SEAL-Tag: Self-Tag Evidence Aggregation with Probabilistic Circuits for PII-Safe Retrieval-Augmented Generation
On the map: Retrieval-augmented generation → Privacy and security of RAG
Abstract (arXiv)
Retrieval-Augmented Generation (RAG) systems introduce a critical vulnerability: contextual leakage, where adversaries exploit instruction-following to exfiltrate Personally Identifiable Information (PII) via adaptive extraction. Current defenses force a rigid trade-off between semantic utility and latency. We present SEAL-Tag, a privacy-preserving runtime environment that resolves this via a Verify-then-Route paradigm. SEAL-Tag introduces the SEAL-Probe protocol, transforming auditing into a structured tool-use operation where the model generates a verifiable PII-Evidence Table (PET) alongside its draft. To adjudicate this evidence, we employ a Probabilistic Circuit (PC) that enforces verifiable logical constraints for robust decision-making. To overcome the privacy "Cold Start" problem, we introduce the S0--S6 Anchored Synthesis Pipeline, generating high-fidelity, provenanced RAG interactions. We pair this with a Two-Stage Curriculum that first optimizes for entity detection before aligning the model to the rigorous audit protocol. Our evaluation demonstrates that SEAL-Tag establishes a new Pareto frontier, reducing adaptive leakage by over 8× while matching the utility and speed of unsafe baselines.
Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 22 of its 27 references that are in the map. First posted on arXiv 18 Mar 2026.
Builds on
22 of 27 references.
Closest ancestors · 6
Same direction, newest first
- 2025RAG Security and Privacy: Formalizing the Threat Model and Attack Surface24 Sep
- 2025Learning to Erase Private Knowledge from Multi-Documents for Retrieval-Augmented Large Language Models14 Apr
- 2024Privacy-Preserving Retrieval-Augmented Generation with Differential Privacy6 Dec
- 2024Feedback-Guided Extraction of Knowledge Base from Retrieval-Augmented LLM Applications21 Nov
- 2024Mitigating the Privacy Issues in Retrieval-Augmented Generation (RAG) via Pure Synthetic Data20 Jun
- 2024The Good and The Bad: Exploring Privacy Issues in Retrieval-Augmented Generation (RAG)23 Feb
Other references · 16
- 2022Chain-of-Thought Prompting Elicits Reasoning in Large Language Modelscited by 12,459
- 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,297
- 2020Dense Passage Retrieval for Open-Domain Question Answeringcited by 3,824
- 2020Extracting Training Data from Large Language Modelscited by 2,189
- 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,443
- 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,207
- 2023Prompt Injection attack against LLM-integrated Applicationscited by 605
- 2016Neural Architectures for Named Entity Recognitioncited by 550
- 2024A Survey on RAG Meeting LLMs: Towards Retrieval-Augmented Large Language Modelscited by 452
- 2018A Survey on Deep Learning for Named Entity Recognitioncited by 282
- 2023Tensor Trust: Interpretable Prompt Injection Attacks from an Online Gamecited by 145
- 2024The Emerged Security and Privacy of LLM Agent: A Survey with Case Studiescited by 131
4 more
- 2024R2-Guard: Robust Reasoning Enabled LLM Guardrail via Knowledge-Enhanced Logical Reasoningcited by 43
- 2023PrivacyMind: Large Language Models Can Be Contextual Privacy Protection Learnerscited by 14
- 2025LLM-as-a-Judge for Privacy Evaluation? Exploring the Alignment of Human and LLM Perceptions of Privacy in Textual Datacited by 10
- 2024Privacy-preserved LLM Cascade via CoT-enhanced Policy Learningcited by 8
Built on by
Not cited yet.
Similar, not cited
Close in wording, no citation either way
- 2026Security and Privacy in Retrieval-Augmented Generation: Architectures, Threats, Defenses, and Future Directions for Building Trustworthy Systems
- 2026RAG-CT: Mitigating Privacy Risks on Retrieval-Augmented Generation Systems via Scanning Prompt Distribution
- 2026Mind the Hook: Source-Level Auditing of Privacy Defenses in Retrieval-Augmented Generation
- 2026PRAG: End-to-End Privacy-Preserving Retrieval-Augmented Generation
- 2026Benchmarking Knowledge-Extraction Attack and Defense on Retrieval-Augmented Generation
- 2026SD-RAG: A Prompt-Injection-Resilient Framework for Selective Disclosure in Retrieval-Augmented Generation
- 2025Privacy-Aware RAG: Secure and Isolated Knowledge Retrieval
- 2024Pirates of the RAG: Adaptively Attacking LLMs to Leak Knowledge Bases