Search papers, labs, and topics across Lattice.
This paper introduces an active-path audit methodology for evaluating privacy defenses in retrieval-augmented generation (RAG) systems, focusing on the source-level hooks that influence data leakage. The authors find that existing differential privacy defenses primarily modify retrieval scores without adequately addressing generation hooks, resulting in misleading privacy scores and ineffective protection against membership inference. Their experiments reveal that while traditional defenses fail to mitigate named-entity leakage, a novel end-to-end LPRAG approach significantly improves privacy by validating canary tokens in generated text.
Existing privacy defenses in RAG systems may be misleading, as they often fail to address critical generation hooks, leaving data vulnerable to leakage.
Black-box privacy scores for retrieval-augmented generation (RAG) are difficult to interpret unless the audited defense's active pipeline hook is known. We propose an active-path audit: inventory source-level hooks over retrieval, retrieved content, and generation; map each metric to the leakage channel it observes; and validate generated-text effects with exact-match canaries. In our benchmark reimplementations, the DP-style defenses modify retrieval scores only: their generation hooks are TODO-flagged stubs that return responses unchanged. This active path explains why they affect membership-inference behavior but track No-Defense on generated-text named-entity leakage, measured by NEL_strict. By contrast, the end-to-end LPRAG path is canary-validated on the email channel, recovering 53/150 canaries under No-Defense and 0/150 under LPRAG. These findings concern our reimplementations on our stack, not released defenses or defense families; the contribution is a methodology and case study, not a universal ranking
