The DOI matches its Crossref record; 46 of the 46 references it cites were found in a registry or an index; 2 of the 81 sources its claims cite were checked for support.
External Data Extraction Attacks Against Retrieval-Augmented Large Language Models
Open accessAbstract
In recent years, RAG has emerged as a key paradigm for enhancing large language models (LLMs). By integrating externally retrieved information, RAG alleviates issues like outdated knowledge and, crucially, insufficient domain expertise. While effective, RAG introduces new risks of external data extraction attacks (EDEAs), where sensitive or copyrighted data in its knowledge base may be extracted verbatim. These risks are particularly acute when RAG is used to customize specialized LLM applications with private knowledge bases. Despite initial studies exploring these risks, they often lack a formalized framework, robust attack performance, and comprehensive evaluation, leaving critical questions about real-world EDEA feasibility unanswered. In this paper, we present the first comprehensive study to formalize EDEAs against retrieval-augmented LLMs. We first formally define EDEAs and propose a unified framework decomposing their design into three components: extraction instruction, jailbreak operator, and retrieval trigger, under which prior attacks can be considered instances within our framework. Guided by this framework, we develop SECRET: a Scalable and EffeCtive exteRnal data Extraction aTtack. Specifically, SECRET incorporates (1) an adaptive optimization process using LLMs as optimizers to generate specialized jailbreak prompts for EDEAs, and (2) cluster-focused triggering, an adaptive strategy that alternates between global exploration and local exploitation to efficiently generate effective retrieval triggers. Extensive evaluations across 4 models reveal that SECRET significantly outperforms previous attacks, and is highly effective against all 16 tested RAG instances. Notably, SECRET successfully extracts 35% of the data from RAG powered by Claude 3.7 Sonnet for the first time, whereas other attacks yield 0% extraction. Our findings call for attention to this emerging threat.
Overview
CoChat Summary
Written by AI from the paper’s full text.
TL;DR
The paper formalizes external data extraction attacks (EDEAs) against retrieval-augmented LLMs and proposes SECRET, a black-box attack combining LLM-optimized jailbreak prompts with cluster-focused retrieval triggering. SECRET substantially outperforms prior EDEAs across four LLMs and two sensitive datasets, including extracting 35% of data from a Claude 3.7 Sonnet RAG instance where prior attacks yield 0%.
Key findings
- SECRET significantly outperforms five baselines across all 16 tested RAG instances (4 models × 2 datasets × 2 defense settings). Against naive defenses on HealthcareMagic-101, SECRET achieves MERs of 34.0% (Claude 3.7 Sonnet), 48.1% (Gemini 2.0 Flash), 45.7% (GPT-4o mini), and 49.4% (DeepSeek-V3), with refusal rates of 7.7%, 0.0%, 5.7%, and 0.0%, respectively.
- Prior EDEAs are largely ineffective against commercial LLMs and simple defenses: under naive defenses, many baselines show refusal rates near 100% and MERs near 0%; for example, Jiang et al. reaches 0.0% MER on all four models in Table II.
- SECRET’s adaptive jailbreak prompt transfers across models: a prompt optimized against Gemini achieves near-zero refusal rates (5.7% and 0%) when applied to defended GPT-4o and DeepSeek.
- Tested defenses provide only partial mitigation: a retrieval similarity threshold at τ = 0.85 filters about 50% of relevant documents but SECRET still reaches 24.6% ER-TMQ; context rephrasing reduces ER-TMQ from 28.8% to 21.6% and MER from 45.5% to 36.7%; summarization eliminates verbatim extraction but retains 0.911 semantic similarity while reducing utility to 0.196. DataSentinel detects some adversarial prompts but flags 96.1% of complex benign prompts as malicious, and SECRET shows 0% detection by Llama-Guard-3-8B and a perplexity-based detector.
Methods
- The paper first defines EDEAs formally and proposes a unified framework decomposing an attack query into three components: extraction instruction, jailbreak operator, and retrieval trigger. SECRET instantiates this with an LLM-driven optimizer/evaluator loop to generate a specialized jailbreak prompt, then uses cluster-focused triggering (CFT) that alternates global exploration with local exploitation.
- Evaluation uses four SOTA LLMs as RAG backends: Claude 3.7 Sonnet, Gemini 2.0 Flash, GPT-4o mini, and DeepSeek-V3. External databases are built from Enron Email and HealthcareMagic-101, randomly sampling 1,000 entries from each. The retriever uses bge-large-en-v1.5 with Euclidean distance; a surrogate embedding model mxbai-embed-large-v1 is used for local exploitation.
