Towards Secure Retrieval-Augmented Generation: A Comprehensive Review of Threats, Defenses and Benchmarks

2026-03-23

AI Summary

This work presents the first end-to-end security survey of Retrieval-Augmented Generation (RAG) systems, addressing critical threats such as data poisoning, adversarial attacks, and membership inference that compromise reliability and privacy due to their multi-module architecture. The study systematically analyzes threat mechanisms across the entire RAG pipeline and establishes a comprehensive taxonomy of defense techniques spanning both input and output stages. It integrates key strategies including dynamic access control, homomorphic encryption for retrieval, adversarial pre-filtering, federated learning-based isolation, differential privacy perturbation, and lightweight data sanitization. Furthermore, the paper introduces a unified RAG security analysis framework incorporating standardized datasets and evaluation benchmarks, moving beyond prior work constrained to isolated vulnerabilities and laying the foundation for robust, trustworthy next-generation RAG systems.

Technology Category

• Natural Language Processing: Safety and Robustness
• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness

Application Category

• Search and Retrieval-Augmented AI: Retrieval-Augmented Generation (RAG) and multi-modal RAG
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Security and Privacy: Data transparency and provenance

Abstract

Retrieval-Augmented Generation (RAG) significantly mitigates the hallucinations and domain knowledge deficiency in large language models by incorporating external knowledge bases. However, the multi-module architecture of RAG introduces complex system-level security vulnerabilities. Guided by the RAG workflow, this paper analyzes the underlying vulnerability mechanisms and systematically categorizes core threat vectors such as data poisoning, adversarial attacks, and membership inference attacks. Based on this threat assessment, we construct a taxonomy of RAG defense technologies from a dual perspective encompassing both input and output stages. The input-side analysis reviews data protection mechanisms including dynamic access control, homomorphic encryption retrieval, and adversarial pre-filtering. The output-side examination summarizes advanced leakage prevention techniques such as federated learning isolation, differential privacy perturbation, and lightweight data sanitization. To establish a unified benchmark for future experimental design, we consolidate authoritative test datasets, security standards, and evaluation frameworks. To the best of our knowledge, this paper presents the first end-to-end survey dedicated to the security of RAG systems. Distinct from existing literature that isolates specific vulnerabilities, we systematically map the entire pipeline-providing a unified analysis of threat models, defense mechanisms, and evaluation benchmarks. By enabling deep insights into potential risks, this work seeks to foster the development of highly robust and trustworthy next-generation RAG systems.

Problem

• Retrieval-Augmented Generation
• security vulnerabilities
• threat models
• data poisoning
• adversarial attacks

Innovation

• Retrieval-Augmented Generation
• Security Threats
• Defense Mechanisms
• Privacy-Preserving Techniques
• Benchmarking Framework