Privacy-preserving retrieval-augmented generation via random projection

1. 01What problem does this paper attempt to solve?

   A RAG retrieval corpus can be extracted via API queries to reveal sensitive text; the authors use the same random projection to reduce extraction while preserving similarity.

   How to reduce the risk of sensitive information leakage from the RAG retrieval corpus via data extraction attacks without providing formal differential privacy guarantees, while preserving retrieval and generation utility.

   • Scenario: RAG uses external knowledge to augment LLMs. The authors state that carefully crafted prompts can extract personal information such as emails, phone numbers, and URLs; attack queries can look very similar to normal queries, and simple access control may block ordinary users.
   • Existing shortcomings: The authors state that existing defenses focus on differential privacy. Formal guarantees target worst-case scenarios, often raising perplexity and being more complex to implement. Synthetic data, local DP on addresses, and mixing original text with cleaned documents are described by the authors as reducing efficiency on large data, or requiring additional training, validation, or first labeling all private tokens.
   • Observation: The authors believe that blocking existing strong attacks does not need to rely on formal DP. Certain random projections approximately preserve pairwise similarity after dimensionality reduction; the added randomness changes the retrieval corpus embeddings, so users can still get reasonably accurate answers while attackers find it hard to recover the original text.
   • Approach: Propose random projection (RP) that multiplies retrieval corpus embeddings and query embeddings by the same matrix, used with KNN-LM and Standard RAG, and evaluate privacy by the empirical success rate of strong extraction attacks.
   • Threat model:
     • Goal: Extract sensitive information from the retrieval corpus. The authors treat identifiable details such as names, addresses, phone numbers, and emails as sensitive, and overly generic, low-distinctiveness content as non-sensitive (Table 1).
     • Knowledge: black-box. Only text answers from the model API are visible; parameters, projection matrix, logits, embeddings, and hidden representations are unavailable. The attacker knows RP is used but not the specific matrix.
     • Capability: Submit queries via the API, in one or multiple rounds, including repeated queries (Section 4.2) and multi-round adaptive attacks (Section 4.3).
     • System and out of scope: The victim system is an internal retrieval corpus and a RAG that only returns text answers to users. The authors state they do not evaluate network and system-level attacks, white-box, embedding inversion, projection matrix inversion, or side channels requiring side information.

   Collapse this answer

2. 02What related research exists?

   The paper discusses privacy RAG defenses and similarity-preserving random projections separately, and positions itself as an empirical baseline that does not pursue formal guarantees.

   Leakage and defenses in privacy RAG

   • Huang et al. (2023), Zeng et al. (2024), He et al. (2025), Wang et al. (2025), Jiang et al. (2024), and Di Maio et al. (2024): Different RAGs can expose personal data such as emails, phone numbers, and URLs from external corpora. The paper cites these works to illustrate the risk and follows their attack protocols; the Related Works section does not critique the attacks individually.
   • DP sampling and aggregation by Koga et al. (2024) and Grislain (2025), and purely synthetic data by Zeng et al. (2025): The authors claim these defenses reduce efficiency on large data and often require additional validation or training. The introduction lists Koga et al. (2024) and Wu et al. (2025) as the main concerns in the DP direction.
   • Zhao and Zhang (2025): The authors cite that synthetic data alone cannot fully prevent memorization or leakage. He et al. (2025) apply local DP to content like addresses; the authors claim privacy can be at the sentence or paragraph level, and simple masking is insufficient. Thareja et al. (2025) mix original and cleaned documents; the authors claim all privacy tokens must be identified, which is unsuitable for large-scale RAG.

   Similarity-preserving random projections

   • Johnson and Lindenstrauss (1984): Random projections can reduce dimensionality with high probability while preserving some similarity.
   • Blocki et al. (2012) and subsequent works grouped together in the paper: In specific applications, methods built on projections can achieve differential privacy. The authors claim the paper shows that random projection itself can also be used for various RAGs; the experiments adapt Blocki et al.'s method into DP-RP-G usable for document retrieval.

