PaperlayerView exact revision on arXiv

Source-linked AI summary

A Security Meta-Model for Retrieval-Augmented Generation Systems

Steve Nouyep, Sébastien Salva, Maxime Puys

arXiv:2610.11893v1cs.CR

TL;DR

RAG’s multiple pipeline stages create distinct attack surfaces, while existing security work leaves engineers without a structured, deployment-aware way to connect threats and impacts. The paper derives a causal security meta-model and catalog from 43 publications, then uses the catalog to expose configuration-specific risks and cross-cutting research patterns.

  • Problem

    RAG exposes multiple pipeline stages as distinct attack surfaces, while the literature lacks a structured model linking those stages to weaknesses, attacks, risks, and CIA impact across deployment configurations.

    Source: §1 · p. 1, §2.1 · p. 4

  • Method

    The authors analyze 43 publications to derive a security meta-model and instantiate a catalog linking RAG components, attacks, weaknesses, risks, mitigations, and CIA impact.

    Source: §1 · p. 2, §4 · p. 8

  • Results

    Aggregating 43 publications reveals cross-cutting patterns, including imbalance between attack- and defense-focused research and gaps in documented mitigations and output-integrity coverage.

    Source: §1 · p. 2, §6.2 · p. 17, §6.5 · p. 19

  • Takeaways & Limitations

    The visualizer lets stakeholders filter risks by deployment context and reach relevant information through causal chains and role-specific views.

    Source: §6.1 · p. 17

    Completeness is limited to the documented threat landscape, with publication bias, coarse CWE coverage, and unknown threats constraining what the literature-based catalog captures.

    Source: §6.4 · p. 19

Abstract

from arXiv · show

Retrieval-Augmented Generation (RAG) systems extend large language models (LLMs) with external knowledge through a multi-stage pipeline. While this architecture can improve the factual grounding of generated answers, it introduces structural attack surfaces that extend beyond those of standalone LLMs. In this paper, we introduce a security meta-model that captures explicit causal relationships between RAG surfaces, attacks, weaknesses, risks, and CIA impact (Confidentiality, Integrity, Availability). Its purpose is to provide security engineers with a structured and user-friendly framework for gathering and assessing the risks, weaknesses, and mitigations relevant to their RAG deployment. We designed the meta-model through an iterative, structured analysis of 43~publications (2023--2026) and instantiated it as a catalog populated with the security threats and remediations reported in the literature. Filtering the catalog according to a deployment configuration produces a risk profile containing the risks applicable to that deployment. An interactive web visualizer lets users navigate the catalog as a graph, follow causal chains, and explore stakeholder-specific views. Analysis of the catalog revealed a persistent imbalance between attack-focused and defense-focused research, a concentration of threats at ingestion, and coverage gaps affecting output integrity. Coverage is assessed against the OWASP LLM Top~10, and operational applicability is illustrated across textual, graph-based, and multimodal RAG configurations.

1 Introduction

RAG’s multiple pipeline stages create distinct attack surfaces, while existing security work leaves engineers with fragmented guidance and limited deployment-specific structure. The paper proposes a causal security meta-model and catalog, derived from literature analysis, to support configuration-specific risk assessment and stakeholder exploration.

1 Introduction

  • Existing RAG security work often treats threats, mitigations, and risks in isolation, making context-appropriate solutions difficult for security engineers to identify.The paper calls for a structured approach linking pipeline components to weaknesses, attacks, risks, and CIA impact, adaptable to deployment configurations.Source: §1 · p. 2
  • The proposed meta-model links RAG components, attacks, weaknesses, risks, and CIA impact, and is instantiated as a catalog spanning 3 RAG types, 8 surfaces, 38 attacks, 12 weaknesses, 41 risks, and 72 mitigations.The catalog supports configuration-dependent risk filtering, four stakeholder views, and an interactive graph visualizer that can validate drafted attacks against integration rules.Source: §1 · p. 2
  • The meta-model and catalog were derived through structured analysis of 43 publications, which also revealed a systematic imbalance between attack- and defense-focused research.The catalog integrates security data from the publications and supplies the basis for the stakeholder views.Source: §1 · p. 2

2 Background and Related Work

The background frames RAG security around pipeline-specific trust boundaries and reviews existing threat-modeling foundations and security frameworks. It positions the paper’s structured, deployment-aware model against prior work and summarizes empirical findings motivating broader security analysis.

