RAGFence

• 

  Home

• 

  Four Primitives project uses

• 

  Overview Page

• 

  Authorization Matrix

• 

  Inspecting the corpus

• 

  Audit page for Vulnerable RAG

• 

  Audit Report for Vulnerable RAG

Inspiration

Enterprise AI assistants are increasingly being connected to internal documents, knowledge bases, and sensitive company data.

The problem is that traditional access control does not automatically guarantee safe AI behavior.

A document system may correctly say:

Engineering → DENY
Executive → ALLOW

But a RAG system can still retrieve that restricted document, place it inside the LLM context, and reveal its information through a generated answer.

The user may never ask for the document directly. They might simply ask:

“Are there any major acquisitions planned this quarter?”

If restricted information was retrieved behind the scenes, the AI may answer it anyway.

That led to the core question behind RAGFence:

Your data says DENY. Does your AI agree?

RAGFence was also motivated by recent research into privacy leakage from RAG systems, particularly “Five Queries Are Enough” (MEntA, USENIX Security 2026).

The paper demonstrates that information about private documents can survive through generated responses even when the model does not directly quote the source. A model may paraphrase sensitive information while preserving its meaning.

That observation inspired two security questions in RAGFence:

1. Authorization Boundary: Can a user learn information from a resource they are not authorized to access?
2. Membership Privacy: Can a user infer that a candidate document exists inside the RAG corpus at all?

What it does

RAGFence is an automated security testing system for RAG applications.

A company provides:

• its RAG endpoint
• identities and roles to test
• the expected authorization policy
• protected resources
• sensitive facts that should not leak

RAGFence then automatically attacks the denied authorization boundaries.

For example:

Alice → Engineering

Raven Acquisition
Allowed roles → Executive

Alice + Raven Acquisition → DENY

Built With

• bm25-retrieval
• docker
• fastapi
• featherless.ai
• next.js
• pydantic
• python
• react
• render
• tailwind-css
• typescript
• vercel