Protection Is Not One Event: A Survey of RAG Protection Research by Measured Endpoint

What it is

A survey and human-coded evidence map of 118 full-text-confirmed RAG defense papers (arXiv 2610.30193, October 2026, Peking University and coauthors). Papers are grouped by the endpoint their primary metric measures, not by the defense mechanism or the claimed goal. The authors release the taxonomy, the dataset, the coding protocols and a controlled testbed.

How it works

Each paper gets one primary endpoint family. Thirty-two annotators double-coded the papers (κ = 0.867 on family; median κ = 0.94 across 34 annotated fields). Counts per family in the 118 records:

• A, emitted expression copying: 8
• A-pii, emitted identifiers: 6
• B, source recovery outside ordinary generation (embedding inversion, cache or state): 7
• C, formal or statistical proxies (DP bounds, perplexity): 6
• D, access, retrieval or answer suppression: 26
• E, watermark, membership or ownership detection: 18
• F, poisoning, prompt injection, attribution, removal: 47

Only A, A-pii and B observe content reaching a user or adversary. Together that is 21 papers (17.8%). Family C reports a bound or proxy, not observed leakage.

Search ran through 17 July 2026 over arXiv, OpenAlex and the ACL Anthology (11,972 hits, 8,978 unique, 925 screened in, 824 full texts). Inclusion required a RAG system, an intervention, and a source-verified protection metric. The authors estimate about 27.2 further confirmable papers exist beyond the pool, so the figures describe this pool, not the whole field.

Findings that matter for a defender

• Mechanism does not tell you what was protected. Retrieval reranking and context rewriting are each evaluated against five or six endpoint families.
• Among papers with the copyright/ownership label, 73.3% measure corpus-use detection, and none measure emitted expression.
• Most evaluations use general QA datasets with little sensitive content, and non-adaptive attacks instead of multi-turn extraction.
• In the testbed, a normalized 8-gram guard cuts 20-token copying to 0.0%. A three-query adaptive attacker still recovers 48.3% of hidden facts on Qwen3-8B.

What to do

When reading a vendor or paper claim of "RAG protection", check which family its metric falls in. A verbatim-copy score says nothing about fact recovery, and an access-control or watermark result says nothing about leakage. For your own evaluation, test with sensitive data and adaptive multi-turn extraction. Do not rely on n-gram overlap alone. The released testbed and Appendix D.2 operating points can serve as a starting baseline.

Caveats

• The fetched text cuts off in Section 4.1, so Sections 5 and 6 and Appendix C are not visible. The testbed's setup, attack design and fact-recovery metric are not described beyond the abstract, and the 48.3% figure is for one model.
• Single-endpoint assignment means a paper that measures several things is counted under only one family.
• Counts reflect the authors' screening rule and the 118-record pool.