2.1 RAG System Architecture and Analysis

  • The security-oriented pipeline decomposition has 11 modules and 8 attack surfaces, with conditional graph and multimodal components and optional memory and orchestration surfaces.Attacker-controlled documents may persist after entering through document acquisition, and retrieved corpus content enters the LLM prompt, providing the structural basis for indirect prompt injection.Source: §2.1 · pp. 3–4

2.2 Threat Modeling Foundations

  • The paper adopts ISO/IEC risk terminology and models risk as the combined effect of a threat exploiting a vulnerability and impacting an asset.CAPEC and CWE provide attack-pattern and weakness vocabularies, while NIST SP 800-30 supplies a threat-to-impact causal-chain anchor.Source: §2.2 · p. 5

2.3 RAG and LLM Security Frameworks

  • Prior RAG and LLM security frameworks have narrower scope or operational support; this work combines structural causal modeling, CWE/CAPEC traceability, deployment filtering, and all three CIA dimensions.The comparison covers ten criteria spanning scope, modeling depth, and operational support.Source: §2.3 · pp. 5–6

2.4 Broader Systematizations and Empirical Studies

  • Experiments find RAG increases unsafe outputs in 8 of 11 models, even from safe documents [3], while poisoning [30] and benign-looking-query knowledge extraction [28] make integrity and confidentiality practically exploitable.Access model, underlying LLM, and data provenance affect severity, but their interplay has not been systematically studied.Source: §2.4 · p. 7

3 Corpus Construction and Scope

The corpus was assembled through structured searches and selection for RAG-specific security work with enough technical detail to identify pipeline surfaces and CIA impacts. Its 43 publications support both meta-model derivation and catalog population.

3 Corpus Construction and Scope

  • The structured literature analysis sought structural representativeness for deriving a coherent meta-model, rather than exhaustiveness as a formal systematic review.Searches covered Google Scholar, IEEE Xplore, and arXiv; six arXiv queries returned 67 results before deduplication.Source: §3 · p. 7
  • After deduplication and backward snowballing, studies were included when they described a RAG-specific attack or defense with enough detail to identify its pipeline surface and CIA impact.Work on LLM security without retrieval or RAG quality without a security dimension was excluded.Source: §3 · p. 8
  • The retained corpus comprises 43 publications: 31 attack-focused (72%), 9 defense-focused (21%), and 3 frameworks (7%).The corpus is used to derive the meta-model structure and populate its catalog.Source: §3 · p. 8

4 The RAG Security Meta-Model

The section defines a literature-derived RAG security meta-model linking pipeline surfaces to attacks, weaknesses, risks, mitigations, and CIA impact. It instantiates this structure as a catalog populated with security data from the literature.

4 The RAG Security Meta-Model

  • The meta-model defines M=(E, R, C) over entity types and directed relations, with constraints ensuring attacks, weaknesses, and risks connect architecture to security impact.Its seven entity types are RAG, Surface, Attack, Weakness, Risk, Mitigation, and CIA.Source: §4 · pp. 8–9

4.1 Iterative Construction of the Meta-Model

  • Iterative derivation refined indexing trust boundaries, conditional surfaces, mitigation relations, and deployment properties; structural saturation followed examination of the first 35 publications.The remaining eight publications confirmed existing categories without adding entity or relation types.Source: §4.1 · p. 9

4.2 RAG Types and Modules

  • RAG types split only when they introduce new risks: Naive, Advanced, and Modular variants are grouped as TEXTUAL, while graph and multimodal components add distinct attack risks.The stated exclusive risks are graph poisoning and cross-modal attacks.Source: §4.2 · p. 10, Table 2 · p. 10

