---
title: "Detecting RAG Extraction Attack via Dual-Path Runtime Integrity"
description: "RAG systems can leak proprietary knowledge-base content when attackers use adaptive, iterative prompts to make the model… 18 references."
authors: ["Yuanbo Xie", "Yingjie Zhang", "Yulin Li", "Shouyou Song", "Xiaokun Chen", "Zhihan Liu", "Liya Su", "Tingwen Liu"]
year: 2026
venue: "Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)"
source: "https://aclanthology.org/2026.acl-long.385/"
doi: "10.18653/v1/2026.acl-long.385"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/xie-2026-detecting-rag-extraction-attack-dual/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/xie-2026-detecting-rag-extraction-attack-dual/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2026](https://md.research.elamur.ai/free/en/papers/2026/page/29/) / Detecting RAG Extraction Attack via Dual-Path Runtime Integrity Game

# Detecting RAG Extraction Attack via Dual-Path Runtime Integrity Game

**Authors:** Yuanbo Xie, Yingjie Zhang, Yulin Li, Shouyou Song, Xiaokun Chen, Zhihan Liu, Liya Su and [Tingwen Liu](https://md.research.elamur.ai/free/en/authors/tingwen-liu/) · **Year:** 2026 · **Venue:** [Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)](https://md.research.elamur.ai/free/en/venues/acl/) ([ACL 2026](https://md.research.elamur.ai/free/en/venues/acl/2026/)) · **Publisher:** [Association for Computational Linguistics](https://md.research.elamur.ai/free/en/publishers/association-for-computational-linguistics/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2026.acl-long.385/) · [PDF](https://aclanthology.org/2026.acl-long.385.pdf) · [DOI 10.18653/v1/2026.acl-long.385](https://doi.org/10.18653/v1/2026.acl-long.385) · [OpenAlex](https://openalex.org/W7166825628)

**Citations:** 0 citations (OpenAlex, 2026-10-14)

## Summary
RAG systems can leak proprietary knowledge-base content when attackers use adaptive, iterative prompts to make the model reproduce retrieved chunks. Existing defenses such as Reranker, Summarize and RAGFort mainly make reconstruction more expensive, require changes to the pipeline, and still leak under strong attacks. The authors treat leakage as a runtime integrity violation, borrowing the idea of stack canaries from software security. Their method, CanaryRAG, inserts random, non-semantic canary tokens into retrieved chunks. During decoding it flags any output that exposes them, because legitimate answers never need these tokens. A second "oracle" path uses a task that should make the canary appear. If the canary is missing there, the system infers that an adversary is suppressing or obfuscating it. In evaluations with three RAG agents and existing extraction attacks, CanaryRAG cut chunk recovery to near zero. It barely affected answer quality or latency and needs no retraining. This makes it a practical plug-in safeguard for deployed RAG services.

## Key points
- Chunk recovery rate (CRR) relative to No Defense (1.00×): Reranker 0.98×, Summarize 0.67×, RAGFort 0.60×, CanaryRAG 0.04×, an average reduction of about 96%. This held even against canary-aware attackers.
- Benign-query utility was evaluated on ChatDoctor, Mini-Wikipedia and Mini-BioASQ:
  - BERTScore dropped by at most 0.003 (e.g., 0.517 → 0.515 on ChatDoctor).
  - False positive rates were 0.08–0.15%.
- Detection TPR with the oracle path stayed high: 99.2% for the non-adaptive attack, and 94.1% and 95.6% for two adaptive variants (canary suppression or output obfuscation, each combined with deferred task injection).
- Without the oracle path, TPR fell to 51.8% and 23.4% on those adaptive variants, which shows the value of dual-path monitoring.
- Latency distributions with CanaryRAG closely match those without any defense.
- The method is model-agnostic and plug-and-play.
- It targets large-scale knowledge-base reconstruction, not membership inference or single-fact privacy.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

