Jul 2026· Black Sea Journal of Engineering and Science· 0 citations· 29 references
TL;DR
PADP is presented, a sensitivity-aware perturbation framework inspired by differential privacy principles, which provides a plug-and-play, middleware framework that can be easily integrated into enterprise RAG pipelines without requiring costly computations for LLM fine-tuning and reconstruction of vector indices.
Abstract
Retrieval-Augmented Generation (RAG) makes it possible to enhance output from Large Language Models (LLMs) with retrieval-based evidence; however, these systems can also introduce privacy vulnerabilities, and in particular, Membership Inference Attacks (MIAs). Specifically, Differential Privacy (DP) is a well-established methodology for protecting privacy; however, applying static perturbation strategies, typically used in low-dimensional spaces, will result in degradation of semantic utility due to the high dimensionality of the embedding spaces. To solve this privacy-utility problem, we present PADP, a sensitivity-aware perturbation framework inspired by differential privacy principles, which provides a plug-and-play, middleware framework that can be easily integrated into enterprise RAG pipelines without requiring costly computations for LLM fine-tuning and reconstruction of vector indices. PADP uses Named Entity Recognition (NER) based on DeBERTa-v3 to perform sensitivity assessments of documents at the document level on an offline basis, computing PII sensitivity scores for each document. These scores are then used to adaptively calibrate the application of Laplace perturbations to dense query embeddings during retrieval. PADP assigns more protection to the higher-risk content and less to the lower-risk content than static perturbation methods would typically do, thereby increasing the effectiveness of retrieval. PADP draws on concepts from Differential Privacy; nonetheless, it does not furnish formal database-level Differential Privacy guarantees under conventional adjacency definitions. Consequently, the proposed framework should be understood as an adaptive privacy-enhancement mechanism rather than as a formally guaranteed Differential Privacy mechanism. Through the evaluation of the performance of PADP across diverse datasets by way of retrieval effectiveness metrics and distinguishability analysis, its comparison with static embedding perturbation baseline methods affords a contextual statistical analysis which indicates that adaptive sensitivity aware perturbation preserves semantic retrievability while dampening membership based distinguishability signals under the conditions of the study. These findings position sensitivity-aware perturbation as a practical approach to enhancing privacy in Retrieval-Augmented Generation systems while preserving utility.
Retrieval-augmented generation (RAG) enhances large language models via external document retrieval, but retrieved contexts may leak sensitive information. Current privacy protection methods typically rely on a document-level static risk assumption, treating all retrieved documents as having the same privacy leakage risk. However, this assumption overlooks a fundamental characteristic of RAG: the privacy risk of a document is highly dependent on the user's query, making privacy leakage inherently query-driven and dynamic. To address this challenge, we propose a Prompt-Aware Dynamic Hierarchical Differential Privacy framework (PA-HDP) for privacy-preserving RAG. PA-HDP first performs a prompt-aware risk hierarchy to dynamically assess privacy risks under different queries. It then applies adaptive sensitive entity replacement and exponential mechanism-based text selection to provide differentiated privacy protection while preserving semantic utility. By protecting only the content that is truly sensitive under a given query, PA-HDP minimizes unnecessary modifications to the retrieval corpus. Extensive experiments on benchmark datasets demonstrate that PA-HDP significantly reduces privacy leakage while maintaining high retrieval quality, achieving a better privacy-utility trade-off than prior methods.
Gang Zhang, Mingyu Tian, Xukun Luan et al.· 0 citations
ProxyDrift is presented, a framework that identifies and measures drift between production traffic and offline evaluation sets, and constructs and refreshes those evaluation sets accordingly; all without access to raw user data.
Michael Levit, Josh Ledgard, Haoyu Dong et al.· 0 citations
A uniform experimental comparison of vector search schemes finds that the performance of SAP matches Plaintext, EMVP delivers cryptographic indistinguishability at a 4x throughput cost on CPU, BNTM adds malicious-server verifiability at a further 22x median-latency cost, and Tiptoe hides the cluster choice itself, but incurs a 190x per-query cost compared to Plaintext.
