snapRAG recovers up to 96.9% of a test RAG corpus through repeated queries

A retrieval assistant can refuse to hand over its entire underlying document store and still reveal much of that store one answer at a time. The November 9 snapRAG paper tests a query strategy that repeatedly steers retrieval toward portions of the indexed corpus not already seen.

The unit of leakage is a recovered chunk

The attacker in the study had query access, not database credentials or direct access to document storage. It tracked retrieved snippets, generated queries to explore new semantic regions and assembled the responses into a reconstructed collection. This is different from a prompt saying “dump all documents.” The snapRAG paper measures extracted corpus coverage and queries required to recover new material, with an explicit comparison to other extraction strategies.

Across five evaluated RAG targets, snapRAG reported final extraction rates of 69.7%, 68.5%, 79.3%, 92.1% and 96.9%. Three targets used a 2,000-query budget and the other two used 1,000. A reported factor of up to 6.77 fewer queries applies to a selected baseline comparison for reaching half the target collection, not every deployed assistant or every measured endpoint. The Case also records defense-test results and the limits of that evaluation.

These experiments do not prove that any particular customer's private workspace was compromised. Extraction success depends on which documents retrieval exposes, how chunks overlap, the query budget and whether document-level authorization exists. A front-end model's refusal to output a full database is not an access-control boundary if the retrieval service itself will repeatedly return its contents.

Protect source documents at retrieval time using the requesting principal's ACLs, then measure cumulative disclosure across sessions. Operators can monitor overlapping query patterns and enforce disclosure budgets, but rate limiting alone is not a substitute for authorizing each retrieved chunk. The relevant audit evidence is the source material actually returned, not only the assistant’s final phrasing.