mlsanityData to 7 Oct 2026

Privacy and security of RAG

378 papers1 this weekHigh confidence in this grouping: the papers form one clear topicHigh confidence in this grouping: the papers form one clear topic · About

Keywords: rag, attacks, attack, generation, poisoning

Key facts. Privacy and security of RAG: 378 papers on arXiv since 2023 (data through 7 Oct 2026). 84 of its 378 mapped papers (22%) cite “PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models” (2024, arXiv 2402.07867). 80 of its 378 mapped papers (21%) cite “The Good and The Bad: Exploring Privacy Issues in Retrieval-Augmented Generation (RAG)” (2024, arXiv 2402.16893). 10 new papers 17 Sep–7 Oct.

What’s new

17 Sep – 7 Oct 2026

10 new papers, 17 Sep – 7 Oct; 1 this week.

  1. This week · 1
  2. RAG-PIBench: A Leakage-Aware Benchmark for Prompt-Injection Detection in Trustworthy RAG Systems
  3. Earlier · 9
  4. Walking the Embedding Space: Datastore Extraction from Multimodal RAG
  5. PILLAR: Private Inverted-Index Lexical Lookup for Augmented Retrieval
  6. Retrieve, Reproduce, Reveal: Dissecting Retrieval-Augmented Software Vulnerability Detection also fits: RAG for code
  7. Quantization Enables Private Dense Retrieval against Malicious Service Providers
  8. Backdoor in the Loop: Compromising Agentic Search via Malicious Retrievers
  9. Only Pay What You Must Spend: On-Demand Privacy Budget Payment for Differentially Private RAG
  10. Divide and Doubt: Diverse Distributed Poisoning for Retrieval-Augmented Generation
  11. RAG-NAROK: Retrieval-Aware Knowledge Corpus Poisoning in RAG with Source-specific Refutation
  12. Micro-Collaborative Poisoning: A Distributed Attack on RAG Systems

Foundations

Most cited by papers here

  1. PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models2024cited by 84 here
  2. The Good and The Bad: Exploring Privacy Issues in Retrieval-Augmented Generation (RAG)2024cited by 80 here
  3. Certifiably Robust RAG against Retrieval Corruption2024cited by 60 here
  4. Machine Against the RAG: Jamming Retrieval-Augmented Generation with Blocker Documents2024cited by 58 here
  5. Typos that Broke the RAG's Back: Genetic Attack on RAG Pipeline by Simulating Documents in the Wild via Low-level Perturbations2024cited by 44 here

Lineage

The papers this direction builds on, oldest first.

Each paper on the line cites the one before.

  1. 2020REALM: Retrieval-Augmented Language Model Pre-Trainingcited by 53 here
  2. 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 253 here
  3. 2023REPLUG: Retrieval-Augmented Black-Box Language Modelscited by 27 here
  4. 2023In-Context Retrieval-Augmented Language Modelscited by 32 here
  5. 2023Self-RAG: Learning to Retrieve, Generate, and Critique through Self-Reflectioncited by 47 here
  6. 2023Retrieval-Augmented Generation for Large Language Models: A Surveycited by 61 here
  7. 2024The Good and The Bad: Exploring Privacy Issues in Retrieval-Augmented Generation (RAG)cited by 80 here
  8. 2024BadRAG: Identifying Vulnerabilities in Retrieval Augmented Generation of Large Language Modelscited by 41 here
  9. 2024Machine Against the RAG: Jamming Retrieval-Augmented Generation with Blocker Documentscited by 58 here
  10. 2025Practical Poisoning Attacks against Retrieval-Augmented Generationcited by 26 here
14 more it builds on, not in this chain
  1. 2024PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Modelscited by 84 here
  2. 2024Follow My Instruction and Spill the Beans: Scalable Data Extraction from Retrieval-Augmented Generation Systemscited by 40 here
  3. 2024Typos that Broke the RAG's Back: Genetic Attack on RAG Pipeline by Simulating Documents in the Wild via Low-level Perturbationscited by 44 here
  4. 2024From Local to Global: A Graph RAG Approach to Query-Focused Summarizationcited by 23 here
  5. 2024A Survey on RAG Meeting LLMs: Towards Retrieval-Augmented Large Language Modelscited by 36 here
  6. 2024TrojanRAG: Retrieval-Augmented Generation Can Be Backdoor Driver in Large Language Modelscited by 29 here
  7. 2024Certifiably Robust RAG against Retrieval Corruptioncited by 60 here
  8. 2024Is My Data in Your Retrieval Database? Membership Inference Attacks Against Retrieval Augmented Generationcited by 27 here
  9. 2024Phantom: General Backdoor Attacks on Retrieval Augmented Language Generationcited by 27 here
  10. 2024Mitigating the Privacy Issues in Retrieval-Augmented Generation (RAG) via Pure Synthetic Datacited by 32 here
  11. 2024"Glue pizza and eat rocks" -- Exploiting Vulnerabilities in Retrieval-Augmented Generative Modelscited by 42 here
  12. 2024Privacy-Preserving Retrieval-Augmented Generation with Differential Privacycited by 23 here
  13. 2025TrustRAG: Enhancing Robustness and Trustworthiness in Retrieval-Augmented Generationcited by 25 here
  14. 2025Topic-FlipRAG: Topic-Orientated Adversarial Opinion Manipulation Attacks to Retrieval-Augmented Generation Modelscited by 23 here

