arXiv Machine Learning
Jul 3
Embedding Inference Attack
arXiv:2607. 01276v1 Announce Type: cross Abstract: Embedding models are essential components of modern Information Retrieval (IR) systems, yet they are typically hidden behind APIs.
Shadow Queries for Private Retrieval in Vector Databases
The paper introduces SHAQ, a defense called Shadow Query Generation that protects document embeddings in vector databases from embedding inversion attacks. SHAQ replaces direct embeddings with diverse shadow queries generated by a language model, thereby decomposing document semantics and decoupling stored embeddings from the original text. Experiments on various IR datasets show that SHAQ significantly lowers recovery rates, defends more tokens than baseline methods, and even improves retrieval utility.
Related stories
arXiv AI
Jun 26
Hybrid privacy-aware semantic search: SVD-truncated document geometry and CKKS-encrypted query reranking under a restricted threat model
arXiv:2606. 26373v1 Announce Type: cross Abstract: Dense embeddings power semantic search and retrieval-augmented generation, but embedding-inversion attacks can reconstruct source text from a vector: when a vector database leaks, the documents behind it leak too.
arXiv Computation and Language
Aug 31
CamoDocs: A Poisoning Attack Against Retrieval-Augmented Language Models Using Camouflaged Documents
arXiv:2608. 28389v1 Announce Type: cross Abstract: Retrieval-augmented generation (RAG) augments LLMs with external documents, but public or user-editable sources expose RAG systems to data poisoning: attackers can inject malicious documents to steer outputs toward targeted answers.
arXiv Machine Learning
Aug 27
Pointing the Way, Hiding the Destination: Practical Private Dense Retrieval at Scale
The paper presents a practical private dense retrieval system that uses learned deep hashing as a private filter to generate a short candidate list for each query. Encrypted reranking and oblivious key transfer protect the exact query and final selection, allowing the system to match full‑corpus retrieval quality with only 200‑500 candidates. Experiments on five zero‑shot corpora and the 2.68M‑passage NQ corpus show minimal latency overhead and strong privacy guarantees.
arXiv AI
Aug 14
Privacy-Preserving RAG by Concealing Sensitive Information from External LLMs
arXiv:2608. 12675v1 Announce Type: new Abstract: Retrieval-Augmented Generation (RAG) is widely used to improve the performance of Large Language Models (LLMs) in answering user queries.
Hugging Face Trending Papers
Aug 26
Pointing the Way, Hiding the Destination: Practical Private Dense Retrieval at Scale
Hosted retrieval-augmented generation (RAG) and semantic search allow users to query valuable provider-held corpora, raising two competing demands: to hide each query and chosen result, yet reveal onl...
arXiv AI
Aug 26
RAGSentinel: Certifiable Geometric Consensus for Robust Retrieval-Augmented Generation
RAGSentinel is a training‑free, label‑free defense designed for black‑box retrieval‑augmented generation systems. It employs a surrogate encoder to detect hidden‑state shifts caused by retrieved documents, removes shared topic directions, and filters poisoned documents as geometric outliers from a robust majority consensus. The method is proven to recover a poison‑free majority context under honest‑majority and representation‑separation assumptions, and experiments show it keeps attack success rates low while maintaining accuracy across multiple datasets, LLM families, and adaptive attacks.
arXiv AI
Sep 16
RAG-CT: Mitigating Privacy Risks on Retrieval-Augmented Generation Systems via Scanning Prompt Distribution
RAG-CT is a defense mechanism designed to protect Retrieval-Augmented Generation (RAG) systems from leaking personally identifiable information (PII). It works by detecting malicious queries through analysis of entropy and margin distributions, applying a score-based detection method. Experiments across four attack strategies and four baseline defenses on two datasets show that RAG-CT significantly reduces PII leakage while outperforming existing defenses, all without altering the underlying LLM or retriever.
arXiv Machine Learning
Sep 4
Spruce: Scalable Private Outsourced Retrieval Using Compact Embeddings
Spruce is a system that enables scalable private outsourced retrieval by learning compact binary embeddings and using efficient Hamming-distance computation under a two‑server multi‑party computation protocol. It replaces costly corpus‑wide embedding scoring with a fixed‑radius protocol that avoids multi‑round candidate selection, and introduces private cluster pruning and a one‑core dealer to reduce computation and eliminate OT preprocessing bottlenecks. Across corpora of 383K–5.42M documents, Spruce maintains original search quality while achieving up to 31.5× higher throughput and reducing query times to a few seconds.
arXiv AI
Jun 6
RAG Security and Privacy: Formalizing the Threat Model and Attack Surface
arXiv:2509. 20324v2 Announce Type: replace-cross Abstract: Retrieval-Augmented Generation (RAG) is an emerging approach in natural language processing that combines large language models (LLMs) with external document retrieval to produce more accurate and grounded responses.
Hugging Face Trending Papers
Sep 6
A Novel Semantic Manifold Alignment Attack against Embedding-to-Embedding Obfuscation in Privacy-Preserving LLMs
With the widespread applications of large language models (LLMs), privacy-preserving inference has become increasingly essential for sensitive queries. To balance privacy and utility, a series of ligh...
arXiv AI
Jun 9
Securing Retrieval-Augmented Generation: A Taxonomy of Attacks, Defenses, and Future Directions
arXiv:2604. 08304v3 Announce Type: replace-cross Abstract: Retrieval-augmented generation (RAG) extends large language models (LLMs) with external knowledge, but this access path also introduces security risks that existing work often conflates with inherent LLM flaws.