{"id":"c9e5a0e3-9e22-4c35-b95b-107722f19962","arxiv_id":"2508.03098","paper_version":2,"verdict":"UNVERDICTED","confidence":"LOW","novelty_score":6.0,"correctness_risk":"unknown","formal_verification":"none","parameter_count":2,"one_line_summary":"Privacy-Aware Decoding (PAD) injects calibrated Gaussian noise into token logits at inference time to provide per-response DP guarantees for retrieval-augmented generation.","lead":"This paper introduces Privacy-Aware Decoding (PAD), a method that adds controlled random noise to a language model's token choices during text generation, so that systems using private documents in answers are less likely to leak secrets. It claims to give a formal per-response privacy guarantee without retraining, which could make private RAG systems more trustworthy.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The per-response (ε,δ)-DP claim depends on accounting for confidence-based screening and data-dependent sensitivity estimation that the abstract never establishes; without a fixed global sensitivity bound, the calibration can leak through the screening rule.","rationale":"The reader's weakest_assumption identifies exactly the same soft spot: the confidence-based screening and data-dependent sensitivity estimation must be either privacy-neutral or fully charged in the RDP accountant, and the abstract does not explain how. My read agrees and sharpens the concern. The paper may well be sound: a careful full text could prove that the screening predicate is public or has bounded sensitivity, and that the noise scale is derived from a fixed global Lipschitz constant. But with only the abstract readable and the full text corrupted in this input, the guarantee is unverified. The reader's UNVERDICTED verdict is therefore appropriate, and my concern does not change that verdict. I would leave it UNVERDICTED pending full-text inspection; the concrete test above would turn the concern into a decisive check once the code or paper is accessible.","tokens_in":12663,"tokens_out":3752,"duration_ms":51205,"concrete_test":"Using the released repository, reconstruct the exact PAD mechanism for a minimal two-token vocabulary and a fixed prompt. Construct two neighboring corpora D and D' differing by one record such that the confidence-based screening rule marks a token 'high-risk' under D but not under D'. Compute the Max Divergence (or RDP bound) between the output distributions of PAD under D and D' by enumerating all generated continuations or using large Monte Carlo samples. If the realized divergence exceeds the claimed (ε,δ) budget, the accountant is missing the screening or sensitivity term; then patch the mechanism to use a fixed global sensitivity bound and a corpus-independent screening rule and repeat, to determine whether PAD's guarantee can be recovered with a modest change.","verdict_should_be":"UNCHANGED","load_bearing_attack":"To make the advertised per-response (ε,δ)-DP guarantee true, the entire sampling procedure—including the confidence-based screening that decides which tokens receive Gaussian noise and the sensitivity estimate that sets the noise scale—must be a randomized algorithm whose output distributions under neighboring corpora differ by no more than the claimed RDP bound. The abstract describes screening as \"selectively protect high-risk tokens\" and sensitivity estimation as \"efficient ... to minimize unnecessary noise,\" but it does not state that the screening predicate and the sensitivity parameter are independent of the private retrieval corpus. If the screening rule changes under neighboring corpora, the set of perturbed logits changes, and the privacy loss of that selection step is not captured by adding Gaussian noise only after selection. Similarly, if the noise scale is chosen from an empirical sensitivity estimate rather than a fixed, corpus-independent Lipschitz constant, the noise distribution itself can reveal information about the private input. Both omissions are load-bearing because the central claim is that PAD gives explicit per-response guarantees, not merely heuristic leakage reduction. The full text is unreadable in this input, so I cannot confirm that the paper later supplies a global sensitivity lemma or charges the screening cost; the concern is therefore unresolved rather than demonstrated false.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes Privacy-Aware Decoding (PAD), an inference-time defense that injects calibrated Gaussian noise into token logits during retrieval-augmented generation. PAD combines confidence-based screening of high-risk tokens, sensitivity estimation, and an Rényi differential privacy accountant, and the abstract claims explicit per-response (ε,δ)-DP guarantees as well as improved utility over existing defenses on three datasets. The paper also provides a code repository. In the version supplied for review, however, the full text is not legibly encoded, so the mathematical derivation, algorithmic details, and experimental tables cannot be inspected.","tokens_in":12945,"tokens_out":3425,"duration_ms":45343,"significance":"If the central claim holds, PAD addresses a timely and practically important problem: privacy leakage from private corpora in RAG systems. A decoding-time, model-agnostic defense with a per-response DP guarantee would be a useful contribution, and the availability of code is a concrete strength. The significance is currently conditional, because the advertised formal guarantee depends on accounting details—the sensitivity of the logit perturbation, the treatment of confidence-based screening, and the composition analysis—that are not visible in the supplied version. The privacy-accounting concern raised in the stress-test note is therefore unresolved rather than refuted.","major_comments":[{"comment":"The abstract states that an RDP accountant 'rigorously tracks cumulative privacy loss, enabling explicit per-response (ε,δ)-DP guarantees,' but it does not define the sensitivity of the logit perturbation or the Gaussian noise scale. If the sensitivity estimate is computed from the private corpus, the noise distribution itself may depend on the private data and must be charged in the RDP budget. Please