REVIEW 3 major objections 2 minor 3 cited by
Privacy-Aware Decoding: Mitigating Privacy Leakage of Large Language Models in Retrieval-Augmented Generation
T0 review · 3 major / 2 minor · reviewed 2026-08-06 · deepseek-v4-flash
Pith's one-line read The paper proposes Privacy-Aware Decoding, an inference-time method that adds calibrated Gaussian noise to token logits so each RAG response carries an explicit $(\varepsilon,\delta)$-DP guarantee while reducing private-information leakage.
desk verdict A plausible decoding-time privacy defense whose per-response DP guarantee hinges on accounting for the screening and sensitivity estimation; the text is unreadable in this form, so the headline claim is unverified, not refuted. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The carrying object is the Privacy-Aware Decoding (PAD) procedure, an inference-time wrapper around the LLM's next-token logits. Its three components are confidence-based screening, which selects high-risk token positions; efficient sensitivity estimation, which bounds how much the logits can change with the private context so noise is not wasted; and context-aware calibration, which picks the Gaussian noise scale for each position. A Rényi differential privacy accountant then accumulates the noise across decoding steps and converts it into a per-response $(\varepsilon,\delta)$-DP guarantee. Because all of this operates on logits alone, PAD is model-agnostic and needs no retraining.
What would settle it
Audit a PAD-protected RAG system by inserting a known private sentence into the retrieved corpus and running a membership-extraction attack over many responses. If an attacker can reliably recover that sentence while each response is reported at a small budget (say $\varepsilon \leq 1$), the empirical leakage would exceed what the claimed $(\varepsilon,\delta)$-DP guarantee permits, showing the accounting misses part of the mechanism.
Extended reading notes
Core claim
On the paper's own terms, the central discovery is that a decoding-time mechanism can make RAG outputs differentially private one response at a time. PAD treats the generated response as the output of a Gaussian mechanism applied to token logits: confidence screening identifies tokens whose exposure would be most damaging, efficient sensitivity estimation bounds how much the logits shift if a private document changes, and context-aware calibration sets the noise level per position. The Rényi accountant then composes these per-token perturbations across the whole response, yielding the explicit $(\varepsilon,\delta)$-DP bound. The reported experiments show the method cutting private-information leakage substantially while keeping answer quality, and beating existing retrieval-based and post-processing-based defenses.
Load-bearing premise
The central guarantee stands only if the confidence-based screening and noise-calibration steps are either independent of the private data or fully charged in the Rényi privacy accountant; the abstract does not describe how these data-dependent steps are accounted for.
Editorial extensions
If this is right
- PAD can be attached to a deployed RAG system without retraining or modifying the private corpus, because it only reads the model's token logits.
- Each response gets its own $(\varepsilon,\delta)$ budget, so a deployment can set a release threshold and regenerate or withhold answers that would exceed it.
- Because screening targets only high-risk tokens, utility loss is concentrated where leakage risk is greatest, which is how the method preserves answer quality.
- If the results generalize, decoding-time noise becomes a practical alternative to corpus-level filtering in settings where the corpus cannot be altered.
Reading between the lines
- Repeated queries to the same private corpus would need to compose their per-response budgets; the Rényi accountant already provides the composition machinery, so a total privacy budget per user or session is a natural deployment constraint, though the paper does not spell this out.
- A testable extension is to apply PAD to other sensitive generation tasks, such as summarizing private documents or completing code from private repositories, to see whether the logit-level mechanism transfers.
- If confidence-based screening is data-dependent, the pattern of which tokens get noise could itself signal which content is private; the formal guarantee is complete only if the screening decision is included in the privacy accountant, which the paper's abstract does not explicitly describe.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper proposes Privacy-Aware Decoding (PAD), an inference-time defense that injects calibrated Gaussian noise into token logits during retrieval-augmented generation. PAD combines confidence-based screening of high-risk tokens, sensitivity estimation, and an Rényi differential privacy accountant, and the abstract claims explicit per-response (ε,δ)-DP guarantees as well as improved utility over existing defenses on three datasets. The paper also provides a code repository. In the version supplied for review, however, the full text is not legibly encoded, so the mathematical derivation, algorithmic details, and experimental tables cannot be inspected.
Significance. If the central claim holds, PAD addresses a timely and practically important problem: privacy leakage from private corpora in RAG systems. A decoding-time, model-agnostic defense with a per-response DP guarantee would be a useful contribution, and the availability of code is a concrete strength. The significance is currently conditional, because the advertised formal guarantee depends on accounting details—the sensitivity of the logit perturbation, the treatment of confidence-based screening, and the composition analysis—that are not visible in the supplied version. The privacy-accounting concern raised in the stress-test note is therefore unresolved rather than refuted.
major comments (3)
- [Abstract (per-response DP claim)] The abstract states that an RDP accountant 'rigorously tracks cumulative privacy loss, enabling explicit per-response (ε,δ)-DP guarantees,' but it does not define the sensitivity of the logit perturbation or the Gaussian noise scale. If the sensitivity estimate is computed from the private corpus, the noise distribution itself may depend on the private data and must be charged in the RDP budget. Please provide a formal sensitivity bound (ideally a fixed, corpus-independent Lipschitz constant for the logit mapping) and a precise composition rule over the decoding steps; otherwise the advertised guarantee is not verifiable.
- [Abstract (confidence-based screening)] The screening rule that selects which tokens receive noise is described as 'selectively protect[ing] high-risk tokens,' but the abstract does not state whether the screening predicate is independent of the private corpus or whether its privacy cost is included in the accounting. If, under neighboring corpora, the set of screened tokens changes, then the mechanism is not simply additive Gaussian noise applied after selection; the selection itself is part of the randomized algorithm and must be accounted for. Please either prove that screening is a public, corpus-independent function or explicitly compose the screening step into the RDP analysis.
