Random projection improves privacy in retrieval augmented generation
Private Retrieval Augmented Generation via Random Projection
Artificial IntelligenceCryptography and Security
Summary
Retrieval-Augmented Generation (RAG) systems help language models answer questions by looking up information from external sources. However, these lookups can risk leaking private data from the stored information. The authors show that using a technique called random projection on the data and queries can keep the important connections while making it harder for attackers to steal private information. Their approach performs better than previous privacy methods and works well with different systems and datasets.
What this means in practice
- •For enterprise ai teams: Protect sensitive corporate data in retrieval-augmented language model systems by applying a lightweight privacy method that maintains retrieval quality.
- •For healthcare data engineers: Secure patient data while enabling medical question answering systems to retrieve relevant records with preserved privacy.
Authors
Dixi Yao, Tahseen Rabbani, Tian Li
Abstract
Retrieval-Augmented Generation (RAG) enhances the capabilities of large language models (LLMs) by querying external structured knowledge. However, it can also introduce privacy risks by leaking sensitive information from the retrieval datastore. We propose a simple method to preserve datastore privacy in RAG systems via random projection. By applying the same projection to both datastore embeddings and query embeddings, our method provably preserves semantic similarity between queries and retrieved items while substantially mitigating data extraction attacks. Across multiple RAG architectures and datasets, we show that this lightweight approach achieves superior retrieval and generation performance compared to prior methods which leverage formal differential privacy (DP) guarantees, while exhibiting comparable empirical privacy under strong attack models. Our results for the first time suggest that random projection can serve as a competitive and practical baseline for privacy-preserving RAG systems.