Retrieval-augmented generation (RAG) extends large language models (LLMs) with external knowledge, but this access path also introduces security risks that existing work often conflates with inherent LLM flaws. We frame secure RAG as securing external knowledge access and organize the literature with SLOT, a taxonomy along four axes: the attack Surface (S) where an adversary acts, the defense Layer (L) that controls the same point, the Objective (O) it breaks following the CIA properties, and the Target (T) it pursues, from a single known query (T1) to target-claim manipulation across a query distribution (T2). Mapping attacks, defenses, remediation, and evaluation onto a six-stage knowledge-access pipeline, we expose two structural mismatches. Finally, we discuss directions for more realistic targets, no-blind-spot and adaptively evaluated defenses, stronger confidentiality, and evaluation for multimodal and agentic RAG. The curated paper list for RAG security is in: https://github.com/TreeAI-Lab/Awesome-RAG-Security.

翻译：检索增强生成（RAG）通过引入外部知识扩展了大语言模型（LLM），但这种访问路径也引入了安全风险，现有工作常将其与LLM固有缺陷混为一谈。我们将安全RAG框架定义为保障外部知识访问的安全性，并采用SLOT分类法对文献进行系统化整理。该分类法沿四个维度展开：攻击面（S）——攻击者作用的环节，防御层（L）——控制相同环节的机制，目标（O）——根据CIA属性破坏的对象，以及目标（T）——从单一已知查询（T1）到跨查询分布的目标声明操控（T2）。通过将攻击、防御、补救措施及评估映射到六阶段知识访问流水线中，我们揭示了两种结构性错配。最后，我们探讨了更现实目标、无盲点且经自适应评估的防御策略、更强机密性保障，以及多模态与智能体RAG评估体系的发展方向。RAG安全相关论文清单详见：https://github.com/TreeAI-Lab/Awesome-RAG-Security。