B.Sc. Thesis / Undergraduate Research
A Security Evaluation Framework for Distributed Retrieval-Augmented Generation Systems
Abstract
Distributed RAG systems distribute knowledge across independent participants instead of relying on one centralized knowledge base. This introduces new trust assumptions about which participant to query and whether the information or behavior it reports can be trusted. This thesis develops a systematic security evaluation framework for identifying and testing these trust assumptions, and applies it to two distributed RAG architectures — DRAG and Reliable-dRAG — deriving six attack classes across the CIA triad and six corresponding defense mechanisms.
Research Question
What trust assumptions do distributed RAG architectures rely on, and how can those assumptions be systematically identified, attacked, and defended against?
Motivation
As RAG systems move toward decentralized and multi-party deployments, the security guarantees a designer can rely on change. Without a systematic way to surface hidden trust assumptions, distributed RAG systems risk being deployed with confidentiality, integrity, and availability gaps that only surface after real-world exploitation.
Threat Model
The framework assumes an attacker who can participate in or influence the distributed retrieval process — for example, by controlling or compromising one or more participant nodes — without necessarily requiring privileged access to the system as a whole. Attacks are derived directly from the trust assumptions each architecture makes about its participants.
Methodology
The thesis proposes a seven-step security evaluation procedure applied consistently across the target architectures.
- 01Enumerate trust assumptions in the target architecture
- 02Identify the component carrying each assumption
- 03Derive attacks against those assumptions
- 04Implement the attacks
- 05Evaluate their impact
- 06Design corresponding defenses
- 07Measure recovery and overhead
Systems evaluated: DRAG, Reliable-dRAG
Attacks
Integrity
Data Poisoning
Injecting manipulated or false content into the distributed knowledge base to influence retrieved context and downstream generation.
Source Selection Manipulation
Manipulating which participant or source is selected during retrieval to bias the information returned to the system.
Confidentiality
Knowledge Extraction
Recovering private or restricted content held by a participant through crafted retrieval queries.
Membership Inference
Determining whether a specific document or record is present in a participant's knowledge base.
Availability
Selective Forwarding
A participant selectively drops, delays, or withholds forwarding of retrieval requests or results to degrade system reliability.
Denial of Service
Overwhelming a participant or the coordination layer to make retrieval unavailable or unreliable.
Defenses
Replication and Cross-Peer Validation
Cross-checks results across multiple participants to detect and reduce the impact of poisoned or manipulated responses.
Topic-Claim Quota Enforcement
Limits how much influence a single participant or source can exert over a given topic or claim, reducing source selection manipulation and grounding manipulation.
Layered Extraction Prevention
Applies multiple layers of query and response filtering to reduce the effectiveness of knowledge extraction attempts.
Privacy-Preserving Retrieval
Reduces the signal available for membership inference by limiting what retrieval responses reveal about participant-held content.
Reputation-Based Forwarding Defense
Tracks participant forwarding behavior over time to detect and route around participants exhibiting selective forwarding.
Layered Congestion Defense
Applies layered rate-limiting and congestion control to reduce the impact of denial-of-service attempts on retrieval availability.
Key Findings
Grounding-Farming
A previously undocumented attack against Reliable-dRAG's reliability mechanism. It requires no privileged access and can evade the deployed defense because the attack does not exhibit the transaction properties that the defense observes.
Knowledge Extraction Effectiveness Varies by Corpus Type
Knowledge extraction recovered approximately 20–30% of a multiple-choice corpus under the evaluated setting, compared with approximately 1–6% for the evaluated free-text corpora.
Defenses Evaluated for Recovery and Overhead, Not Just Attack Prevention
All six defense mechanisms were evaluated on recovery and overhead rather than attack prevention alone, reflecting a practical security-engineering trade-off rather than a purely theoretical one.
- Six corresponding defense mechanisms were designed and evaluated against the derived attack classes.
- The work studies recovery, overhead, and security impact rather than reporting attacks in isolation.
Contribution
- A reusable, seven-step security evaluation procedure for distributed RAG architectures
- Six attack classes derived systematically across the CIA triad
- Discovery of Grounding-Farming, a previously undocumented attack on a deployed reliability mechanism
- Six defense mechanisms evaluated for both security impact and operational overhead
Limitations
- The framework was demonstrated on two systems, DRAG and Reliable-dRAG, to show transfer of the procedure rather than to claim universal generalization across all distributed RAG architectures.
- Attack effectiveness figures (such as knowledge-extraction recovery rates) are specific to the evaluated corpora and settings and may not transfer directly to other deployments.
Related Research
Interested in working together?
I am open to research discussions, collaborations, and opportunities related to AI security, LLM security, RAG, multi-agent systems, privacy, and trustworthy AI.