mlsanityData to 14 Oct 2026

RAG-CT: Mitigating Privacy Risks on Retrieval-Augmented Generation Systems via Scanning Prompt Distribution

arXiv 2609.16095 ↗First posted 14 Sep 2026cs.CL cs.AI cs.CRcited by 0

On the map: Retrieval-augmented generation → Privacy and security of RAG

Abstract (arXiv)

Retrieval-Augmented Generation (RAG) has emerged as a powerful paradigm for improving the quality of generated contents of Large Language Models (LLMs) by grounding responses in external knowledge, thus reducing hallucinations and factual errors. However, recent studies have highlighted a critical vulnerability: adversaries can exploit the retrieval process to extract personally identifiable information (PII) from the underlying corpus. To mitigate this risk, we propose a novel defense, RAG-CT, that identifies malicious queries by analyzing their entropy and margin distributions and using a score-based detection method. Extensive experiments with four state-of-the-art attack strategies and four defense baselines on two datasets show that our approach significantly reduces PII leakage while outperforming existing defenses. This work provides a lightweight yet effective mechanism to protect RAG systems against PII leakage without requiring modifications to the underlying LLM or retriever.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 12 of its 20 references that are in the map. First posted on arXiv 14 Sep 2026.

Builds on

12 of 20 references.

Closest ancestors · 4

Same direction, newest first

  1. 2025Safeguarding Privacy of Retrieval Data against Membership Inference Attacks: Is This Query Too Close to Home?28 May
  2. 2024Pirates of the RAG: Adaptively Attacking LLMs to Leak Knowledge Bases24 Dec
  3. 2024Follow My Instruction and Spill the Beans: Scalable Data Extraction from Retrieval-Augmented Generation Systems27 Feb
  4. 2024The Good and The Bad: Exploring Privacy Issues in Retrieval-Augmented Generation (RAG)23 Feb

Other references · 8

  1. 2023In-Context Retrieval-Augmented Language Modelscited by 702
  2. 2023ChatDoctor: A Medical Chat Model Fine-Tuned on a Large Language Model Meta-AI (LLaMA) Using Medical Domain Knowledgecited by 325
  3. 2023Certifying LLM Safety against Adversarial Promptingcited by 266
  4. 2023Query Rewriting for Retrieval-Augmented Large Language Modelscited by 213
  5. 2024A Comprehensive Study of Jailbreak Attack versus Defense for Large Language Modelscited by 106
  6. 2023Enhancing Financial Sentiment Analysis via Retrieval Augmented Large Language Modelscited by 68
  7. 2024Unleashing Worms and Extracting Data: Escalating the Outcome of Attacks against RAG-based Inference in Scale and Severity Using Jailbreakingcited by 30
  8. 2024Margin-bounded Confidence Scores for Out-of-Distribution Detectioncited by 4

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2025RAG Security and Privacy: Formalizing the Threat Model and Attack Surface
  2. 2026Towards Secure Retrieval-Augmented Generation: A Comprehensive Review of Threats, Defenses and Benchmarks
  3. 2026Security and Privacy in Retrieval-Augmented Generation: Architectures, Threats, Defenses, and Future Directions for Building Trustworthy Systems
  4. 2026SoK: Privacy Risks and Mitigations in Retrieval-Augmented Generation Systems
  5. 2026Retrieved But Not Reliable: A Survey on Attacks, and Defenses in Retrieval-Augmented Generation
  6. 2025RAGPart & RAGMask: Retrieval-Stage Defenses Against Corpus Poisoning in Retrieval-Augmented Generation
  7. 2026Securing Retrieval-Augmented Generation: A Taxonomy of Attacks, Defenses, and Future Directions
  8. 2025Securing RAG: A Risk Assessment and Mitigation Framework