## Institutions

- [Stanford University](https://md.research.elamur.ai/free/en/universities/stanford-university/) — University, Stanford, United States · 506 works · 330,053 citations
- [Chinese Academy of Sciences](https://md.research.elamur.ai/free/en/government/chinese-academy-of-sciences/) — Government body, Beijing, China · 246 works · 24,951 citations
- [Beijing University of Posts and Telecommunications](https://md.research.elamur.ai/free/en/universities/beijing-university-of-posts-and-telecommunications/) — University, Beijing, China · 78 works · 33,365 citations
- [University of Chinese Academy of Sciences](https://md.research.elamur.ai/free/en/universities/university-of-chinese-academy-of-sciences/) — University, Beijing, China · 188 works · 8,743 citations
- [Institute of Information Engineering](https://md.research.elamur.ai/free/en/labs/institute-of-information-engineering/) — Research institute, Beijing, China · 41 works · 1,485 citations
- [North China Electric Power University](https://md.research.elamur.ai/free/en/universities/north-china-electric-power-university/) — University, Beijing, China · 5 works · 1 citation

📚 Shelves (4): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 18,614 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 17,965 works · [🎭 Arts and Humanities](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/) · 17,450 works · [🗣️ Language and Linguistics](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/language-and-linguistics/) · 17,296 works

## Cite

Cite as: Yuanbo Xie, Yingjie Zhang, Yulin Li, Shouyou Song, Xiaokun Chen, Zhihan Liu, Liya Su and Tingwen Liu. 2026. Detecting RAG Extraction Attack via Dual-Path Runtime Integrity Game. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers).

