Security framework maps risks and defenses in retrieval-augmented ai systems
A Security Meta-Model for Retrieval-Augmented Generation Systems
Cryptography and Security
Summary
Retrieval-augmented generation (RAG) systems combine big language models and external data to give more accurate answers, but this setup can create new vulnerabilities. The authors created a detailed framework that shows how weaknesses and attacks relate in these systems, helping engineers understand where risks arise and how they affect system security. They gathered known threats and defenses from many papers into an organized catalog, which users can filter to see threats relevant to their setup. This work highlights areas where more security research is needed, especially for protecting the system output's correctness.
What this means in practice
- •For security engineers: Create a tailored risk profile for your retrieval-augmented system by filtering known threats and mitigations specific to your deployment.
- •For ai platform operators: Use the interactive visual tool to understand causal attack paths and identify critical defenses in complex ai systems combining models and external data.
A survey. It maps existing work.
Authors
Steve Nouyep, Sébastien Salva, Maxime Puys
Abstract
Retrieval-Augmented Generation (RAG) systems extend large language models (LLMs) with external knowledge through a multi-stage pipeline. While this architecture can improve the factual grounding of generated answers, it introduces structural attack surfaces that extend beyond those of standalone LLMs. In this paper, we introduce a security meta-model that captures explicit causal relationships between RAG surfaces, attacks, weaknesses, risks, and CIA impact (Confidentiality, Integrity, Availability). Its purpose is to provide security engineers with a structured and user-friendly framework for gathering and assessing the risks, weaknesses, and mitigations relevant to their RAG deployment. We designed the meta-model through an iterative, structured analysis of 43~publications (2023--2026) and instantiated it as a catalog populated with the security threats and remediations reported in the literature. Filtering the catalog according to a deployment configuration produces a risk profile containing the risks applicable to that deployment. An interactive web visualizer lets users navigate the catalog as a graph, follow causal chains, and explore stakeholder-specific views. Analysis of the catalog revealed a persistent imbalance between attack-focused and defense-focused research, a concentration of threats at ingestion, and coverage gaps affecting output integrity. Coverage is assessed against the OWASP LLM Top~10, and operational applicability is illustrated across textual, graph-based, and multimodal RAG configurations.