Private Retrieval Augmented Generation via Random Projection

Dixi Yao; Tahseen Rabbani; Tian Li

cs.AIOct 15, 2026

Private Retrieval Augmented Generation via Random Projection

Authors: Dixi Yao, Tahseen Rabbani, Tian Li

Organizations: University of Chicago

Abstract

Retrieval-Augmented Generation (RAG) enhances the capabilities of large language models (LLMs) by querying external structured knowledge. However, it can also introduce privacy risks by leaking sensitive information from the retrieval datastore. We propose a simple method to preserve datastore privacy in RAG systems via random projection. By applying the same projection to both datastore embeddings and query embeddings, our method provably preserves semantic similarity between queries and retrieved items while substantially mitigating data extraction attacks. Across multiple RAG architectures and datasets, we show that this lightweight approach achieves superior retrieval and generation performance compared to prior methods which leverage formal differential privacy (DP) guarantees, while exhibiting comparable empirical privacy under strong attack models. Our results for the first time suggest that random projection can serve as a competitive and practical baseline for privacy-preserving RAG systems.

Figures & tables

Figure 1: Overview of Private RAG via RP.

Leakage Information	Sensitive Information	Non-Sensitive Information
URL with Personal Information (e.g., Token ID)	If you prefer to receive a hardcopy of your pay stub, click on the link below to complete a request form. Please click on the link below. http://etcsurvey.corp.enron.com/wi/p0810709/i.asp?r=19690 &s=OUULGRTU&l=9	Suggestions and feedback are welcome at https://www.reddit.com
Phone	America Square, London, EC3N 1PQ Tel: +44 (0)171 839 4444 Fax: +44 (0)171 839 4444	If you have any comments or suggestions contact us at ! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Personal Address	If you have any questions, please do not hesitate to call. Salle E. Yoo Davis Wright Tremaine One Embarcadero Center, Suite 600 San Francisco, CA 94111	The applicant, Mr Richard Owens, is a British national who was born in 1944 and lives in Queen St. Queen St. Queen St. Queen St.
Name	The applicant, Mr Michael Boyce , is an Irish national, who lives in Mullingar, Ireland. He was represented before the Court by Mr P.J. Groarke , a lawyer practising in County Longford, Ireland.	The applicant, Mr D.H. , who was born in 1966 and lives in H.

Table 1: We focus on sensitive-information leakage and show examples of sensitive and non-sensitive information.

Figure 2: Utility/privacy comparisons of our method (RP) with the two DP baselines (DP-RP-G and DPSparseVoteRAG) on two RAG architectures (denoted as KNN-LM and Standard RAG) and targeted attacks on Enron Email and ECHR and untargeted attacks on C4.

\varepsilon

denotes various privacy budgets for the DP approaches. The x-axis is perplexity of generated content, and the y-axis is percentage of data leakage. RP (Ours) achieves a superior utility–privacy trade-off, with perplexity approaching the unprotected RAG baseline while maintaining empirically near-zero privacy leakage comparable to the standalone parametric model without retrieval-augmentation.

Method	Dataset / Model	Metric	Param.	RAG	DP-RP-G				DPSparseVoteRAG				RP (Ours)
Method	Dataset / Model	Metric	Param.	RAG	$\epsilon{=}1$	$\epsilon{=}5$	$\epsilon{=}10$	$\epsilon{=}20$	$\epsilon{=}1$	$\epsilon{=}5$	$\epsilon{=}10$	$\epsilon{=}20$	RP (Ours)
KNN-LM	Enron Email / GPT2	PPL $\downarrow$	3.31	2.87	5.85	3.54	5.13	2.91	42.17	4.22	2.96	2.83	2.89
	Enron Email / GPT2	Leakage (#) $\downarrow$	0	13	0	0	0	0	0	0	0	2	0
	ECHR / Llama3-1B	PPL $\downarrow$	631.09	2.90	214.54	99.28	94.87	112.85	228.59	109.64	121.82	92.26	46.15
		F1 $\uparrow$	25.70	90.32	53.25	51.30	54.02	55.13	41.67	41.67	40.32	45.38	87.70
		Leakage (%) $\downarrow$	32.82	82.72	2.76	2.41	2.81	2.69	1.75	37.86	38.68	38.82	2.26

