$p^2$RAG: Privacy-Preserving RAG Service Supporting Arbitrary Top-$k$ Retrieval

• URL: http://arxiv.org/abs/2603.14778v1
• Date: Mon, 16 Mar 2026 03:19:39 GMT
• Title: $p^2$RAG: Privacy-Preserving RAG Service Supporting Arbitrary Top-$k$ Retrieval
• Abstract summary: We propose $p2$RAG, a privacy-preserving RAG service that supports arbitrary top-$k$ retrieval.<n>For security, $p2$RAG uses secret sharing on two semi-honest non-colluding servers to protect the data owner's database and the user's prompt.
• Score: 26.612116219963095
• License: http://creativecommons.org/licenses/by-nc-sa/4.0/
• Abstract: Retrieval-Augmented Generation (RAG) enables large language models to use external knowledge, but outsourcing the RAG service raises privacy concerns for both data owners and users. Privacy-preserving RAG systems address these concerns by performing secure top-$k$ retrieval, which typically is secure sorting to identify relevant documents. However, existing systems face challenges supporting arbitrary $k$ due to their inability to change $k$, new security issues, or efficiency degradation with large $k$. This is a significant limitation because modern long-context models generally achieve higher accuracy with larger retrieval sets. We propose $p^2$RAG, a privacy-preserving RAG service that supports arbitrary top-$k$ retrieval. Unlike existing systems, $p^2$RAG avoids sorting candidate documents. Instead, it uses an interactive bisection method to determine the set of top-$k$ documents. For security, $p^2$RAG uses secret sharing on two semi-honest non-colluding servers to protect the data owner's database and the user's prompt. It enforces restrictions and verification to defend against malicious users and tightly bound the information leakage of the database. The experiments show that $p^2$RAG is 3--300$\times$ faster than the state-of-the-art PRAG for $k = 16$--$1024$.

