mlsanityData to 14 Oct 2026

Securing Retrieval-Augmented Generation: A Taxonomy of Attacks, Defenses, and Future Directions

arXiv 2604.08304 ↗First posted 9 Apr 2026cs.CR cs.AIcited by 2

On the map: Retrieval-augmented generation → Privacy and security of RAG

Abstract (arXiv)

Retrieval-augmented generation (RAG) improves large language models (LLMs) with external knowledge, but this access path creates security risks distinct from inherent prompt-only or parametric-model flaws. We frame secure RAG as securing external knowledge access. We conducted a systematic search and curated 135 works on attacks, defenses, and security evaluation, and organized them with SLOT: a taxonomy along the attack Surface (S) and the corresponding defense Layer (L), with cross-cutting axes Objective (O) and attack-target scope (T). Mapping these studies onto an external knowledge-access pipeline, we expose three mismatches: target mismatch (T2 attacks outpace T2 defenses and evaluation), stage mismatch (S1 attacks outnumber L1 defenses), and signal mismatch (fluent, retrievable, corpus-fitting S1 attacks challenge anomaly-based L2/L3 defenses). Finally, we discuss directions for more realistic targets, surface-complete defense stacks, standardized evaluation, confidentiality, and multimodal and agentic systems, and release the screening process, selected-paper metadata, and machine-readable SLOT labels at https://github.com/TreeAI-Lab/Awesome-RAG-Security.

Key facts. Cited by 2 papers in the map (data through 14 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 99 of its 131 references that are in the map. First posted on arXiv 9 Apr 2026.

Builds on

99 of 131 references.

