Differentially Private GraphRAG: Protecting relational connectivity and semantics

The researchers propose RelGuard, which they describe as the first GraphRAG defense framework with formal differential privacy guarantees, addressing the risk that under black-box access an attacker reconstructs the knowledge graph and recovers connections and relational semantics between entities. The paper formally defines relation differential privacy (relation-DP), which constrains the distinguishability of the mechanism's output by the semantic distance between alternative relations and incorporates consideration of relation deletion; the defense mechanism sanitizes source documents before GraphRAG indexing, perturbing relation predicates or removing the corresponding connections via the exponential mechanism. Experiments on three GraphRAG systems and two targeted reconstruction attacks show that RelGuard provides stronger protection than four existing defense mechanisms while better preserving downstream utility.