Pith. sign in

REVIEW 10 cited by

The Good and The Bad: Exploring Privacy Issues in Retrieval-Augmented Generation (RAG)

Not yet reviewed by Pith; the record is open.

Re-run · record.json Download PDF Read on arXiv ↗

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 2402.16893 v1 pith:MCBYWFJE submitted 2024-02-23 cs.CR cs.AIcs.CL

Shenglai Zeng , Jiankun Zhang , Pengfei He , Yue Xing , Yiding Liu , Han Xu , Jie Ren , Shuaiqiang Wang
show 3 more authors
Dawei Yin Yi Chang Jiliang Tang
This is my paper
classification cs.CRcs.AIcs.CL
keywords privacydatallmsgenerationretrieval-augmentedextensiveissueslanguage
verification ladder T0 review T1 audit T2 compute T3 formal
0 comments
read the original abstract

Retrieval-augmented generation (RAG) is a powerful technique to facilitate language model with proprietary and private data, where data privacy is a pivotal concern. Whereas extensive research has demonstrated the privacy risks of large language models (LLMs), the RAG technique could potentially reshape the inherent behaviors of LLM generation, posing new privacy issues that are currently under-explored. In this work, we conduct extensive empirical studies with novel attack methods, which demonstrate the vulnerability of RAG systems on leaking the private retrieval database. Despite the new risk brought by RAG on the retrieval data, we further reveal that RAG can mitigate the leakage of the LLMs' training data. Overall, we provide new insights in this paper for privacy protection of retrieval-augmented LLMs, which benefit both LLMs and RAG systems builders. Our code is available at https://github.com/phycholosogy/RAG-privacy.

Discussion (0). Sign in to comment.

Forward citations

Cited by 10 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents

    cs.CR 2026-07 conditional novelty 7.5 of 10

    Malicious tools can systematically extract isolated LLM-agent long-term memory via persistence, pure-anchor retrieval steering, and reactivation payloads, reaching 80% extraction with unlimited triggers and 47% with 20.

  2. MRMMIA: Membership Inference Attacks on Memory in Chat Agents

    cs.CR 2026-05 unverdicted novelty 7.0 of 10

    MRMMIA is a multi-recall-probe membership inference attack that extracts signals from chat agent memory and outperforms baselines in black-, gray-, and white-box settings.

  3. Trustworthiness in Retrieval-Augmented Generation Systems: A Survey

    cs.IR 2024-09 unverdicted novelty 7.0 of 10

    Introduces Trust-RAG Compass framework and TRC Bench benchmark to assess RAG trustworthiness across factuality, robustness, fairness, transparency, accountability, and privacy, with evaluations showing performance gap...

  4. PRAG: End-to-End Privacy-Preserving Retrieval-Augmented Generation

    cs.CR 2026-04 unverdicted novelty 6.0 of 10

    PRAG delivers end-to-end private RAG with 72-74% recall via non-interactive homomorphic approximations, interactive client assistance, and operation-error estimation to preserve ranking quality.

  5. ADAM: A Systematic Data Extraction Attack on Agent Memory via Adaptive Querying

    cs.CR 2026-04 unverdicted novelty 6.0 of 10

    ADAM extracts data from LLM agent memory with up to 100% attack success rate by estimating data distribution and selecting queries via entropy guidance.

  6. Guaranteeing Knowledge Integration with Joint Decoding for Retrieval-Augmented Generation

    cs.CL 2026-04 unverdicted novelty 6.0 of 10

    GuarantRAG improves RAG accuracy up to 12.1% and cuts hallucinations 16.3% by decoupling parametric reasoning from evidence integration via contrastive DPO and joint decoding.

  7. Epistemic Bias Injection: Manipulating LLM Opinion via Selective Context Retrieval

    cs.CR 2025-11 conditional novelty 6.0 of 10

    Factually correct but one-sided passages injected into a RAG database can shift LLM answers toward an attacker's stance, and a PCA/KL-based filter (BiasDef) reduces that shift.

  8. Agents That Know Too Much: A Data-Centric Survey of Privacy in LLM Agents

    cs.CR 2026-06 unverdicted novelty 5.0 of 10

    A data-centric survey finds that only information-flow control covers compositional and cross-session leakage in LLM agents and that no single benchmark tests an agent across all its data surfaces under one policy.

  9. Benchmarking Knowledge-Extraction Attack and Defense on Retrieval-Augmented Generation

    cs.CR 2026-02 conditional novelty 5.0 of 10

    A unified benchmark comparing RAG knowledge-extraction attacks and defenses, showing query diversity boosts extraction, embedding attacks fail to transfer, and graph indexing raises per-token leakage.

  10. RAG Security and Privacy: Formalizing the Threat Model and Attack Surface

    cs.CR 2025-09 conditional novelty 3.0 of 10

    A formal RAG threat model is defined with four adversary classes and game-based notions of membership inference, leakage, and poisoning, but the definitions largely restate known concepts and the main DP-based protect...

Pith tools