Elamur Research⌕
☰
home / papers / 2026 / Detecting RAG Extraction Attack via Dual-Path Runtime Integrity Game

Detecting RAG Extraction Attack via Dual-Path Runtime Integrity Game

Paper · 2026 · Yuanbo Xie, Yingjie Zhang, Yulin Li et al.

Summary

RAG systems can leak proprietary knowledge-base content when attackers use adaptive, iterative prompts to make the model reproduce retrieved chunks. Existing defenses such as Reranker, Summarize and RAGFort mainly make reconstruction more expensive, require changes to the pipeline, and still leak under strong attacks. The authors treat leakage as a runtime integrity violation, borrowing the idea of stack canaries from software security. Their method, CanaryRAG, inserts random, non-semantic canary tokens into retrieved chunks. During decoding it flags any output that exposes them, because legitimate answers never need these tokens. A second "oracle" path uses a task that should make the canary appear. If the canary is missing there, the system infers that an adversary is suppressing or obfuscating it. In evaluations with three RAG agents and existing extraction attacks, CanaryRAG cut chunk recovery to near zero. It barely affected answer quality or latency and needs no retraining. This makes it a practical plug-in safeguard for deployed RAG services.

Key points

  • Chunk recovery rate (CRR) relative to No Defense (1.00×): Reranker 0.98×, Summarize 0.67×, RAGFort 0.60×, CanaryRAG 0.04×, an average reduction of about 96%. This held even against canary-aware attackers.
  • Benign-query utility was evaluated on ChatDoctor, Mini-Wikipedia and Mini-BioASQ:
    • BERTScore dropped by at most 0.003 (e.g., 0.517 → 0.515 on ChatDoctor).
    • False positive rates were 0.08–0.15%.
  • Detection TPR with the oracle path stayed high: 99.2% for the non-adaptive attack, and 94.1% and 95.6% for two adaptive variants (canary suppression or output obfuscation, each combined with deferred task injection).
  • Without the oracle path, TPR fell to 51.8% and 23.4% on those adaptive variants, which shows the value of dual-path monitoring.
  • Latency distributions with CanaryRAG closely match those without any defense.
  • The method is model-agnostic and plug-and-play.
  • It targets large-scale knowledge-base reconstruction, not membership inference or single-fact privacy.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🎓Stanford UniversityStanford · United States506 works · 330,053 citations🏛️Chinese Academy of SciencesBeijing · China246 works · 24,951 citations🎓Beijing University of Posts and TelecommunicationsBeijing · China78 works · 33,365 citations🎓University of Chinese Academy of SciencesBeijing · China188 works · 8,743 citations🔬Institute of Information EngineeringBeijing · China41 works · 1,485 citations🎓North China Electric Power UniversityBeijing · China5 works · 1 citation

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 18,614 worksArtificial Intelligence · 17,965 worksArts and Humanities · 17,450 worksLanguage and Linguistics · 17,296 works

Cite

Cite as Yuanbo Xie, Yingjie Zhang, Yulin Li, Shouyou Song, Xiaokun Chen, Zhihan Liu, Liya Su and Tingwen Liu. 2026. Detecting RAG Extraction Attack via Dual-Path Runtime Integrity Game. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers).

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.acl-long.385

@inproceedings{xie2026detecting,
  title = {{Detecting RAG Extraction Attack via Dual-Path Runtime Integrity Game}},
  author = {Yuanbo Xie, Yingjie Zhang, Yulin Li, Shouyou Song, Xiaokun Chen, Zhihan Liu, Liya Su and Tingwen Liu},
  booktitle = {Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.acl-long.385},
  url = {https://doi.org/10.18653/v1/2026.acl-long.385}
}