- [Abstract (experimental claims)] The empirical claims—'substantially reduces private information leakage while preserving response utility' and outperforming existing defenses on three datasets—cannot be checked from this version. The supplied text is largely unreadable, and the abstract alone gives no dataset sizes, baselines, noise scales, utility or privacy metrics, or variance information. The revision should make the experimental protocol and full results legible, including the private-information leakage measure and standard deviations or confidence intervals.
minor comments (2)
- [Abstract] The first occurrence of 'Rényi' is typeset as '\renyi'; it should be rendered with the proper accent as 'Rényi Differential Privacy'.
- [Full text (as supplied)] The full-text encoding is corrupted throughout, with many passages appearing as unreadable character substitutions. Please ensure the published version encodes all mathematical notation, special characters, and CJK text correctly so that reviewers and readers can access the algorithms and proofs.
Circularity Check
No demonstrated circularity; the data-dependent sensitivity concern is an unresolved soundness gap, not a reduction by construction.
full rationale
The paper's derivation chain (sensitivity estimation, noise calibration, RDP accountant, per-response (epsilon, delta)-DP guarantee) is not shown to reduce to its own inputs. The abstract describes 'efficient sensitivity estimation' and 'context-aware noise calibration' but does not state whether the sensitivity is a fixed, corpus-independent global bound or whether the confidence-based screening has its privacy cost charged in the accountant. That absence is a missing proof or a soundness risk, not a demonstrated equivalence by construction. A DP claim that is unsupported because a parameter may be data-dependent is a correctness concern, not a case where an equation is identical to its input or a fitted value is renamed as a prediction. No self-citation chain, imported uniqueness theorem, or renamed known result is visible in the readable portion of the manuscript. Because the full text is garbled, no specific circular equation can be quoted, and the instructions forbid manufacturing circularity from a vague concern. The correct circularity score is therefore 0, with the caveat that the advertised guarantee depends on a global sensitivity lemma or a privacy charge for the screening step that the abstract does not establish.
Assumptions & free parameters
free parameters (2)
- Gaussian noise scale (sigma) =
not specified in abstract
- Confidence screening threshold =
not specified in abstract
assumptions (3)
- standard math Renyi differential privacy (RDP) composition theorem applies to the token-level noise mechanism over the generated sequence.
- domain assumption The sensitivity of token logits with respect to any private document is bounded and can be estimated from the model's confidence scores.
- ad hoc to paper Confidence-based screening does not itself consume privacy budget or its cost is included in the RDP accounting.
Cite this review
Pith. "Pith review of Privacy-Aware Decoding: Mitigating Privacy Leakage of Large Language Models in Retrieval-Augmented Generation." pith.science (2026). https://pith.science/paper/UL7T5KV6
@misc{pith2026250803098,
author = {Pith},
title = {Pith review of: Privacy-Aware Decoding: Mitigating Privacy Leakage of Large Language Models in Retrieval-Augmented Generation},
year = {2026},
howpublished = {\url{https://pith.science/paper/UL7T5KV6}},
note = {Machine review of arXiv:2508.03098}
}
abstract
Retrieval-Augmented Generation (RAG) enhances the factual accuracy of large language models (LLMs) by conditioning outputs on external knowledge sources. However, when retrieval involves private or sensitive data, RAG systems are susceptible to extraction attacks that can leak confidential information through generated responses. We propose Privacy-Aware Decoding (PAD), a lightweight, inference-time defense that adaptively injects calibrated Gaussian noise into token logits during generation. PAD integrates confidence-based screening to selectively protect high-risk tokens, efficient sensitivity estimation to minimize unnecessary noise, and context-aware noise calibration to balance privacy with generation quality. A \renyi Differential Privacy (RDP) accountant rigorously tracks cumulative privacy loss, enabling explicit per-response $(\varepsilon, \delta)$-DP guarantees for sensitive outputs. Unlike prior approaches requiring retraining or corpus-level filtering, PAD is model-agnostic and operates entirely at decoding time with minimal computational overhead. Experiments on three real-world datasets demonstrate that PAD substantially reduces private information leakage while preserving response utility, outperforming existing retrieval- and post-processing-based defenses. Our work takes an important step toward mitigating privacy risks in RAG via decoding strategies, paving the way for universal and scalable privacy solutions in sensitive domains. Our code is available: https://github.com/wang2226/PAD.
Forward citations
Cited by 3 Pith papers
-
Is External Database Protection Static in Retrieval-Augmented Generation? Rethinking Privacy Preservation under Dynamic Queries
A query-aware hierarchical differential privacy method for retrieval-augmented generation reports zero extraction leakage in targeted tests while preserving more answer utility than static baselines.
-
Graphs Don't Stay Secret: Practical Subgraph Reconstruction Attacks on Defended Graph RAG
GRASP, a closed-box multi-turn prompt attack, reconstructs type-faithful one-hop subgraphs from defended Graph RAG systems, reaching up to 82.9 F1 where prior attacks fail.
-
RAG Security and Privacy: Formalizing the Threat Model and Attack Surface
A formal RAG threat model is defined with four adversary classes and game-based notions of membership inference, leakage, and poisoning, but the definitions largely restate known concepts and the main DP-based protect...
Reference graph
Works this paper leans on
-
[1]
���������� �������� �� ������������ �� ���������� ���� ��� ��������� ������������� �������� ���� ��� ��� � ��������� ��� � ����� ��� � ��������� ��� � ����� ��� ��� � ������ �������� ������������������������� ��������� �� ���������� ������������ �������� ���������������������� ������������ ���������������������� �������������������������������������������...
Reviewed August 6, 2026 · model on record in the stance chip above.
Discussion (0). Sign in to comment.