snapRAG extracted indexed knowledge from retrieval assistants under a controlled query budget

Unlike a prompt injection that directs an agent to email secrets, snapRAG probes a retrieval-augmented question-answering system repeatedly and uses observed answers to infer the material held in its retrieval corpus. The attack exploits a service that reveals content in small, individually plausible answers even while it does not offer a general export API. Researchers iterate candidate questions and aggregate overlaps to recover larger segments of the hidden indexed collection.

The research reports extraction up to 96.9% under its strongest controlled setup and particular query and scoring configuration, not a measured breach of an identified production enterprise tenant. Success depends on corpus characteristics, retrieval policy, exposed citation/excerpt behavior and the permitted budget. The paper does not imply that an arbitrary LLM possesses every indexed document in its weights.

Retrieval-augmented AI services where user queries are allowed to draw from a repository whose entire contents should not be disclosed through the user's effective authorization.

The reported maximum applies to benchmark conditions and cannot be extrapolated to all RAG products, document security models or query quotas. No real-world victim or actual customer dataset theft was demonstrated.

The paper describes a black-box corpus-extraction attacker who can issue many ordinary-looking queries to a retrieval assistant, but does not have direct access to its indexed documents. snapRAG turns previously returned chunks into new candidate queries, mutating token choices and calibrating the similarity threshold to visit less explored parts of the index. Its extraction frontier therefore exploits aggregate disclosure over time rather than one obviously forbidden retrieval request.

Across tested benchmark RAG targets, the authors report up to 96.9% chunk recovery in a chosen configuration, a 6.77-fold query reduction to reach half the corpus against selected baselines, and extraction between 50.7% and 96.3% on their defended targets. These are controlled, denominator-dependent retrieval measurements, not a demonstrated theft of a real company's private files. Controls need to address both caller-level document ACLs and repeated-query extraction patterns; a generic prompt telling the model not to reveal the index cannot enforce corpus authorization.