From One Query to Many: A Critical Survey of Privacy Accounting in RAG
Survey says RAG differential-privacy claims cannot be compared by epsilon alone across repeated queries.
This survey examines differential-privacy accounting for retrieval-augmented generation when the retrieved corpus contains sensitive information. It argues that a privacy budget reported for one response does not characterize loss over repeated queries, and that identical epsilon values can represent different guarantees. Existing methods are categorized as query-time privatization, multi-query accounting, and one-time corpus privatization. The authors say an epsilon is meaningful only together with the protected data unit, accounting scope, and release boundary.
- A single-response epsilon does not describe privacy loss across repeated RAG queries.
- Methods are grouped as query-time, multi-query, and one-time corpus privatization.
- Each guarantee needs the protected unit, accounting scope, and release boundary.
From the original article
1 min read at arxiv.orgRetrieval-augmented generation (RAG) enables large language models to leverage external knowledge but introduces privacy risks when the retrieved corpus contains sensitive information. Differential privacy (DP) offers formal protection, yet interpreting and comparing privacy guarantees across existing DP-RAG methods remains challenging.
By Zhiyuan Zhang · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.