mlsanityData to 14 Oct 2026

Private-RAG: Answering Multiple Queries with LLMs while Keeping Your Data Private

arXiv 2511.07637 ↗First posted 10 Nov 2025cs.LG cs.AI cs.CRcited by 3

On the map: Retrieval-augmented generation → Privacy and security of RAG

Abstract (arXiv)

Retrieval-augmented generation (RAG) enhances large language models (LLMs) by retrieving documents from an external corpus at inference time. When this corpus contains sensitive information, however, unprotected RAG systems are at risk of leaking private information. Prior work has introduced differential privacy (DP) guarantees for RAG, but only in single-query settings, which fall short of realistic usage. In this paper, we study the more practical multi-query setting and propose two DP-RAG algorithms. The first, MURAG, leverages an individual privacy filter so that the accumulated privacy loss only depends on how frequently each document is retrieved rather than the total number of queries. The second, MURAG-ADA, further improves utility by privately releasing query-specific thresholds, enabling more precise selection of relevant documents. Our experiments across multiple LLMs and datasets demonstrate that the proposed methods scale to hundreds of queries within a practical DP budget (varepsilon≈10), while preserving meaningful utility.

Key facts. Cited by 3 papers in the map (data through 14 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 39 of its 45 references that are in the map. First posted on arXiv 10 Nov 2025.

Builds on

39 of 45 references.

Closest ancestors · 11

Same direction, newest first

  1. 2025InvisibleInk: High-Utility and Low-Cost Text Generation with Differential Privacy30 Jun
  2. 2025Riddle Me This! Stealthy Membership Inference for Retrieval-Augmented Generation1 Feb
  3. 2024RAG with Differential Privacy26 Dec
  4. 2024RemoteRAG: A Privacy-Preserving LLM Cloud RAG Service17 Dec
  5. 2024Privacy-Preserving Retrieval-Augmented Generation with Differential Privacy6 Dec
  6. 2024Data Extraction Attacks in Retrieval-Augmented Generation via Backdoors3 Nov
  7. 2024Mask-based Membership Inference Attacks for Retrieval-Augmented Generation26 Oct
  8. 2024Generating Is Believing: Membership Inference Attacks against Retrieval-Augmented Generation27 Jun
  9. 2024Mitigating the Privacy Issues in Retrieval-Augmented Generation (RAG) via Pure Synthetic Data20 Jun
  10. 2024Is My Data in Your Retrieval Database? Membership Inference Attacks Against Retrieval Augmented Generation30 May
  11. 2024The Good and The Bad: Exploring Privacy Issues in Retrieval-Augmented Generation (RAG)23 Feb

Other references · 28

  1. 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,297
  2. 2019BERTScore: Evaluating Text Generation with BERTcited by 5,512
  3. 2020Dense Passage Retrieval for Open-Domain Question Answeringcited by 3,824
  4. 2022OPT: Open Pre-trained Transformer Language Modelscited by 3,512
  5. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,281
  6. 2023Pythia: A Suite for Analyzing Large Language Models Across Training and Scalingcited by 1,786
  7. 2017Reading Wikipedia to Answer Open-Domain Questionscited by 777
  8. 2017Renyi Differential Privacycited by 650
  9. 2021Large Language Models Can Be Strong Differentially Private Learnerscited by 412
  10. 2021Differentially Private Fine-tuning of Language Modelscited by 400
  11. 2023ChatDoctor: A Medical Chat Model Fine-Tuned on a Large Language Model Meta-AI (LLaMA) Using Medical Domain Knowledgecited by 325
  12. 2023MQuAKE: Assessing Knowledge Editing in Language Models via Multi-Hop Questionscited by 300
16 more
  1. 2018Privacy Amplification by Subsampling: Tight Analyses via Couplings and Divergencescited by 242
  2. 2018Subsampled R'enyi Differential Privacy and Analytical Moments Accountantcited by 236
  3. 2023Privacy-Preserving In-Context Learning with Differentially Private Few-Shot Generationcited by 96
  4. 2023Flocks of Stochastic Parrots: Differentially Private Prompt Learning for Large Language Modelscited by 83
  5. 2024Differentially Private Synthetic Data via Foundation Model APIs 2: Textcited by 76
  6. 2020Individual Privacy Accounting via a Renyi Filtercited by 59
  7. 2023DP-OPT: Make Large Language Model Your Privacy-Preserving Prompt Engineercited by 57
  8. 2023Privacy-Preserving In-Context Learning for Large Language Modelscited by 50
  9. 2019Practical Differentially Private Top-k Selection with Pay-what-you-get Compositioncited by 39
  10. 2016Privacy Odometers and Filters: Pay-as-you-Go Compositioncited by 33
  11. 2024Fine-Tuning Large Language Models with User-Level Differential Privacycited by 29
  12. 2024Private prediction for large-scale synthetic text generationcited by 24
  13. 2022Fully Adaptive Composition in Differential Privacycited by 22
  14. 2022Individual Privacy Accounting with Gaussian Differential Privacycited by 20
  15. 2022Fully Adaptive Composition for Gaussian Differential Privacycited by 5
  16. 2025Clustering and Median Aggregation Improve Differentially Private Inferencecited by 5

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 3.

3 papers.

  1. 2026P2RAG: Efficient Privacy-Preserving RAG Service Supporting Arbitrary Top-k Retrievalcited by 1
  2. 2026Is External Database Protection Static in Retrieval-Augmented Generation? Rethinking Privacy Preservation under Dynamic Queriescited by 0
  3. 2026ScoreShield: Differentially Private Release of Similarity Scorescited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Differentially Private Synthetic Text Generation for Retrieval-Augmented Generation (RAG)
  2. 2026Differentially Private Retrieval-Augmented Generation
  3. 2026SoK: Privacy Risks and Mitigations in Retrieval-Augmented Generation Systems
  4. 2024Pirates of the RAG: Adaptively Attacking LLMs to Leak Knowledge Bases
  5. 2026PRAG: End-to-End Privacy-Preserving Retrieval-Augmented Generation
  6. 2026PILLAR: Private Inverted-Index Lexical Lookup for Augmented Retrieval
  7. 2025Privacy-Aware RAG: Secure and Isolated Knowledge Retrieval
  8. 2026Not All Entities are Created Equal: A Dynamic Anonymization Framework for Privacy-Preserving RAG