Retrieval-augmented generation (RAG) significantly enhances large language models (LLMs) but introduces novel security risks through external knowledge access. While existing studies cover various RAG vulnerabilities, they often conflate inherent LLM risks with those specifically introduced by RAG. In this paper, we propose that secure RAG is fundamentally about the security of the external knowledge-access pipeline. We establish an operational boundary to separate inherent LLM flaws from RAG-introduced or RAG-amplified threats. Guided by this perspective, we abstract the RAG workflow into six stages and organize the literature around three trust boundaries and four primary security surfaces, including pre-retrieval knowledge corruption, retrieval-time access manipulation, downstream context exploitation, and knowledge exfiltration. By systematically reviewing the corresponding attacks, defenses, remediation mechanisms, and evaluation benchmarks, we reveal that current defenses remain largely reactive and fragmented. Finally, we discuss these gaps and highlight future directions toward layered, boundary-aware protection across the entire knowledge-access lifecycle.

翻译：检索增强生成（RAG）显著增强了大语言模型（LLM），但通过外部知识接入引入了新的安全风险。现有研究涵盖多种RAG漏洞，但常将固有的LLM风险与RAG特定引入的风险混为一谈。本文提出，安全RAG本质上关乎外部知识接入管道的安全性。我们建立了一个操作边界，以区分固有LLM缺陷与RAG引入或放大的威胁。基于这一视角，我们将RAG工作流抽象为六个阶段，并围绕三个信任边界和四个主要安全面对文献进行组织，包括检索前知识污染、检索时访问操纵、下游上下文利用及知识窃取。通过系统审视相应的攻击、防御、补救机制及评估基准，我们揭示当前防御仍主要处于被动且碎片化状态。最后，我们讨论这些差距，并强调未来在知识接入全生命周期中实现分层、边界感知保护的方向。