provide a formal sensitivity bound (ideally a fixed, corpus-independent Lipschitz constant for the logit mapping) and a precise composition rule over the decoding steps; otherwise the advertised guarantee is not verifiable.","section":"Abstract (per-response DP claim)"},{"comment":"The screening rule that selects which tokens receive noise is described as 'selectively protect[ing] high-risk tokens,' but the abstract does not state whether the screening predicate is independent of the private corpus or whether its privacy cost is included in the accounting. If, under neighboring corpora, the set of screened tokens changes, then the mechanism is not simply additive Gaussian noise applied after selection; the selection itself is part of the randomized algorithm and must be accounted for. Please either prove that screening is a public, corpus-independent function or explicitly compose the screening step into the RDP analysis.","section":"Abstract (confidence-based screening)"},{"comment":"The empirical claims—'substantially reduces private information leakage while preserving response utility' and outperforming existing defenses on three datasets—cannot be checked from this version. The supplied text is largely unreadable, and the abstract alone gives no dataset sizes, baselines, noise scales, utility or privacy metrics, or variance information. The revision should make the experimental protocol and full results legible, including the private-information leakage measure and standard deviations or confidence intervals.","section":"Abstract (experimental claims)"}],"minor_comments":[{"comment":"The first occurrence of 'Rényi' is typeset as '\\renyi'; it should be rendered with the proper accent as 'Rényi Differential Privacy'.","section":"Abstract"},{"comment":"The full-text encoding is corrupted throughout, with many passages appearing as unreadable character substitutions. Please ensure the published version encodes all mathematical notation, special characters, and CJK text correctly so that reviewers and readers can access the algorithms and proofs.","section":"Full text (as supplied)"}],"recommendation":"uncertain","confidential_remarks":"To the editor: the central risk in this paper is circularity between data-dependent sensitivity/screening and the advertised per-response DP guarantee. Because the full text is unreadable in the version I received, I cannot determine whether the authors already provide a sound global-sensitivity lemma or properly charge the screening step in the RDP accountant. The work may be salvageable, but the current manuscript is not verifiable. I recommend asking the authors to resubmit a legible version with explicit privacy accounting, or at least to clarify the formal setup in a revised abstract and main text."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThe paper proposes PAD, a decoding-time defense that adds calibrated Gaussian noise to token logits to give per-response (ε, δ)-DP guarantees in RAG, with confidence-based screening on high-risk tokens. If the privacy accounting holds, that is a genuinely useful, model-agnostic contribution, and it avoids retraining and corpus-level filtering. The abstract reports gains on three datasets and the authors released code. The idea is distinct from the prior defenses it cites.\n\nThe main soft spot is exactly what you flagged. The per-response guarantee is only real if the confidence screening and the sensitivity estimation are either independent of the private corpus or fully charged in the RDP budget. The abstract says \"efficient sensitivity estimation\" and \"context-aware noise calibration,\" which sound data-dependent. Nothing visible says they use a fixed global sensitivity bound or that the screening predicate is privacy-neutral. If the noise scale depends on the retrieved corpus, the noise itself leaks; if the screening decision depends on it, the selection step leaks. The reader's soundness score of 3 is fair, with one caveat: this is an unresolved concern, not a demonstrated flaw. The full text I was given is corrupted mojibake, so I could not check whether the paper later supplies a global sensitivity lemma or charges the screening cost. It may well do so; I simply cannot confirm.\n\nA minor issue: \"per-response\" DP is an odd unit. The paper should specify what an adversary can query adaptively and how composition across responses is handled. That matters, but it is fixable if the per-response budget is presented honestly.\n\nWho this is for: people building privacy-preserving RAG and anyone evaluating decoding-time DP as an alternative to retraining or filtering. The paper deserves a serious referee once the full text is available. Desk rejection would be wrong for this idea; the burden is on the authors to show the accounting covers screening and sensitivity estimation. If it does, this is a solid contribution. If it doesn't, the headline claim collapses. I would not cite it until I see the proof, but I would send it to review.","headline":"A plausible decoding-time privacy defense whose per-response DP guarantee hinges on accounting for the screening and sensitivity estimation; the text is unreadable in this form, so the headline claim is unverified, not refuted.","tokens_in":13396,"tokens_out":2684,"would_cite":false,"duration_ms":36317,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper proposes Privacy-Aware Decoding, an inference-time method that adds calibrated Gaussian noise to token logits so each RAG response carries an explicit $(\\varepsilon,\\delta)$-DP guarantee while reducing private-information leakage.","keywords":["Privacy-Aware Decoding","retrieval-augmented generation","differential privacy","Rényi differential privacy","inference-time defense","token-level noise","privacy leakage","large language models"],"falsifier":"Audit a PAD-protected RAG system by inserting a known private sentence into the retrieved corpus and running a membership-extraction attack over many responses. If an attacker can reliably recover that sentence while each response is reported at a small budget (say $\\varepsilon \\leq 1$), the empirical leakage would exceed what the claimed $(\\varepsilon,\\delta)$-DP guarantee