mlsanityData to 14 Oct 2026

Beyond Text: Unveiling Privacy Vulnerabilities in Multi-modal Retrieval-Augmented Generation

arXiv 2505.13957 ↗First posted 20 May 2025cs.CR cs.CLcited by 5

On the map: Retrieval-augmented generation → Privacy and security of RAG

Abstract (arXiv)

Multimodal Retrieval-Augmented Generation (MRAG) systems enhance LMMs by integrating external multimodal databases, but introduce unexplored privacy vulnerabilities. While text-based RAG privacy risks have been studied, multimodal data presents unique challenges. We provide the first systematic analysis of MRAG privacy vulnerabilities across vision-language and speech-language modalities. Using a novel compositional structured prompt attack in a black-box setting, we demonstrate how attackers can extract private information by manipulating queries. Our experiments reveal that LMMs can both directly generate outputs resembling retrieved content and produce descriptions that indirectly expose sensitive information, highlighting the urgent need for robust privacy-preserving MRAG techniques.

Key facts. Cited by 5 papers in the map (data through 14 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 29 of its 53 references that are in the map. First posted on arXiv 20 May 2025.

Builds on

29 of 53 references.

Closest ancestors · 1

Same direction, newest first

  1. 2024The Good and The Bad: Exploring Privacy Issues in Retrieval-Augmented Generation (RAG)23 Feb

Other references · 28

  1. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,744
  2. 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,297
  3. 2015VQA: Visual Question Answeringcited by 2,506
  4. 2020Extracting Training Data from Large Language Modelscited by 2,189
  5. 2021Align before Fuse: Vision and Language Representation Learning with Momentum Distillationcited by 1,619
  6. 2024MiniCPM-V: A GPT-4V Level MLLM on Your Phonecited by 1,079
  7. 2019Generalization through Memorization: Nearest Neighbor Language Modelscited by 800
  8. 2023Large Language Modelscited by 780
  9. 2022Large-scale Contrastive Language-Audio Pretraining with Feature Fusion and Keyword-to-Caption Augmentationcited by 719
  10. 2021Retrieval Augmentation Reduces Hallucination in Conversationcited by 692
  11. 2022MuRAG: Multimodal Retrieval-Augmented Generator for Open Question Answering over Images and Textcited by 220
  12. 2022Re-Imagen: Retrieval-Augmented Text-to-Image Generatorcited by 210
16 more
  1. 2024Emilia: An Extensive, Multilingual, and Diverse Speech Dataset for Large-Scale Speech Generationcited by 204
  2. 2024Retrieval-Augmented Generation with Graphs (GraphRAG)cited by 172
  3. 2022REVEAL: Retrieval-Augmented Visual-Language Pre-Training with Multi-Source Multimodal Knowledge Memorycited by 123
  4. 2024MMedAgent: Learning to Use Medical Tools with Multi-modal Agentcited by 109
  5. 2025Unveiling Privacy Risks in LLM Agent Memorycited by 101
  6. 2022Retrieval Augmented Visual Question Answering with Outside Knowledgecited by 94
  7. 2024MMed-RAG: Versatile Multimodal RAG System for Medical Vision Language Modelscited by 85
  8. 2024Protecting Privacy in Multimodal Large Language Models with MLLMU-Benchcited by 64
  9. 2023Can Language Models be Instructed to Protect Personal Information?cited by 46
  10. 2024Let's Go Real Talk: Spoken Dialogue Model for Face-to-Face Conversationcited by 41
  11. 2024Copyright Protection in Generative AI: A Technical Perspectivecited by 38
  12. 2024Towards Knowledge Checking in Retrieval-augmented Generation: A Representation Perspectivecited by 20
  13. 2025Empowering GraphRAG with Knowledge Filtering and Integrationcited by 15
  14. 2022Extracting Targeted Training Data from ASR Models, and How to Mitigate Itcited by 7
  15. 2025Towards Context-Robust LLMs: A Gated Representation Fine-tuning Approachcited by 6
  16. 2024Noise Masking Attacks and Defenses for Pretrained Speech Modelscited by 3

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 1; 2026: 4.

5 papers.

  1. 2025Safe-LLaVA: A Privacy-Preserving Vision-Language Dataset and Benchmark for Biometric Safetycited by 7
  2. 2026Do Multimodal RAG Systems Leak Data? A Comprehensive Evaluation of Membership Inference and Image Caption Retrieval Attackscited by 3
  3. 2026Securing Retrieval-Augmented Generation: A Taxonomy of Attacks, Defenses, and Future Directionscited by 2
  4. 2026Fix Before Search: Benchmarking Agentic Query Visual Pre-processing in Multimodal Retrieval-augmented Generationcited by 1
  5. 2026Walking the Embedding Space: Datastore Extraction from Multimodal RAGcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Security and Privacy in Retrieval-Augmented Generation: Architectures, Threats, Defenses, and Future Directions for Building Trustworthy Systems
  2. 2025MrM: Black-Box Membership Inference Attacks against Multimodal RAG Systems
  3. 2026RAG-CT: Mitigating Privacy Risks on Retrieval-Augmented Generation Systems via Scanning Prompt Distribution
  4. 2026SD-RAG: A Prompt-Injection-Resilient Framework for Selective Disclosure in Retrieval-Augmented Generation
  5. 2026Hidden in the Metadata: Stealth Poisoning Attacks on Multimodal Retrieval-Augmented Generation
  6. 2026SoK: Privacy Risks and Mitigations in Retrieval-Augmented Generation Systems
  7. 2026PRAG: End-to-End Privacy-Preserving Retrieval-Augmented Generation
  8. 2025RAG Security and Privacy: Formalizing the Threat Model and Attack Surface