Retrieval-augmented generation (RAG) extends large language models (LLMs) with external knowledge, but this access path also introduces security risks that existing work often conflates with inherent LLM flaws. We frame secure RAG as securing external knowledge access and organize the literature with SLOT, a taxonomy along four axes: the attack Surface (S) where an adversary acts, the defense Layer (L) that controls the same point, the Objective (O) it breaks following the CIA properties, and the Target (T) it pursues, from a single known query (T1) to target-claim manipulation across a query distribution (T2). Mapping attacks, defenses, remediation, and evaluation onto a six-stage knowledge-access pipeline, we expose two structural mismatches. Finally, we discuss directions for more realistic targets, no-blind-spot and adaptively evaluated defenses, stronger confidentiality, and evaluation for multimodal and agentic RAG.
@article{arxiv.2604.08304,
title = {Securing Retrieval-Augmented Generation: A Taxonomy of Attacks, Defenses, and Future Directions},
author = {Yuming Xu and Mingtao Zhang and Zhuohan Ge and Haoyang Li and Nicole Hu and Yongqi Zhang and Zhiyuan Wen and Jason Chen Zhang and Qing Li and Lei Chen},
journal= {arXiv preprint arXiv:2604.08304},
year = {2026}
}