SECURITY AND PRIVACY IN RETRIEVAL-AUGMENTED GENERATION: ARCHITECTURES, THREATS, DEFENSES, AND FUTURE DIRECTIONS FOR BUILDING TRUSTWORTHY SYSTEMS

Overview of RAG Security and Privacy

Retrieval-Augmented Generation (RAG) has become the standard for grounding Large Language Models (LLMs) in external knowledge. While this improves factual accuracy, it shifts the security perimeter from a single model to a complex pipeline involving document indexing, retrieval, and context assembly. This paper provides a comprehensive, deployment-aware analysis of how these systems are attacked and how they can be defended across different architectural paradigms.

Taxonomy of RAG Deployments

The authors categorize RAG systems into four distinct paradigms, each with unique security implications:

• Centralized RAG: The traditional cloud-based model where data and computation are pooled. It is highly efficient but creates a single point of failure and significant privacy risks regarding user queries and sensitive knowledge.
• Micro-RAG (On-Device): Moves retrieval and generation to local hardware. This enhances data sovereignty and offline capability but is severely limited by the memory, compute, and energy constraints of edge devices.
• Federated RAG: Enables collaborative model improvement across multiple clients without sharing raw data. It introduces complex threats like gradient leakage and Byzantine attacks during aggregation.
• Hybrid Edge-Cloud RAG: A flexible approach that partitions tasks between local and cloud resources, requiring careful management of the trust boundary between the two.

Threat Surfaces and Defenses

The paper identifies that the 'context construction' phase—where retrieved documents are packed into the LLM's prompt—is a critical, under-researched vulnerability. Adversaries can exploit this through retrieval poisoning (injecting malicious documents into the knowledge base) or context manipulation (truncating or reordering evidence to bias the model). The authors propose a defense-in-depth strategy that includes query filtering, privacy-aware context assembly, and hardware-assisted isolation (e.g., TEEs) to mitigate these risks.