Search papers, labs, and topics across Lattice.
This paper surveys the security and privacy challenges inherent in Retrieval-Augmented Generation (RAG) systems, which enhance large language models by integrating external knowledge. It identifies a unified taxonomy of threat surfaces across various deployment paradigms, including centralized, on-device, federated, and hybrid models, while systematically analyzing attack classes such as membership inference and gradient leakage. The authors also review potential defenses and highlight critical trade-offs, paving the way for more trustworthy RAG systems in practical applications.
RAG systems may expose sensitive information through various attack vectors, challenging the trustworthiness of AI-generated outputs.
Retrieval-Augmented Generation (RAG) has emerged as a dominant paradigm for enhancing large language models with external knowledge. By coupling retrieval mechanisms with generative models, RAG systems improve factual grounding and adaptability across domains. However, integrating retrieval pipelines introduces new security and privacy risks that extend beyond conventional language modeling threats. Sensitive information may be exposed through retrieval indices, query logs, context construction, or federated updates, while adversarial manipulation of knowledge bases can undermine trust in generated outputs. This survey provides a comprehensive examination of privacy and security challenges across RAG systems deployed in centralized, on-device (Micro-RAG), federated, and hybrid paradigms. We present a unified taxonomy of threat surfaces spanning the retrieval, context construction, and generation stages and systematically analyze attack classes, including membership inference, index inference, poisoning, gradient leakage, and collusion. We further review architectural, algorithmic, and cryptographic defenses, highlighting privacy-utility trade-offs and deployment considerations. Finally, we outline open research challenges toward building trustworthy, secure, and resilient RAG systems for real-world applications.
