mlsanityData to 14 Oct 2026

Provably Secure Retrieval-Augmented Generation

arXiv 2508.01084 ↗First posted 1 Aug 2025cs.CR cs.AIcited by 0

On the map: Retrieval-augmented generation → Privacy and security of RAG

also in 1 more
Abstract (arXiv)

Although Retrieval-Augmented Generation (RAG) systems have been widely applied, the privacy and security risks they face, such as data leakage and data poisoning, have not been systematically addressed yet. Existing defense strategies primarily rely on heuristic filtering or enhancing retriever robustness, which suffer from limited interpretability, lack of formal security guarantees, and vulnerability to adaptive attacks. To address these challenges, this paper proposes the first provably secure framework for RAG systems(SAG). Our framework employs a pre-storage full-encryption scheme to ensure dual protection of both retrieved content and vector embeddings, guaranteeing that only authorized entities can access the data. Through formal security proofs, we rigorously verify the scheme's confidentiality and integrity under a computational security model. Extensive experiments across multiple benchmark datasets demonstrate that our framework effectively resists a range of state-of-the-art attacks. This work establishes a theoretical foundation and practical paradigm for verifiably secure RAG systems, advancing AI-powered services toward formally guaranteed security.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 56 of its 78 references that are in the map. First posted on arXiv 1 Aug 2025.

Builds on

56 of 78 references.

Closest ancestors · 13

Same direction, newest first

  1. 2025ControlNET: A Firewall for RAG-based LLM System13 Apr
  2. 2025Practical Poisoning Attacks against Retrieval-Augmented Generation4 Apr
  3. 2025Topic-FlipRAG: Topic-Orientated Adversarial Opinion Manipulation Attacks to Retrieval-Augmented Generation Models3 Feb
  4. 2025Poison-RAG: Adversarial Data Poisoning Attacks on Retrieval-Augmented Generation in Recommender Systems20 Jan
  5. 2024Pirates of the RAG: Adaptively Attacking LLMs to Leak Knowledge Bases24 Dec
  6. 2024Feedback-Guided Extraction of Knowledge Base from Retrieval-Augmented LLM Applications21 Nov
  7. 2024HijackRAG: Hijacking Attacks against Retrieval-Augmented Large Language Models30 Oct
  8. 2024Machine Against the RAG: Jamming Retrieval-Augmented Generation with Blocker Documents9 Jun
  9. 2024Phantom: General Backdoor Attacks on Retrieval Augmented Language Generation30 May
  10. 2024Is My Data in Your Retrieval Database? Membership Inference Attacks Against Retrieval Augmented Generation30 May
  11. 2024TrojanRAG: Retrieval-Augmented Generation Can Be Backdoor Driver in Large Language Models22 May
  12. 2024Follow My Instruction and Spill the Beans: Scalable Data Extraction from Retrieval-Augmented Generation Systems27 Feb
1 more
  1. 2024The Good and The Bad: Exploring Privacy Issues in Retrieval-Augmented Generation (RAG)23 Feb

