Protection Is Not One Event: A Survey of RAG Protection Research by Measured Endpoint

Summary

This survey codes 118 RAG defense papers by the endpoint each one measures, using a seven-family taxonomy with double-coded annotations (kappa=0.867). It finds that most studies measure corpus-use detection rather than content disclosure, and that most evaluations use general QA datasets and non-adaptive attacks. In the authors' testbed, a normalized 8-gram guard reduced 20-token copying to 0.0%, yet a three-query adaptive attacker still recovered 48.3% of hidden facts on Qwen3-8B.

Topics

• Retrieval-augmented generation

Related items

• InfoAfterDeleteBench: Auditing Post-Deletion Information Persistence in LLM AgentsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoEnterprise Agentic RAG with Pre-Search Role-Based Access Control, Multi-Layered Guardrails, and Operational TelemetrySimilar attack · OpenAlex (peer-reviewed AI security)
• LowAgent Mosaic: Recognizing Confidentiality Leaks in Agentic LLM SystemsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• Medium“Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime ActivitiesSimilar attack · Palo Alto Unit 42
• MediumCVE-2026-114054: vLLM cache aliasing lets attackers collide shared cache keysSimilar attack · NVD/CVE Database