Security, Privacy, and Trustworthy Design for Retrieval-Augmented Generation Systems
Year: 2026
Type: article
Abstract: Retrieval-augmented generation (RAG) lets a language model draw on an external knowledge store. Factual coverage improves, but the system also gains security and privacy boundaries that a stand-alone model does not have: a malicious or unauthorized document can shape what is retrieved, enter the model context, over-ride instructions, disclose sensitive information, or trigger an external action. This structured narrative review synthesizes RAG attacks, defenses, threat models, and evaluation practices in work published between 2020 and September 2026. The evidence is grouped by pipeline stage, from ingestion, chunking, and embedding through retrieval, vector storage, context assembly, generation, output, and tool execution. Four findings stand out. First, poisoning, extraction, membership inference, and indirect prompt injection are distinct but composable threats. Second, attack success often falls when realistic chunking, re-ranking, corpus redundancy, and permissions are introduced, while adaptive evaluation can expose residual weaknesses in defenses. Third, credible security requires layered controls spanning provenance, access control, retrieval-time anomaly detection, context isolation, output monitoring, and tool permissions. Fourth, current benchmarks rarely evaluate authorization state, multi-tenant isolation, cache invalidation, deployment cost, or external actions. The review contributes a RAG security reference architecture, an attack-defense matrix, and a reporting framework for deployment-aware evaluation.
Source: Electronics
Author: Abdulrahman Abdullah Alghamdi
Institution: Shaqra University
Language: English
Subfield: Artificial Intelligence
Field: Computer Science
Domain: Physical Sciences
Open Access status: gold
Estimated APC paid: $2,896
OpenAlex ID: W7225828080
FWCI:
Cites:
Cited by:
Related to: