Search papers, labs, and topics across Lattice.
This paper formalizes the security risks introduced by retrieval-augmented generation (RAG) systems, arguing that secure RAG is fundamentally about securing the external knowledge-access pipeline. It abstracts the RAG workflow into six stages, organizing attacks and defenses around three trust boundaries and four security surfaces: pre-retrieval knowledge corruption, retrieval-time access manipulation, downstream context exploitation, and knowledge exfiltration. The authors find that current defenses are reactive and fragmented, and propose future research directions toward layered, boundary-aware protection.
RAG introduces a whole new attack surface beyond inherent LLM vulnerabilities, and current defenses are woefully inadequate.
Retrieval-augmented generation (RAG) significantly enhances large language models (LLMs) but introduces novel security risks through external knowledge access. While existing studies cover various RAG vulnerabilities, they often conflate inherent LLM risks with those specifically introduced by RAG. In this paper, we propose that secure RAG is fundamentally about the security of the external knowledge-access pipeline. We establish an operational boundary to separate inherent LLM flaws from RAG-introduced or RAG-amplified threats. Guided by this perspective, we abstract the RAG workflow into six stages and organize the literature around three trust boundaries and four primary security surfaces, including pre-retrieval knowledge corruption, retrieval-time access manipulation, downstream context exploitation, and knowledge exfiltration. By systematically reviewing the corresponding attacks, defenses, remediation mechanisms, and evaluation benchmarks, we reveal that current defenses remain largely reactive and fragmented. Finally, we discuss these gaps and highlight future directions toward layered, boundary-aware protection across the entire knowledge-access lifecycle.