   Baseline methods and benchmarks/datasets

   • Baseline methods: No-retrieval parametric model, vanilla RAG, DP-RP-G, DPSparseVoteRAG (Koga et al., 2024).
   • Benchmarks/datasets: Enron Email, ECHR, C4, HotpotQA. Repeated queries reference Huang et al. (2023); multi-turn attacks use Jiang et al. (2024) and Yao et al. (2026); membership inference uses E-MIA (Guan et al., 2026).

   The authors place the paper in a setting without formal privacy guarantees, using success rates of existing strong attacks to evaluate leakage. The authors claim the results are the first to suggest that random projection can serve as a practical baseline for privacy RAG, while formal DP may be overkill for blocking existing attacks and harms utility.

   Collapse this answer

3. 03How does the paper address this problem?

   Offline and online share the same Gaussian matrix to project embeddings, then perform nearest-neighbor retrieval or concatenation for generation in the low-dimensional space.

   The method is RP: offline, all retrieval corpus embeddings are projected with the same Gaussian matrix; online, only the query undergoes one matrix-vector multiplication, and retrieval is performed in the projected space.

   Two architectures and sensitive content

   • KNN-LM: The next token is a linear combination of the parametric language model distribution and the k-nearest-neighbor distribution. The neighbor distribution is a softmax over cosine similarities between the query and retrieval corpus embeddings. Experiments use λ=0.1, K=1024 (Section 4.1); Algorithm 2 writes λ=0.25.
   • Standard RAG: Text is retrieved by similarity, concatenated with the original query, and given to the parametric LLM. The authors use this name in contrast to KNN-LM and note that other RAG architectures exist.
   • The retrieval corpus is n natural language documents. The embedding function f is a tokenizer plus embedding layer; the paper assumes the encoder is a fixed pretrained model. Sensitive and non-sensitive comparison examples are in Table 1; identity details are not copied here.

   Projection and generation

   • Sample R_ij∼𝒩(0,1/k), where R is a k×d matrix. Offline, compute ẽi=R ei once and store in FAISS or another index; the authors claim this adds no inference-time overhead. Online, compute x=f(q), x̃=Rx.
   • KNN-LM takes neighbors in the projected space, then selects the next token according to P(y∣ x)=λ P_LM(x)+(1−λ)P_KNN(x̃,Ẽ_D) until reaching the maximum length or an end token.
   • Standard RAG uses projected cosine similarity to retrieve the most relevant text, concatenates it to the original query, and generates (Algorithm 1). The only tunable parameter of RP is k. The authors use k=100 and claim utility is comparable to k=1600 with less computation. For d=2048, the authors suggest smaller k (e.g., 25) for more privacy or lower offline latency, and larger k (e.g., 1600) for more utility.

   Similarity preservation and replacement

   • The authors use the Johnson–Lindenstrauss argument: with variance 1/k, the projected L2 distance falls within (1±λJL) times the original distance. Appendix B.1 gives the expected projected cosine similarity as the original similarity times (1-(1-ρ)/(2k)), plus an O(1/k^2) remainder. Appendix B.2 performs a consistency check with synthetic vectors and 100 retrieval items generated by Llama3-8B-Instruct, each with 100 queries.
   • The privacy mechanism is changing the retrieved neighbors: embeddings sufficiently close to the original top-1 can surpass it after projection with non-negligible probability (Appendix C, condition written as normalized embedding L2 distance not exceeding Δ). The authors claim sensitive tokens may be replaced by semantically close tokens. Appendix C's probability lower bound depends on Δ, the original top-1 similarity, k, and an upper bound on the Fisher-transformed correlation coefficient; formulas are not expanded here.

