Private Retrieval Augmented Generation via Random Projection

AI security research · arXiv cs.CR (AI security)

Private Retrieval Augmented Generation via Random Projection

REDCORE assessment

The research demonstrates that random projection effectively preserves semantic search utility while increasing the difficulty of unauthorized data extraction from RAG stores. This method serves as a lightweight, performance-conscious alternative to traditional differential privacy, which often hinders retrieval quality. Defenders should view this as an empirical security improvement that maintains usability, rather than a mathematically perfect cryptographic guarantee of privacy.

Impact for lean teams

Small teams using RAG should be aware that their internal databases are vulnerable to data extraction attacks via the LLM. Implementing privacy-preserving techniques like random projection is a practical step for teams handling sensitive documents.

Source summary

Retrieval-Augmented Generation (RAG) enhances the capabilities of large language models (LLMs) by querying external structured knowledge. However, it can also introduce privacy risks by leaking sensitive information from the retrieval datastore. We propose a simple method to preserve datastore privacy in RAG systems via random projection. By applying the same projection to both datastore embeddings and query embeddings, our method provably preserves semantic similarity between queries and retrieved items while substantially mitigating data extraction attacks. Across multiple RAG architectures and datasets, we show that this lightweight approach achieves superior retrieval and generation performance compared to prior methods which leverage formal differential privacy (DP) guarantees, while exhibiting comparable empirical privacy under strong attack models. Our results for the first time s

Recommended actions

• Verify RAG retrieval access controls to ensure only authorized data is searchable.
• Implement data masking on sensitive fields within the vector database.
• Audit embeddings for potential PII leakage prior to storage in the vector index.
• Use project-specific isolation boundaries for external knowledge bases.

This assessment was generated by REDCORE AI from the attributed source above and is provided for situational awareness. Validate against the original research and your own environment before acting.