Benchmarking Knowledge-Extraction Attack and Defense on Retrieval-Augmented Generation

2026-02-10

AI Summary

This work addresses the vulnerability of Retrieval-Augmented Generation (RAG) systems to knowledge extraction attacks, which can lead to the leakage of sensitive knowledge base contents and compromise intellectual property and privacy. To tackle this issue, the authors establish the first systematic benchmark for evaluating both attacks and defenses in RAG systems. The benchmark integrates diverse attack strategies, defense mechanisms, mainstream embedding models, and both open- and closed-source generators within a unified and reproducible framework, enabling standardized assessment. By consolidating previously fragmented research efforts, this benchmark provides a comparable and reliable foundation for evaluating privacy-preserving RAG systems and offers practical design guidance to advance the development of secure RAG technologies.

Technology Category

• Data Mining & Knowledge Management: Conversational Systems for Recommendation & Retrieval
• Computer Vision: Adversarial Attacks & Robustness
• Natural Language Processing: Safety and Robustness

Application Category

• Search and Retrieval-Augmented AI: Retrieval-Augmented Generation (RAG) and multi-modal RAG
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Semantics and Knowledge: Methods to enhance, augment, integrate or synergize semantic models such as knowledge graphs and LLMs

Abstract

Retrieval-Augmented Generation (RAG) has become a cornerstone of knowledge-intensive applications, including enterprise chatbots, healthcare assistants, and agentic memory management. However, recent studies show that knowledge-extraction attacks can recover sensitive knowledge-base content through maliciously crafted queries, raising serious concerns about intellectual property theft and privacy leakage. While prior work has explored individual attack and defense techniques, the research landscape remains fragmented, spanning heterogeneous retrieval embeddings, diverse generation models, and evaluations based on non-standardized metrics and inconsistent datasets. To address this gap, we introduce the first systematic benchmark for knowledge-extraction attacks on RAG systems. Our benchmark covers a broad spectrum of attack and defense strategies, representative retrieval embedding models, and both open- and closed-source generators, all evaluated under a unified experimental framework with standardized protocols across multiple datasets. By consolidating the experimental landscape and enabling reproducible, comparable evaluation, this benchmark provides actionable insights and a practical foundation for developing privacy-preserving RAG systems in the face of emerging knowledge extraction threats. Our code is available here.

Problem

• Retrieval-Augmented Generation
• knowledge-extraction attack
• benchmark
• privacy leakage
• defense

Innovation

• Retrieval-Augmented Generation
• knowledge-extraction attack
• systematic benchmark
• privacy-preserving RAG
• standardized evaluation