A new arXiv paper, RAGLeak, examines how retrieval-augmented generation (RAG) expands the attack surface for large language models. Because RAG systems pull in external knowledge during inference, they inherit vulnerabilities from the knowledge bases and supply chains they rely on. The authors frame this as a privacy backdoor that can be introduced through those external dependencies.
The abstract notes that existing data extraction attacks are a known concern, but RAGLeak appears to be a distinct vector. Rather than extracting data directly from the model, the attack targets the supply chain of the retrieval component. This shifts the focus to the integrity of the knowledge sources themselves.
The paper's significance lies in drawing attention to a class of attacks that sit at the intersection of model security and supply-chain trust. As RAG becomes more common, securing the external knowledge pipeline is as important as securing the model weights. The authors stop short of providing full details in the abstract, but the framing suggests a new category of privacy risk for deployed RAG systems.