Security and Privacy in Retrieval-Augmented Generation: Architectures, Threats, Defenses, and Future Directions for Building Trustworthy Systems
Source published ·Modelwire updated
Original coverage: arXiv cs.CL ↗·How Modelwire adds context
The development
A comprehensive survey maps the expanding attack surface of retrieval-augmented generation systems across centralized, federated, and edge deployments. As RAG becomes the standard production pattern for grounding LLMs with external knowledge, the paper catalogs novel threat vectors emerging from retrieval indices, query logs, and knowledge base poisoning that fall outside traditional language model security frameworks. The work signals that production RAG deployments now require threat modeling distinct from base model risks, reshaping how teams architect trustworthy systems at scale.
Modelwire’s AI-generated summary of coverage from arXiv cs.CL.
Modelwire analysis
Analyst takeOur AI-generated reading of the wider context and the next developments to watch.
The survey's most consequential framing is that RAG-specific threats, particularly knowledge base poisoning and query log exposure, don't map cleanly onto existing LLM red-teaming playbooks, meaning teams that have invested in base model security are not covered and face a distinct compliance and engineering gap.
The federated RAG threat surface connects directly to coverage of TL++ (from the same day), which addressed privacy leakage in distributed training through secret-shared activations. That work assumed the training pipeline as the attack surface; this survey extends the concern downstream to inference-time retrieval indices and knowledge bases, suggesting the security perimeter in federated ML deployments is wider than either paper treats in isolation. The MedGuards multi-agent safety work is also relevant here: compositional guardrails designed for output correction don't address poisoned retrieval inputs upstream, a gap this survey makes explicit.
Watch whether major cloud RAG providers (AWS Bedrock, Azure AI Search, Google Vertex) publish updated threat models or compliance documentation within the next two quarters that specifically address retrieval-layer attack vectors. Adoption of this survey's taxonomy by a major provider would confirm the field is moving from academic cataloging to enforceable production standards.
This interpretation is generated from the summary above and the archive coverage cited below. Our methodology · Report an error
Coverage behind this analysis
These archive entries ground the connection in our analysis. They are ordered by source publication date, with links to our coverage and the original sources.
·arXiv cs.LG
TL++: Accuracy and Privacy Preserving Traversal Learning for Distributed Intelligent Systems
TL++ addresses a critical bottleneck in federated learning: how to train across fragmented data without exposing raw information or requiring expensive full-model synchronization. The framework reconstructs centralized gradient behavior through virtual batching while offering a secure mode that secret-shares intermediate activations, reducing both communication overhead and privacy leakage. This matters because production ML systems increasingly…
MentionsRetrieval-Augmented Generation · Large Language Models · Federated Learning · Micro-RAG
How this coverage is produced
Modelwire uses AI to generate summaries and context from source headlines, snippets, and selected archive coverage. Automated checks do not verify every claim, and items are not routinely reviewed by a person before publication. Zacaria Solis operates the site. Read the linked source for the full evidence and report errors through our corrections process.
Modelwire summarizes, we don’t republish. The full content lives on arxiv.org. If you’re a publisher and want a different summarization policy for your work, see our takedown page.