- Main analysis compares SECRET against five baselines (Qi et al., Zeng et al., Cohen et al., Jiang et al., and an adapted GCG Leak) using three metrics: Refusal Rate (RR), Extraction Rate with Theoretical Minimum Queries (ER-TMQ), and Maximum Extraction Rate (MER). Successful extraction is measured with normalized Levenshtein distance and τ = 0.1. Implementation uses N_iter = 20, N_cand = 3, local query budget 30, k = 10 retrieved documents, and Qwen2.5-1.5B-Instruct for semantic-shift trigger generation.
Limitations
- Stated: the study does not consider multimodal retrieval; the framework and SECRET target text-only document retrieval, leaving multimodal attack surfaces out of scope.
- Stated: a gap remains between empirical ER-TMQ and the theoretical optimum of 100%, indicating that non-redundant coverage of the external database with minimal queries remains a nontrivial black-box search problem.
- Evident from the text: evaluation uses sampled databases of 1,000 entries per dataset rather than full production-scale knowledge bases, and the defense evaluation covers a limited set of countermeasures; the paper also notes that no canonical norm-based definition of stealthiness is available for natural-language triggers, so stealthiness is assessed only empirically.
Model-written summary. Check it against the paper before relying on it.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
91 Own interpretation · 59 Own result · 19 Not checked yet · 16 Check pending · 4 Sources not found · 3 Own method · 3 No basis given · 2 No full text of the sources · 1 Partly supported · accuracy not yet measured
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Extensive evaluations across 4 models (including 3 leading commercial LLMs) reveal that SECRET significantly outperforms previous attacks, and is highly effective against all 16 tested RAG instances.”
§ IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY 1 External Data Extraction Attacks against Retrieval-Augmented Large Language Models > Abstract
boostedstates a cause- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Extensive evaluations across 4 models (including 3 leading commercial LLMs) reveal that SECRET significantly outperforms previous attacks, and is highly effective against all 16 tested RAG instances.”
§ IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY 1 External Data Extraction Attacks against Retrieval-Augmented Large Language Models > Abstract
plainstates a cause- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper states — it cites no source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Takeaway 2: Incorporating defensive instructions, even those seemingly straightforward, into system prompts can mitigate the threats posed by prior EDEAs.”
§ IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY 1 External Data Extraction Attacks against Retrieval-Augmented Large Language Models > B. Main Results
plainstates a cause- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Although seemingly plausible, we observe that this strategy results in extremely low extraction rates (even worse than the random sampling approach).”
§ IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY 1 External Data Extraction Attacks against Retrieval-Augmented Large Language Models > D. Design of Retrieval Trigger
plainstates a cause- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Furthermore, we perform ablation studies to validate the contribution of each component within SECRET, alongside analyses of hyperparameter sensitivity and robustness to various retrieval settings.”
§ IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY 1 External Data Extraction Attacks against Retrieval-Augmented Large Language Models > I. INTRODUCTION
plainstates a cause- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Probably not a substantial claim. 42
- It may state two separate claims as one. 72
- The quote only partly states this claim. 1
Create a free account to see these claims.
Create a free account to see these assumptions.
94 more claims
Create a free account to see all 198 claims and to verify the 50 references still open.
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
Each contradiction between two passages listed here was confirmed by an independent check.
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY 1 External Data Extraction Attacks against Retrieval-Augmented Large Language Models > D. Robustness Assessment
“We test SECRET with k varying from 5 to 20 on both datasets.Figure 5 shows that reducing k does not essentially mitigate the threat posed by SECRET, as the attacker can still extract 30% of the documents using the theoretical minimum queries (regardless of the value of k).”
§ IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY 1 External Data Extraction Attacks against Retrieval-Augmented Large Language Models > APPENDIX D ON THE CONFIDENTIALITY AND VALUE OF RAG DATABASE CONTENT
“Figure: -TMQ=18.0%k=10, ER-TMQ=19.0%k=15, ER-TMQ=21.8%k=20, ER-TMQ=23.5%(b) Enron Email[61]”
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY 1 External Data Extraction Attacks against Retrieval-Augmented Large Language Models > B. Main Results
“Specifically, all these attacks achieve RRs of nearly 100% and MERs of nearly 0% against Claude 3.7, Gemini 2.0, and GPT-4o mini enhanced with such a defense.”
§ IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY 1 External Data Extraction Attacks against Retrieval-Augmented Large Language Models > A. Main Settings
“Cohen et al. 93.0% 0.0% 99.7% 90.7%”
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY 1 External Data Extraction Attacks against Retrieval-Augmented Large Language Models > B. Defenses at the LLM Input Stage
“We evaluate four prompts from prior work [17], including the one used in our main setup, on the HealthcareMagic-101 dataset.”
§ IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY 1 External Data Extraction Attacks against Retrieval-Augmented Large Language Models > B. Defenses at the LLM Input Stage
“The first defensive instruction is from our work, and the remaining three are from [17].”
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY 1 External Data Extraction Attacks against Retrieval-Augmented Large Language Models > B. Design of Distance Threshold
“calculated the Euclidean distances between documents and queries, yielding a mean of 0.857; and (4) set τ = 0.8 to avoid blocking relevant documents.”
§ IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY 1 External Data Extraction Attacks against Retrieval-Augmented Large Language Models > B. Design of Distance Threshold
“For realworld deployment, we recommend setting τ slightly above the average distance (e.g., using the maximum observed distance) to ensure RAG remains effective while mitigating data leakage.”
Citations
Cites
Sentence-BERT: Sentence Embeddings using Siamese BERT-Networks
Reimers, N., & Gurevych, I. (2019) · Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP) · doi:10.18653/v1/d19-1410 · Cited by 12,778
Bengio, Y., Louradour, J., Collobert, R., & Weston, J. (2009) · Proceedings of the 26th Annual International Conference on Machine Learning · doi:10.1145/1553374.1553380 · Cited by 5,366
Survey of Hallucination in Natural Language Generation
Ji, Z., Lee, N., Frieske, R., Yu, T., Su, D., Xu, Y., Ishii, E., Bang, Y. J., Madotto, A., & Fung, P. (2023) · ACM Computing Surveys · doi:10.1145/3571730 · Cited by 5,025
Membership Inference Attacks Against Machine Learning Models
Shokri, R., Stronati, M., Song, C., & Shmatikov, V. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.41 · Cited by 4,754
Huang, L., Yu, W., Ma, W., Zhong, W., Feng, Z., Wang, H., Chen, Q., Peng, W., Feng, X., Qin, B., et al. (2025) · ACM Transactions on Information Systems · doi:10.1145/3703155 · Cited by 4,688
SimCSE: Simple Contrastive Learning of Sentence Embeddings
Gao, T., Yao, X., & Chen, D. (2021) · Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing · doi:10.18653/v1/2021.emnlp-main.552 · Cited by 2,851
When Is ''Nearest Neighbor'' Meaningful?
Beyer, K., Goldstein, J., Ramakrishnan, R., & Shaft, U. (1999) · Lecture Notes in Computer Science · doi:10.1007/3-540-49257-7_15 · Cited by 2,403
A Survey of Large Language Models
Zhao, W. X., Zhou, K., Li, J., Tang, T., Dong, Z., Hou, Y., Zhang, B., Min, Y., Zhang, J., Liu, P., et al. (2026) · Frontiers of Computer Science · doi:10.1007/s11704-026-60308-3 · Cited by 2,093
Self-citationThe Enron Corpus: A New Dataset for Email Classification Research
Klimt, B., & Yang, Y. (2004) · Lecture notes in computer science · doi:10.1007/978-3-540-30115-8_22 · Cited by 1,238
Gemini: A Family of Highly Capable Multimodal Models
Gemini Team, Anil, R., Borgeaud, S., Alayrac, J.-B., Yu, J., Soricut, R., Schalkwyk, J., Dai, A. M., Hauth, A., Millican, K., et al. (2023) · arXiv · doi:10.48550/arxiv.2312.11805 · Cited by 990
Self-citation
Research works printed but not linked: 31
- Wei, Finetuned language models are zero-shot learners, 1
- Nijkamp, CodeGen: An open large language model for code with multi-turn program synthesis, 1
- Zhang, Prompting large language model for machine translation: A case study, 41092
- Lewis, Retrieval-augmented generation for knowledge-intensive NLP tasks, 33, 9459
- Ganju, 2024, Develop Secure, Reliable Medical Apps With Rag and Nvidia Nemo Guardrails
- Malec, 2025, Harnessing Rag in Healthcare: Use-cases, Impact, & Solutions
- 2024, Ai in Finance: The Promise and Risks of Rag