Anne-Marie Kermarrec, Rafael Pires, Mathis Randl et al.· 1 citation
: Mobile devices store highly sensitive personal data, yet privacy failures often arise not from technical compromise but from mismatches between user intent and sharing interfaces that offer little contextual nuance. We propose ORCHID-FL, an on-device, language-mediated privacy agent that combines tag-grounded perception, a promptable LLM that proposes sharing decisions, and a deterministic rule engine that retains final authority. To allow the agent to adapt to evolving social and institutional norms without centralising sensitive data, ORCHID-FL is designed to participate in a federated fine-tuning loop using parameter-efficient (LoRA-style) updates. We position this paper as an architectural proposal: we present the system design, a hybrid LLM + deterministic-rule decision pipeline, and a threat model that treats the LLM and the federation channel as untrusted. We provide preliminary empirical evidence on the perception layer by comparing CNN-tag, multimodal-tag, and end-to-end multimodal architectures on 200 VizWiz-Priv images annotated by the author, and find that structured tag-grounded pipelines achieve the highest decision agreement and the lowest unintended disclosure rate. Federated fine-tuning evaluation, multi-annotator validation, and quantification of the differential-privacy/utility trade-off are deferred to future work.
George Popescu-Craiova· Proceedings of the 23rd Inte...· 0 citations
Personalized recommendation systems are central to modern e-commerce and retail platforms, but they typically rely on centralized storage of detailed user interaction data, creating significant privacy and regulatory challenges. With increasing requirements from regulations such as GDPR, CCPA, and CPRA, organizations must develop recommendation systems that preserve user privacy without substantially degrading recommendation quality. This work presents and evaluates a privacy-preserving recommendation framework that combines federated learning, differential privacy, cohort-level modeling, and privacy-aware intelligent agents. The framework keeps raw user data decentralized while introducing mathematically bounded noise to model updates. Experiments were conducted on synthetic retail datasets that emulate customer clickstream and purchase behavior. Recommendation quality was evaluated using Click-Through Rate (CTR), Precision@K, Recall@K, and Normalized Discounted Cumulative Gain (NDCG@K) across multiple differential privacy budgets. We evaluate matrix factorization, neural collaborative filtering, and GRU4Rec under varying privacy constraints and analyze the trade-off between privacy and utility. An interactive Streamlit dashboard was developed to visualize recommendation performance, ranking stability, privacy-utility trade-offs, and fairness metrics. Results show that the proposed framework maintains competitive recommendation quality at moderate privacy budgets (approximately $\epsilon \approx 5$), demonstrating that strong privacy guarantees can be achieved with limited impact on recommendation effectiveness. This work provides a practical framework for deploying privacy-preserving recommendation systems that balance personalization, regulatory compliance, and business objectives, offering a scalable approach for next-generation AI-driven retail platforms.
Ranjeet K Jha, Venkata Suresh Gummadilli· 0 citations
There are serious problems of privacy protection for continuous spatial data streams in the edge computing scenario. Traditional Concentrated Geo-Privacy (CGP) mechanisms and the existing adaptive methods both have a utility-efficiency bottleneck. Due to high concurrency and resource limitations in the environment, the current model has a large computational cost, and local spatial pruning methods often overlook the risk of cardinality leakage to deduce the true density. In response to the aforementioned weaknesses, this paper puts forward a lightweight collaborative geographic privacy preservation mechanism for dynamic data streams called Pruning-CGP. First, a physically separated query architecture will separate data ingestion from real-time queries to reduce computation. Second, in the zero-concentrated Differential Privacy (zCDP) setting, a discrete Gaussian mechanism is used for cardinality-preserving noise addition. In conjunction with the public prior, an adaptive distribution of the privacy budget is realised. Extensive physical stress tests with actual data have shown that the engineering feasibility of the proposed architecture has been realised. Under the above-mentioned privacy-equivalent constraints, the system has blocked side-channel cardinality leakage. Although it has a relatively low recall rate of about 31.5% and keeps the distance error at a practical hundred-meter level (e.g., 62 meters), it also achieves an extremely fast sub-millisecond response speed of 0.16 ms. Based on the above results, the Pruning-CGP mechanism can be applied to address the demand for a high-performance, low-resource algorithm in the context of edge computing.
Shiwen Xu· Applied and Computational En...· 0 citations