Security, Privacy, and Trustworthy Design for Retrieval-Augmented Generation Systems

Retrieval-augmented generation (RAG) lets a language model draw on an external knowledge store. Factual coverage improves, but the system also gains security and privacy boundaries that a stand-alone model does not have: a malicious or unauthorized document can shape what is retrieved, enter the model context, over-ride instructions, disclose sensitive information, or trigger an external action. This structured narrative review synthesizes RAG attacks, defenses, threat models, and evaluation practices in work published between 2020 and September 2026. The evidence is grouped by pipeline stage, from ingestion, chunking, and embedding through retrieval, vector storage, context assembly, generation, output, and tool execution. Four findings stand out. First, poisoning, extraction, membership inference, and indirect prompt injection are distinct but composable threats. Second, attack success often falls when realistic chunking, re-ranking, corpus redundancy, and permissions are introduced, while adaptive evaluation can expose residual weaknesses in defenses. Third, credible security requires layered controls spanning provenance, access control, retrieval-time anomaly detection, context isolation, output monitoring, and tool permissions. Fourth, current benchmarks rarely evaluate authorization state, multi-tenant isolation, cache invalidation, deployment cost, or external actions. The review contributes a RAG security reference architecture, an attack-defense matrix, and a reporting framework for deployment-aware evaluation.