揭示RAG隐私防御中源级钩子的隐藏漏洞
Mind the Hook: Source-Level Auditing of Privacy Defenses in Retrieval-Augmented Generation
- 通过追踪检索、内容与生成环节的接口钩子，定位隐私泄漏路径
- 发现差分隐私类防御仅修改检索得分，生成环节无实际处理
- 提出可验证的精准检测方法，适合研究隐私防御机制者
对检索增强生成（RAG）的黑箱隐私评分难以解释，除非知晓被审计防御的活跃管道钩子。我们提出一种主动路径审计：系统梳理检索、检索内容与生成环节的源级钩子；将每项指标映射到其观测的泄漏通道；并通过精确匹配信标验证生成文本影响。在我们的基准复现中，类差分隐私防御仅修改检索分数：其生成钩子为待办占位符，返回结果不变。这解释了为何它们影响成员推断行为，却在生成文本命名实体泄漏上表现如无防御（NEL_strict指标）。相比之下，端到端LPRAG路径在邮件通道上经信标验证，无防御下恢复53/150个信标，而LPRAG下为0/150。这些发现基于我们自建实现，不适用于已发布防御或防御家族；贡献在于方法论与案例研究，非普适排名。
原文摘要 · Abstract (English)
Black-box privacy scores for retrieval-augmented generation (RAG) are difficult to interpret unless the audited defense's active pipeline hook is known. We propose an active-path audit: inventory source-level hooks over retrieval, retrieved content, and generation; map each metric to the leakage channel it observes; and validate generated-text effects with exact-match canaries. In our benchmark reimplementations, the DP-style defenses modify retrieval scores only: their generation hooks are TODO-flagged stubs that return responses unchanged. This active path explains why they affect membership-inference behavior but track No-Defense on generated-text named-entity leakage, measured by NEL_strict. By contrast, the end-to-end LPRAG path is canary-validated on the email channel, recovering 53/150 canaries under No-Defense and 0/150 under LPRAG. These findings concern our reimplementations on our stack, not released defenses or defense families; the contribution is a methodology and case study, not a universal ranking
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。