Survey on Retrieval-Augmented Generation Security Highlights Pipeline Vulnerabilities and Defense Frameworks
A new research survey published on arXiv details the expanding threat landscape of Retrieval-Augmented Generation pipelines, analyzing attacks like corpus poisoning and privacy leakage. It provides a structured overview of defense mechanisms across the retrieval, reranking, generation, and traceback stages.
Retrieval-Augmented Generation has become a standard architecture for reducing large language model hallucinations by integrating external knowledge sources. However, this architectural shift introduces fresh security and robustness risks that extend beyond conventional model vulnerabilities. A new survey paper published on arXiv, titled "Retrieved But Not Reliable," systematically explores these emerging threat vectors, including corpus poisoning, backdoor attacks, and privacy leakage. The researchers categorize the security landscape into three core attacker objectives: accuracy, privacy, and fairness. By mapping these objectives across the standard retrieval pipeline, the survey provides a unified threat model targeting the corpus database, the vector retriever, and the generator model. This structured approach helps engineers pinpoint exactly where traditional data sanitization fails to protect downstream model outputs. On the defensive front, the survey evaluates countermeasures across four distinct stages: retrieval, reranking, generation, and traceback. Security teams can leverage these findings to design defense-in-depth strategies, such as validating retrieved documents before feeding them to generators or implementing traceback mechanisms to detect poisoned sources. Practitioners should evaluate these defensive patterns against their specific organizational data constraints and operational pipelines before production deployment.
Primary source
Open arXiv ↗This article summarizes the source. Check the original for full details and conditions.
Action Checklist
- Audit and sanitize all data ingestion sources Prevent corpus poisoning by verifying the integrity of raw documents before they are embedded into the vector database.
- Implement validation checks during the retrieval stage Filter out low-confidence or potentially adversarial retrieval results prior to the reranking and generation phases.
- Treat retrieved chunks as untrusted inputs inside the generator prompt Apply prompt-injection defenses and output-filtering techniques on the generation layer.
- Establish a traceback and lineage auditing system Maintain detailed mappings of which source documents contributed to specific model outputs to trace security anomalies.
- Benchmark pipeline robustness against known RAG attack models Utilize existing security benchmarks to simulate corpus poisoning and privacy leakage attacks in staging environments.