Other references · 43

  1. 2022Training language models to follow instructions with human feedbackcited by 15,971
  2. 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,297
  3. 2025DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learningcited by 6,330
  4. 2023Reflexion: Language Agents with Verbal Reinforcement Learningcited by 4,276
  5. 2022Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedbackcited by 3,720
  6. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,281
  7. 2020REALM: Retrieval-Augmented Language Model Pre-Trainingcited by 2,141
  8. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,207
  9. 2020ColBERT: Efficient and Effective Passage Search via Contextualized Late Interaction over BERTcited by 1,178
  10. 2022Quantifying Memorization Across Neural Language Modelscited by 763
  11. 2021Deduplicating Training Data Makes Language Models Bettercited by 714
  12. 2023Prompt Injection attack against LLM-integrated Applicationscited by 605
31 more
  1. 2024InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agentscited by 538
  2. 2024A Survey on RAG Meeting LLMs: Towards Retrieval-Augmented Large Language Modelscited by 452
  3. 2020RocketQA: An Optimized Training Approach to Dense Passage Retrieval for Open-Domain Question Answeringcited by 413
  4. 2023NeMo Guardrails: A Toolkit for Controllable and Safe LLM Applications with Programmable Railscited by 365
  5. 2023Formalizing and Benchmarking Prompt Injection Attacks and Defensescited by 364
  6. 2022A Holistic Approach to Undesired Content Detection in the Real Worldcited by 356
  7. 2024Retrieval-Augmented Generation for AI-Generated Content: A Surveycited by 354
  8. 2022Deduplicating Training Data Mitigates Privacy Risks in Language Modelscited by 314
  9. 2023Detecting and Preventing Hallucinations in Large Vision Language Modelscited by 256
  10. 2024RankRAG: Unifying Context Ranking with Retrieval-Augmented Generation in LLMscited by 202
  11. 2023Text Embeddings Reveal (Almost) As Much As Textcited by 192
  12. 2022A New Generation of Perspective API: Efficient Multilingual Character-level Transformerscited by 185
  13. 2023Poisoning Retrieval Corpora by Injecting Adversarial Passagescited by 159
  14. 2023Tensor Trust: Interpretable Prompt Injection Attacks from an Online Gamecited by 145
  15. 2024Optimization-based Prompt Injection Attack to LLM-as-a-Judgecited by 143
  16. 2024Attacks, Defenses and Evaluations for LLM Conversation Safety: A Surveycited by 130
  17. 2024xRAG: Extreme Context Compression for Retrieval-augmented Generation with One Tokencited by 125
  18. 2024ClashEval: Quantifying the tug-of-war between an LLM's internal prior and external evidencecited by 113
  19. 2023Cognitive Mirage: A Review of Hallucinations in Large Language Modelscited by 84
  20. 2023Assessing Prompt Injection Risks in 200+ Custom GPTscited by 55
  21. 2023PromptBench: A Unified Library for Evaluation of Large Language Modelscited by 44
  22. 2023PoisonPrompt: Backdoor Attack on Prompt-based Large Language Modelscited by 42
  23. 2024When Large Language Models Meet Vector Databases: A Surveycited by 39
  24. 2024HealthQ: Unveiling Questioning Capabilities of LLM Chains in Healthcare Conversationscited by 31
  25. 2024Unleashing Worms and Extracting Data: Escalating the Outcome of Attacks against RAG-based Inference in Scale and Severity Using Jailbreakingcited by 30
  26. 2024Prompt Leakage effect and defense strategies for multi-turn LLM interactionscited by 23
  27. 2023A Comprehensive Survey of Attack Techniques, Implementation, and Mitigation Strategies in Large Language Modelscited by 14
  28. 2024Scaling Up LLM Reviews for Google Ads Content Moderationcited by 12
  29. 2020A Survey of Published Attacks on Intel SGXcited by 10
  30. 2023A Survey of Secure Computation Using Trusted Execution Environmentscited by 8
  31. 2024Multitask Mayhem: Unveiling and Mitigating Safety Gaps in LLMs Fine-tuningcited by 8

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026Towards Secure Retrieval-Augmented Generation: A Comprehensive Review of Threats, Defenses and Benchmarks
  2. 2025Privacy-Aware RAG: Secure and Isolated Knowledge Retrieval
  3. 2026Security and Privacy in Retrieval-Augmented Generation: Architectures, Threats, Defenses, and Future Directions for Building Trustworthy Systems
  4. 2026Efficient Privacy-Preserving Retrieval Augmented Generation with Distance-Preserving Encryption
  5. 2026Securing Retrieval-Augmented Generation: A Taxonomy of Attacks, Defenses, and Future Directions
  6. 2025RAG Security and Privacy: Formalizing the Threat Model and Attack Surface
  7. 2026P2RAG: Efficient Privacy-Preserving RAG Service Supporting Arbitrary Top-k Retrieval
  8. 2026RAG-CT: Mitigating Privacy Risks on Retrieval-Augmented Generation Systems via Scanning Prompt Distribution