Closest ancestors · 70

Same direction, newest first

  1. 2026PIDP-Attack: Combining Prompt Injection with Database Poisoning Attacks on Retrieval-Augmented Generation Systems26 Mar
  2. 2026Benchmarking Knowledge-Extraction Attack and Defense on Retrieval-Augmented Generation10 Feb
  3. 2026Retrieval Pivot Attacks in Hybrid RAG: Measuring and Mitigating Amplified Leakage from Vector Seeds to Graph Expansion9 Feb
  4. 2026Addressing Corpus Knowledge Poisoning Attacks on RAG Using Sparse Attention4 Feb
  5. 2026Do Multimodal RAG Systems Leak Data? A Comprehensive Evaluation of Membership Inference and Image Caption Retrieval Attacks25 Jan
  6. 2026Connect the Dots: Knowledge Graph-Guided Crawler Attack on Retrieval-Augmented Generation Systems22 Jan
  7. 2026SD-RAG: A Prompt-Injection-Resilient Framework for Selective Disclosure in Retrieval-Augmented Generation16 Jan
  8. 2026Hidden-in-Plain-Text: A Benchmark for Social-Web Indirect Prompt Injection in RAG16 Jan
  9. 2026SoK: Privacy Risks and Mitigations in Retrieval-Augmented Generation Systems7 Jan
  10. 2026Making Theft Useless: Adulteration-Based Protection of Proprietary Knowledge Graphs in GraphRAG Systems1 Jan
  11. 2025MemoryGraft: Persistent Compromise of LLM Agents via Poisoned Experience Retrieval18 Dec
  12. 2025MIRAGE: Misleading Retrieval-Augmented Generation via Black-box and Query-agnostic Poisoning Attacks9 Dec
38 more
  1. 2025Ensemble Privacy Defense for Knowledge-Intensive LLMs against Membership Inference Attacks1 Dec
  2. 2025Medusa: Cross-Modal Transferable Adversarial Attacks on Multimodal Medical Retrieval-Augmented Generation24 Nov
  3. 2025Rescuing the Unpoisoned: Efficient Defense against Knowledge Corruption Attacks on RAG Systems3 Nov
  4. 2025Secure Retrieval-Augmented Generation against Poisoning Attacks28 Oct
  5. 2025RAG-Pull: Turning Retrieval into a Code-Injection Channel via Invisible Unicode Perturbations13 Oct
  6. 2025Differentially Private Synthetic Text Generation for Retrieval-Augmented Generation (RAG)8 Oct
  7. 2025ReliabilityRAG: Effective and Provably Robust Defense for RAG-based Web-Search27 Sep
  8. 2025Your RAG is Unfair: Exposing Fairness Vulnerabilities in Retrieval-Augmented Generation via Backdoor Attacks26 Sep
  9. 2025RAG Security and Privacy: Formalizing the Threat Model and Attack Surface24 Sep
  10. 2025AIP: Subverting Retrieval-Augmented Generation via Adversarial Instructional Prompt18 Sep
  11. 2025ImportSnare: Directed "Code Manual" Hijacking in Retrieval-Augmented Code Generation9 Sep
  12. 2025SMA: Who Said That? Auditing Membership Leakage in Semi-Black-box RAG Controlling12 Aug
  13. 2025Token-Level Precise Attack on RAG: Searching for the Best Alternatives to Mislead Generation5 Aug
  14. 2025Safeguarding RAG Pipelines with GMTP: A Gradient-based Masked Token Probability Method for Poisoned Document Detection24 Jul
  15. 2025The Hidden Threat in Plain Text: Attacking RAG Data Loaders7 Jul
  16. 2025InvisibleInk: High-Utility and Low-Cost Text Generation with Differential Privacy30 Jun
  17. 2025Joint-GCG: Unified Gradient-Based Poisoning Attacks on Retrieval-Augmented Generation Systems6 Jun
  18. 2025Adversarial Threat Vectors and Risk Mitigation for Retrieval-Augmented Generation Systems30 May
  19. 2025Safeguarding Privacy of Retrieval Data against Membership Inference Attacks: Is This Query Too Close to Home?28 May
  20. 2025The Silent Saboteur: Imperceptible Adversarial Attacks against Black-Box Retrieval-Augmented Generation Systems24 May
  21. 2025Benchmarking Poisoning Attacks against Retrieval-Augmented Generation24 May
  22. 2025Silent Leaks: Implicit Knowledge Extraction Attack on RAG Systems through Benign Queries21 May
  23. 2025Beyond Text: Unveiling Privacy Vulnerabilities in Multi-modal Retrieval-Augmented Generation20 May
  24. 2025One Shot Dominance: Knowledge Poisoning Attack on Retrieval-Augmented Generation Systems15 May
  25. 2025Securing RAG: A Risk Assessment and Mitigation Framework13 May
  26. 2025GRADA: Graph-based Reranking against Adversarial Documents Attack12 May
  27. 2025Defending against Indirect Prompt Injection by Instruction Detection8 May
  28. 2025PR-Attack: Coordinated Prompt-RAG Attacks on Retrieval-Augmented Generation in Large Language Models via Bilevel Optimization10 Apr
  29. 2025One Pic is All it Takes: Poisoning Visual Document Retrieval Augmented Generation with a Single Image2 Apr
  30. 2025Tricking Retrievers with Influential Tokens: An Efficient Black-Box Corpus Poisoning Attack27 Mar
  31. 2025Privacy-Aware RAG: Secure and Isolated Knowledge Retrieval17 Mar
  32. 2025Poisoned-MRAG: Knowledge Poisoning Attacks to Multimodal Retrieval Augmented Generation8 Mar
  33. 2025The RAG Paradox: A Black-Box Attack Exploiting Unintentional Vulnerabilities in Retrieval-Augmented Generation Systems28 Feb
  34. 2025Exploring the Security Threats of Knowledge Base Poisoning in Retrieval-Augmented Code Generation5 Feb
  35. 2025Topic-FlipRAG: Topic-Orientated Adversarial Opinion Manipulation Attacks to Retrieval-Augmented Generation Models3 Feb
  36. 2025Riddle Me This! Stealthy Membership Inference for Retrieval-Augmented Generation1 Feb
  37. 2025FlippedRAG: Black-Box Opinion Manipulation Adversarial Attacks to Retrieval-Augmented Generation Models6 Jan
  38. 2025TrustRAG: Enhancing Robustness and Trustworthiness in Retrieval-Augmented Generation1 Jan

50 newest of 70 All 70 (JSON)

