Evaluating Indirect Prompt Injection in RAG Systems: Defense-in-Depth, Retrieval Effects, and Security–Utility Trade-offs

Statut : article court accepté le 31 août 2026 à IEEE/WIC WI-IAT 2026 (Brisbane, 3–6 décembre 2026). Version finale déposée ; actes IEEE à paraître.

Résumé

IPI robustness in RAG is not a model-only property: it emerges from the interaction between retrieval exposure, prompt assembly, and defense-layer composition. We present a controlled benchmark and defense-in-depth evaluation framework for indirect prompt injection in RAG, evaluating 12 attack families across five datasets, three retriever strategies, and three generators, with four metrics including the new Security-Oriented Answer Utility (SAU). Heuristic defenses reach 0% attack success on canonical attacks; retrieval-optimized and adaptive attacks remain open threats; retrieval design is a security parameter; and defense composition can be non-monotonic. Code, data and results are public.