Securing RAG: A Risk Assessment and Mitigation Framework

Lukas Ammann; Sara Ott; Christoph R Landolt; Marco P Lehmann

TL;DR

Maps the attack surface of Retrieval Augmented Generation pipelines end to end, pairs each risk with a mitigation, and combines them with existing security standards into a framework for building trustworthy RAG systems.

Abstract

Retrieval Augmented Generation (RAG) has emerged as the de facto industry standard for user-facing NLP applications, offering the ability to integrate data without re-training or fine-tuning Large Language Models (LLMs). This capability enhances the quality and accuracy of responses but also introduces novel security and privacy challenges, particularly when sensitive data is integrated. With the rapid adoption of RAG, securing data and services has become a critical priority. This paper first reviews the vulnerabilities of RAG pipelines, and outlines the attack surface from data pre-processing and data storage management to integration with LLMs. The identified risks are then paired with corresponding mitigations in a structured overview. In a second step, the paper develops a framework that combines RAG-specific security considerations, with existing general security guidelines, industry standards, and best practices. The proposed framework aims to guide the implementation of robust, compliant, secure, and trustworthy RAG systems.

BibTeX

@inproceedings{ammann2025securingrag,
  title         = {Securing RAG: A Risk Assessment and Mitigation Framework},
  author        = {Ammann, Lukas and Ott, Sara and Landolt, Christoph R. and Lehmann, Marco P.},
  booktitle     = {IEEE Swiss Conference on Data Science (SDS)},
  year          = {2025},
  eprint        = {2505.08728},
  archivePrefix = {arXiv},
  primaryClass  = {cs.CR}
}