Private Retrieval Augmented Generation via Random Projection

What it is

A defense for RAG datastores against text-extraction attacks: sample one secret Gaussian matrix R (k×d, entries N(0, 1/k)), project every datastore embedding once offline, and project each incoming query embedding with the same R before similarity search. It is evaluated on two architectures, kNN-LM and standard RAG (retrieved text concatenated into the prompt). The authors frame it as an empirical defense, not a formal privacy guarantee.

How it works

Random projection approximately preserves L2 distance and cosine similarity (Johnson-Lindenstrauss; the paper includes a proof and a synthetic-data check), so retrieval stays relevant. The paper's privacy argument is that after projection, embeddings near the original top match can be selected with non-negligible probability. A different token or document can therefore replace the one vanilla RAG would have returned. Cost is one matrix-vector multiply per query, and projected vectors go into FAISS or similar as usual.

The only tunable is k. The authors use k=100, which they say gives utility comparable to k=1600. For kNN-LM they set λ=0.1 and K=1024.

Preconditions / Affected

The threat model is narrow:

• Black-box attacker who sees only text responses.
• R stays secret. The attacker knows RP is used.
• Repeated queries (10 attempts per entry; the system is assumed to block queries repeated more than 10 times) and multi-round adaptive attacks are covered.
• Explicitly out of scope: white-box access, embedding inversion, projection-matrix inversion, and side channels.

If embeddings or R can leak, the evaluation does not cover your case.

Results worth knowing

Datasets and models: Enron/GPT-2, ECHR/Llama3-1B and Qwen3-4B, C4/Llama3-8B. HotpotQA/Qwen2-7B is also listed in the setup.

• Unprotected standard RAG on Enron leaked 217 items in Table 2. Table 3 shows 36 emails, 56 URLs and 125 phone numbers. RP leaked 3 in Table 2 and 3 URLs in Table 3.
• ECHR/Llama3-1B, kNN-LM: leakage fell from 82.72% (RAG) to 2.26%, with F1 87.70 against 90.32 for RAG.
• ECHR/Llama3-1B, standard RAG: RP perplexity was 47.92 against 79.72–7780 for the DP baselines. F1 was 66.70 against 97.18 for plain RAG, a visible utility loss.
• C4/Llama3-8B: RP leaked 17 (kNN-LM) and 23 (standard RAG), against 269 and 358 for plain RAG. It was not zero, and some DP settings did better on leakage. DP-RP-G at ε=1 and ε=5 leaked 0 on C4, but with perplexity of 5.98 and 28.41 (kNN-LM, standard RAG) against RP's 2.98 and 2.96.
• The DPSparseVoteRAG baseline showed no good operating point: higher ε lowered perplexity but raised leakage. The paper's own sweep found DP-RP-G strongly private at all budgets but with poorer utility.

What to do

If you run a RAG system with a sensitive datastore and have no mitigation yet, this is cheap to prototype: add a fixed, secret projection layer between the encoder and the index. Then re-run your own extraction attacks, since the paper's attack prompts are dataset-specific (Appendix E, not reproduced here). Treat k as the knob and test it on your own data.

Caveats

• Empirical only. There is no formal privacy bound, and the paper says formal guarantees are not its goal.
• Results are on four datastore/model pairs, and leakage is not uniformly lowest for RP.
• The membership-inference (Table 4) text is cut off in the fetched page, so that result is unverified here.
• Security rests on R staying secret and on embeddings never being exposed. The paper does not test the case where either fails.
• This is a v1 preprint.