mlsanityData to 7 Oct 2026

Security and Privacy in Retrieval-Augmented Generation: Architectures, Threats, Defenses, and Future Directions for Building Trustworthy Systems

arXiv 2606.25533 ↗First posted 24 Jun 2026cs.CR cs.CLcited by 0

On the map: Retrieval-augmented generation → Privacy and security of RAG

Abstract (arXiv)

Retrieval-Augmented Generation (RAG) has emerged as a dominant paradigm for enhancing large language models with external knowledge. By coupling retrieval mechanisms with generative models, RAG systems improve factual grounding and adaptability across domains. However, integrating retrieval pipelines introduces new security and privacy risks that extend beyond conventional language modeling threats. Sensitive information may be exposed through retrieval indices, query logs, context construction, or federated updates, while adversarial manipulation of knowledge bases can undermine trust in generated outputs. This survey provides a comprehensive examination of privacy and security challenges across RAG systems deployed in centralized, on-device (Micro-RAG), federated, and hybrid paradigms. We present a unified taxonomy of threat surfaces spanning the retrieval, context construction, and generation stages and systematically analyze attack classes, including membership inference, index inference, poisoning, gradient leakage, and collusion. We further review architectural, algorithmic, and cryptographic defenses, highlighting privacy-utility trade-offs and deployment considerations. Finally, we outline open research challenges toward building trustworthy, secure, and resilient RAG systems for real-world applications.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 69 of its 129 references that are in the map. First posted on arXiv 24 Jun 2026.

Builds on

69 of 129 references.

Closest ancestors · 16

Same direction, newest first

  1. 2025Retrieval-Augmented Defense: Adaptive and Controllable Jailbreak Prevention for Large Language Models22 Aug
  2. 2025DeRAG: Black-box Adversarial Attacks on Multiple Retrieval-Augmented Generation Applications via Prompt Injection20 Jul
  3. 2025The Hidden Threat in Plain Text: Attacking RAG Data Loaders7 Jul
  4. 2025Traceback of Poisoning Attacks to Retrieval-Augmented Generation30 Apr
  5. 2025RAG LLMs are Not Safer: A Safety Analysis of Retrieval-Augmented Generation for Large Language Models25 Apr
  6. 2025Practical Poisoning Attacks against Retrieval-Augmented Generation4 Apr
  7. 2025SafeRAG: Benchmarking Security in Retrieval-Augmented Generation of Large Language Model28 Jan
  8. 2025FlippedRAG: Black-Box Opinion Manipulation Adversarial Attacks to Retrieval-Augmented Generation Models6 Jan
  9. 2024RAG with Differential Privacy26 Dec
  10. 2024Towards More Robust Retrieval-Augmented Generation: Evaluating RAG Under Adversarial Poisoning Attacks21 Dec
  11. 2024RemoteRAG: A Privacy-Preserving LLM Cloud RAG Service17 Dec
  12. 2024Mask-based Membership Inference Attacks for Retrieval-Augmented Generation26 Oct
4 more
  1. 2024Backdoored Retrievers for Prompt Injection Attacks on Retrieval Augmented Generation of Large Language Models18 Oct
  2. 2024BadRAG: Identifying Vulnerabilities in Retrieval Augmented Generation of Large Language Models3 Jun
  3. 2024The Good and The Bad: Exploring Privacy Issues in Retrieval-Augmented Generation (RAG)23 Feb
  4. 2024PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models12 Feb