References

18 references, 7 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. 2024. Minibioasq. Hugging Face dataset. 2024. Miniwikipedia. Hugging Face dataset. find
  2. Stav Cohen, Ron Bitton, and Ben Nassi. 2024. Unleashing worms and extracting data: Escalating the outcome of attacks against rag-based inference in scale and severity using jailbreaking. arXiv preprint arXiv:2409.08045. — [arXiv:2409.08045](https://arxiv.org/abs/2409.08045) find
  3. Crispan Cowan, Calton Pu, Dave Maier, Jonathan Walpole, Peat Bakke, Steve Beattie, Aaron Grier, Perry Wagle, Qian Zhang, and Heather Hinton. 1998. Stackguard: Automatic adaptive detection and prevention of buffer-overflow attacks. In USENIX security symposium, volume 98, pages 63–78. San Antonio, TX… find
  4. Christian Di Maio, Cristian Cosci, Marco Maggini, Valentina Poggioni, and Stefano Melacci. 2024. Pirates of the rag: Adaptively attacking llms to leak knowledge bases. arXiv preprint arXiv:2412.18295. — [arXiv:2412.18295](https://arxiv.org/abs/2412.18295) find
  5. Kelvin Guu, Kenton Lee, Zora Tung, Panupong Pasupat, and Mingwei Chang. 2020. Retrieval augmented language model pre-training. In International conference on machine learning, pages 3929–3938. PMLR.
  6. Changyue Jiang, Xudong Pan, Geng Hong, Chenfu Bao, and Min Yang. 2025. Feedback-guided extraction of knowledge base from retrieval-augmented llm applications. arXiv preprint arXiv:2411.14110. — [arXiv:2411.14110](https://arxiv.org/abs/2411.14110) find
  7. Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich Küttler, Mike Lewis, Wen-tau Yih, Tim Rocktäschel, and 1 others. 2020. Retrieval-augmented generation for knowledge-intensive nlp tasks. Advances in neural information processing systems, 33:9459–…
  8. Qinfeng Li, Miao Pan, Ke Xiong, Ge Su, Zhiqiang Shen, Yan Liu, Bing Sun, Hao Peng, and Xuhong Zhang. 2025. Ragfort: Dual-path defense against proprietary knowledge base extraction in retrieval-augmented generation. arXiv preprint arXiv:2511.10128. — [arXiv:2511.10128](https://arxiv.org/abs/2511.10128) find
  9. Yunxiang Li, Zihan Li, Kai Zhang, Ruilong Dan, Steve Jiang, and You Zhang. 2023. Chatdoctor: A medical chat model fine-tuned on a large language model meta-ai (llama) using medical domain knowledge. Cureus, 15(6).
  10. Yepeng Liu, Xuandong Zhao, Dawn Song, and Yuheng Bu. 2025. Dataset protection via watermarked canaries in retrieval-augmented LLMs. In ICML 2025 Workshop on Reliable and Responsible Foundation Models. find
  11. Zhenting Qi, Hanlin Zhang, Eric P. Xing, Sham M. Kakade, and Himabindu Lakkaraju. 2025. Follow my instruction and spill the beans: Scalable data extraction from retrieval-augmented generation systems. In The Thirteenth International Conference on Learning Representations. find
  12. Kurt Shuster, Spencer Poff, Moya Chen, Douwe Kiela, and Jason Weston. 2021. Retrieval augmentation reduces hallucination in conversation. In Findings of the Association for Computational Linguistics: EMNLP 2021, pages 3784–3803, Punta Cana, Dominican Republic. Association for Computational Linguisti…
  13. Liang Wang, Nan Yang, Xiaolong Huang, Binxing Jiao, Linjun Yang, Daxin Jiang, Rangan Majumder, and Furu Wei. 2022. Text embeddings by weakly-supervised contrastive pre-training. arXiv preprint arXiv:2212.03533.
  14. Yuhao Wang, Wenjie Qu, Yanze Jiang, Lichen Liu, Yue Liu, Shengfang Zhai, Yinpeng Dong, and Jiaheng Zhang. 2025. Silent leaks: Implicit knowledge extraction attack on RAG systems through benign queries. In ICML 2025 Workshop on Reliable and Responsible Foundation Models. find
  15. Shitao Xiao, Zheng Liu, Peitian Zhang, and Niklas Muennighoff. 2023. C-pack: Packaged resources to advance general chinese embedding. Preprint, arXiv:2309.07597.
  16. Shenglai Zeng, Jiankun Zhang, Pengfei He, Yiding Liu, Yue Xing, Han Xu, Jie Ren, Yi Chang, Shuaiqiang Wang, Dawei Yin, and 1 others. 2024. The good and the bad: Exploring privacy issues in retrieval-augmented generation (rag). In Findings of the Association for Computational Linguistics: ACL 2024, p… find
  17. Shenglai Zeng, Jiankun Zhang, Pengfei He, Jie Ren, Tianqi Zheng, Hanqing Lu, Han Xu, Hui Liu, Yue Xing, and Jiliang Tang. 2025. Mitigating the privacy issues in retrieval-augmented generation (rag) via pure synthetic data. In Proceedings of the 2025 Conference on Empirical Methods in Natural Languag… find
  18. Tianyi Zhang, Varsha Kishore, Felix Wu, Kilian Q Weinberger, and Yoav Artzi. Bertscore: Evaluating text generation with bert. In International Conference on Learning Representations. Xin Zhang, Yanzhao Zhang, Dingkun Long, Wen Xie, Ziqi Dai, Jialong Tang, Huan Lin, Baosong Yang, Pengjun Xie, Fei Hua… — mGTE: Generalized Long-Context Text Representation and Reranking Models for Multilingual Text Retrieval

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/xie-2026-detecting-rag-extraction-attack-dual/