Privacy-Aware Adaptive Differential Privacy for Semantic Retrieval: A Pii-Aware Dynamic Budget Allocation Framework

Abstract

Retrieval-Augmented Generation (RAG) makes it possible to enhance output from Large Language Models (LLMs) with retrieval-based evidence; however, these systems can also introduce privacy vulnerabilities, and in particular, Membership Inference Attacks (MIAs). Specifically, Differential Privacy (DP) is a well-established methodology for protecting privacy; however, applying static perturbation strategies, typically used in low-dimensional spaces, will result in degradation of semantic utility due to the high dimensionality of the embedding spaces. To solve this privacy-utility problem, we present PADP, a sensitivity-aware perturbation framework inspired by differential privacy principles, which provides a plug-and-play, middleware framework that can be easily integrated into enterprise RAG pipelines without requiring costly computations for LLM fine-tuning and reconstruction of vector indices. PADP uses Named Entity Recognition (NER) based on DeBERTa-v3 to perform sensitivity assessments of documents at the document level on an offline basis, computing PII sensitivity scores for each document. These scores are then used to adaptively calibrate the application of Laplace perturbations to dense query embeddings during retrieval. PADP assigns more protection to the higher-risk content and less to the lower-risk content than static perturbation methods would typically do, thereby increasing the effectiveness of retrieval. PADP draws on concepts from Differential Privacy; nonetheless, it does not furnish formal database-level Differential Privacy guarantees under conventional adjacency definitions. Consequently, the proposed framework should be understood as an adaptive privacy-enhancement mechanism rather than as a formally guaranteed Differential Privacy mechanism. Through the evaluation of the performance of PADP across diverse datasets by way of retrieval effectiveness metrics and distinguishability analysis, its comparison with static embedding perturbation baseline methods affords a contextual statistical analysis which indicates that adaptive sensitivity aware perturbation preserves semantic retrievability while dampening membership based distinguishability signals under the conditions of the study. These findings position sensitivity-aware perturbation as a practical approach to enhancing privacy in Retrieval-Augmented Generation systems while preserving utility.

Keywords

• Retrieval-augmented generation
• Differential privacy
• Membership inference attacks
• Privacy–utility trade-off
• Semantic retrieval
• Sensitivity-aware perturbation

Ethical Statement

Ethics committee approval was not required for this study because of there was no study on animals or humans.

Thanks

This article was written as part of a doctoral dissertation at the Istanbul University-Cerrahpasa Institute of Graduate Studies.

References

1. Anderson, M., Amit, G., & Goldsteen, A. (2025). Is my data in your retrieval database? Membership inference attacks against retrieval augmented generation. In Proceedings of the International Conference on Information Systems Security and Privacy (pp. 345–354). SCITEPRESS. https://doi.org/10.5220/0013108300003899
2. Azzam, R., Musamih, A., Gebreab, S. A., Salah, K. H., & Omar, M. A. (2026). Agentic LLM for anonymizing healthcare data with contextual awareness. Knowledge-Based Systems, 312, Article 116034. https://doi.org/10.1016/j.knosys.2026.116034
3. Castagnaro, A., Salviati, U., Conti, M., Pajola, L., & Pizzi, S. (2025). The hidden threat in plain text: Attacking RAG data loaders. In Proceedings of the 18th ACM Workshop on Artificial Intelligence and Security (AISec 2025) (pp. 45–56). ACM. https://doi.org/10.1145/3733799.3762976
4. Chen, B., Han, N., & Miyao, Y. (2025). A statistical and multi-perspective revisiting of the membership inference attack in large language models. In Proceedings of the Annual Meeting of the Association for Computational Linguistics (pp. 1124–1138). ACL. https://doi.org/10.18653/v1/2025.acl-long.1114
5. Dwork, C., McSherry, F., Nissim, K., & Smith, A. D. (2006). Calibrating noise to sensitivity in private data analysis. In Theory of Cryptography Conference (pp. 265–284). Springer. https://doi.org/10.1007/11681878_14
6. Emelyanov, A. A., Kudriashov, S., & Alena, F. S. (2026). FiMMIA: Scaling semantic perturbation-based membership inference across modalities. In Proceedings of the Conference of the European Chapter of the Association for Computational Linguistics (EACL 2026) (pp. 89–94). ACL. https://doi.org/10.18653/v1/2026.eacl-demo.11
7. Eyupoglu, C., Aydin, M. A., Zaim, A. H., & Sertbas, A. (2018). An efficient big data anonymization algorithm based on chaos and perturbation techniques. Entropy, 20(5), Article 373. https://doi.org/10.3390/e20050373
8. Ferrag, M. A., Tihanyi, N., Hamouda, D., Lakas, A., & Debbah, M. A. (2026). From prompt injections to protocol exploits: Threats in LLM-powered AI agents workflows. ICT Express, 12(1), 15–28. https://doi.org/10.1016/j.icte.2025.12.001