   Comparison method DP-RP-G and judgment

   • DP-RP-G follows Blocki et al.: first project, then clip vectors to norm at most c, then add Gaussian noise. Noise standard deviation is c times sqrt(2 ln(1.25/δ)) divided by ε; noise is added only to retrieval corpus embeddings, not to queries (Algorithm 3). The original method assumes binary or bounded vectors; the authors claim LLM embeddings do not satisfy that assumption, so they add clipping.
   • Targeted leakage is counted by whether annotated information is extracted; untargeted C4 uses ROUGE-L; multi-turn attacks use block overlap, semantic similarity, and extended edit distance. Specific thresholds and budgets are in the experimental setup.

   Collapse this answer

4. 04What experiments did the paper conduct?

   In Table 2, RP leakage is lower than unprotected RAG; on ECHR/Llama3-1B, RP's PPL is higher than RAG.

   Experimental setup

   • Models: GPT-2 with Enron Email; Llama3-1B-Instruct and Qwen3-4B with ECHR; Llama3-8B-Instruct with C4; Qwen2-7B-Instruct with HotpotQA. The four pairings in Section 4.1 do not list Qwen3-4B, but Table 2 and Figure 4 use it. ECHR sensitive information is annotated by Llama3-8B-Instruct.
   • Architectures and baselines: KNN-LM (λ=0.1, K=1024) and Standard RAG. Comparisons are no-retrieval parametric model, vanilla RAG, DP-RP-G, DPSparseVoteRAG. ε takes 1, 5, 10, 20.
   • Data scale: Enron is fully indexed, 4576 sensitive items; ECHR uses 10K documents; C4 selects 5000 items; HotpotQA training set is indexed, over 90K documents, distractor setting, multi-turn attacks randomly sample 100 documents. The authors also state the largest evaluated retrieval corpus is about 100K HotpotQA documents, about 200 million tokens.
   • Metrics and judgment: Utility is PPL, with F1 and EM for ECHR and HotpotQA. Privacy is number or percentage of leaked items, CRR, SS, EED, E-MIA membership leakage rate, and retrieval cosine similarity. Success is not scored by an LLM judge.
   • Attack protocols: Repeated queries are made 10 times per item; any success counts as leakage, and it is assumed that repeating the same query more than 10 times is blocked; dataset-related priors can be injected, construction details are in Section E, query sentences are not copied here. C4 leakage is defined as generation with ROUGE-L greater than 0.5 against any corpus sample. Multi-turn attack budget is at most 200 queries; block length 1500 words, maximum overlap 300 words, reconstruction overlap exceeding 1200 words counts as block recovery.
   • Other parameters: RP uses k=100. DP-RP-G reports the best among nine clipping bounds from 0.1 to 100; the paper does not list the chosen bound for each setting. DPSparseVoteRAG's subset number m is selected as 50 from 10 to 60. δ is 10^-4 for Enron and ECHR, 10^-5 for HotpotQA and C4. Embedding dimensions: GPT-2 is 128, Llama3 is 2048, Qwen2 is 3584; using each model's last hidden state. Maximum output 2048 tokens, repetition penalty 0.75. The paper does not report the number of repetitions for utility metrics.

   Main results

   Leakage and PPL under repeated queries, according to Table 2. Enron and C4 leakage are counts, ECHR is percentage.

   Swipe horizontally to read the table

   Setting	RAG leakage	RP leakage	RAG PPL	RP PPL
   KNN-LM, Enron/GPT-2	13	0	2.87	2.89
   KNN-LM, ECHR/Llama3-1B	82.72%	2.26%	2.90	46.15
   KNN-LM, ECHR/Qwen3-4B	19.08%	1.94%	1.55	1.55
   KNN-LM, C4/Llama3-8B	269	17	3.16	2.98
   Standard RAG, Enron/GPT-2	217	3	1.58	2.05
   Standard RAG, ECHR/Llama3-1B	37.92%	2.16%	9.84	47.92
   Standard RAG, ECHR/Qwen3-4B	21.30%	2.05%	1.19	1.19
   Standard RAG, C4/Llama3-8B	358	23	2.83	2.96