permits, showing the accounting misses part of the mechanism.","tokens_in":12509,"feed_emoji":"🔒","tokens_out":10898,"duration_ms":120135,"temperature":0.7,"pith_summary":"Retrieval-augmented generation can leak private information when the model freely generates from retrieved documents that contain sensitive content. The paper argues this leakage can be controlled at decoding time, without retraining the model or filtering the corpus. It introduces Privacy-Aware Decoding (PAD), which adds calibrated Gaussian noise to token logits, screens tokens by confidence so only high-risk positions are perturbed, estimates logit sensitivity to keep noise as small as possible, and adjusts the noise scale to the context. A Rényi differential privacy accountant converts the accumulated noise into an explicit per-response $(\\varepsilon,\\delta)$-DP guarantee. The authors report that PAD substantially reduces private-information leakage on three datasets while preserving response utility and outperforms retrieval- and post-processing-based defenses.","feed_headline":"Decoding-time noise gives RAG replies per-response privacy","feed_subtitle":"A lightweight decoder wrapper with RDP accounting cuts private-information leakage while keeping answers useful.","key_machinery":"The carrying object is the Privacy-Aware Decoding (PAD) procedure, an inference-time wrapper around the LLM's next-token logits. Its three components are confidence-based screening, which selects high-risk token positions; efficient sensitivity estimation, which bounds how much the logits can change with the private context so noise is not wasted; and context-aware calibration, which picks the Gaussian noise scale for each position. A Rényi differential privacy accountant then accumulates the noise across decoding steps and converts it into a per-response $(\\varepsilon,\\delta)$-DP guarantee. Because all of this operates on logits alone, PAD is model-agnostic and needs no retraining.","core_discovery":"On the paper's own terms, the central discovery is that a decoding-time mechanism can make RAG outputs differentially private one response at a time. PAD treats the generated response as the output of a Gaussian mechanism applied to token logits: confidence screening identifies tokens whose exposure would be most damaging, efficient sensitivity estimation bounds how much the logits shift if a private document changes, and context-aware calibration sets the noise level per position. The Rényi accountant then composes these per-token perturbations across the whole response, yielding the explicit $(\\varepsilon,\\delta)$-DP bound. The reported experiments show the method cutting private-information leakage substantially while keeping answer quality, and beating existing retrieval-based and post-processing-based defenses.","pith_inferences":["Repeated queries to the same private corpus would need to compose their per-response budgets; the Rényi accountant already provides the composition machinery, so a total privacy budget per user or session is a natural deployment constraint, though the paper does not spell this out.","A testable extension is to apply PAD to other sensitive generation tasks, such as summarizing private documents or completing code from private repositories, to see whether the logit-level mechanism transfers.","If confidence-based screening is data-dependent, the pattern of which tokens get noise could itself signal which content is private; the formal guarantee is complete only if the screening decision is included in the privacy accountant, which the paper's abstract does not explicitly describe."],"forward_implications":["PAD can be attached to a deployed RAG system without retraining or modifying the private corpus, because it only reads the model's token logits.","Each response gets its own $(\\varepsilon,\\delta)$ budget, so a deployment can set a release threshold and regenerate or withhold answers that would exceed it.","Because screening targets only high-risk tokens, utility loss is concentrated where leakage risk is greatest, which is how the method preserves answer quality.","If the results generalize, decoding-time noise becomes a practical alternative to corpus-level filtering in settings where the corpus cannot be altered."],"supporting_citations":[],"fun_headline_variants":["PAD adds calibrated noise so RAG outputs meet DP per reply","Per-response DP for RAG: confidence-targeted logit noise","Decoding noise stops RAG from leaking private data","RAG privacy on demand: PAD injects noise at inference","Turn RAG into a DP machine with decoding-time noise"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The central guarantee stands only if the confidence-based screening and noise-calibration steps are either independent of the private data or fully charged in the Rényi privacy accountant; the abstract does not describe how these data-dependent steps are accounted for.","fun_headline_variants_meta":{"raw":{"variants":["PAD adds calibrated noise so RAG outputs meet DP per reply","Per-response DP for RAG: confidence-targeted logit noise","Decoding noise stops RAG from leaking private data","RAG privacy on demand: PAD injects noise at inference","Turn RAG into a DP machine with decoding-time noise"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000226,"raw_usage":{"total_tokens":1459,"prompt_tokens":924,"completion_tokens":535,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":540,"completion_tokens_details":{"reasoning_tokens":449}},"tokens_in":540,"tokens_out":535,"duration_ms":6315,"temperature":1.0,"reasoning_tokens":449,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T04:39:30.685363+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Audit a PAD-protected RAG system by inserting a known private sentence into the retrieved corpus and running a membership-extraction attack over many responses. If an attacker can reliably recover that sentence while each response is reported at a small budget (say $\\varepsilon \\leq 1$), the empirical leakage would exceed what the claimed $(\\varepsilon,\\delta)$-DP guarantee permits, showing the accounting misses part of the mechanism.","supporting_citations":[],"review_version":1}