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{xie2026detecting,
  title = {{Detecting RAG Extraction Attack via Dual-Path Runtime Integrity Game}},
  author = {Yuanbo Xie, Yingjie Zhang, Yulin Li, Shouyou Song, Xiaokun Chen, Zhihan Liu, Liya Su and Tingwen Liu},
  booktitle = {Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.acl-long.385},
  url = {https://doi.org/10.18653/v1/2026.acl-long.385}
}
```

- [← previous Detecting Non-Membership in LLM Training Data via Rank Correlations](https://md.research.elamur.ai/free/en/papers/shetty-2026-detecting-non-membership-llm-training/)
- [next → Detecting Risky Behavior Related to Alcohol and Drug Use within Adolescents' Private Messenger Conversations](https://md.research.elamur.ai/free/en/papers/plhak-2026-detecting-risky-behavior-related-alcohol/)
- [↑ back to papers of 2026](https://md.research.elamur.ai/free/en/papers/2026/page/29/)

## References

18 references, 7 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. 2024. Minibioasq. Hugging Face dataset. 2024. Miniwikipedia. Hugging Face dataset. [find](https://scholar.google.com/scholar?q=2024%2E+Minibioasq%2E+Hugging+Face+dataset%2E+2024%2E+Miniwikipedia%2E+Hugging+Face+dataset%2E)
2. Stav Cohen, Ron Bitton, and Ben Nassi. 2024. Unleashing worms and extracting data: Escalating the outcome of attacks against rag-based inference in scale and severity using jailbreaking. arXiv preprint arXiv:2409.08045. — [arXiv:2409.08045](https://arxiv.org/abs/2409.08045) [find](https://scholar.google.com/scholar?q=Stav+Cohen%2C+Ron+Bitton%2C+and+Ben+Nassi%2E+2024%2E+Unleashing+worms+and+extracting+data%3A+Escalating+the+outcome+of+attacks+against+rag%2Dbased+inference+in+scale+and+severity+using+jailbreaking%2E+arXiv+preprin)
3. Crispan Cowan, Calton Pu, Dave Maier, Jonathan Walpole, Peat Bakke, Steve Beattie, Aaron Grier, Perry Wagle, Qian Zhang, and Heather Hinton. 1998. Stackguard: Automatic adaptive detection and prevention of buffer-overflow attacks. In USENIX security symposium, volume 98, pages 63–78. San Antonio, TX… [find](https://scholar.google.com/scholar?q=Crispan+Cowan%2C+Calton+Pu%2C+Dave+Maier%2C+Jonathan+Walpole%2C+Peat+Bakke%2C+Steve+Beattie%2C+Aaron+Grier%2C+Perry+Wagle%2C+Qian+Zhang%2C+and+Heather+Hinton%2E+1998%2E+Stackguard%3A+Automatic+adaptive+detection+and+preventi)
4. Christian Di Maio, Cristian Cosci, Marco Maggini, Valentina Poggioni, and Stefano Melacci. 2024. Pirates of the rag: Adaptively attacking llms to leak knowledge bases. arXiv preprint arXiv:2412.18295. — [arXiv:2412.18295](https://arxiv.org/abs/2412.18295) [find](https://scholar.google.com/scholar?q=Christian+Di+Maio%2C+Cristian+Cosci%2C+Marco+Maggini%2C+Valentina+Poggioni%2C+and+Stefano+Melacci%2E+2024%2E+Pirates+of+the+rag%3A+Adaptively+attacking+llms+to+leak+knowledge+bases%2E+arXiv+preprint+arXiv%3A2412%2E18295%2E)
5. Kelvin Guu, Kenton Lee, Zora Tung, Panupong Pasupat, and Mingwei Chang. 2020. [Retrieval augmented language model pre-training](https://md.research.elamur.ai/free/en/papers/guu-2020-realm-retrieval-augmented-language-model/). In International conference on machine learning, pages 3929–3938. PMLR.
6. Changyue Jiang, Xudong Pan, Geng Hong, Chenfu Bao, and Min Yang. 2025. Feedback-guided extraction of knowledge base from retrieval-augmented llm applications. arXiv preprint arXiv:2411.14110. — [arXiv:2411.14110](https://arxiv.org/abs/2411.14110) [find](https://scholar.google.com/scholar?q=Changyue+Jiang%2C+Xudong+Pan%2C+Geng+Hong%2C+Chenfu+Bao%2C+and+Min+Yang%2E+2025%2E+Feedback%2Dguided+extraction+of+knowledge+base+from+retrieval%2Daugmented+llm+applications%2E+arXiv+preprint+arXiv%3A2411%2E14110%2E+%E2%80%94+%5BarXiv)
7. Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich Küttler, Mike Lewis, Wen-tau Yih, Tim Rocktäschel, and 1 others. 2020. [Retrieval-augmented generation for knowledge-intensive nlp tasks](https://md.research.elamur.ai/free/en/papers/lewis-2020-retrieval-augmented-generation-knowledge-intensive/). Advances in neural information processing systems, 33:9459–…
8. Qinfeng Li, Miao Pan, Ke Xiong, Ge Su, Zhiqiang Shen, Yan Liu, Bing Sun, Hao Peng, and Xuhong Zhang. 2025. Ragfort: Dual-path defense against proprietary knowledge base extraction in retrieval-augmented generation. arXiv preprint arXiv:2511.10128. — [arXiv:2511.10128](https://arxiv.org/abs/2511.10128) [find](https://scholar.google.com/scholar?q=Qinfeng+Li%2C+Miao+Pan%2C+Ke+Xiong%2C+Ge+Su%2C+Zhiqiang+Shen%2C+Yan+Liu%2C+Bing+Sun%2C+Hao+Peng%2C+and+Xuhong+Zhang%2E+2025%2E+Ragfort%3A+Dual%2Dpath+defense+against+proprietary+knowledge+base+extraction+in+retrieval%2Daugment)
