RAG LLMs are Not Safer: A Safety Analysis of Retrieval-Augmented Generation for Large Language Models
Shiyue Zhang, M. Dredze, AI Bloomberg, M. Zitnik, Meng Jiang, Mohit Bansal, James Zou, Jian Pei, Jian Liu, Jianfeng Gao, Jiawei Han, Jieyu Zhao, Jiliang Tang, Jindong Wang, Joaquin Vanschoren, John C. Mitchell, Kai Shu, Kaidi Xu, Kai-Wei Chang, Lifang He, Lifu Huang, Michael Backes, Aaron Hurst, Adam Lerer, Adam P. Goucher, Adam Perelman, Aditya Ramesh, Aidan Clark, AJ Os-trow, Akila Welihinda, Alan Hayes, Alec Radford, Alon Jacovi, Andrew Wang, Chris Alberti, Connie Tao, Jon Lipovetz, Kate Olszewska, Lukas Haas, Michelle Liu, Nate Keating, Adam E. Bloniarz, Carl Saroufim, Corey Fry, Dror Marcus, Doron Kukliansky, Gau-rav Singh Tomar, James Swirhun, J. Xing, Lily Wang, Madhu Gurumurthy, Michael Aaron, Moran Ambar, Rachana Fellinger, Rui Wang, Zizhao Zhang, S. Goldshtein, Dipanjan Das. 2025, Neel Jain, Avi Schwarzschild, Yuxin Wen, Gowthami Somepalli, John Kirchenbauer, Ping-yeh Chiang, Micah Goldblum, Aniruddha Saha, Jonas Geiping, Tom Goldstein. 2023, Jiaming Ji, Mickel Liu, Josef Dai, Xuehai Pan, Chi Zhang, Juntao Dai, Tianyi Qiu, Bo Chen, Borong Zhang, Hantao Lou, Kaile Wang, Ya Duan
North American Chapter of the Association for Computational Linguistics
Abstract
Efforts to ensure the safety of large language models (LLMs) include safety fine-tuning, evaluation, and red teaming. However, despite the widespread use of the Retrieval-Augmented Generation (RAG) framework, AI safety work focuses on standard LLMs, which means we know little about how RAG use cases change a model's safety profile. We conduct a detailed comparative analysis of RAG and non-RAG frameworks with eleven LLMs. We find that RAG can make models less safe and change their safety profile.
Categories
Framework mappings
- MEASUREMeasure
Suggested from the entry's categories.
Cite
@article{zhang2025rag,
title = {{RAG LLMs are Not Safer: A Safety Analysis of Retrieval-Augmented Generation for Large Language Models}},
author = {Shiyue Zhang and M. Dredze and {AI Bloomberg} and M. Zitnik and Meng Jiang and Mohit Bansal and James Zou and Jian Pei and Jian Liu and Jianfeng Gao and Jiawei Han and Jieyu Zhao and Jiliang Tang and Jindong Wang and Joaquin Vanschoren and John C. Mitchell and Kai Shu and Kaidi Xu and Kai-Wei Chang and Lifang He and Lifu Huang and Michael Backes and Aaron Hurst and Adam Lerer and Adam P. Goucher and Adam Perelman and Aditya Ramesh and Aidan Clark and AJ Os-trow and Akila Welihinda and Alan Hayes and Alec Radford and Alon Jacovi and Andrew Wang and Chris Alberti and Connie Tao and Jon Lipovetz and Kate Olszewska and Lukas Haas and Michelle Liu and Nate Keating and Adam E. Bloniarz and Carl Saroufim and Corey Fry and Dror Marcus and Doron Kukliansky and Gau-rav Singh Tomar and James Swirhun and J. Xing and Lily Wang and Madhu Gurumurthy and Michael Aaron and Moran Ambar and Rachana Fellinger and Rui Wang and Zizhao Zhang and S. Goldshtein and Dipanjan Das. 2025 and Neel Jain and Avi Schwarzschild and Yuxin Wen and Gowthami Somepalli and John Kirchenbauer and Ping-yeh Chiang and Micah Goldblum and Aniruddha Saha and Jonas Geiping and Tom Goldstein. 2023 and Jiaming Ji and Mickel Liu and Josef Dai and Xuehai Pan and Chi Zhang and Juntao Dai and Tianyi Qiu and Bo Chen and Borong Zhang and Hantao Lou and Kaile Wang and Ya Duan},
year = {2025},
month = apr,
journal = {North American Chapter of the Association for Computational Linguistics},
eprint = {2504.18041},
archivePrefix = {arXiv},
doi = {10.48550/arXiv.2504.18041},
url = {https://www.semanticscholar.org/paper/f716a18b462826004899010dfc30947f9c01ef90}
}