Related papers

• TopoGuard: Graph Theory Based Defenses Against Split-Knowledge Attacks on RAG [5.328366903719861]
  Production Retrieval Augmented Generation (RAG) systems rely on aggregating external documents to answer complex queries.<n>The retrieved documents introduce a new threat surface that can be exploited to launch split-knowledge attacks.<n>This paper shows that the new attack is structurally invisible to existing per-document filters, like LlamaGuard.<n>To address this issue in RAG, this work introduces TopoGuard, a family of graph theory-based methods specifically targeting the split-knowledge attacks.
  arXiv  Detail & Related papers  (2026-05-11T17:46:02Z)
• PAR$^2$-RAG: Planned Active Retrieval and Reasoning for Multi-Hop Question Answering [57.89576196160413]
  Large language models (LLMs) remain brittle on multi-hop question answering (MHQA)<n>We propose textbfPlanned Active Retrieval and Reasoning RAG (PAR$2$-RAG), a two-stage framework that separates emphcoverage from emphcommitment.
  arXiv  Detail & Related papers  (2026-03-30T23:52:54Z)
• Improving User Privacy in Personalized Generation: Client-Side Retrieval-Augmented Modification of Server-Side Generated Speculations [37.909483957959715]
  Personalization is crucial for aligning Large Language Model (LLM) outputs with individual user preferences and background knowledge.<n>We introduce $P3$, an interactive framework for high-quality personalization without revealing private profiles to server-side LLMs.<n>Experiments on LaMP-QA, a recent benchmark consisting of three personalized question answering datasets, show that $P3$ consistently outperforms both non-personalized server-side and personalized client-side baselines.
  arXiv  Detail & Related papers  (2026-01-24T19:46:40Z)
• HearSay Benchmark: Do Audio LLMs Leak What They Hear? [71.05839007164776]
  This paper investigates whether Audio Large Language Models inadvertently leak user privacy solely through acoustic voiceprints.<n>$textitHearSay$ is a comprehensive benchmark constructed from over 22,000 real-world audio clips.<n>Experiments on $textbfSignificant Privacy Leakage$ yield three critical findings.
  arXiv  Detail & Related papers  (2026-01-07T10:33:44Z)
• Private-RAG: Answering Multiple Queries with LLMs while Keeping Your Data Private [21.980739918403344]
  Retrieval-augmented generation (RAG) enhances large language models (LLMs) by retrieving documents from an external corpus at inference time.<n>When this corpus contains sensitive information, unprotected RAG systems are at risk of leaking private information.<n>In this paper, we study the more practical multi-query setting and propose two DP-RAG algorithms.
  arXiv  Detail & Related papers  (2025-11-10T21:12:32Z)
• Evaluating Retrieval-Augmented Generation Systems on Unanswerable, Uncheatable, Realistic, Multi-hop Queries [53.99620546358492]
  Real-world use cases often present RAG systems with complex queries for which relevant information is missing from the corpus or is incomplete.<n>Existing RAG benchmarks rarely reflect realistic task complexity for multi-hop or out-of-scope questions.<n>We present the first pipeline for automatic, difficulty-controlled creation of un$underlinec$heatable, $underliner$ealistic, $underlineu$nanswerable, and $underlinem$ulti-hop.
  arXiv  Detail & Related papers  (2025-10-13T21:38:04Z)
• MES-RAG: Bringing Multi-modal, Entity-Storage, and Secure Enhancements to RAG [65.0423152595537]
  We propose MES-RAG, which enhances entity-specific query handling and provides accurate, secure, and consistent responses.<n>MES-RAG introduces proactive security measures that ensure system integrity by applying protections prior to data access.<n> Experimental results demonstrate that MES-RAG significantly improves both accuracy and recall, highlighting its effectiveness in advancing the security and utility of question-answering.
  arXiv  Detail & Related papers  (2025-03-17T08:09:42Z)
• GeAR: Generation Augmented Retrieval [82.20696567697016]
  This paper introduces a novel method, $textbfGe$neration.<n>It improves the global document-Query similarity through contrastive learning, but also integrates well-designed fusion and decoding modules.<n>When used as a retriever, GeAR does not incur any additional computational cost over bi-encoders.
  arXiv  Detail & Related papers  (2025-01-06T05:29:00Z)
• RemoteRAG: A Privacy-Preserving LLM Cloud RAG Service [10.383191657228826]
  We are the first to formally define the privacy-preserving cloud RAG service to protect the user query.<n>For privacy, we introduce $(n,epsilon)$-DistanceDP to characterize privacy leakage of the user query and the leakage inferred from relevant documents.<n>For efficiency, we limit the search range from the total documents to a small number of selected documents related to a perturbed embedding generated from $(n,epsilon)$-DistanceDP.
  arXiv  Detail & Related papers  (2024-12-17T10:36:52Z)
• MemoRAG: Boosting Long Context Processing with Global Memory-Enhanced Retrieval Augmentation [60.04380907045708]
  Retrieval-Augmented Generation (RAG) is considered a promising strategy to address this problem.<n>We propose MemoRAG, a novel RAG framework empowered by global memory-augmented retrieval.<n>MemoRAG achieves superior performances across a variety of long-context evaluation tasks.
  arXiv  Detail & Related papers  (2024-09-09T13:20:31Z)
• Differential Privacy of Cross-Attention with Provable Guarantee [18.331374727331077]
  We design a novel differential privacy (DP) data structure to address the privacy security of cross-attention with a theoretical guarantee. Our result is robust to adaptive queries in which users can intentionally attack the cross-attention system.
  arXiv  Detail & Related papers  (2024-07-20T01:02:27Z)
• SwiftAgg: Communication-Efficient and Dropout-Resistant Secure Aggregation for Federated Learning with Worst-Case Security Guarantees [83.94234859890402]
  We propose SwiftAgg, a novel secure aggregation protocol for federated learning systems. A central server aggregates local models of $N$ distributed users, each of size $L$, trained on their local data. SwiftAgg significantly reduces the communication overheads without any compromise on security.
  arXiv  Detail & Related papers  (2022-02-08T22:08:56Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.