mlsanityData to 14 Oct 2026

Securing RAG: A Risk Assessment and Mitigation Framework

arXiv 2505.08728 ↗First posted 13 May 2025cs.CR cs.AI cs.IRcited by 3

On the map: Retrieval-augmented generation → Privacy and security of RAG

Abstract (arXiv)

Retrieval Augmented Generation (RAG) has emerged as the de facto industry standard for user-facing NLP applications, offering the ability to integrate data without re-training or fine-tuning Large Language Models (LLMs). This capability enhances the quality and accuracy of responses but also introduces novel security and privacy challenges, particularly when sensitive data is integrated. With the rapid adoption of RAG, securing data and services has become a critical priority. This paper first reviews the vulnerabilities of RAG pipelines, and outlines the attack surface from data pre-processing and data storage management to integration with LLMs. The identified risks are then paired with corresponding mitigations in a structured overview. In a second step, the paper develops a framework that combines RAG-specific security considerations, with existing general security guidelines, industry standards, and best practices. The proposed framework aims to guide the implementation of robust, compliant, secure, and trustworthy RAG systems.

Key facts. Cited by 3 papers in the map (data through 14 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 34 of its 65 references that are in the map. First posted on arXiv 13 May 2025.

Builds on

34 of 65 references.

Closest ancestors · 9

Same direction, newest first

  1. 2024Feedback-Guided Extraction of Knowledge Base from Retrieval-Augmented LLM Applications21 Nov
  2. 2024HijackRAG: Hijacking Attacks against Retrieval-Augmented Large Language Models30 Oct
  3. 2024Black-Box Opinion Manipulation Attacks to Retrieval-Augmented Generation of Large Language Models18 Jul
  4. 2024Poisoned LangChain: Jailbreak LLMs by LangChain26 Jun
  5. 2024Mitigating the Privacy Issues in Retrieval-Augmented Generation (RAG) via Pure Synthetic Data20 Jun
  6. 2024Is My Data in Your Retrieval Database? Membership Inference Attacks Against Retrieval Augmented Generation30 May
  7. 2024The Good and The Bad: Exploring Privacy Issues in Retrieval-Augmented Generation (RAG)23 Feb
  8. 2024Pandora: Jailbreak GPTs by Retrieval Augmented Generation Poisoning13 Feb
  9. 2024PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models12 Feb

Other references · 25

  1. 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,297
  2. 2019BERTScore: Evaluating Text Generation with BERTcited by 5,512
  3. 2024Gemini 1.5: Unlocking multimodal understanding across millions of tokens of contextcited by 3,224
  4. 2023Retrieval-Augmented Generation for Large Language Models: A Surveycited by 2,212
  5. 2023Self-RAG: Learning to Retrieve, Generate, and Critique through Self-Reflectioncited by 1,839
  6. 2023A Survey on Hallucination in Large Language Models: Principles, Taxonomy, Challenges, and Open Questionscited by 1,601
  7. 2024From Local to Global: A Graph RAG Approach to Query-Focused Summarizationcited by 1,453
  8. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,443
  9. 2023A Survey on Evaluation of Large Language Modelscited by 1,242
  10. 2024Retrieval-Augmented Generation for AI-Generated Content: A Surveycited by 354
  11. 2024Knowledge Conflicts for LLMs: A Surveycited by 283
  12. 2024The Power of Noise: Redefining Retrieval for RAG Systemscited by 281
13 more
  1. 2023ARES: An Automated Evaluation Framework for Retrieval-Augmented Generation Systemscited by 265
  2. 2023Evaluating Large Language Models: A Comprehensive Surveycited by 202
  3. 2023Text Embeddings Reveal (Almost) As Much As Textcited by 192
  4. 2023From ChatGPT to ThreatGPT: Impact of Generative AI in Cybersecurity and Privacycited by 143
  5. 2022Machine Learning Operations (MLOps): Overview, Definition, and Architecturecited by 128
  6. 2024On the Privacy Risk of In-context Learningcited by 32
  7. 2022MLOps -- Definitions, Tools and Challengescited by 25
  8. 2024Transferable Embedding Inversion Attack: Uncovering Privacy Risks in Text Embeddings without Model Queriescited by 25
  9. 2024Multi-Head RAG: Solving Multi-Aspect Problems with LLMscited by 18
  10. 2024Reconstruct Your Previous Conversations! Comprehensively Investigating Privacy Leakage Risks in Conversations with GPT Modelscited by 16
  11. 2018A Re-ranker Scheme for Integrating Large Scale NLU modelscited by 9
  12. 2024Mixture-of-Instructions: Aligning Large Language Models via Mixture Promptingcited by 4
  13. 2024SecGenAI: Enhancing Security of Cloud-based Generative AI Applications within Australian Critical Technologies of National Interestcited by 2

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 1; 2026: 2.

3 papers.

  1. 2025RAG+: Enhancing Retrieval-Augmented Generation with Application-Aware Reasoningcited by 3
  2. 2026Securing Retrieval-Augmented Generation: A Taxonomy of Attacks, Defenses, and Future Directionscited by 2
  3. 2026AI Engineering Blueprint for On-Premises Retrieval-Augmented Generation Systemscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Towards Secure Retrieval-Augmented Generation: A Comprehensive Review of Threats, Defenses and Benchmarks
  2. 2025RAG Security and Privacy: Formalizing the Threat Model and Attack Surface
  3. 2026SoK: Privacy Risks and Mitigations in Retrieval-Augmented Generation Systems
  4. 2024ConfusedPilot: Confused Deputy Risks in RAG-based LLMs
  5. 2025Privacy-Aware RAG: Secure and Isolated Knowledge Retrieval
  6. 2026Security and Privacy in Retrieval-Augmented Generation: Architectures, Threats, Defenses, and Future Directions for Building Trustworthy Systems
  7. 2026RAG-CT: Mitigating Privacy Risks on Retrieval-Augmented Generation Systems via Scanning Prompt Distribution
  8. 2024Pirates of the RAG: Adaptively Attacking LLMs to Leak Knowledge Bases