   • Utility exceptions: The authors claim RP's perplexity is close to unprotected RAG. The ECHR/Llama3-1B rows are not like that. Same-table F1: KNN-LM RAG 90.32, RP 87.70; Standard RAG RAG 97.18, RP 66.70. Qwen3-4B F1 is closer: KNN-LM 90.32 vs 89.32, Standard RAG 97.32 vs 95.43.
   • DP does not always have lower leakage: The authors claim increasing the DP budget lowers perplexity and increases leakage. On Standard RAG, C4/Llama3-8B, DPSparseVoteRAG leakage at ε=1, 5, 10, 20 is 0, 33, 79, 203 items. Exceptions: Standard RAG, ECHR/Qwen3-4B, DP-RP-G at ε=1 leaks 25.43%, higher than RAG's 21.30%; KNN-LM, ECHR/Llama3-1B, DPSparseVoteRAG at ε=5, 10, 20 leaks 37.86%, 38.68%, 38.82%, and at ε=1 is 1.75% but PPL is 228.59.
   • Compared to no-retrieval model and summary numbers: KNN-LM no-retrieval model leakage is Enron 0 items, ECHR/Llama3-1B 32.82%, ECHR/Qwen3-4B 2.03%, C4 0 items. The authors claim RP is roughly at the same protection level as that model; C4's two RP rows are above 0, while ECHR/Llama3-1B's parametric model is above RP. Standard RAG's parametric model is listed as –. The authors claim utility improves by more than 50% on average relative to baselines, and drops 7% overall relative to vanilla RAG; the paper does not provide per-cell calculations for these two claims.

   Multi-turn adaptive attacks

   HotpotQA, KNN-LM, Qwen2-7B-Instruct. Two attacks, Jiang et al. and Yao et al., privacy budget only reported at ε=10 (Table 5).

   Swipe horizontally to read the table

   Method	Jiang CRR	Jiang EED	Yao CRR	Yao EED
   Parametric	30%	0.030	37%	0.07
   RAG	60%	0.028	75%	0.10
   RP	3%	0.88	0%	0.93
   DP-RP-G, ε=10	3%	0.89	0%	0.90
   DPSparseVoteRAG, ε=10	2%	0.88	0%	0.90

   • Authors' reading: High CRR and low EED indicate successful extraction. Jiang attack's SS is 0.16 or 0.17, Yao attack's is 0.033, 0.034, 0.032, 0.031, 0.034; the authors attribute similar SS to the model still trying to give correct answers. Jiang attack's average number of rounds is 2.18, 2.05, 2.05, 2.01, 2.34. The no-retrieval model's CRR is still 30% and 37%; the paper does not separately explain that cell.
   • Utility: Table 6's Ans EM/F1 are parametric model 7.48/28.74, RAG 12.48/29.88, RP 11.32/28.57; cosine similarities are 0.73, 0.75, 0.75. DP-RP-G and DPSparseVoteRAG at ε=10 have Ans EM 3.58 and 7.48, cosine similarity both 0.54. The authors claim the three privacy methods have similar utility and RP has the highest accuracy; in the table, RP is close to RAG, and the two DP methods are lower.
   • Case study: Table 7 compares original blocks and reconstructions; identity details are not copied here. The authors claim that names already present in the question appearing in the answer is reasonable; RP's answer differs greatly from the original block, does not write the address, nationality, or birth date from the corpus, and writes a different date. The authors claim an attacker might mistakenly think the date has been extracted and stop. The authors claim Standard RAG and Jiang et al. extract large verbatim passages, and the knowledge graph method recovers most original information.

