mlsanityData to 13 Oct 2026

Privacy Challenges and Solutions in Retrieval-Augmented Generation-Enhanced LLMs for Healthcare Chatbots: A Review of Applications, Risks, and Future Directions

arXiv 2511.11347 ↗First posted 14 Nov 2025cs.CR cs.AIcited by 3

On the map: Retrieval-augmented generation → Privacy and security of RAG

Abstract (arXiv)

Retrieval-augmented generation (RAG) has rapidly emerged as a transformative approach for integrating large language models into clinical and biomedical workflows. However, privacy risks, such as protected health information (PHI) exposure, remain inconsistently mitigated. This review provides a thorough analysis of the current landscape of RAG applications in healthcare, including (i) sensitive data type across clinical scenarios, (ii) the associated privacy risks, (iii) current and emerging data-privacy protection mechanisms and (iv) future direction for patient data privacy protection. We synthesize 23 articles on RAG applications in healthcare and systematically analyze privacy challenges through a pipeline-structured framework encompassing data storage, transmission, retrieval and generation stages, delineating potential failure modes, their underlying causes in threat models and system mechanisms, and their practical implications. Building on this analysis, we critically review 17 articles on privacy-preserving strategies for RAG systems. Our evaluation reveals critical gaps, including insufficient clinical validation, absence of standardized evaluation frameworks, and lack of automated assessment tools. We propose actionable directions based on these limitations and conclude with a call to action. This review provides researchers and practitioners with a structured framework for understanding privacy vulnerabilities in healthcare RAG and offers a roadmap toward developing systems that achieve both clinical effectiveness and robust privacy preservation.

Key facts. Cited by 3 papers in the map (data through 13 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 19 of its 74 references that are in the map. First posted on arXiv 14 Nov 2025.

Builds on

19 of 74 references.

Closest ancestors · 15

Same direction, newest first

  1. 2025HyFedRAG: A Federated Retrieval-Augmented Generation Framework for Heterogeneous and Privacy-Sensitive Data8 Sep
  2. 2025Privacy-Preserving Reasoning with Knowledge-Distilled Parametric Retrieval Augmented Generation1 Sep
  3. 2025Privacy-protected Retrieval-Augmented Generation for Knowledge Graph Question Answering12 Aug
  4. 2025Privacy-Aware Decoding: Mitigating Privacy Leakage of Large Language Models in Retrieval-Augmented Generation5 Aug
  5. 2025Silent Leaks: Implicit Knowledge Extraction Attack on RAG Systems through Benign Queries21 May
  6. 2025Privacy-Preserving Federated Embedding Learning for Localized Retrieval-Augmented Generation27 Apr
  7. 2024RAG with Differential Privacy26 Dec
  8. 2024Privacy-Preserving Retrieval-Augmented Generation with Differential Privacy6 Dec
  9. 2024Data Extraction Attacks in Retrieval-Augmented Generation via Backdoors3 Nov
  10. 2024Mask-based Membership Inference Attacks for Retrieval-Augmented Generation26 Oct
  11. 2024Generating Is Believing: Membership Inference Attacks against Retrieval-Augmented Generation27 Jun
  12. 2024Mitigating the Privacy Issues in Retrieval-Augmented Generation (RAG) via Pure Synthetic Data20 Jun
3 more
  1. 2024Is My Data in Your Retrieval Database? Membership Inference Attacks Against Retrieval Augmented Generation30 May
  2. 2024Follow My Instruction and Spill the Beans: Scalable Data Extraction from Retrieval-Augmented Generation Systems27 Feb
  3. 2024The Good and The Bad: Exploring Privacy Issues in Retrieval-Augmented Generation (RAG)23 Feb

Other references · 4

  1. 2021Federated Learning on Non-IID Data: A Surveycited by 346
  2. 2024The Ethics of ChatGPT in Medicine and Healthcare: A Systematic Review on Large Language Models (LLMs)cited by 45
  3. 2024Transferable Embedding Inversion Attack: Uncovering Privacy Risks in Text Embeddings without Model Queriescited by 25
  4. 2025A Survey on Privacy Risks and Protection in Large Language Modelscited by 20

Built on by

Cited by year (2026 to 13 Oct)

Citing papers per year: 2026: 3.

3 papers.

  1. 2026When RAG Chatbots Expose Their Backend: An Anonymized Case Study of Privacy and Security Risks in Patient-Facing Medical AIcited by 0
  2. 2026Is External Database Protection Static in Retrieval-Augmented Generation? Rethinking Privacy Preservation under Dynamic Queriescited by 0
  3. 2026RAG-PIBench: A Leakage-Aware Benchmark for Prompt-Injection Detection in Trustworthy RAG Systemscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026SoK: Privacy Risks and Mitigations in Retrieval-Augmented Generation Systems
  2. 2026Security and Privacy in Retrieval-Augmented Generation: Architectures, Threats, Defenses, and Future Directions for Building Trustworthy Systems
  3. 2026MedPriv-Bench: Benchmarking the Privacy-Utility Trade-off of Large Language Models in Medical Open-Ended Question Answering
  4. 2024Hybrid RAG-empowered Multi-modal LLM for Secure Data Management in Internet of Medical Things: A Diffusion-based Contract Approach
  5. 2026RAG-CT: Mitigating Privacy Risks on Retrieval-Augmented Generation Systems via Scanning Prompt Distribution
  6. 2025Privacy-Aware RAG: Secure and Isolated Knowledge Retrieval
  7. 2025Securing RAG: A Risk Assessment and Mitigation Framework
  8. 2025RAG Security and Privacy: Formalizing the Threat Model and Attack Surface