mlsanityData to 14 Oct 2026

Where Privacy Risk Lives in English-Source Multilingual RAG: A Stage-Decomposed Audit Across Five Query Languages

arXiv 2608.05163 ↗First posted 26 May 2026cs.CL cs.LGcited by 0

On the map: Retrieval-augmented generation → Privacy and security of RAG

Abstract (arXiv)

A common assumption holds that switching to a non-English language makes a multilingual RAG system easier to attack for personal information. We test this on an English-source synthetic-PII corpus with five query languages and a two-stage defence (LLM input judge + regex output filter), in a pipeline whose translator, judge, back-translator, and generator are all Qwen2.5-7B -- so every finding below is pipeline-conditional, not a causal ranking of language-inherent risk. Under output-only filtering, English has the highest observed unstructured-PII leak rate; only English-vs-Swahili separates cleanly under document-level bootstrap intervals. Once the input judge is added, residual leaks remain on Arabic and Swahili, and back-translating the query does not close the gap (an ablation we report but cannot use as a causal diagnostic, since the back-translator is also Qwen). On a separate n=17 multilingual-prompted-judge residual corner, attaching the gold corpus document to the input judge blocks 15/17 residual cells. We frame this last result as a mechanism diagnostic, not a deployable defence: it uses oracle retrieval, BLOCK/ALLOW rates are measured on adversarial queries only, and we measure no benign-query false-positive rate and no answer-utility cost. The supplementary material contains code, corpora, queries, and per-trial JSONLs; the priority follow-up is an independent-MT plus non-Qwen-judge replication with a native-speaker query set, scoped in the Limitations section.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 16 of its 23 references that are in the map. First posted on arXiv 26 May 2026.

Builds on

16 of 23 references.

Closest ancestors · 1

Same direction, newest first

  1. 2024The Good and The Bad: Exploring Privacy Issues in Retrieval-Augmented Generation (RAG)23 Feb

Other references · 15

  1. 2017Billion-scale similarity search with GPUscited by 2,497
  2. 2020Extracting Training Data from Large Language Modelscited by 2,189
  3. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,207
  4. 2024M3-Embedding: Multi-Linguality, Multi-Functionality, Multi-Granularity Text Embeddings Through Self-Knowledge Distillationcited by 1,073
  5. 2023Low-Resource Languages Jailbreak GPT-4cited by 309
  6. 2025AgentAuditor: Human-Level Safety and Security Evaluation for LLM Agentscited by 90
  7. 2025The State of Multilingual LLM Safety Research: From Measuring the Language Gap to Mitigating Itcited by 45
  8. 2024A Survey on Large Language Models with Multilingualism: Recent Advances and New Frontierscited by 40
  9. 2026SafetyRepro: Configuration-Conditional Rank Instability on Alignment Benchmarkscited by 15
  10. 2024Multilingual Retrieval Augmented Generation for Culturally-Sensitive Tasks: A Benchmark for Cross-lingual Robustnesscited by 14
  11. 2025Understanding and Mitigating Cross-lingual Privacy Leakage via Language-specific and Universal Privacy Neuronscited by 13
  12. 2025Cross-Cloud Data Privacy Protection: Optimizing Collaborative Mechanisms of AI Systems by Integrating Federated Learning and LLMscited by 9
3 more
  1. 2026Retrieval--Reasoning Processes for Multi-hop Question Answering: A Four-Axis Design Framework and Empirical Trendscited by 8
  2. 2026SOK: A Taxonomy of Attack Vectors and Defense Strategies for Agentic Supply Chain Runtimecited by 8
  3. 2026Auditing Reasoning-Trace Memorization Claims after Unlearning with Head-Conditioned Canariescited by 7

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2025The Model's Language Matters: A Comparative Privacy Analysis of LLMs
  2. 2026Cross-Lingual Transferability of Training Data Extraction Attacks to Recover Memorized PII
  3. 2026SoK: Privacy Risks and Mitigations in Retrieval-Augmented Generation Systems
  4. 2025A Survey on Privacy Risks and Protection in Large Language Models
  5. 2025Controlling What You Share: Assessing Language Model Adherence to Privacy Preferences
  6. 2026Exploratory As-Analyzed No-Detection of Culturally-Marked Predicate-Triggered PII Amplification in a Synthetic-English RAG Probe: A Predicate-Resource-Confounded Audit
  7. 2026On the Privacy of LLMs: An Ablation Study
  8. 2026Benchmarking Empirical Privacy Protection for Adaptations of Large Language Models