4.3 Causal chain

  • The seven entity types form a causal chain from exposed surfaces through attacks, weaknesses, and risks to CIA impact; mitigations mitigate risks and may also remediate weaknesses.Only preventive mitigations carry both mitigates and remediates relations; detective and reactive mitigations carry only mitigates.Source: §4.3 · p. 10

4.4 Security Data Integration and Catalog

  • Eight integration rules construct links from documented evidence; preventive mitigations also remediate weaknesses, while detective and reactive measures mitigate risks only.Links carry traceability tags, and mitigations without supporting evidence remain unlinked to risks.Source: §4.4 · pp. 10–11
  • The catalog contains 3 RAG categories, 8 surfaces, 38 attacks, 12 weaknesses, 41 risks, 72 mitigations, and 3 CIA dimensions; poisoning (16) is largest, followed by exfiltration (11).Poisoning accounts for 42% of attacks, followed by exfiltration at 29%.Source: §4.4 · p. 11

5 Views Related to Context and Role

The catalog is made navigable through an interactive graph, deployment-context filtering, and stakeholder-specific projections. These views help users focus on applicable risks and role-relevant information without traversing the full catalog.

5.1 The Interactive Web Visualizer

  • The visualizer renders the catalog as a navigable graph, allowing users to follow surface-to-CIA chains, switch stakeholder views, filter risks, and draft attacks checked against integration rules.Risk labels update as deployment configurations change.Source: §5.1 · p. 13

5.2 Views Related to Context

  • Six deployment properties determine risk applicability; filtering labels risks as eliminated, mitigated, aggravated, or normal, while added-surface risks enter as normal unless another rule applies.The filtering rules are extensible without changing the procedure or meta-model schema.Source: §5.2 · pp. 13–14
  • In a multimodal e-commerce example, 40 of 41 risks remain applicable; cloud hosting aggravates three confidentiality risks, while only the graph-specific poisoning risk is eliminated.The example illustrates differentiation among risks rather than broad risk elimination.Source: §5.2 · pp. 14–15

5.3 Views Related to Role

  • CORPUS accounts for 20 of 41 risks, while OUTPUT has the highest mitigation gap at 25%, with 3 of 12 risks lacking mitigation.The DPO view projects risk and mitigation by target asset to support GDPR Data Protection Impact Assessments.Source: §5.3 · p. 16

6 Discussion

The discussion assesses catalog coverage and consistency, then identifies imbalances and gaps in the documented threat landscape. It presents role-based use cases while noting limits in corpus completeness and empirical validation.

6.1 Quality Assessment

  • Seven OWASP LLM Top 10 entries are fully covered, two partially covered, and Unbounded Consumption falls outside the RAG-specific scope.Declarative integration rules produce links deterministically for fixed extracted entities and evidence; practitioner validation remains future work.Source: §6.1 · pp. 16–17

6.2 Cross-Cutting Observations

  • 31 of 43 publications (72%) are attack papers versus 9 defense papers (21%); many proposed mitigations lack systematic evaluation, and some have been bypassed.Examples include perplexity-based detectors bypassed by adaptive attacks [16] and similarity filtering bypassed by reformulated queries [7].Source: §6.2 · p. 17
  • 16 of 38 attacks (42%) target S-DOC, including 14 poisoning attacks; trusted internal sources contextually mitigate four poisoning risks, whereas open ingestion alone mitigates none of the 16 attacks.Poisoning can persist in the corpus until detected or removed, leaving open-ingestion configurations particularly exposed to integrity threats.Source: §6.2 · p. 18
  • OUTPUT has the highest mitigation-gap ratio at 25%: R34, R35, and R36 have no incoming mitigation edge, and two CORPUS risks also lack documented mitigations.The authors suggest publication bias or limits of the available corpus may help explain the output-integrity gap.Source: §6.2 · p. 18, Table 9 · p. 18