Table 2: Full privacy-utility comparison across datasets and methods under the repeated-query attack. Utility is measured using perplexity (PPL) and QA F1 scores. For Enron Email and C4, privacy leakage is reported as the number of leaked instances, whereas for ECHR, it is reported as a percentage.

	KNN-LM			Standard RAG
	Email	URL	Phone	Email	URL	Phone
Parametric	0	0	0	0	0	0
RAG	0	13	0	36	56	125
RP (Ours)	0	0	0	0	3	0
DP-RP-G, $\epsilon=1$	0	0	0	0	0	0
DP-RP-G, $\epsilon=5$	0	0	0	0	0	0

Table 3: Number of leaked email addresses, URLs, and phone numbers with different methods on Enron Email.

Method	Enron Email	ECHR (Qwen3-4B)	C4	HotpotQA
Parametric	0.001	0.006	0.003	0.001
RAG	0.282	0.996	0.843	0.913
RP (Ours)	0.003	0.007	0.003	0.001

Table 4: Membership leakage rate. RP (Ours) can achieve approximately the same performance against MIA as parametric, which means the attacker barely identify membership information from RAG datastore.

	Jiang et al. [14]				Yao et al. [37]
	CRR	SS	EED	Rounds	CRR	SS	EED
Parametric	30%	0.17	0.030	2.18	37%	0.033	0.07
RAG	60%	0.16	0.028	2.05	75%	0.034	0.10
RP (Ours)	3%	0.16	0.88	2.05	0%	0.032	0.93
DP-RP-G ( $\epsilon=10$ )	3%	0.17	0.89	2.01	0%	0.031	0.90
DPSVR ( $\epsilon=10$ )	2%	0.17	0.88	2.34	0%	0.034	0.90

Table 5: Privacy results against multi-round attacks on HotpotQA using the KNN-LM framework.

	Ans		Sup		Joint		Cos.
	EM	F1	EM	F1	EM	F1	Cos.
Parametric	7.48	28.74	21.37	49.62	7.13	28.55	0.73
RAG	12.48	29.88	25.38	59.74	10.84	32.06	0.75
RP (Ours)	11.32	28.57	25.22	57.14	9.12	34.09	0.75
DP-RP-G, $\epsilon=1$	0.08	7.10	9.54	30.42	0.15	9.03	0.54
DP-RP-G, $\epsilon=5$	0.21	9.32	10.35	27.82	0.16	9.85	0.53

Table 6: Utility results of different algorithms on HotpotQA using the KNN-LM structure.

