Mitigating Database Leakage in RAG Systems with Keyword-Grounded Fact Substitution
This paper proposes KFS-RAG, a defense for prompt-injection-driven data leakage in RAG systems that replaces raw retrieved passages with a compact, sanitized set of keyword-grounded facts before handing context to the generator. The interesting bit is the two-stage grounding pipeline—attention/causal perturbation to pick influential keywords, then an auxiliary LLM to rewrite evidence around them—which directly reduces exposure of sensitive retrieved text while preserving answer quality, though it likely adds latency/cost and depends on the reliability of the keyword selection and fact-generation steps.
Abstract
Retrieval-Augmented Generation (RAG) has emerged as a powerful paradigm for combining large language models (LLMs) with external knowledge sources. However, RAG systems remain vulnerable to prompt injection attacks, which may mislead the retriever or generator to expose sensitive database contents. To address this issue, we propose KFS-RAG, a defense that mitigates information leakage by reformulating the retrieved context. Specifically, our method first identifies a small set of influential keywords from the retrieved context via an attention rollout plus a causal perturbation mechanism. These keywords are then used to guide an auxiliary LLM to generate a compact set of keyword-grounded facts from the retrieved passages. Finally, the original context is substituted with these curated facts, ensuring that the generator operates on sanitized evidence rather than the raw retrieved text. Experimental evaluations demonstrate that KFS-RAG significantly reduces the risk of database leakage under injection attacks while maintaining response accuracy and relevance. This work highlights a practical pathway toward building secure and trustworthy RAG systems.