The 24 most cited of 565.

Browse

30 of 378, ranked 6–35

  1. 6"Glue pizza and eat rocks" -- Exploiting Vulnerabilities in Retrieval-Augmented Generative Models202442
  2. 7BadRAG: Identifying Vulnerabilities in Retrieval Augmented Generation of Large Language Models202441
  3. 8Follow My Instruction and Spill the Beans: Scalable Data Extraction from Retrieval-Augmented Generation Systems202440
  4. 9Mitigating the Privacy Issues in Retrieval-Augmented Generation (RAG) via Pure Synthetic Data202432
  5. 10TrojanRAG: Retrieval-Augmented Generation Can Be Backdoor Driver in Large Language Models202429
  6. 11Is My Data in Your Retrieval Database? Membership Inference Attacks Against Retrieval Augmented Generation202427
  7. 12Phantom: General Backdoor Attacks on Retrieval Augmented Language Generation202427
  8. 13Practical Poisoning Attacks against Retrieval-Augmented Generation202526
  9. 14TrustRAG: Enhancing Robustness and Trustworthiness in Retrieval-Augmented Generation202525
  10. 15Topic-FlipRAG: Topic-Orientated Adversarial Opinion Manipulation Attacks to Retrieval-Augmented Generation Models202523
All 30
  1. 16Privacy-Preserving Retrieval-Augmented Generation with Differential Privacy202423
  2. 17Mask-based Membership Inference Attacks for Retrieval-Augmented Generation202422
  3. 18Feedback-Guided Extraction of Knowledge Base from Retrieval-Augmented LLM Applications202421
  4. 19FlippedRAG: Black-Box Opinion Manipulation Adversarial Attacks to Retrieval-Augmented Generation Models202519
  5. 20PR-Attack: Coordinated Prompt-RAG Attacks on Retrieval-Augmented Generation in Large Language Models via Bilevel Optimization202519
  6. 21One Shot Dominance: Knowledge Poisoning Attack on Retrieval-Augmented Generation Systems202519
  7. 22Pandora: Jailbreak GPTs by Retrieval Augmented Generation Poisoning202419
  8. 23Generating Is Believing: Membership Inference Attacks against Retrieval-Augmented Generation202419
  9. 24HijackRAG: Hijacking Attacks against Retrieval-Augmented Large Language Models202419
  10. 25Riddle Me This! Stealthy Membership Inference for Retrieval-Augmented Generation202518
  11. 26RevPRAG: Revealing Poisoning Attacks in Retrieval-Augmented Generation through LLM Activation Analysis202418
  12. 27Traceback of Poisoning Attacks to Retrieval-Augmented Generation202517
  13. 28MM-PoisonRAG: Disrupting Multimodal RAG with Local and Global Poisoning Attacks202515
  14. 29RAG with Differential Privacy202415
  15. 30SafeRAG: Benchmarking Security in Retrieval-Augmented Generation of Large Language Model202514
  16. 31ReliabilityRAG: Effective and Provably Robust Defense for RAG-based Web-Search202514
  17. 32Secure Retrieval-Augmented Generation against Poisoning Attacks202513
  18. 33Data Extraction Attacks in Retrieval-Augmented Generation via Backdoors202413
  19. 34RemoteRAG: A Privacy-Preserving LLM Cloud RAG Service202413
  20. 35The RAG Paradox: A Black-Box Attack Exploiting Unintentional Vulnerabilities in Retrieval-Augmented Generation Systems202512