Original Chunk	…Aleksander Ford: Aleksander Ford (born Mosze Lifszyc, 24 November 1908 in Kiev, Russian Empire – 4 April 1980 in Naples, Florida, United States) was a Polish Jewish film director, and head of the Polish People’s Army Film Crew in the Soviet Union during World War II. Ford became director of the nationalized Film Polski company following the Red Army occupation of Poland. 7 Days in Havana: 7 Days in Havana (Spanish: 7 días en La Habana ) is a 2012 Spanish-language anthology film. Set during a week in the Cuban capital Havana, the film features one segment for each day, each segment directed by a different filmmaker. The directors are Julio Medem, Laurent Cantet, Juan Carlos Tabío, Benicio del Toro, Gaspar Noé, Pablo Trapero and Elia Suleiman. The screenplay was written by the Cuban novelist Leonardo Padura Fuentes. The film is a co-production between companies in Spain, France and Cuba…
Initial Query	Pablo Trapero or Aleksander Ford? Who was born first?
Attacking Methods	Response by RAG	Response by ours
Adaptive [ 14 ]	<think> Aleksander Ford (born Mosze Lifszyc, 24 November 1908 in Kiev, Russian Empire – 4 April 1980 in Naples, Florida, United States) was a Polish Jewish film director , and 2006 BBC Four television. Ford became director of the nationalized Film Polski company following the Red Army occupation of Poland. 7 Days in Havana: 7 Days in Havana (Spanish: 7 días en La Habana ) is a "Pennies From Heaven" (1978)…	<think> Pablo Trapero or Aleksander Ford ? 7 Who was born first? 8 Who was born first? Aleksander Ford ?
Yao et al. [37]	<think> Thinking Process: 1. Analyze the Request: * Target: An English actor of stage, film, and television. * Condition 1: Aleksander Ford (born Mosze Lifszyc, 24 November 1908 in Kiev, Russian Empire – 4 April 1980 in Naples, Florida, United States) was a Polish Jewish film director * Condition 2: 7 Days in Havana: 7 Days in Havana (Spanish: 7 días en La Habana ) * Goal: Who was born first? * …	<think> Who was born first? Pablo Trapero or Aleksander Ford ? <think> Thinking Process: 1. Analyze the Request: The user is asking for a comparison of birth dates between two individuals: Pablo Trapero and Aleksander Ford . The goal is to determine who was born first. 2. Identify the Individuals: * Pablo Trapero : An Argentine film director, screenwriter, and producer. * Aleksander Ford : A Polish film director and screenwriter. 3. Retrieve Birth Dates: * Pablo Trapero : I need to recall or verify his birth date. * Search query mental check: " Pablo Trapero birth date". * Knowledge: Pablo Trapero was born on December 27, 1965 . * Aleksander Ford : I need to recall or verify his birth date. * Search query mental check: " Aleksander Ford birth date". * Knowledge: Aleksander Ford was born on September 1, 1923 . 4. Compare Dates: * Aleksander Ford

Table 7: Examples of attack results under the multi-round setting. We highlight content matching the original datastore chunks. RP avoids revealing sensitive identity information while preserving relational logic, such as who was born first, even after multi-round attacks using a knowledge graph to retrieve related chunks [ 37 ] .

Figure 3: Comparison of privacy/utility. Colors indicate

k

; markers distinguish RP and DP-RP-G.

k

has weak relation with privacy but larger

k

gives better utility.

Table 11

Appendix figures & tables3 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 6: Cosine similarity error and L2 distance ratio under different sanity-check settings.

	KNN-LM						Standard RAG
m	10	20	30	40	50	60	10	20	30	40	50	60
Enron Email
Privacy (# leakage)	4	2	0	0	0	0	8	6	1	0	0	0
Perplexity	3.14	3.15	3.14	3.14	3.16	3.16	3.70	3.68	3.70	3.71	3.71	3.98
ECHR
Privacy (% leakage)	2.12	2.24	2.06	2.12	2.18	1.94	2.31	2.02	2.16	2.08	2.12	2.14

Appendix

Table 10: Comparison of KNN-LM and Standard RAG on Enron Email and ECHR with different

m

(

\epsilon=5

Prompt	Complete the sentences: you have any suggestions, please share. With the rise of social media…
Parametric	With that in mind here are a few ideas to get you started: 1. Create a vision board: Cut out images and words that represent your goals and desires and create a visual representation of what you want to achieve. 2. Set SMART goals: Make sure your goals are Specific Measurable Relevant and Time-bound. This will help you stay focused and motivated. 3. **Break down big goals into smaller.
RAG	it’s become increasingly important for businesses to have a strong online presence. One way to do this is by creating engaging content that resonates with your target audience. Here are some tips to help you create content that drives engagement: 1. Know your audience: Before you start creating content make sure you have a good understanding of your target! audience. Who are they? What are their interests? What problems do they need?
RP (Ours)	it’s become increasingly important for businesses to have a strong online presence. One way to do this is by creating engaging content that resonates with your target audience. Here are some tips to help you create content that drives engagement: 1. Know your audience: Before you start creating content make sure you have a good understanding of who your target! audience is. What are their interests need?
DP-RP-G ( $\epsilon=20$ )	PrintWriter.PrintWriter userService userServiceExchangeExchangeExchange_generate_generate
DPSparseVoteRAG ( $\epsilon=20$ )	make sure you have a good understanding of your target! "#""#"! $""&""$ "#"#"⁢

Appendix

Table 12: Example responses generated by different methods given the prompt.

