Survey on Retrieval-Augmented Generation Security Highlights Pipeline Vulnerabilities and Defense Frameworks

Retrieval-Augmented Generation has become a standard architecture for reducing large language model hallucinations by integrating external knowledge sources. However, this architectural shift introduces fresh security and robustness risks that extend beyond conventional model vulnerabilities. A new survey paper published on arXiv, titled "Retrieved But Not Reliable," systematically explores these emerging threat vectors, including corpus poisoning, backdoor attacks, and privacy leakage. The researchers categorize the security landscape into three core attacker objectives: accuracy, privacy, and fairness. By mapping these objectives across the standard retrieval pipeline, the survey provides a unified threat model targeting the corpus database, the vector retriever, and the generator model. This structured approach helps engineers pinpoint exactly where traditional data sanitization fails to protect downstream model outputs. On the defensive front, the survey evaluates countermeasures across four distinct stages: retrieval, reranking, generation, and traceback. Security teams can leverage these findings to design defense-in-depth strategies, such as validating retrieved documents before feeding them to generators or implementing traceback mechanisms to detect poisoned sources. Practitioners should evaluate these defensive patterns against their specific organizational data constraints and operational pipelines before production deployment.