Is External Database Protection Static in Retrieval-Augmented Generation? Rethinking Privacy Preservation under Dynamic Queries

2026-07-16

AI Summary

This work addresses a critical limitation in existing retrieval-augmented generation (RAG) systems, where privacy-preserving methods typically assume static document-level risk and overlook the dynamic influence of user queries on privacy leakage. To overcome this, the paper introduces Prompt-Aware Hierarchical Differential Privacy (PA-HDP), a novel framework that incorporates query-driven dynamic risk modeling into RAG for the first time. PA-HDP achieves fine-grained, on-demand privacy protection through prompt-aware risk stratification, adaptive sensitive entity replacement, and exponential mechanism–based text selection. Experimental results demonstrate that PA-HDP significantly reduces privacy leakage risk across multiple benchmark datasets while maintaining high retrieval quality, outperforming state-of-the-art approaches in the privacy-utility trade-off.

Abstract

Retrieval-augmented generation (RAG) enhances large language models via external document retrieval, but retrieved contexts may leak sensitive information. Current privacy protection methods typically rely on a document-level static risk assumption, treating all retrieved documents as having the same privacy leakage risk. However, this assumption overlooks a fundamental characteristic of RAG: the privacy risk of a document is highly dependent on the user's query, making privacy leakage inherently query-driven and dynamic. To address this challenge, we propose a Prompt-Aware Dynamic Hierarchical Differential Privacy framework (PA-HDP) for privacy-preserving RAG. PA-HDP first performs a prompt-aware risk hierarchy to dynamically assess privacy risks under different queries. It then applies adaptive sensitive entity replacement and exponential mechanism-based text selection to provide differentiated privacy protection while preserving semantic utility. By protecting only the content that is truly sensitive under a given query, PA-HDP minimizes unnecessary modifications to the retrieval corpus. Extensive experiments on benchmark datasets demonstrate that PA-HDP significantly reduces privacy leakage while maintaining high retrieval quality, achieving a better privacy-utility trade-off than prior methods.

Problem

• Retrieval-Augmented Generation
• Privacy Preservation
• Dynamic Queries
• Privacy Leakage
• Differential Privacy

Innovation

• retrieval-augmented generation
• differential privacy
• query-aware privacy
• dynamic risk assessment
• privacy-utility trade-off