Private Retrieval Augmented Generation via Random Projection

What it claims

Multiply both the datastore embeddings and the query embeddings by one secret Gaussian matrix. Retrieval still finds relevant neighbours, but the attacker no longer reliably pulls out the exact top-scoring chunk. The authors claim this cuts black-box data extraction to roughly the level of the parametric model with no retrieval. They also claim it beats two DP baselines on utility: "over 50% on average across datasets". The paper offers no formal privacy guarantee. Privacy is measured only as the success rate of existing attacks.

How it works

1. Offline. Sample R ∈ ℝ^{k×d} with entries drawn from N(0, 1/k). Embed every document with a fixed pretrained encoder, then store R·eᵢ in FAISS or a similar index.
2. Online. Embed the query as x and compute Rx, which is one matrix-vector multiply. Run nearest-neighbour search in the k-dimensional space.
3. Standard RAG. Concatenate the top retrieved text with the query and pass it to the LLM.
4. KNN-LM. Take a softmax over cosine similarities and mix it with the LLM's distribution: λ·p_LLM + (1−λ)·p_kNN.

The claimed privacy effect: after projection, neighbours close to the original top match get selected with non-negligible probability, so a different token or chunk can replace the sensitive one. The utility argument rests on Johnson-Lindenstrauss distance preservation, and the appendix proves that L2 distance and cosine similarity are preserved.

The only parameter is k. The authors use k = 100 and say it matches k = 1600 on utility while being cheaper. For KNN-LM they set λ = 0.1 and K = 1024.

Evidence

The main attack is a repeated-query attack. Each entry gets 10 attempts, and the queries are seeded with dataset-specific priors, for example asking for emails on Enron. The baselines are:

• DP-RP-G: the Blocki et al. method adapted to RAG (project, clip, add Gaussian noise), with the clipping bound swept and the best value reported.
• DPSparseVoteRAG: Koga et al., with m = 50.

Both baselines are run at ε ∈ {1, 5, 10, 20}.

Standard RAG results:

KNN-LM on C4 / Llama3-8B: unprotected RAG leaks 269 items, RP leaks 17, and the parametric model alone leaks 0.

Setups also evaluated: Enron/GPT-2, ECHR/Llama3-1B, C4/Llama3-8B, and HotpotQA/Qwen2-7B. Utility is measured as perplexity plus task metrics.

How to use it

The page gives no code, repository or licence. The method needs no training and only a few lines of code. Generate R once from a seed and keep it secret. Project the index offline, then project each query before search. Run the same benchmark as the paper: a sweep over k. The authors' default is k = 100.

Limits

• The guarantee is empirical only. The threat model assumes the attacker sees text responses only. R, the embeddings, the logits and the model weights are all hidden. White-box attacks, embedding inversion, projection-matrix inversion and side channels are explicitly out of scope. If R or the projected index leaks, the paper says nothing about what protection remains.
• Leakage is reduced, not zero. RP leaked 23 items on C4 with Standard RAG and 17 with KNN-LM, while DP-RP-G at ε = 1 leaked 0 on both. If any residual leakage is unacceptable, RP is not sufficient.
• The utility cost can be large on small models. On ECHR with Llama3-1B, Standard RAG F1 drops from 97.2 to 66.7 and perplexity rises from 9.8 to 47.9. With Qwen3-4B the loss is small.
• The rate-limit assumption is built into the attack. The attack assumes the system blocks queries repeated more than 10 times.
• The ε values are inconsistent. Table 3 lists ε ∈ {10, 50, 100, 200}, but the text states {1, 5, 10, 20}. Check this before comparing the DP numbers.
• Part of the paper was not available. The fetched page cuts off at the membership-inference table. The multi-round adaptive attack (Section 4.3) and the HotpotQA results are not in the fetched text.
• This is a v1 preprint dated 15 Oct 2026.