Securing Retrieval-Augmented Generation: A Taxonomy of Attacks, Defenses, and Future Directions

Referee: [RAG workflow abstraction and trust boundaries section] The section describing the RAG workflow abstraction into six stages and the organization under three trust boundaries and four security surfaces: the paper does not articulate explicit inclusion criteria or a repeatable derivation process for these categories, which is load-bearing for the central claim that the taxonomy separates RAG-introduced threats from LLM flaws without significant omission or overlap.

Authors: We appreciate this observation. The six workflow stages are derived by decomposing the canonical RAG pipeline (query encoding, retrieval, context augmentation, generation, post-processing, and output) as established in foundational RAG literature, with each stage mapped to points where external knowledge crosses into the LLM. The three trust boundaries are defined operationally as the interfaces separating the untrusted external knowledge store, the retrieval mechanism, and the LLM generation process. The four security surfaces emerge directly from these boundaries by identifying where RAG-specific threats (as opposed to inherent LLM vulnerabilities) can be introduced or amplified: pre-retrieval corruption of the knowledge base, retrieval-time manipulation of access or ranking, post-retrieval context exploitation within the prompt, and post-generation exfiltration of sensitive retrieved content. While the manuscript presents the resulting taxonomy, it does not include an explicit subsection detailing this derivation process or inclusion criteria. We will add such a subsection in the revision, including a table that enumerates each category with its derivation rationale and explicit criteria for assigning attacks and defenses, thereby making the separation of RAG-introduced threats repeatable and transparent. revision: partial

Referee: [Survey of defenses section] The section surveying defenses and remediation mechanisms: the claim that defenses 'remain largely reactive and fragmented' is central to the call for future directions, yet it rests on a qualitative synthesis without stated criteria for classifying a defense as reactive versus proactive or for quantifying fragmentation (e.g., no enumeration of defense types or overlap metrics).

Authors: The referee correctly identifies that our assessment of defenses as 'largely reactive and fragmented' is a qualitative synthesis drawn from reviewing the literature across the four security surfaces. Reactive defenses are those that detect or mitigate threats after they have manifested (e.g., output filtering or anomaly detection on generated responses), while proactive ones intervene at the trust boundaries before threats propagate (e.g., knowledge sanitization or retrieval-time access controls). Fragmentation is evidenced by the concentration of existing work on isolated surfaces without cross-boundary integration. We acknowledge that the manuscript does not provide explicit classification criteria or quantitative metrics such as overlap counts. In the revised version, we will add a dedicated table that enumerates all reviewed defense categories with their assigned classification (reactive/proactive), the security surface they address, and a brief note on observed overlaps or gaps. This will make the synthesis more rigorous while preserving the central observation that motivates the future directions toward layered protections. revision: partial