9. Gade, S. R., Ponna, D., Shah, J., & Patel, K. A. (2026). Retrieval-Augmented Generation (RAG): Architecture, ethical challenges, and optimization strategies. In Proceedings of the 3rd International Conference on Machine Learning and Autonomous Systems (ICMLAS 2026) (pp. 204–211). IEEE. https://doi.org/10.1109/ICMLAS67792.2026.11483907
10. Gao, X., Meng, X., Dong, Y., Li, Z., & Guo, S. (2025). DCMI: A differential calibration membership inference attack against Retrieval-Augmented Generation. In Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security (CCS 2025) (pp. 1421–1435). ACM. https://doi.org/10.1145/3719027.3765103
11. Ge, Y., Zhang, H., Sun, H., Huang, Z., & Yang, H. (2026). PrivTabRAG: A data-model co-design framework for privacy-preserving retrieval-augmented generation on tabular data. Expert Systems with Applications, 264, Article 132023. https://doi.org/10.1016/j.eswa.2026.132023
12. Geng, T., Xu, Z., Qu, Y., & Wong, W. E. (2026). Prompt injection attacks on large language models: A survey of attack methods, root causes, and defense strategies. Computers, Materials & Continua, 82(3). https://doi.org/10.32604/cmc.2025.074081
13. Grislain, N. (2025). RAG with differential privacy. In Proceedings of the 2025 IEEE Conference on Artificial Intelligence (CAI 2025) (pp. 112–119). IEEE. https://doi.org/10.1109/CAI64502.2025.00150
14. Habernal, I. (2021). When differential privacy meets NLP: The devil is in the detail. In Proceedings of the Conference on Empirical Methods in Natural Language Processing (EMNLP 2021) (pp. 1522–1528). ACL. https://doi.org/10.18653/v1/2021.emnlp-main.114
15. Habernal, I. (2022). How reparametrization trick broke differentially-private text representation learning. In Proceedings of the Annual Meeting of the Association for Computational Linguistics (pp. 671–676). ACL. https://doi.org/10.18653/v1/2022.acl-short.87
16. He, L., Tang, P., Zhang, Y., Zhou, P., & Su, S. (2025). Mitigating privacy risks in Retrieval-Augmented Generation via locally private entity perturbation. Information Processing & Management, 62(3), Article 104150. https://doi.org/10.1016/j.ipm.2025.104150
17. He, Y., Li, B., Liu, L., Ren, K., & Chen, C. (2025). Towards label-only membership inference attack against pre-trained large language models. In Proceedings of the 34th USENIX Security Symposium. USENIX Association.
18. Li, J., Wang, J., Zhao, Z., & Wei, Z. (2026). Large language models in practice: A comprehensive review of privacy risks, attacks, and defense mechanisms for intelligent system deployment. Computer Standards & Interfaces, 94, Article 104181. https://doi.org/10.1016/j.csi.2026.104181
19. Li, Y., Liu, G., Wang, C., & Yang, Y. (2025). Generating is believing: Membership inference attacks against Retrieval-Augmented Generation. In Proceedings of the IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP 2025) (pp. 4120–4124). IEEE. https://doi.org/10.1109/ICASSP49660.2025.10889013
20. Mainetti, L., & Elia, A. (2025). Detecting personally identifiable information through natural language processing: A step forward. Applied System Innovation, 8(2), Article 55. https://doi.org/10.3390/asi8020055
21. Maini, P., Jia, H., Papernot, N., & Dziedzic, A. (2024). LLM dataset inference: Did you train on my dataset? In Advances in Neural Information Processing Systems (NeurIPS 2024). Curran Associates.
22. Martinelli, I., & Ponti, M. A. (2026). Towards secure Retrieval-Augmented Generation: Preventing LLM data leaks with RBAC. In International Conference on Security and Privacy in Communication Networks (pp. 512–527). Springer. https://doi.org/10.1007/978-3-032-15993-9_34
23. Moia, V. H. G., Sanz, I. J., Rebello, G. A. F., Hitaj, B., & Lindqvist, U. (2026). LLM in the middle: A systematic review of threats and mitigations to real-world LLM-based systems. Computer Science Review, 59, Article 100916. https://doi.org/10.1016/j.cosrev.2026.100916
24. Pan, K., Ong, Y. S., Gong, M., Qin, A. K., & Gao, Y. (2024). Differential privacy in deep learning: A literature survey. Neurocomputing, 580, 234–249. https://doi.org/10.1016/j.neucom.2024.127663
25. Puerto, H., Gubri, M., Yun, S., & Oh, S. J. (2025). Scaling up membership inference: When and how attacks succeed on large language models. In Findings of the Annual Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics (Findings of NAACL 2025) (pp. 312–326). ACL. https://doi.org/10.18653/v1/2025.findings-naacl.234
