mlsanityData to 7 Oct 2026

Retrieved But Not Reliable: A Survey on Attacks, and Defenses in Retrieval-Augmented Generation

arXiv 2608.24977 ↗First posted 25 Aug 2026cs.CR cs.CL cs.LGcited by 0

On the map: Retrieval-augmented generation → Privacy and security of RAG

Abstract (arXiv)

Retrieval-Augmented Generation (RAG) enhances large language models by grounding outputs in external knowledge, improving factuality and reducing hallucinations. At the same time, the retrieval-augmented pipeline introduces new robustness and security risks, including corpus poisoning, backdoor attacks, privacy leakage, and fairness violations. Despite rapid progress in this area, existing surveys remain limited in their treatment of attacker objectives, threat models, and stage-specific defenses across the full RAG pipeline. This survey presents a unified and pipeline-aware overview of RAG robustness. We formalize threat models over the corpus, retriever, and generator, and organize attacks into three main objectives: accuracy, privacy, and fairness. We further review defenses from a pipeline-aware perspective, covering the retrieval, rerank, generation, and traceback stages. In addition, we summarize robustness benchmarks and explainability methods for more deeply evaluating and explaining RAG robustness.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 85 of its 130 references that are in the map. First posted on arXiv 25 Aug 2026.

Builds on

85 of 130 references.

Closest ancestors · 34

Same direction, newest first

  1. 2025Rescuing the Unpoisoned: Efficient Defense against Knowledge Corruption Attacks on RAG Systems3 Nov
  2. 2025Secure Retrieval-Augmented Generation against Poisoning Attacks28 Oct
  3. 2025ADMIT: Few-shot Knowledge Poisoning Attacks on RAG-based Fact Checking11 Oct
  4. 2025RIPRAG: Hack a Black-box Retrieval-Augmented Generation Question-Answering System with Reinforcement Learning11 Oct
  5. 2025ReliabilityRAG: Effective and Provably Robust Defense for RAG-based Web-Search27 Sep
  6. 2025Your RAG is Unfair: Exposing Fairness Vulnerabilities in Retrieval-Augmented Generation via Backdoor Attacks26 Sep
  7. 2025AIP: Subverting Retrieval-Augmented Generation via Adversarial Instructional Prompt18 Sep
  8. 2025AttnTrace: Contextual Attribution of Prompt Injection and Knowledge Corruption5 Aug
  9. 2025Token-Level Precise Attack on RAG: Searching for the Best Alternatives to Mislead Generation5 Aug
  10. 2025Fine-Grained Privacy Extraction from Retrieval-Augmented Generation Systems via Knowledge Asymmetry Exploitation31 Jul
  11. 2025Safeguarding RAG Pipelines with GMTP: A Gradient-based Masked Token Probability Method for Poisoned Document Detection24 Jul
  12. 2025Joint-GCG: Unified Gradient-Based Poisoning Attacks on Retrieval-Augmented Generation Systems6 Jun
22 more
  1. 2025Through the Stealth Lens: Attention-Aware Defenses Against Poisoning in RAG4 Jun
  2. 2025The Silent Saboteur: Imperceptible Adversarial Attacks against Black-Box Retrieval-Augmented Generation Systems24 May
  3. 2025Uncovering Competing Poisoning Attacks in Retrieval-Augmented Generation18 May
  4. 2025One Shot Dominance: Knowledge Poisoning Attack on Retrieval-Augmented Generation Systems15 May
  5. 2025GRADA: Graph-based Reranking against Adversarial Documents Attack12 May
  6. 2025Hoist with His Own Petard: Inducing Guardrails to Facilitate Denial-of-Service Attacks on Retrieval-Augmented Generation of LLMs30 Apr
  7. 2025PR-Attack: Coordinated Prompt-RAG Attacks on Retrieval-Augmented Generation in Large Language Models via Bilevel Optimization10 Apr
  8. 2025Tricking Retrievers with Influential Tokens: An Efficient Black-Box Corpus Poisoning Attack27 Mar
  9. 2025The RAG Paradox: A Black-Box Attack Exploiting Unintentional Vulnerabilities in Retrieval-Augmented Generation Systems28 Feb
  10. 2025MM-PoisonRAG: Disrupting Multimodal RAG with Local and Global Poisoning Attacks25 Feb
  11. 2025Topic-FlipRAG: Topic-Orientated Adversarial Opinion Manipulation Attacks to Retrieval-Augmented Generation Models3 Feb
  12. 2024RevPRAG: Revealing Poisoning Attacks in Retrieval-Augmented Generation through LLM Activation Analysis28 Nov
  13. 2024Feedback-Guided Extraction of Knowledge Base from Retrieval-Augmented LLM Applications21 Nov
  14. 2024Data Extraction Attacks in Retrieval-Augmented Generation via Backdoors3 Nov
  15. 2024On the Vulnerability of Applying Retrieval-Augmented Generation within Knowledge-Intensive Application Domains12 Sep
  16. 2024"Glue pizza and eat rocks" -- Exploiting Vulnerabilities in Retrieval-Augmented Generative Models26 Jun
  17. 2024Corpus Poisoning via Approximate Greedy Gradient Descent7 Jun
  18. 2024Get my drift? Catching LLM Task Drift with Activation Deltas2 Jun
  19. 2024Phantom: General Backdoor Attacks on Retrieval Augmented Language Generation30 May
  20. 2024Typos that Broke the RAG's Back: Genetic Attack on RAG Pipeline by Simulating Documents in the Wild via Low-level Perturbations22 Apr
  21. 2024Follow My Instruction and Spill the Beans: Scalable Data Extraction from Retrieval-Augmented Generation Systems27 Feb
  22. 2024The Good and The Bad: Exploring Privacy Issues in Retrieval-Augmented Generation (RAG)23 Feb