   Membership inference and categorical leakage

   • E-MIA: Table 4 only indicates ECHR uses Qwen3-4B. That column's membership leakage rates are parametric model 0.006, RAG 0.996, RP 0.007. For Enron, C4, HotpotQA columns, the models are not indicated in the header; RP is 0.003, 0.003, 0.001, RAG is 0.282, 0.843, 0.913. The authors claim RP is roughly at the same level as the parametric model, and an attacker can barely distinguish membership. The paper claims it does not focus on comparing multiple MIAs.
   • Enron categorical: Table 3 totals match Table 2. Standard RAG unprotected leakage is email 36, URL 56, phone 125; RP is 0, 3, 0. KNN-LM RAG only leaks 13 URLs, RP is 0. The authors claim all three leakage rates are below 3%, with URLs most likely to leak. Several small-ε DP settings are 0, but DPSparseVoteRAG at ε=20 leaks URL 8 and phone 1 under Standard RAG.
   • Failure modes: Appendix H.1 claims failure cases all fall into leakage without sensitive information; numbers, IDs, and emails are fully protected, and common words may be mislabeled as identity information. That section does not give denominators. In Appendix H.2's generation examples, the authors claim the parametric model continues without basing on the retrieval corpus, RAG and RP answer relevantly, and the two DP methods are often incoherent or irrelevant.

   Scale, latency, and DP clipping

   • Scale: Figure 4 is Standard RAG, ECHR, Qwen3-4B, with corpus sizes 1K, 5K, 10K. The authors claim vanilla RAG's extraction rate decreases as the corpus grows, while RP stays near the parametric model. After plain-text conversion, the readings' correspondence to method columns is unclear, so percentages in the figure are not tied to specific methods here. The authors believe the larger the corpus, the more similar tokens or blocks are available for replacement, and the lower the extraction rate.
   • Latency: Table 8 on ECHR, NVIDIA A100, model not written. RAG, RP, DPSparseVoteRAG per-generation latency is 8.35, 9.42, 258.9 seconds, per-token 0.08, 0.08, 2.80 seconds. The authors claim DPSparseVoteRAG is about 30 times slower per inference than RP and vanilla RAG, because it splits the corpus into m subsets and generates tokens for each subset.
   • Clipping: The authors claim DP's utility loss comes from clipping and noise required for formal guarantees, not from projection itself; as ε tends to infinity and the clipping bound is large enough, DP-RP-G approaches RP. Table 9 on ECHR, model not written: KNN-LM / Standard RAG PPL, RP 43.20/47.92, DP-RP-G 97.09/102.66, clipping without noise 45.47/46.99. Among these, 47.92 matches Table 2's Standard RAG, ECHR/Llama3-1B, RP. The authors claim in Figure 5 that larger clipping bounds lower perplexity; the caption does not write the dataset.

   Other ablations and analyses

   • k (Figure 3): Legend is k=25, 100, 1600, distinguishing RP and DP-RP-G; axes are PPL and Leakage (%). The authors claim k has a weak relationship with privacy, and larger k gives better utility. The caption does not write the dataset.
   • Variance deviation from 1/k (Section 4.4, dataset not written): k=1600, sampling from N(0, 0.2^2) gives PPL 70.86, leakage 2.32%; k=25, sampling from N(0, 0.025^2) gives PPL 71.38, leakage 3.1%. The authors claim variance set to 1/k is optimal.
   • m (Table 10, ε=5, model not written): Enron KNN-LM leakage drops from 4 items at m=10 to 0 at m=30 and beyond; ECHR KNN-LM PPL is 512.64 for m=10–30 and 109.64 at m=50. The authors claim utility differs little across m; the paper does not report statistical tests.
   • Projection distribution (Table 11, Enron/GPT-2): Rademacher matrix KNN-LM PPL is 2.92, URL leakage 2 items; Standard RAG PPL is 1.76, URL 3 items, phone 1 item. Gaussian matches Table 3's RP. The authors claim the distribution need not be Gaussian as long as similarity structure is preserved.

   Collapse this answer

5. 05What are some points that can be further explored?

   The authors leave large-scale evaluation of real RAG systems to future work, and estimate that a million queries would take 92 days at about 8 seconds each.

