Error message

Deprecated function: Array and string offset access syntax with curly braces is deprecated in include_once() (line 20 of /home/frontpnj/public_html/journals/ijfstr/includes/file.phar.inc).

Security and privacy challenges of RAG systems

Firoz Mohammed Ozman *

Solutions Architect, Enterprise Architecture, Anecca Ideas Corp, Toronto, Canada.
* Corresponding Author                                                                                                                    
ORCID Details
 
Research Article
International Journal of Frontiers in Science and Technology Research, 2026, 10(02), 001–013.
Article DOI: 10.53294/ijfstr.2026.10.2.0022
Publication history: 
Received on 07 July 2026; revised on 13 August 2026; accepted on 15 August 2026
 
Abstract: 
Retrieval-Augmented Generation (RAG) systems enable robust knowledge integration for large language models but also pose significant security and privacy risks. RAG systems combine two components: a retriever, which searches external data sources for relevant information, and a generator, typically a large language model that uses both the retrieved documents and user queries to produce answers. This study conducts a systematic literature review to assess these challenges using Socio-Technical Systems Theory (which considers interactions among people, technology, and organizational context) and Privacy by Design (PbD, a framework for embedding privacy into system design). Addressing five objectives, the research detects and classifies privacy attacks, evaluates risks throughout the storage, retrieval, and generation phases, scrutinizes measurement methods, contrasts mitigation strategies, and introduces a unified solution. The work culminates in the Integrated Privacy-Preserving RAG Framework (IPRAG), a five-tier architecture supported by a three-phase deployment protocol. This study presents a detailed, actionable approach to constructing secure, privacy-focused RAG systems.
 
Keywords: 
Retrieval-Augmented Generation, RAG privacy, RAG security, Privacy by Design, differential privacy, socio-technical systems, IPRAG, membership inference, data poisoning
 
Full text article in PDF: 
 
Copyright information: 
Copyright © 2026 Author(s) retain the copyright of this article. This article is published under the terms of the Creative Commons Attribution Liscense 4.0