Retrieval-augmented generation (RAG) extends large language models (LLMs) with external knowledge, but this access path also introduces security risks that existing work often conflates with inherent LLM flaws. We frame secure RAG as securing external knowledge access and organize the literature with SLOT, a taxonomy along four axes: the attack Surface (S) where an adversary acts, the defense Layer (L) that controls the same point, the Objective (O) it breaks following the CIA properties, and the Target (T) it pursues, from a single known query (T1) to target-claim manipulation across a query distribution (T2). Mapping attacks, defenses, remediation, and evaluation onto a six-stage knowledge-access pipeline, we expose two structural mismatches. Finally, we discuss directions for more realistic targets, no-blind-spot and adaptively evaluated defenses, stronger confidentiality, and evaluation for multimodal and agentic RAG.

翻译：检索增强生成（RAG）通过外部知识扩展了大语言模型（LLM），但这一访问路径也引入了安全风险，现有工作常将其与LLM固有缺陷混为一谈。我们提出将安全RAG定义为保障外部知识访问的安全性，并采用SLOT分类法对文献进行系统化整理，该分类法沿四个维度展开：攻击发生的攻击面（S）、控制同一环节的防御层（L）、按CIA属性破坏的目标目标（O），以及追求的目标类型（T）——从单个已知查询（T1）到跨查询分布的目标声明操控（T2）。通过将攻击、防御、修复与评估映射至六阶段知识访问管道，我们揭示了两种结构性错配。最后，我们探讨了面向更真实目标、无盲点自适应评估的防御、更强保密性，以及多模态与智能体RAG评估的未来方向。