9. Yunxiang Li, Zihan Li, Kai Zhang, Ruilong Dan, Steve Jiang, and You Zhang. 2023. [Chatdoctor: A medical chat model fine-tuned on a large language model meta-ai (llama) using medical domain knowledge](https://md.research.elamur.ai/free/en/papers/li-2023-chatdoctor-medical-chat-model-fine/). Cureus, 15(6).
10. Yepeng Liu, Xuandong Zhao, Dawn Song, and Yuheng Bu. 2025. Dataset protection via watermarked canaries in retrieval-augmented LLMs. In ICML 2025 Workshop on Reliable and Responsible Foundation Models. [find](https://scholar.google.com/scholar?q=Yepeng+Liu%2C+Xuandong+Zhao%2C+Dawn+Song%2C+and+Yuheng+Bu%2E+2025%2E+Dataset+protection+via+watermarked+canaries+in+retrieval%2Daugmented+LLMs%2E+In+ICML+2025+Workshop+on+Reliable+and+Responsible+Foundation+Models%2E)
11. Zhenting Qi, Hanlin Zhang, Eric P. Xing, Sham M. Kakade, and Himabindu Lakkaraju. 2025. Follow my instruction and spill the beans: Scalable data extraction from retrieval-augmented generation systems. In The Thirteenth International Conference on Learning Representations. [find](https://scholar.google.com/scholar?q=Zhenting+Qi%2C+Hanlin+Zhang%2C+Eric+P%2E+Xing%2C+Sham+M%2E+Kakade%2C+and+Himabindu+Lakkaraju%2E+2025%2E+Follow+my+instruction+and+spill+the+beans%3A+Scalable+data+extraction+from+retrieval%2Daugmented+generation+systems%2E)
12. Kurt Shuster, Spencer Poff, Moya Chen, Douwe Kiela, and Jason Weston. 2021. [Retrieval augmentation reduces hallucination in conversation](https://md.research.elamur.ai/free/en/papers/shuster-2021-retrieval-augmentation-reduces-hallucination-conversation/). In Findings of the Association for Computational Linguistics: EMNLP 2021, pages 3784–3803, Punta Cana, Dominican Republic. Association for Computational Linguisti…
13. Liang Wang, Nan Yang, Xiaolong Huang, Binxing Jiao, Linjun Yang, Daxin Jiang, Rangan Majumder, and Furu Wei. 2022. [Text embeddings by weakly-supervised contrastive pre-training](https://md.research.elamur.ai/free/en/papers/wang-2022-text-embeddings-weakly-supervised-contrastive/). arXiv preprint arXiv:2212.03533.
14. Yuhao Wang, Wenjie Qu, Yanze Jiang, Lichen Liu, Yue Liu, Shengfang Zhai, Yinpeng Dong, and Jiaheng Zhang. 2025. Silent leaks: Implicit knowledge extraction attack on RAG systems through benign queries. In ICML 2025 Workshop on Reliable and Responsible Foundation Models. [find](https://scholar.google.com/scholar?q=Yuhao+Wang%2C+Wenjie+Qu%2C+Yanze+Jiang%2C+Lichen+Liu%2C+Yue+Liu%2C+Shengfang+Zhai%2C+Yinpeng+Dong%2C+and+Jiaheng+Zhang%2E+2025%2E+Silent+leaks%3A+Implicit+knowledge+extraction+attack+on+RAG+systems+through+benign+queries)
15. Shitao Xiao, Zheng Liu, Peitian Zhang, and Niklas Muennighoff. 2023. [C-pack: Packaged resources to advance general chinese embedding](https://md.research.elamur.ai/free/en/papers/xiao-2023-c-pack-packed-resources/). Preprint, arXiv:2309.07597.
16. Shenglai Zeng, Jiankun Zhang, Pengfei He, Yiding Liu, Yue Xing, Han Xu, Jie Ren, Yi Chang, Shuaiqiang Wang, Dawei Yin, and 1 others. 2024. The good and the bad: Exploring privacy issues in retrieval-augmented generation (rag). In Findings of the Association for Computational Linguistics: ACL 2024, p… [find](https://scholar.google.com/scholar?q=Shenglai+Zeng%2C+Jiankun+Zhang%2C+Pengfei+He%2C+Yiding+Liu%2C+Yue+Xing%2C+Han+Xu%2C+Jie+Ren%2C+Yi+Chang%2C+Shuaiqiang+Wang%2C+Dawei+Yin%2C+and+1+others%2E+2024%2E+The+good+and+the+bad%3A+Exploring+privacy+issues+in+retrieval%2Da)
17. Shenglai Zeng, Jiankun Zhang, Pengfei He, Jie Ren, Tianqi Zheng, Hanqing Lu, Han Xu, Hui Liu, Yue Xing, and Jiliang Tang. 2025. Mitigating the privacy issues in retrieval-augmented generation (rag) via pure synthetic data. In Proceedings of the 2025 Conference on Empirical Methods in Natural Languag… [find](https://scholar.google.com/scholar?q=Shenglai+Zeng%2C+Jiankun+Zhang%2C+Pengfei+He%2C+Jie+Ren%2C+Tianqi+Zheng%2C+Hanqing+Lu%2C+Han+Xu%2C+Hui+Liu%2C+Yue+Xing%2C+and+Jiliang+Tang%2E+2025%2E+Mitigating+the+privacy+issues+in+retrieval%2Daugmented+generation+%28rag%29+vi)
18. Tianyi Zhang, Varsha Kishore, Felix Wu, Kilian Q Weinberger, and Yoav Artzi. Bertscore: Evaluating text generation with bert. In International Conference on Learning Representations. Xin Zhang, Yanzhao Zhang, Dingkun Long, Wen Xie, Ziqi Dai, Jialong Tang, Huan Lin, Baosong Yang, Pengjun Xie, Fei Hua… — [mGTE: Generalized Long-Context Text Representation and Reranking Models for Multilingual Text Retrieval](https://md.research.elamur.ai/free/en/papers/zhang-2024-mgte-generalized-long-context-text/)

*Updated 2 November 2026*