26. Qi, Z., Zhang, H., Xing, E. P., Kakade, S. M., & Lakkaraju, H. (2025). Follow my instruction and spill the beans: Scalable data extraction from Retrieval-Augmented Generation systems. In Proceedings of the 13th International Conference on Learning Representations (ICLR 2025).
27. Sanchez-Serrano, P., Rios, R., & Agudo, I. (2025). A decision framework for privacy-preserving synthetic data generation. Computers and Electrical Engineering, 122, Article 110468. https://doi.org/10.1016/j.compeleceng.2025.110468
28. Szawerna, M. I., Dobnik, S., Sánchez, R. M., Tiedemann, T. L., & Volodina, E. (2024). Detecting personal identifiable information in Swedish learner essays. In Proceedings of the Workshop on Computational Approaches to Language Data Pseudonymization (CALD-pseudo 2024) (pp. 45–53). ACL.
29. Vonderhaar, L., MacHado, D. A., & Ochoa, O. (2025). Surveying the RAG attack surface and defenses: Protecting sensitive company data. In Proceedings of the 2025 IEEE International Conference on Artificial Intelligence Testing (AITest 2025) (pp. 24–31). IEEE. https://doi.org/10.1109/AITest66680.2025.00015
30. Vural, Y., & Aydos, M. (2017). A new approach to utility-based privacy preserving in data publishing. In Proceedings of the 2017 IEEE International Conference on Computer and Information Technology (CIT) (pp. 204–209). IEEE. https://doi.org/10.1109/CIT.2017.27
31. Wang, G., He, J., Li, H., Zhang, M., & Feng, D. (2025). RAG-leaks: Difficulty-calibrated membership inference attacks on retrieval-augmented generation. Science China Information Sciences, 68(4), Article 144201. https://doi.org/10.1007/s11432-024-4441-4
32. Wang, T., Zhai, L., Yang, T., Luo, Z., & Liu, S. (2024). Selective privacy-preserving framework for large language models fine-tuning. Information Sciences, 665, Article 121000. https://doi.org/10.1016/j.ins.2024.121000
33. Ward, C. M., & Harguess, J. D. (2025). Adversarial threat vectors and risk mitigation for Retrieval-Augmented Generation systems. In Proceedings of SPIE - The International Society for Optical Engineering, 12450, Article 12.3055931. https://doi.org/10.1117/12.3055931
34. Wu, Y. (2025). Dynamic privacy budget allocation mechanism based on multi-dimensional query management. In Proceedings of the International Conference on Electrical, Computer, and Energy Technologies (ICECET 2025). IEEE. https://doi.org/10.1109/ICECET63943.2025.11472026
35. Wu, Z., Luo, S. L., & Pan, L. (2026). A semantics-maintained differential privacy protection for high-utility text. Knowledge-Based Systems, 310, Article 115478. https://doi.org/10.1016/j.knosys.2026.115478
36. Xie, R., Wang, J., Huang, R., Gong, N. Z., & Dhingra, B. (2024). RECALL: Membership inference via relative conditional log-likelihoods. In Proceedings of the Conference on Empirical Methods in Natural Language Processing (EMNLP 2024) (pp. 5621–5635). ACL. https://doi.org/10.18653/v1/2024.emnlp-main.493
37. Xin, Y., Li, Z., Yu, N., Backes, M., & Zhang, Y. (2024). Inside the black box: Detecting data leakage in pre-trained language encoders. In Proceedings of the European Conference on Artificial Intelligence (ECAI 2024). IOS Press. https://doi.org/10.3233/FAIA240960
38. Yan, B., Li, K., Xu, M., Ren, Z., & Cheng, X. (2025). On protecting the data privacy of Large Language Models (LLMs) and LLM agents: A literature review. High-Confidence Computing, 5(1), Article 100300. https://doi.org/10.1016/j.hcc.2025.100300
39. Yao, Y., Duan, J., Xu, K., Sun, Z., & Zhang, Y. (2024). A survey on Large Language Model (LLM) security and privacy: The good, the bad, and the ugly. High-Confidence Computing, 4(2), Article 100211. https://doi.org/10.1016/j.hcc.2024.100211
40. Ye, H., Guo, J., Liu, Z., & Lam, K. Y. (2025). Efficient privacy-preserving Retrieval Augmented Generation with distance-preserving encryption. In Proceedings of the 2025 3rd International Conference on Foundation and Large Language Models (FLLM 2025) (pp. 74–81). IEEE. https://doi.org/10.1109/FLLM67465.2025.11391120
41. Zeng, H., Liu, X., Hu, Y., Tang, S., & Chen, G. (2026). Automated annotation of privacy information in user interactions with large language models. In Proceedings of the ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (pp. 1420–1434). ACM. https://doi.org/10.1145/3770854.3785680
42. Zhang, J., Zeng, S., Ren, J., Tang, X., & Chang, Y. (2025). Beyond text: Unveiling privacy vulnerabilities in multi-modal Retrieval-Augmented Generation. In Proceedings of the Conference on Empirical Methods in Natural Language Processing (EMNLP 2025) (pp. 1245–1259). ACL. https://doi.org/10.18653/v1/2025.emnlp-main.1259