# Privacy and security of RAG

Area: [Retrieval-augmented generation](https://mlsanity.com/rag/index.md). HTML: https://mlsanity.com/rag/privacy-and-security-of-rag/

## Key facts

- Privacy and security of RAG: 378 papers on arXiv since 2023 (data through 14 Oct 2026).
- 84 of its 378 mapped papers (22%) cite “PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models” (2024, arXiv 2402.07867).
- 80 of its 378 mapped papers (21%) cite “The Good and The Bad: Exploring Privacy Issues in Retrieval-Augmented Generation (RAG)” (2024, arXiv 2402.16893).
- 12 new papers 17 Sep–14 Oct.

## Most cited here

- [PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models](https://mlsanity.com/paper/2402.07867/) (2024), cited by 84 papers here
- [The Good and The Bad: Exploring Privacy Issues in Retrieval-Augmented Generation (RAG)](https://mlsanity.com/paper/2402.16893/) (2024), cited by 80 papers here
- [Certifiably Robust RAG against Retrieval Corruption](https://mlsanity.com/paper/2405.15556/) (2024), cited by 60 papers here
- [Machine Against the RAG: Jamming Retrieval-Augmented Generation with Blocker Documents](https://mlsanity.com/paper/2406.05870/) (2024), cited by 58 papers here
- [Typos that Broke the RAG's Back: Genetic Attack on RAG Pipeline by Simulating Documents in the Wild via Low-level Perturbations](https://mlsanity.com/paper/2404.13948/) (2024), cited by 44 papers here
- ["Glue pizza and eat rocks" -- Exploiting Vulnerabilities in Retrieval-Augmented Generative Models](https://mlsanity.com/paper/2406.19417/) (2024), cited by 42 papers here
- [BadRAG: Identifying Vulnerabilities in Retrieval Augmented Generation of Large Language Models](https://mlsanity.com/paper/2406.00083/) (2024), cited by 41 papers here
- [Follow My Instruction and Spill the Beans: Scalable Data Extraction from Retrieval-Augmented Generation Systems](https://mlsanity.com/paper/2402.17840/) (2024), cited by 40 papers here
- [Mitigating the Privacy Issues in Retrieval-Augmented Generation (RAG) via Pure Synthetic Data](https://mlsanity.com/paper/2406.14773/) (2024), cited by 32 papers here
- [TrojanRAG: Retrieval-Augmented Generation Can Be Backdoor Driver in Large Language Models](https://mlsanity.com/paper/2405.13401/) (2024), cited by 29 papers here

## New (17 Sep–14 Oct)

- [GraphRAG-LTM: A Layered Threat Modeling Framework for Attacks on Graph Retrieval-Augmented Generation](https://mlsanity.com/paper/2610.19549/) (2026-10-14)
- [MemeLogos: Knowledge-Driven Retrieval-Augmented Reasoning for Harmful Meme Detection](https://mlsanity.com/paper/2610.15463/) (2026-10-11)
- [RAG-PIBench: A Leakage-Aware Benchmark for Prompt-Injection Detection in Trustworthy RAG Systems](https://mlsanity.com/paper/2610.08571/) (2026-10-06)
- [Walking the Embedding Space: Datastore Extraction from Multimodal RAG](https://mlsanity.com/paper/2610.01871/) (2026-10-01)
- [PILLAR: Private Inverted-Index Lexical Lookup for Augmented Retrieval](https://mlsanity.com/paper/2609.36326/) (2026-09-30)
- [Retrieve, Reproduce, Reveal: Dissecting Retrieval-Augmented Software Vulnerability Detection](https://mlsanity.com/paper/2609.37669/) (2026-09-29)
- [Quantization Enables Private Dense Retrieval against Malicious Service Providers](https://mlsanity.com/paper/2609.36376/) (2026-09-28)
- [Backdoor in the Loop: Compromising Agentic Search via Malicious Retrievers](https://mlsanity.com/paper/2609.37468/) (2026-09-26)
- [Only Pay What You Must Spend: On-Demand Privacy Budget Payment for Differentially Private RAG](https://mlsanity.com/paper/2609.27406/) (2026-09-23)
- [Divide and Doubt: Diverse Distributed Poisoning for Retrieval-Augmented Generation](https://mlsanity.com/paper/2609.27090/) (2026-09-22)
- [RAG-NAROK: Retrieval-Aware Knowledge Corpus Poisoning in RAG with Source-specific Refutation](https://mlsanity.com/paper/2609.25469/) (2026-09-21)
- [Micro-Collaborative Poisoning: A Distributed Attack on RAG Systems](https://mlsanity.com/paper/2609.21573/) (2026-09-18)