Mitigating privacy risks in Retrieval-Augmented Generation via locally private entity perturbation

Abstract

Retrieval-augmented generation (RAG) improves large language models (LLMs) by incorporating relevant information from external sources to produce more accurate outputs. However, in contexts involving sensitive data, such as healthcare, RAG systems can introduce significant privacy risks, potentially causing the exposure of private information. In this paper, we introduce LPRAG (Locally Private Retrieval-Augmented Generation), a privacy-preserving RAG framework with formal privacy guarantees based on local differential privacy (LDP). LPRAG aims to augment LLM responses using perturbed data to protect privacy. The key insight of LPRAG is to achieve privacy preservation by applying LDP perturbation to private entities within the text (rather than the entire text). Specifically, LPRAG first identifies various types of private entities (words, numbers, or phrases) in texts and assigns privacy budgets based on an adaptive privacy budget assignment strategy. It then perturbs these entities using different LDP perturbation mechanisms designed for words, numbers, or phrases. Finally, the RAG system enhances LLM responses based on the perturbed texts. Extensive experimental results demonstrate that our approach maintains satisfactory utility with low privacy loss.