mlsanityData to 14 Oct 2026

Safeguarding Privacy of Retrieval Data against Membership Inference Attacks: Is This Query Too Close to Home?

arXiv 2505.22061 ↗First posted 28 May 2025cs.CLcited by 9

On the map: Retrieval-augmented generation → Privacy and security of RAG

also in 1 more
Abstract (arXiv)

Retrieval-augmented generation (RAG) mitigates the hallucination problem in large language models (LLMs) and has proven effective for personalized usages. However, delivering private retrieved documents directly to LLMs introduces vulnerability to membership inference attacks (MIAs), which try to determine whether the target data point exists in the private external database or not. Based on the insight that MIA queries typically exhibit high similarity to only one target document, we introduce a novel similarity-based MIA detection framework designed for the RAG system. With the proposed method, we show that a simple detect-and-hide strategy can successfully obfuscate attackers, maintain data utility, and remain system-agnostic against MIA. We experimentally prove its detection and defense against various state-of-the-art MIA methods and its adaptability to existing RAG systems.

Key facts. Cited by 9 papers in the map (data through 14 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 19 of its 28 references that are in the map. First posted on arXiv 28 May 2025.

Builds on

19 of 28 references.

Closest ancestors · 3

Same direction, newest first

  1. 2025Riddle Me This! Stealthy Membership Inference for Retrieval-Augmented Generation1 Feb
  2. 2024Privacy-Preserving Retrieval-Augmented Generation with Differential Privacy6 Dec
  3. 2024The Good and The Bad: Exploring Privacy Issues in Retrieval-Augmented Generation (RAG)23 Feb

Other references · 16

  1. 2020Language Models are Few-Shot Learnerscited by 32,419
  2. 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,297
  3. 2020Dense Passage Retrieval for Open-Domain Question Answeringcited by 3,824
  4. 2017TriviaQA: A Large Scale Distantly Supervised Challenge Dataset for Reading Comprehensioncited by 2,955
  5. 2017Billion-scale similarity search with GPUscited by 2,497
  6. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,281
  7. 2021BEIR: A Heterogenous Benchmark for Zero-shot Evaluation of Information Retrieval Modelscited by 1,252
  8. 2023Towards General Text Embeddings with Multi-stage Contrastive Learningcited by 723
  9. 2023In-Context Retrieval-Augmented Language Modelscited by 702
  10. 2021Retrieval Augmentation Reduces Hallucination in Conversationcited by 692
  11. 2023Lift Yourself Up: Retrieval-augmented Text Generation with Self Memorycited by 103
  12. 2023Privacy-Preserving In-Context Learning with Differentially Private Few-Shot Generationcited by 96
4 more
  1. 2023DP-OPT: Make Large Language Model Your Privacy-Preserving Prompt Engineercited by 57
  2. 2024Membership Inference Attacks Against In-Context Learningcited by 43
  3. 2019Practical Differentially Private Top-k Selection with Pay-what-you-get Compositioncited by 39
  4. 2025Tokens for Learning, Tokens for Unlearning: Mitigating Membership Inference Attacks in Large Language Models via Dual-Purpose Trainingcited by 15

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 1; 2026: 8.

9 papers.

  1. 2025Differentially Private Synthetic Text Generation for Retrieval-Augmented Generation (RAG)cited by 6
  2. 2026Five Queries Are Enough: Query-Efficient and Surrogate-Free Membership Inference Attacks on RAG via Entailmentcited by 4
  3. 2026Securing Retrieval-Augmented Generation: A Taxonomy of Attacks, Defenses, and Future Directionscited by 2
  4. 2026NLP Privacy Risk Identification in Social Media (NLP-PRISM): A Surveycited by 0
  5. 2026Towards Unsupervised Adversarial Document Detection in Retrieval Augmented Generation Systemscited by 0
  6. 2026Agents That Know Too Much: A Data-Centric Survey of Privacy in LLM Agentscited by 0
  7. 2026ScoreShield: Differentially Private Release of Similarity Scorescited by 0
  8. 2026DP-MemView: A Memory Interface for Attribute-Level Transcript Privacy in Long-Term LLM Agentscited by 0
  9. 2026RAG-CT: Mitigating Privacy Risks on Retrieval-Augmented Generation Systems via Scanning Prompt Distributioncited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024Is My Data in Your Retrieval Database? Membership Inference Attacks Against Retrieval Augmented Generation
  2. 2024Generating Is Believing: Membership Inference Attacks against Retrieval-Augmented Generation
  3. 2026Security and Privacy in Retrieval-Augmented Generation: Architectures, Threats, Defenses, and Future Directions for Building Trustworthy Systems
  4. 2024Mask-based Membership Inference Attacks for Retrieval-Augmented Generation
  5. 2026Towards Secure Retrieval-Augmented Generation: A Comprehensive Review of Threats, Defenses and Benchmarks
  6. 2025RAG Security and Privacy: Formalizing the Threat Model and Attack Surface
  7. 2025Ensemble Privacy Defense for Knowledge-Intensive LLMs against Membership Inference Attacks
  8. 2024Pirates of the RAG: Adaptively Attacking LLMs to Leak Knowledge Bases