Mind the Hook: Source-Level Auditing of Privacy Defenses in Retrieval-Augmented Generation
2026-08-10 • Cryptography and Security
Cryptography and SecurityMachine Learning
AI summaryⓘ
The authors looked at how to measure privacy in systems that generate text using retrieved information, especially when the inner workings of the system are unknown (black-box). They propose a method called active-path audit that tracks where and how privacy leaks might happen during retrieval and text generation, and they test this with special hidden markers called canaries. Their study shows that some defenses mainly change retrieval behavior but do not affect what the system generates, which explains why these defenses reduce some privacy risks but not all. The authors emphasize that their work focuses on demonstrating a new analysis approach rather than ranking existing defenses.
retrieval-augmented generationblack-box privacyactive-path auditmembership inferencedifferential privacycanarynamed-entity leakagegeneration hookretrieval scoresLPRAG
Authors
Yanhang Li, Zhichao Fan, Zexin Zhuang
Abstract
Black-box privacy scores for retrieval-augmented generation (RAG) are difficult to interpret unless the audited defense's active pipeline hook is known. We propose an active-path audit: inventory source-level hooks over retrieval, retrieved content, and generation; map each metric to the leakage channel it observes; and validate generated-text effects with exact-match canaries. In our benchmark reimplementations, the DP-style defenses modify retrieval scores only: their generation hooks are TODO-flagged stubs that return responses unchanged. This active path explains why they affect membership-inference behavior but track No-Defense on generated-text named-entity leakage, measured by NEL_strict. By contrast, the end-to-end LPRAG path is canary-validated on the email channel, recovering 53/150 canaries under No-Defense and 0/150 under LPRAG. These findings concern our reimplementations on our stack, not released defenses or defense families; the contribution is a methodology and case study, not a universal ranking