Privacy accounting challenges in retrieval-augmented generation explored
From One Query to Many: A Critical Survey of Privacy Accounting in RAG
Cryptography and Security
Summary
Large language models can look up information from external sources to give better answers, but this can risk exposing sensitive data. The authors review how different methods protect privacy when models make many queries, showing that privacy measurements for one answer don’t simply add up for many. They suggest thinking about privacy guarantees by considering what data is protected, over what time, and what outputs are shared. This helps clarify how to compare privacy protection in systems that use external knowledge safely.
What this means in practice
- •For privacy engineers: Assess cumulative privacy loss across multiple queries to better design private retrieval-augmented systems.
- •For data protection officers: Clarify how to interpret differential privacy guarantees to communicate risks in AI systems using external data.
A survey. It maps existing work.
Authors
Zhiyuan Zhang
Abstract
Retrieval-augmented generation (RAG) enables large language models to leverage external knowledge but introduces privacy risks when the retrieved corpus contains sensitive information. Differential privacy (DP) offers formal protection, yet interpreting and comparing privacy guarantees across existing DP-RAG methods remains challenging. In particular, a privacy budget reported for a single response does not directly characterize privacy loss over repeated queries, and even identical values of $\varepsilon$ may represent different guarantees depending on the protected data unit, accounting horizon, and observable outputs. This survey critically examines how privacy accounting evolves from single-query generation to multi-query RAG systems. We categorize existing approaches into query-time privatization, multi-query accounting, and one-time corpus privatization. We analyze their underlying assumptions and privacy--utility trade-offs. Rather than ranking methods by $\varepsilon$ alone, we propose a framework that interprets a DP-RAG guarantee along three dimensions: privacy granularity, accounting scope, and release boundaries. We conclude that an $\eps$ is a claim only together with the three slots: the protected unit, the accounting scope, and the release boundary.