Other references · 51

  1. 2020Language Models are Few-Shot Learnerscited by 32,199
  2. 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,160
  3. 2021Evaluating Large Language Models Trained on Codecited by 8,053
  4. 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 7,916
  5. 2016SQuAD: 100,000+ Questions for Machine Comprehension of Textcited by 4,115
  6. 2018HotpotQA: A Dataset for Diverse, Explainable Multi-hop Question Answeringcited by 3,686
  7. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  8. 2023Self-RAG: Learning to Retrieve, Generate, and Critique through Self-Reflectioncited by 1,800
  9. 2024From Local to Global: A Graph RAG Approach to Query-Focused Summarizationcited by 1,411
  10. 2021Improving language models by retrieving from trillions of tokenscited by 1,278
  11. 2022Interleaving Retrieval with Chain-of-Thought Reasoning for Knowledge-Intensive Multi-Step Questionscited by 911
  12. 2022Ignore Previous Prompt: Attack Techniques For Language Modelscited by 760
38 more
  1. 2022Precise Zero-Shot Dense Retrieval without Relevance Labelscited by 508
  2. 2023Detecting Language Model Attacks with Perplexitycited by 411
  3. 2020RocketQA: An Optimized Training Approach to Dense Passage Retrieval for Open-Domain Question Answeringcited by 410
  4. 2024AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Basescited by 402
  5. 2023Making Retrieval-Augmented Language Models Robust to Irrelevant Contextcited by 364
  6. 2025Agentic Retrieval-Augmented Generation: A Survey on Agentic RAGcited by 242
  7. 2022MuRAG: Multimodal Retrieval-Augmented Generator for Open Question Answering over Images and Textcited by 216
  8. 2025Prompt Injection Attack to Tool Selection in LLM Agentscited by 145
  9. 2025Memory Injection Attacks on LLM Agents via Query-Only Interactioncited by 127
  10. 2024InstructRAG: Instructing Retrieval-Augmented Generation via Self-Synthesized Rationalescited by 100
  11. 2025PromptArmor: Simple yet Effective Prompt Injection Defensescited by 98
  12. 2024ContextCite: Attributing Model Generation to Contextcited by 93
  13. 2024Enhancing Noise Robustness of Retrieval-Augmented Language Models with Adaptive Adversarial Trainingcited by 88
  14. 2024Neural Exec: Learning (and Learning from) Execution Triggers for Prompt Injection Attackscited by 78
  15. 2023Why So Gullible? Enhancing the Robustness of Retrieval-Augmented Models against Counterfactual Noisecited by 52
  16. 2024Blinded by Generated Contexts: How Language Models Merge Generated and Retrieved Contexts When Knowledge Conflicts?cited by 47
  17. 2025RbFT: Robust Fine-tuning for Retrieval-Augmented Generation against Retrieval Defectscited by 27
  18. 2024Does RAG Introduce Unfairness in LLMs? Evaluating Fairness in Retrieval-Augmented Generation Systemscited by 26
  19. 2024To Trust or Not to Trust? Enhancing Large Language Models' Situated Faithfulness to External Contextscited by 25
