Benchmarking Knowledge-Extraction Attack and Defense on Retrieval-Augmented Generation
On the map: Retrieval-augmented generation → Privacy and security of RAG
also in 1 more
Abstract (arXiv)
Retrieval-Augmented Generation (RAG) has become a cornerstone of knowledge-intensive applications, including enterprise chatbots, healthcare assistants, and agentic memory management. However, recent studies show that knowledge-extraction attacks can recover sensitive knowledge-base content through maliciously crafted queries, raising serious intellectual property and privacy concerns. While prior work has explored individual attack and defense techniques, the research landscape remains fragmented, spanning heterogeneous retrieval embeddings, diverse generation models, and evaluations based on non-standardized metrics and inconsistent datasets. To address this gap, we introduce the first systematic benchmark for knowledge-extraction attacks on RAG systems. Our benchmark covers broad attack/defense strategies, representative retrieval embedding models, open/closed-source generators, (non) graph-based indexing, all evaluated under a unified experimental framework with standardized protocols across multiple datasets spanning diverse languages. By consolidating the experimental landscape and enabling reproducible, comparable evaluation, this benchmark provides actionable insights and a practical foundation for developing privacy-preserving RAG systems in the face of emerging knowledge extraction threats.
Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 38 of its 62 references that are in the map. First posted on arXiv 10 Feb 2026.
Builds on
38 of 62 references.
Closest ancestors · 8
Same direction, newest first
- 2025Exposing Privacy Risks in Graph Retrieval-Augmented Generation24 Aug
- 2025Benchmarking Poisoning Attacks against Retrieval-Augmented Generation24 May
- 2025Silent Leaks: Implicit Knowledge Extraction Attack on RAG Systems through Benign Queries21 May
- 2024Feedback-Guided Extraction of Knowledge Base from Retrieval-Augmented LLM Applications21 Nov
- 2024Mitigating the Privacy Issues in Retrieval-Augmented Generation (RAG) via Pure Synthetic Data20 Jun
- 2024Follow My Instruction and Spill the Beans: Scalable Data Extraction from Retrieval-Augmented Generation Systems27 Feb
- 2024The Good and The Bad: Exploring Privacy Issues in Retrieval-Augmented Generation (RAG)23 Feb
- 2024PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models12 Feb
Other references · 30
- 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,160
- 2016SQuAD: 100,000+ Questions for Machine Comprehension of Textcited by 4,115
- 2016Pointer Sentinel Mixture Modelscited by 2,992
- 2023Retrieval-Augmented Generation for Large Language Models: A Surveycited by 2,185
- 2020Extracting Training Data from Large Language Modelscited by 2,144
- 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,565
- 2020MiniLM: Deep Self-Attention Distillation for Task-Agnostic Compression of Pre-Trained Transformerscited by 1,414
- 2024M3-Embedding: Multi-Linguality, Multi-Functionality, Multi-Granularity Text Embeddings Through Self-Knowledge Distillationcited by 1,050
- 2025A-MEM: Agentic Memory for LLM Agentscited by 1,000
- 2022Quantifying Memorization Across Neural Language Modelscited by 755
- 2023Towards General Text Embeddings with Multi-stage Contrastive Learningcited by 705
- 2023In-Context Retrieval-Augmented Language Modelscited by 694
18 more
- 2022Deduplicating Training Data Mitigates Privacy Risks in Language Modelscited by 309
- 2025Agentic Retrieval-Augmented Generation: A Survey on Agentic RAGcited by 242
- 2023Knowledge Editing for Large Language Models: A Surveycited by 189
- 2024Retrieval-Augmented Generation with Graphs (GraphRAG)cited by 170
- 2025AI Agents vs. Agentic AI: A Conceptual Taxonomy, Applications and Challengescited by 167
- 2022A Survey on Retrieval-Augmented Text Generationcited by 157
- 2023Domain Specialization as the Key to Make Large Language Models Disruptive: A Comprehensive Surveycited by 134
- 2018Exploring Connections Between Active Learning and Model Extractioncited by 84
- 2024Intention Analysis Makes LLMs A Good Jailbreak Defendercited by 64
- 2025RAG vs. GraphRAG: A Systematic Evaluation and Key Insightscited by 51
- 2023Exploring Memorization in Fine-tuned Language Modelscited by 44
- 2024On the Structural Memory of LLM Agentscited by 37
- 2021EmailSum: Abstractive Email Thread Summarizationcited by 24
- 2025Equilibrate RLHF: Towards Balancing Helpfulness-Safety Trade-off in Large Language Modelscited by 22
- 2023Model Extraction Attacks Revisitedcited by 21
- 2024ATTNChecker: Highly-Optimized Fault Tolerant Attention for Large Language Model Trainingcited by 11
- 2024Adversarial Hubness in Multi-Modal Retrievalcited by 9
- 2024Confidential Prompting: Privacy-preserving LLM Inference on Cloudcited by 1
Built on by
Citing papers per year: 2026: 1.
1 paper.
Similar, not cited
Close in wording, no citation either way
- 2025Rescuing the Unpoisoned: Efficient Defense against Knowledge Corruption Attacks on RAG Systems
- 2026Security and Privacy in Retrieval-Augmented Generation: Architectures, Threats, Defenses, and Future Directions for Building Trustworthy Systems
- 2026Towards Secure Retrieval-Augmented Generation: A Comprehensive Review of Threats, Defenses and Benchmarks
- 2025RAG Safety: Exploring Knowledge Poisoning Attacks to Retrieval-Augmented Generation
- 2026Retrieved But Not Reliable: A Survey on Attacks, and Defenses in Retrieval-Augmented Generation
- 2025RAGFort: Dual-Path Defense Against Proprietary Knowledge Base Extraction in Retrieval-Augmented Generation
- 2025SafeRAG: Benchmarking Security in Retrieval-Augmented Generation of Large Language Model
- 2025RAG Security and Privacy: Formalizing the Threat Model and Attack Surface