Retrieval-Augmented Generation (RAG) improves Large Language Model quality by grounding responses in external knowledge, but recent studies show adversaries can exploit this process to extract Personally Identifiable Information (PII).
To address this, Xingyu Lyu and colleagues introduced RAG-CT, a defense mechanism that identifies malicious queries by analyzing entropy and margin distributions within the prompt distribution. The approach utilizes a score-based detection method rather than altering the core model or retrieval component.
Experiments tested the system using four state-of-the-art attack strategies against four defense baselines across two datasets. Results indicate RAG-CT significantly reduces PII leakage compared to existing solutions while maintaining system functionality.
This lightweight mechanism offers a practical solution for engineers deploying RAG systems, as it protects against data extraction without requiring changes to the deployed LLM or retriever architecture.
Source: https://arxiv.org/abs/2609.16095