  20. 2024Retrieval-Augmented Generation with Estimation of Source Reliabilitycited by 19
  21. 2025Hard Negatives, Hard Lessons: Revisiting Training Data Quality for Robust Information Retrieval with LLMscited by 17
  22. 2024Adversarial Decoding: Generating Readable Documents for Adversarial Objectivescited by 16
  23. 2025Collapse of Dense Retrievers: Short, Early, and Literal Biases Outranking Factual Evidencecited by 16
  24. 2024Ward: Provable RAG Dataset Inference via LLM Watermarkscited by 15
  25. 2024Analysing the Residual Stream of Language Models Under Knowledge Conflictscited by 15
  26. 2025PIShield: Detecting Prompt Injection Attacks via Intrinsic LLM Featurescited by 13
  27. 2025SeCon-RAG: A Two-Stage Semantic Filtering and Conflict-Free Framework for Trustworthy RAGcited by 12
  28. 2025TracLLM: A Generic Framework for Attributing Long Context LLMscited by 11
  29. 2025Spa-VLM: Stealthy Poisoning Attacks on RAG-based VLMcited by 10
  30. 2025Scalable Defense against In-the-wild Jailbreaking Attacks with Safety Context Retrievalcited by 7
  31. 2023Typo-Robust Representation Learning for Dense Retrievalcited by 6
  32. 2025Rethinking All Evidence: Enhancing Trustworthy Retrieval-Augmented Generation via Conflict-Driven Summarizationcited by 6
  33. 2024A Curious Case of Searching for the Correlation between Training Data and Adversarial Robustness of Transformer Textual Modelscited by 5
  34. 2025Illusions of Relevance: Arbitrary Content Injection Attacks Deceive Retrievers, Rerankers, and LLM Judgescited by 5
  35. 2025After Retrieval, Before Generation: Enhancing the Trustworthiness of Large Language Models in Retrieval-Augmented Generationcited by 3
  36. 2025EmoRAG: Evaluating RAG Robustness to Symbolic Perturbationscited by 3
  37. 2026URAG: A Benchmark for Uncertainty Quantification in Retrieval-Augmented Large Language Modelscited by 3
  38. 2024Does Vec2Text Pose a New Corpus Poisoning Threat?cited by 2

50 most cited of 51 All 51 (JSON)

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2025RAGPart & RAGMask: Retrieval-Stage Defenses Against Corpus Poisoning in Retrieval-Augmented Generation
  2. 2026Security and Privacy in Retrieval-Augmented Generation: Architectures, Threats, Defenses, and Future Directions for Building Trustworthy Systems
  3. 2025RAG Security and Privacy: Formalizing the Threat Model and Attack Surface
  4. 2026Towards Secure Retrieval-Augmented Generation: A Comprehensive Review of Threats, Defenses and Benchmarks
  5. 2026Securing Retrieval-Augmented Generation: A Taxonomy of Attacks, Defenses, and Future Directions
  6. 2025SafeRAG: Benchmarking Security in Retrieval-Augmented Generation of Large Language Model
  7. 2026PRA-RAG: Provably Robust Aggregation in Retrieval-Augmented Generation against Retrieval Corruption
  8. 2024Backdoored Retrievers for Prompt Injection Attacks on Retrieval Augmented Generation of Large Language Models