mlsanityData to 14 Oct 2026

RAGFort: Dual-Path Defense Against Proprietary Knowledge Base Extraction in Retrieval-Augmented Generation

arXiv 2511.10128 ↗First posted 13 Nov 2025cs.AIcited by 0

On the map: Retrieval-augmented generation → Privacy and security of RAG

Abstract (arXiv)

Retrieval-Augmented Generation (RAG) systems deployed over proprietary knowledge bases face growing threats from reconstruction attacks that aggregate model responses to replicate knowledge bases. Such attacks exploit both intra-class and inter-class paths, progressively extracting fine-grained knowledge within topics and diffusing it across semantically related ones, thereby enabling comprehensive extraction of the original knowledge base. However, existing defenses target only one path, leaving the other unprotected. We conduct a systematic exploration to assess the impact of protecting each path independently and find that joint protection is essential for effective defense. Based on this, we propose RAGFort, a structure-aware dual-module defense combining "contrastive reindexing" for inter-class isolation and "constrained cascade generation" for intra-class protection. Experiments across security, performance, and robustness confirm that RAGFort significantly reduces reconstruction success while preserving answer quality, offering comprehensive defense against knowledge base extraction attacks.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 11 of its 23 references that are in the map. First posted on arXiv 13 Nov 2025.

Builds on

11 of 23 references.

Closest ancestors · 2

Same direction, newest first

  1. 2024Feedback-Guided Extraction of Knowledge Base from Retrieval-Augmented LLM Applications21 Nov
  2. 2024Mitigating the Privacy Issues in Retrieval-Augmented Generation (RAG) via Pure Synthetic Data20 Jun

Other references · 9

  1. 2025DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learningcited by 6,330
  2. 2022Large Language Models Encode Clinical Knowledgecited by 1,830
  3. 2025Gemma 3 Technical Reportcited by 1,824
  4. 2023BloombergGPT: A Large Language Model for Financecited by 939
  5. 2023DistillSpec: Improving Speculative Decoding via Knowledge Distillationcited by 165
  6. 2024Faster Cascades via Speculative Decodingcited by 38
  7. 2024Decoding Speculative Decodingcited by 34
  8. 2024Unleashing Worms and Extracting Data: Escalating the Outcome of Attacks against RAG-based Inference in Scale and Severity Using Jailbreakingcited by 30
  9. 2025Towards Trustworthy Retrieval Augmented Generation for Large Language Models: A Surveycited by 30

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026Benchmarking Knowledge-Extraction Attack and Defense on Retrieval-Augmented Generation
  2. 2026Connect the Dots: Knowledge Graph-Guided Crawler Attack on Retrieval-Augmented Generation Systems
  3. 2025Silent Leaks: Implicit Knowledge Extraction Attack on RAG Systems through Benign Queries
  4. 2026Securing Retrieval-Augmented Generation: A Taxonomy of Attacks, Defenses, and Future Directions
  5. 2025One Shot Dominance: Knowledge Poisoning Attack on Retrieval-Augmented Generation Systems
  6. 2025Rescuing the Unpoisoned: Efficient Defense against Knowledge Corruption Attacks on RAG Systems
  7. 2026Towards Secure Retrieval-Augmented Generation: A Comprehensive Review of Threats, Defenses and Benchmarks
  8. 2026Retrieved But Not Reliable: A Survey on Attacks, and Defenses in Retrieval-Augmented Generation