- 2023, Leveraging Retrieval-augmented Generation (rag) in Banking: A New Era of Finance Transformation
- 2024, Watsonx Assistant
- Qi, Follow my instruction and spill the beans: Scalable data extraction from retrieval-augmented generation systems, 48733
- Liu, AutoDAN: Generating stealthy jailbreak prompts on aligned large language models, 56174
- Yu, LLM-Fuzzer: Scaling assessment of large language model jailbreaks, 4657
- Yang, Large language models as optimizers, 12028
- Bengio, A neural probabilistic language model, 1
- 2025, Claude 3.7 Sonnet and Claude Code
- Möller, COVID-QA: A question answering dataset for COVID-19, 1
- Carlini, Extracting training data from large language models, 2633
- Zhou, 2024, TruVRF: Towards triple-granularity verification on machine unlearning, IEEE TIFS, 20, 4844
- Min, SILO language models: Isolating legal risk in a nonparametric datastore, 25132
- Khandelwal, Generalization through memorization: Nearest neighbor language models, 1
- Carlini, Extracting training data from diffusion models, 5253
- Peng, UPAM: Unified prompt attack in text-to-image generation models against both textual filters and visual checkers, 40200
- Gong, PAPILLON: Efficient and stealthy fuzz testing-powered jailbreaks for LLMs, 2401
- Xiao, 2024, C-pack: Packaged resources to advance general Chinese embedding, 641
- Lee, 2024, Open Source Strikes Bread-New Fluffy Embeddings Model
- Li, 2023, AnglE-optimized text embeddings, arXiv:2309.12871 · arXiv
- 2026, Optimizing Llms for Accuracy
- Lin, Rouge: A package for automatic evaluation of summaries, 74
- 2025, Cost of a Data Breach Report 2025
- Burgess, 2023, Openai’s Custom Chatbots Are Leaking Their Secrets
- 2025, Retrieval-Augmented Generation (RAG)
Cited by
A Survey of Secure Retrieval-Augmented Generation
Xu, Y., Zhang, M., Ge, Z., Li, H., Hu, N., Zhang, J. C., Wen, Z., Zhang, J. C., Li, Q., & Chen, L. (2026) · Findings of the Association for Computational Linguistics: EMNLP (Findings of EMNLP) · doi:10.48550/arxiv.2604.08304 · Cited by 6
Query-Efficient Agentic Graph Extraction Attacks on GraphRAG Systems
Yang, S., Zhang, J., Wang, Y., Lee, D., & Wang, S. (2026) · Proceedings of the conference - Association for Computational Linguistics. Meeting · doi:10.18653/v1/2026.acl-long.727 · Cited by 6
MIRAGE: Misleading Retrieval-Augmented Generation via Black-box and Query-agnostic Poisoning AttacksPreprint
Chen, T., He, Y., Wang, Y., Shao, S., Zheng, H., Liu, Z., Li, J., Qin, Z., Chen, Y., Chu, Z., et al. (2025) · arXiv (Cornell University) · doi:10.48550/arxiv.2512.08289 · Cited by 5
Self-citationPrivate Retrieval Augmented Generation via Random ProjectionPreprint
Yao, D., Rabbani, T., & Li, T. (2026) · arXiv (Cornell University)
Metadata
- Authors
- He, Y., Chen, Y., Li, Y., Shao, S., Qi, L., Li, B., Tao, D., & Qin, Z.
- Affiliations
- Zhejiang University (CN)
- Nanyang Technological University (SG)
- Venue
- IEEE Transactions on Information Forensics and Security
- Published
- 2026
- Volume
- 21
- Pages
- 5864-5879
- ISSN
- 1556-6013 (ISSN-L)
- 1556-6021
- OpenAlex
- W4415981883
- Cited by
- 4
- References
- 45
- Citations by year
- 2026: 3
- FWCI
- 4.26
- Type
- journal article
- Language
- en
- Open access
- green
- arxiv.org
- Licence
- Locations
- IEEE Transactions on Information Forensics and Security (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- DR-NTU (Nanyang Technological University) (submittedVersion)
- arXiv (Cornell University)
- Funders
- “Pioneer” and “Leading Goose” Research and Development Program of Zhejiang (2024C01169)
- National Natural Science Foundation of China (62441238, U2441240)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Topic Modeling
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Keywords
- retrieval-augmented generation, large language models, jailbreak prompts
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
A language model drew the claims from the paper on 2026-11-12, under version 3 of the claim definition (model deepseek-v4.1-flash, prompt extract-v3).
A second model labelled each claim on 2026-11-12 (model jev-1.13-20260917, definition revision gold-guideline-v0.2).
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