Other references · 53

  1. 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,592
  2. 2018HotpotQA: A Dataset for Diverse, Explainable Multi-hop Question Answeringcited by 3,686
  3. 2023Lost in the Middle: How Language Models Use Long Contextscited by 3,383
  4. 2017TriviaQA: A Large Scale Distantly Supervised Challenge Dataset for Reading Comprehensioncited by 2,895
  5. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  6. 2019Federated Learning: Challenges, Methods, and Future Directionscited by 1,531
  7. 2020What Disease does this Patient Have? A Large-scale Open Domain Question Answering Dataset from Medical Examscited by 1,324
  8. 2019PubMedQA: A Dataset for Biomedical Research Question Answeringcited by 1,271
  9. 2020Making Pre-trained Language Models Better Few-shot Learnerscited by 1,255
  10. 2022When Not to Trust Language Models: Investigating Effectiveness of Parametric and Non-Parametric Memoriescited by 1,103
  11. 2023Large Language Models Can Be Easily Distracted by Irrelevant Contextcited by 820
  12. 2018LEAF: A Benchmark for Federated Settingscited by 780
38 more
  1. 2023A Comprehensive Overview of Large Language Modelscited by 639
  2. 2024A Survey on RAG Meeting LLMs: Towards Retrieval-Augmented Large Language Modelscited by 450
  3. 2023LegalBench: A Collaboratively Built Benchmark for Measuring Legal Reasoning in Large Language Modelscited by 328
  4. 2023ChatDoctor: A Medical Chat Model Fine-Tuned on a Large Language Model Meta-AI (LLaMA) Using Medical Domain Knowledgecited by 324
  5. 2024Alignment faking in large language modelscited by 316
  6. 2024Knowledge Conflicts for LLMs: A Surveycited by 274
  7. 2021Federated Learning for Internet of Things: A Comprehensive Surveycited by 247
  8. 2020Information Leakage in Embedding Modelscited by 199
  9. 2024PrivacyLens: Evaluating Privacy Norm Awareness of Language Models in Actioncited by 161
  10. 2024A Comprehensive Survey of Small Language Models in the Era of Large Language Models: Techniques, Enhancements, Applications, Collaboration with LLMs, and Trustworthinesscited by 125
  11. 2024CRAG -- Comprehensive RAG Benchmarkcited by 94
  12. 2024Enhancing Noise Robustness of Retrieval-Augmented Language Models with Adaptive Adversarial Trainingcited by 88
  13. 2024Summary of a Haystack: A Challenge to Long-Context LLMs and RAG Systemscited by 87
  14. 2024A Review of Prominent Paradigms for LLM-Based Agents: Tool Use (Including RAG), Planning, and Feedback Learningcited by 74
  15. 2025Agentic AI: A Comprehensive Survey of Architectures, Applications, and Future Directionscited by 46
  16. 2024A Survey of Small Language Modelscited by 31
  17. 2023Black-box Adversarial Attacks against Dense Retrieval Models: A Multi-view Contrastive Learning Methodcited by 29
  18. 2025Towards Trustworthy Retrieval Augmented Generation for Large Language Models: A Surveycited by 29
  19. 2022Privacy-Preserving Aggregation in Federated Learning: A Surveycited by 25
  20. 2024Open-RAG: Enhanced Retrieval-Augmented Reasoning with Open-Source Large Language Modelscited by 25
  21. 2021FedMatch: Federated Learning Over Heterogeneous Question Answering Datacited by 23
  22. 2024Shaping the Safety Boundaries: Understanding and Defending Against Jailbreaks in Large Language Modelscited by 23
  23. 2025Visual Contextual Attack: Jailbreaking MLLMs with Image-Driven Context Injectioncited by 23
  24. 2022Trustworthy Recommender Systemscited by 21
  25. 2024Large Language Models for Constructing and Optimizing Machine Learning Workflows: A Surveycited by 19
  26. 2025Graph-based Approaches and Functionalities in Retrieval-Augmented Generation: A Comprehensive Surveycited by 18
  27. 2025A Systematic Literature Review of Retrieval-Augmented Generation: Techniques, Metrics, and Challengescited by 16
  28. 2024Robust Neural Information Retrieval: An Adversarial and Out-of-distribution Perspectivecited by 15
  29. 2024MeMemo: On-device Retrieval Augmentation for Private and Personalized Text Generationcited by 12
  30. 2025Federated Retrieval Augmented Generation for Multi-Product Question Answeringcited by 10
  31. 2017LatentPoison - Adversarial Attacks On The Latent Spacecited by 9
  32. 2025Deep Learning Model Inversion Attacks and Defenses: A Comprehensive Surveycited by 9
  33. 2024Know Your RAG: Dataset Taxonomy and Generation Strategies for Evaluating RAG Systemscited by 8
  34. 2024Inference Scaling for Bridging Retrieval and Augmented Generationcited by 7
  35. 2023Don't forget private retrieval: distributed private similarity search for large language modelscited by 5
  36. 2025Federated Retrieval-Augmented Generation: A Systematic Mapping Studycited by 5
  37. 2024Federated Learning and RAG Integration: A Scalable Approach for Medical Large Language Modelscited by 4
  38. 2025FedRAG: A Framework for Fine-Tuning Retrieval-Augmented Generation Systemscited by 4

50 most cited of 53 All 53 (JSON)

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026Towards Secure Retrieval-Augmented Generation: A Comprehensive Review of Threats, Defenses and Benchmarks
  2. 2025RAG Security and Privacy: Formalizing the Threat Model and Attack Surface
  3. 2026Securing Retrieval-Augmented Generation: A Taxonomy of Attacks, Defenses, and Future Directions
  4. 2026Retrieved But Not Reliable: A Survey on Attacks, and Defenses in Retrieval-Augmented Generation
  5. 2026SoK: Privacy Risks and Mitigations in Retrieval-Augmented Generation Systems
  6. 2026RAG-CT: Mitigating Privacy Risks on Retrieval-Augmented Generation Systems via Scanning Prompt Distribution
  7. 2025Privacy-Aware RAG: Secure and Isolated Knowledge Retrieval
  8. 2024Pirates of the RAG: Adaptively Attacking LLMs to Leak Knowledge Bases