6.3 Practitioner Use Cases

  • The four stakeholder views support decisions at design, operations, security assessment, and data-protection stages, including configuration-specific risk prioritization and per-asset assessments.The visualizer supports these tasks, but whether its views effectively support practitioners remains an empirical question.Source: §6.3 · p. 18

6.4 Limitations and Threats to Validity

  • The catalog is complete only relative to documented threats; publication bias, coarse CWE coverage, unknown threats, unmodeled attack combinations, and single-coder judgment constrain its scope.It covers three RAG types but has not been validated on production deployments, and inter-coder agreement was not formally measured.Source: §6.4 · p. 19

6.5 Perspectives

  • The authors prioritize closing five coverage gaps, re-evaluating mitigations lacking validation against adaptive adversaries, and empirically assessing the model and views with practitioners.The proposed user study would have practitioners answer their role-specific questions on a real deployment.Source: §6.5 · p. 19

7 Conclusion

The paper presents a structurally specified RAG security meta-model and an instantiated catalog that links architecture to CIA impact. It highlights deployment filtering and stakeholder views alongside persistent output-integrity gaps and proposed validation work.

7 Conclusion

  • The meta-model links RAG architecture to CIA impact through a causal chain, maps RAG-specific threats to CWE/CAPEC identifiers, and applies deployment-aware risk filtering.Eight declarative integration rules constrain how literature-derived data enters the catalog.Source: §7 · pp. 19–20
  • Filtering, stakeholder-specific taxonomic views, and structural constraints support configuration-specific risk profiles, role-relevant navigation, and consistency as the catalog grows.Cross-cutting analysis identifies persistent output-integrity under-protection and the need to re-evaluate proposed defenses.Source: §7 · p. 20
  • The authors identify closing five coverage gaps, re-evaluating unvalidated mitigations, and validating the model on production deployments with practitioner evaluation as future work.The work systematizes publicly documented attacks and develops no new exploit.Source: §7 · p. 20

Supplementary Material

The supplementary material is optional and provides a full-catalog overview and additional discussion-referenced tables.

Supplementary Material

  • The supplementary material contains a full-catalog overview and additional tables cited in the discussion; reviewers are not required to read it.Source: Supplementary Material · p. 22

A Full Catalog Overview

The catalog view brings together RAG types, security concepts, CIA dimensions, mitigations, and their relations. The visualizer also marks coverage gaps, configuration-aggravated risks, and risks that do not apply to the default configuration.

A Full Catalog Overview

  • The complete catalog view contains 3 RAG types, 8 surfaces, 38 attacks, 12 weaknesses, 41 risks, 3 CIA dimensions, and 72 mitigations.It renders all their relations in one view.Source: A Full Catalog Overview · p. 22
  • Long node names are truncated in the view; full names, descriptions, and sources are available interactively and in zoomable vector exports.The exports are provided in the supplementary material.Source: A Full Catalog Overview · p. 22
  • The visualizer arranges the causal chain as RAG type → Surface → Attack → Weakness / Risk → CIA, with mitigations linked to the risks they mitigate.“!” marks a risk without mitigation, “↑” marks a risk aggravated by the default configuration, and dashed styling marks risks not applicable to it.Source: Figure 4 · p. 23

B Additional Tables

The additional tables address candidate segmentation criteria and persistent coverage gaps; the supplied passages provide their titles but not their contents.

B Additional Tables

  • Table 10 concerns the discriminant power of candidate segmentation criteria.The supplied passage gives the table title only.Source: Table 10 · p. 24
  • The two additional tables cover segmentation criteria and persistent coverage gaps, respectively.Their captions do not provide the underlying findings.Source: Table 10 · p. 24, Table 11 · p. 24
  • Table 11 is titled “Persistent coverage gaps.”The supplied passage gives no further table content.Source: Table 11 · p. 24
Loading 2610.11893v1…