Retrieval-augmented generation

The paper introduces a security meta-model for Retrieval-Augmented Generation (RAG) systems that links RAG surfaces, attacks, weaknesses, risks, and CIA impact. Built from an iterative analysis of 43 publications from 2023 to 2026, it is instantiated as a catalog that filters into a deployment-specific risk profile. The authors report an imbalance between attack-focused and defense-focused research, a concentration of threats at ingestion, and coverage gaps affecting output integrity.

A practical pen-testing guide for generative AI, LLM and RAG applications argues that the security question has shifted from whether a model says something it should not to whether manipulated language can reach protected data or trigger unauthorized business actions. It recommends starting with an architecture walk-through that maps prompts, retrieval, tools, identities and logging, then treating prompt injection as a multi-turn campaign rather than a single-phrase test.

This survey reviews trustworthiness in Retrieval Augmented Generation (RAG) for large language models. The source text provided is limited to the bibliographic line (ACM Computing Surveys, Volume 58, Issue 15, Pages 1-36, November 2026) and does not include the article body, so no findings or methods can be reported.

DP2-RAG is a framework that adds end-to-end differential privacy to Retrieval-Augmented Generation, covering both the retrieval stage and the generation stage. It introduces Noise-Aware Retrieval with Correction (NARC), which enforces chunk-level DP with calibrated noise and ranking-bias correction, and the Dual Utility-Exponent Mechanism (DUEM), which provides token-level DP for generated surrogates. Evaluated on six benchmarks, it reduces privacy leakage by over 15% relative to strong baselines while keeping near-baseline Top-k retrieval accuracy.

This paper formalizes external data extraction attacks (EDEAs) against retrieval-augmented LLMs (RA-LLMs), where sensitive or copyrighted knowledge-base data can be extracted verbatim. The authors propose a framework built from extraction instruction, jailbreak operator, and retrieval trigger, and implement an attack called Secret. Across 4 models, including 3 commercial LLMs, Secret outperforms prior attacks and succeeds against all 16 tested RAG instances, extracting 35% of the data from RAG powered by Claude 3.7 Sonnet where other attacks yield 0%.

Researchers present the first backdoor attacks against graph-based Retrieval-Augmented Generation (RAG) systems used with LLMs. The attacker poisons a crafted corpus in the external database so that trigger entities are inserted into the knowledge graph, causing the model to give attacker-chosen answers only for trigger-containing queries while answering other queries correctly. The authors evaluate three trigger types (word-level, topic-level and semantic-level) with increasing stealth across multiple knowledge databases and language models, and warn of risks to chatbots and agents built on such systems.

ParaVul is a framework that combines parallel LLM fine-tuning with retrieval-augmented generation to detect smart contract vulnerabilities more accurately than static analysis and formal verification. It introduces Sparse Low-Rank Adaptation (SLoRA), which inserts parallel sparse and low-rank branches after the attention projection and feed-forward block, and a hybrid RAG system combining Okapi BM25 with dense retrieval. Simulation results report F1 scores of 0.9398 for single-label and 0.9930 for multi-label detection.