   Limitations and future directions noted by the authors

   • Large-scale real-system evaluation: The authors state that evaluating privacy protection methods on real LLM RAG systems remains future work (Limitations).
   • Query scale and time cost: The authors state that real systems may process billions of queries per day; per Table 8, one query takes about 8 seconds, and evaluating one million queries without system-level optimization would take 92 days. The authors leave the system-level work required for such evaluation to the future (Limitations).

   Experimental coverage

   • Generation models are GPT-2, Llama3-1B-Instruct, Qwen3-4B, Llama3-8B-Instruct, Qwen2-7B-Instruct; architectures are KNN-LM and Standard RAG (Section 4.1, Table 2).
   • Data are Enron Email (4576 sensitive items), ECHR (10K documents), C4 (5000 items), and HotpotQA (retrieval corpus over 90K documents); there are also scale comparisons of 1K, 5K, 10K on ECHR/Qwen3-4B (Section 4.5, Figure 4, Section E).
   • Attacks include repeated queries of 10 per item, two multi-round adaptive attacks on KNN-LM over HotpotQA (up to 200 queries), and E-MIA membership inference (Section 4.2–4.3, Table 4–5). The authors state in Section 3.1 that they do not evaluate white-box, embedding inversion, projection matrix inversion, or side channels.
   • Baselines include a no-retrieval parameter model, vanilla RAG, DP-RP-G, and DPSparseVoteRAG, with ε of 1, 5, 10, 20. The paper does not report the clipping bounds chosen for each setting, nor the number of repetitions for utility metrics.
   • k, sampling variance, Rademacher matrix, subset count m, and clipping bounds have separate results (Section 4.4–4.6, Table 8–11, Appendix G). Privacy and utility tables for multi-round attacks are given only for KNN-LM (Table 5, Table 6).

   Collapse this answer

6. 06Summarize the main content of the paper

   Using the same random projection to protect the RAG retrieval corpus; the authors claim empirical privacy is close to a no-retrieval model, and utility is better than DP baselines in most settings.

   The authors propose using random projection for privacy RAG, targeting settings that do not pursue formal differential privacy and only consider empirical extraction leakage.

   • Problem: External retrieval corpora can expose emails, phone numbers, URLs, and longer sensitive text to carefully constructed queries. The authors argue that formal DP often increases perplexity and is more complex to implement.
   • Method: In a black-box setting, the attacker only sees API text, knows RP is used but not the matrix. The same Gaussian matrix is multiplied offline and online, and cosine nearest-neighbor retrieval is performed in the low-dimensional space. KNN-LM weights the neighbor distribution with the language model distribution; Standard RAG concatenates retrieved text into the original query. The authors use similarity preservation to explain utility and neighbor replacement to explain privacy.
   • Repeated queries: In Table 2, RP leakage is lower than unprotected RAG across eight settings. Enron/GPT-2 Standard RAG drops from 217 to 3 items; ECHR/Llama3-1B KNN-LM drops from 82.72% to 2.26%. The latter's PPL rises from 2.90 to 46.15, and Standard RAG's F1 drops from 97.18 to 66.70. On ECHR/Qwen3-4B, RP's PPL is the same as RAG: 1.55 for KNN-LM and 1.19 for Standard RAG.
   • Other attacks: On HotpotQA, KNN-LM, Jiang et al.'s attack CRR drops from 60% for RAG to 3% for RP, and Yao et al.'s attack drops from 75% to 0% (Table 5). Ans EM is 12.48 for RAG and 11.32 for RP (Table 6). E-MIA membership leakage on ECHR (Qwen3-4B) drops from 0.996 for RAG to 0.007 for RP (Table 4).
   • Authors' conclusion: The authors claim RP's empirical protection is roughly at the same level as a no-retrieval parametric model, semantic utility drops 7% overall relative to vanilla RAG, and utility improves by more than 50% on average relative to DP baselines. In Table 2, C4's RP still leaks 17 and 23 items, higher than the parametric model's 0; some DP settings also leak more than unprotected RAG. The authors claim random projection can serve as a practical baseline for privacy RAG.

   Collapse this answer

Related papers