Private Retrieval Augmented Generation via Random Projection

Summary

The paper proposes a method to protect the privacy of a RAG datastore by applying the same random projection to both datastore and query embeddings. The authors report that this preserves semantic similarity between queries and retrieved items and substantially mitigates data extraction attacks. They also state it outperforms prior differential privacy based methods on retrieval and generation performance while showing comparable empirical privacy under strong attack models.

Mitigation

The proposed mitigation is applying the same random projection to both datastore embeddings and query embeddings in RAG systems.

Topics

• Retrieval-augmented generation

Related items

• InfoFrom knowledge retrieval to generation: a comprehensive study of RAG's architectures, evolution, and applicationsSimilar attack · OpenAlex (peer-reviewed AI security)
• InfoThe LLM-Attacker: A Unified Red-Team Framework for Privacy Evaluation of Split and Distributed LLM SystemsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoModel-as-a-Trojan: Self-Activating Covert DNS Exfiltration Baked Into the Weights of an LLM AgentSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• MediumAI coding agents expose developer screenshots on GitHub reposSimilar attack · ReversingLabs Blog
• InfoLLM Development Risks: Security Threats and Mitigation Strategies | Endor LabsSimilar attack · Endor Labs Blog