# PIR-RAG: A System for Private Information Retrieval in Retrieval-Augmented Generation

arXiv: https://arxiv.org/abs/2509.21325 · HTML: https://mlsanity.com/paper/2509.21325/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation.
- Builds on 2 of its 11 references that are in the map.
- First posted on arXiv 1 Sep 2025.

## Placed in

- Retrieval-augmented generation / [Privacy and security of RAG](https://mlsanity.com/rag/privacy-and-security-of-rag/)

## Builds on (most cited first, 2 of 2)

- [Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks](https://mlsanity.com/paper/2005.11401/) (2020)
- [Efficient and robust approximate nearest neighbor search using Hierarchical Navigable Small World graphs](https://mlsanity.com/paper/1603.09320/) (2016)

## Built on by (most cited first, 4 of 4)

- [Spruce: Scalable Private Outsourced Retrieval Using Compact Embeddings](https://mlsanity.com/paper/2609.03376/) (2026)
- [Masking or Mitigating? Deconstructing the Impact of Query Rewriting on Retriever Biases in RAG](https://mlsanity.com/paper/2604.06097/) (2026)
- [Agents That Know Too Much: A Data-Centric Survey of Privacy in LLM Agents](https://mlsanity.com/paper/2606.26627/) (2026)
- [Quantization Enables Private Dense Retrieval against Malicious Service Providers](https://mlsanity.com/paper/2609.36376/) (2026)

## Abstract (arXiv)

Retrieval-Augmented Generation (RAG) has become a foundational component of modern AI systems, yet it introduces significant privacy risks by exposing user queries to service providers. To address this, we introduce PIR-RAG, a practical system for privacy-preserving RAG. PIR-RAG employs a novel architecture that uses coarse-grained semantic clustering to prune the search space, combined with a fast, lattice-based Private Information Retrieval (PIR) protocol. This design allows for the efficient retrieval of entire document clusters, uniquely optimizing for the end-to-end RAG workflow where full document content is required. Our comprehensive evaluation against strong baseline architectures, including graph-based PIR and Tiptoe-style private scoring, demonstrates PIR-RAG's scalability and its superior performance in terms of "RAG-Ready Latency"-the true end-to-end time required to securely fetch content for an LLM. Our work establishes PIR-RAG as a viable and highly efficient solution for privacy in large-scale AI systems.