterogenous Benchmark for Zero-shot Evaluation of Information Retrieval Modelscited by 1,225
  6. 2021Membership Inference Attacks From First Principlescited by 839
  7. 2022Ignore Previous Prompt: Attack Techniques For Language Modelscited by 760
  8. 2023Towards General Text Embeddings with Multi-stage Contrastive Learningcited by 705
  9. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 608
  10. 2019White-box vs Black-box: Bayes Optimal Strategies for Membership Inferencecited by 265
  11. 2023Membership Inference Attacks against Language Models via Neighbourhood Comparisoncited by 249
  12. 2020AutoPrompt: Eliciting Knowledge from Language Models with Automatically Generated Promptscited by 246
18 more
  1. 2022Promptagator: Few-shot Dense Retrieval From 8 Examplescited by 233
  2. 2023Proving Test Set Contamination in Black Box Language Modelscited by 227
  3. 2019Document Expansion by Query Predictioncited by 225
  4. 2022COLD Decoding: Energy-based Constrained Text Generation with Langevin Dynamicscited by 159
  5. 2021On the Importance of Difficulty Calibration in Membership Inference Attackscited by 137
  6. 2023Are Diffusion Models Vulnerable to Membership Inference Attacks?cited by 135
  7. 2024PLeak: Prompt Leaking Attacks against Large Language Model Applicationscited by 113
  8. 2024LLM Dataset Inference: Did you train on my dataset?cited by 107
  9. 2023Low-Cost High-Power Membership Inference Attackscited by 99
  10. 2024Blind Baselines Beat Membership Inference Attacks for Foundation Modelscited by 65
  11. 2023ConvGQR: Generative Query Reformulation for Conversational Searchcited by 59
  12. 2024SoK: Membership Inference Attacks on LLMs are Rushing Nowhere (and How to Fix It)cited by 54
  13. 2020Conversational Question Reformulation via Sequence-to-Sequence Architectures and Pretrained Language Modelscited by 45
  14. 2024InjecGuard: Benchmarking and Mitigating Over-defense in Prompt Injection Guardrail Modelscited by 36
  15. 2024On the Privacy Risk of In-context Learningcited by 31
  16. 2024Unleashing Worms and Extracting Data: Escalating the Outcome of Attacks against RAG-based Inference in Scale and Severity Using Jailbreakingcited by 30
  17. 2024Ward: Provable RAG Dataset Inference via LLM Watermarkscited by 15
  18. 2024Fairness Testing of Large Language Models in Role-Playingcited by 10

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 10; 2026: 16.

26 papers.

Sort:

By area:

  1. 2025Silent Leaks: Implicit Knowledge Extraction Attack on RAG Systems through Benign Queriescited by 19
  2. 2025Benchmarking Poisoning Attacks against Retrieval-Augmented Generationcited by 17
  3. 2025Safeguarding Privacy of Retrieval Data against Membership Inference Attacks: Is This Query Too Close to Home?cited by 8
  4. 2025Differentially Private Synthetic Text Generation for Retrieval-Augmented Generation (RAG)cited by 5
  5. 2026Confundo: Learning to Generate Robust Poison for Practical RAG Systemscited by 5
  6. 2025Exposing Privacy Risks in Graph Retrieval-Augmented Generationcited by 4
  7. 2026Five Queries Are Enough: Query-Efficient and Surrogate-Free Membership Inference Attacks on RAG via Entailmentcited by 4
  8. 2025SMA: Who Said That? Auditing Membership Leakage in Semi-Black-box RAG Controllingcited by 3
  9. 2026Connect the Dots: Knowledge Graph-Guided Crawler Attack on Retrieval-Augmented Generation Systemscited by 3
  10. 2025MrM: Black-Box Membership Inference Attacks against Multimodal RAG Systemscited by 2
  11. 2025External Data Extraction Attacks against Retrieval-Augmented Large Language Modelscited by 2
  12. 2025Private-RAG: Answering Multiple Queries with LLMs while Keeping Your Data Privatecited by 2
14 more
  1. 2025BudgetLeak: Membership Inference Attacks on RAG Systems via the Generation Budget Side Channelcited by 2
  2. 2026Securing Retrieval-Augmented Generation: A Taxonomy of Attacks, Defenses, and Future Directionscited by 2
  3. 2026MRMMIA: Membership Inference Attacks on Memory in Chat Agentscited by 2
  4. 2026E-MIA: Exam-Style Black-Box Membership Inference Attacks against RAG Systemscited by 0
  5. 2026ALDEN: Boosting Private Data Extraction from Retrieval-Augmented Generation Systems via Active Learning and Distribution Estimationcited by 0
  6. 2026ImageAuditor: Membership Inference Attack against Image-based Retrieval-Augmented Generationcited by 0
  7. 2026One Framework for All: Cross-Modal Membership Inference for Generative Modelscited by 0
  8. 2026When T2I Synthetic Data Backfires: Amplified Privacy Risks in Real-Synthetic Mix Trainingcited by 0
  9. 2026Context Inference Attacks Without Jailbreakscited by 0
  10. 2026K-Bench: A Benchmark for LLM Unlearning in Agentic Deploymentscited by 0
  11. 2026CIG-MIA: Context-Induced Information Gain Membership Inference Attacks against Retrieval-Augmented Generationcited by 0
  12. 2026Only Pay What You Must Spend: On-Demand Privacy Budget Payment for Differentially Private RAGcited by 0
  13. 2026Walking the Embedding Space: Datastore Extraction from Multimodal RAGcited by 0
  14. 2026Inverting Multi-Vector Visual Document Indicescited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024Mask-based Membership Inference Attacks for Retrieval-Augmented Generation
  2. 2025RAG Security and Privacy: Formalizing the Threat Model and Attack Surface
  3. 2024Is My Data in Your Retrieval Database? Membership Inference Attacks Against Retrieval Augmented Generation
  4. 2026Security and Privacy in Retrieval-Augmented Generation: Architectures, Threats, Defenses, and Future Directions for Building Trustworthy Systems
  5. 2026RAGSentinel: Certifiable Geometric Consensus for Robust Retrieval-Augmented Generation
  6. 2024Generating Is Believing: Membership Inference Attacks against Retrieval-Augmented Generation
  7. 2025AIP: Subverting Retrieval-Augmented Generation via Adversarial Instructional Prompt
  8. 2025Retrieval-Augmented Generation: A Comprehensive Survey of Architectures, Enhancements, and Robustness Frontiers