Other references · 29

  1. 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,297
  2. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,443
  3. 2024AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Basescited by 429
  4. 2024Evaluation of Retrieval-Augmented Generation: A Surveycited by 146
  5. 2025Memory Injection Attacks on LLM Agents via Query-Only Interactioncited by 144
  6. 2024A Survey on Large Language Model Acceleration based on KV Cache Managementcited by 131
  7. 2024RAGBench: Explainable Benchmark for Retrieval-Augmented Generation Systemscited by 117
  8. 2024InstructRAG: Instructing Retrieval-Augmented Generation via Self-Synthesized Rationalescited by 101
  9. 2024Trustworthiness in Retrieval-Augmented Generation Systems: A Surveycited by 83
  10. 2024Retrieval-Augmented Generation for Natural Language Processing: A Surveycited by 71
  11. 2024Astute RAG: Overcoming Imperfect Retrieval Augmentation and Knowledge Conflicts for Large Language Modelscited by 58
  12. 2023Why So Gullible? Enhancing the Robustness of Retrieval-Augmented Models against Counterfactual Noisecited by 54
17 more
  1. 2023ReEval: Automatic Hallucination Evaluation for Retrieval-Augmented Large Language Models via Transferable Adversarial Attackscited by 28
  2. 2025Worse than Zero-shot? A Fact-Checking Dataset for Evaluating the Robustness of RAG Against Misleading Retrievalscited by 28
  3. 2025RbFT: Robust Fine-tuning for Retrieval-Augmented Generation against Retrieval Defectscited by 27
  4. 2025Retrieval-Augmented Generation: A Comprehensive Survey of Architectures, Enhancements, and Robustness Frontierscited by 27
  5. 2024Not All Contexts Are Equal: Teaching LLMs Credibility-aware Generationcited by 21
  6. 2024Towards Knowledge Checking in Retrieval-augmented Generation: A Representation Perspectivecited by 20
  7. 2025Retrieval Augmented Generation Evaluation in the Era of Large Language Models: A Comprehensive Surveycited by 20
  8. 2024Unsupervised Information Refinement Training of Large Language Models for Retrieval-Augmented Generationcited by 19
  9. 2024ATM: Adversarial Tuning Multi-agent System Makes a Robust Retrieval-Augmented Generatorcited by 19
  10. 2024Retrieval-Augmented Generation with Estimation of Source Reliabilitycited by 19
  11. 2025SeCon-RAG: A Two-Stage Semantic Filtering and Conflict-Free Framework for Trustworthy RAGcited by 13
  12. 2025AGRAG: Advanced Graph-based Retrieval-Augmented Generation for LLMscited by 7
  13. 2025EmoRAG: Evaluating RAG Robustness to Symbolic Perturbationscited by 3
  14. 2026Query-Efficient Agentic Graph Extraction Attacks on GraphRAG Systemscited by 3
  15. 2026MPIB: A Benchmark for Medical Prompt Injection Attacks and Clinical Safety in LLMscited by 3
  16. 2026Adversarial Intent is a Latent Variable: Stateful Trust Inference for Securing Multimodal Agentic RAGcited by 2
  17. 2026MedPriv-Bench: Benchmarking the Privacy-Utility Trade-off of Large Language Models in Medical Open-Ended Question Answeringcited by 1

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 2.

2 papers.

  1. 2026A Systematic Survey of Security Threats and Defenses in LLM-Based AI Agents: A Layered Attack Surface Frameworkcited by 11
  2. 2026TriShieldRAG: 3 Rings, One Blind Spot in Layered Defenses for Retrieval-Augmented Generationcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Security and Privacy in Retrieval-Augmented Generation: Architectures, Threats, Defenses, and Future Directions for Building Trustworthy Systems
  2. 2024Pirates of the RAG: Adaptively Attacking LLMs to Leak Knowledge Bases
  3. 2026Towards Secure Retrieval-Augmented Generation: A Comprehensive Review of Threats, Defenses and Benchmarks
  4. 2026Retrieved But Not Reliable: A Survey on Attacks, and Defenses in Retrieval-Augmented Generation
  5. 2025SafeRAG: Benchmarking Security in Retrieval-Augmented Generation of Large Language Model
  6. 2026RAG-CT: Mitigating Privacy Risks on Retrieval-Augmented Generation Systems via Scanning Prompt Distribution
  7. 2026Mitigating Database Leakage in RAG Systems with Keyword-Grounded Fact Substitution
  8. 2024HijackRAG: Hijacking Attacks against Retrieval-Augmented Large Language Models