Retrieved But Not Reliable: A Survey on Attacks, and Defenses in Retrieval-Augmented Generation
cs.CR, cs.CL, cs.LG
Submitted: 2026-08-25
Updated: 2026-08-27
Comments: 24 pages, 6 figures. Accepted to Findings of the Association for Computational Linguistics: EMNLP 2026. Peer-reviewed through ACL Rolling Review (ARR)
Code: https://github.com/coutMinh/A-Survey-on-RAG-Robustness
License: http://creativecommons.org/licenses/by/4.0/
The gist: Retrieval-Augmented Generation (RAG) enhances large language models by grounding outputs in external knowledge, improving factuality and reducing hallucinations.
Terminology
Abstract
Retrieval-Augmented Generation (RAG) enhances large language models by grounding outputs in external knowledge, improving factuality and reducing hallucinations. At the same time, the retrieval-augmented pipeline introduces new robustness and security risks, including corpus poisoning, backdoor attacks, privacy leakage, and fairness violations. Despite rapid progress in this area, existing surveys remain limited in their treatment of attacker objectives, threat models, and stage-specific defenses across the full RAG pipeline. This survey presents a unified and pipeline-aware overview of RAG robustness. We formalize threat models over the corpus, retriever, and generator, and organize attacks into three main objectives: accuracy, privacy, and fairness. We further review defenses from a pipeline-aware perspective, covering the retrieval, rerank, generation, and traceback stages. In addition, we summarize robustness benchmarks and explainability methods for more deeply evaluating and explaining RAG robustness.
Sources
- Do Multimodal RAG Systems Leak Data? A Comprehensive Evaluation of Membership Inference and Image Caption Retrieval Attacks
- Detecting Language Model Attacks with Perplexity
- What External Knowledge is Preferred by LLMs? Characterizing and Exploring Chain of Evidence in Imperfect Context for Multi-Hop QA
- Rethinking All Evidence: Enhancing Trustworthy Retrieval-Augmented Generation via Conflict-Driven Summarization
- Uncovering Competing Poisoning Attacks in Retrieval-Augmented Generation
- Evaluating Large Language Models Trained on Code
- Scalable Defense against In-the-wild Jailbreaking Attacks with Safety Context Retrieval
- Eyes-on-Me: Scalable RAG Poisoning through Transferable Attention-Steering Attractors
- Fine-Grained Privacy Extraction from Retrieval-Augmented Generation Systems via Knowledge Asymmetry Exploitation
- Black-Box Opinion Manipulation Attacks to Retrieval-Augmented Generation of Large Language Models
- TrojanRAG: Retrieval-Augmented Generation Can Be Backdoor Driver in Large Language Models
- Secure Retrieval-Augmented Generation against Poisoning Attacks
- Recent Advances in Attack and Defense Approaches of Large Language Models
- After Retrieval, Before Generation: Enhancing the Trustworthiness of Large Language Models in Retrieval-Augmented Generation
- From Local to Global: A Graph RAG Approach to Query-Focused Summarization
- Collapse of Dense Retrievers: Short, Early, and Literal Biases Outranking Factual Evidence
- UniC-RAG: Universal Knowledge Corruption Attacks to Retrieval-Augmented Generation
- Topic-FlipRAG: Topic-Orientated Adversarial Opinion Manipulation Attacks to Retrieval-Augmented Generation Models
- MM-PoisonRAG: Disrupting Multimodal RAG with Local and Global Poisoning Attacks
- RAGRank: Using PageRank to Counter Poisoning in CTI LLM Pipelines
Related papers
- SoK: AI-Augmented Binary Reversing
- Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
- Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
- Estimating the Social Cost of Corporate Data Breaches
- Efficient Fuzzy PSI under One-Sided Assumptions
- Sealing the Audit-Runtime Gap for LLM Skills