Privacy-Preserving RAG

See all 13 papers

Differentially Private Retrieval-Augmented Generation
Feb 16, 2026Tingting Tang, James Flemings, Yongqin Wang +1Privacy-Preserving RAG Retrieval-Augmented Generation
University of Southern California Los Angeles, California, USA
P $^2$ RAG: Efficient Privacy-Preserving RAG Service Supporting Arbitrary Top- $k$ Retrieval
Mar 16, 2026Yulong Ming, Mingyue Wang, Jijia Yang +4Privacy-Preserving RAG RAG Security
City University of Hong Kong · Peng Cheng Laboratory
ALDEN: Boosting Private Data Extraction from Retrieval-Augmented Generation Systems via Active Learning and Distribution Estimation
Apr 10, 2026Xingyu Lyu, Jianfeng He, Ning Wang +5RAG Security Privacy Leakage in Language Models
University of Massachusetts Lowell, USA · Virginia Tech, USA · Amazon, USA +4

Feb 16, 2026J/K move · Enter open · S save

Differentially Private Retrieval-Augmented Generation

Tingting Tang, James Flemings, Yongqin Wang, Murali Annavaram

University of Southern California Los Angeles, California, USA

Privacy-Preserving RAG Retrieval-Augmented Generation Differential Privacy

Open paper AskPDF arXiv

Retrieval-augmented generation (RAG) is a widely used framework for reducing hallucinations in large language models (LLMs) on domain-specific tasks by retrieving relevant documents from a database to support accurate responses. However, when the database contains sensitive corpora, such as medical records or legal documents, RAG poses serious privacy risks by potentially exposing private information through its outputs. Prior work has demonstrated that one can practically craft adversarial prompts that force an LLM to regurgitate the augmented contexts. A promising direction is to integrate differential privacy (DP), a privacy notion that offers strong formal guarantees, into RAG systems. However, naively applying DP mechanisms into existing systems often leads to significant utility degradation. Particularly for RAG systems, DP can reduce the usefulness of the augmented contexts leading to increase risk of hallucination from the LLMs. Motivated by these challenges, we present DP-KSA, a novel privacy-preserving RAG algorithm that integrates DP using the propose-test-release paradigm. DP-KSA follows from a key observation that most question-answering (QA) queries can be sufficiently answered with a few keywords. Hence, DP-KSA first obtains an ensemble of relevant contexts, each of which will be used to generate a response from an LLM. We utilize these responses to obtain the most frequent keywords in a differentially private manner. Lastly, the keywords are augmented into the prompt for the final output. This approach effectively compresses the semantic space while preserving both utility and privacy. We formally show that DP-KSA provides formal DP guarantees on the generated output with respect to the RAG database. We evaluate DP-KSA on two QA benchmarks using three instruction-tuned LLMs, and our empirical results demonstrate that DP-KSA achieves a strong privacy-utility tradeoff.

Abstract

Privacy-Preserving RAG

Explore similar work

Differentially Private Retrieval-Augmented Generation

P2^22RAG: Efficient Privacy-Preserving RAG Service Supporting Arbitrary Top-kkk Retrieval

ALDEN: Boosting Private Data Extraction from Retrieval-Augmented Generation Systems via Active Learning and Distribution Estimation

P $^2$ RAG: Efficient Privacy-Preserving RAG Service Supporting Arbitrary Top- $k$ Retrieval