用别名替换敏感信息，让第三方大模型生成答案时看不到隐私内容。
Privacy-Preserving RAG by Concealing Sensitive Information from External LLMs
- 构建轻量级模型识别敏感实体并生成对应别名，替换原始文本。
- 在多个模型上实现超过80%的用户问答准确率，同时隐藏敏感信息。
- 适合需要保护数据隐私又想用外部大模型的医疗、金融等场景。
检索增强生成（RAG）广泛用于提升大语言模型（LLM）回答用户查询的性能。现有隐私研究主要关注防止未授权访问敏感数据，但忽略了外部生成器能获取用户查询和检索文档的问题，其中可能包含机密信息，存在被滥用或意外访问的风险。本文提出敏感实体别名生成器（SEAG），一种隐私保护框架，使用户能在不泄露敏感信息的前提下使用第三方生成器。SEAG引入一个轻量级模型，用于定位敏感实体、生成对应别名，并构建实体替换表。该表用于在将查询和检索文档发送给外部生成器前，替换其中的敏感词。为此，我们构建了两个数据集：一个用于微调SEAG模型生成替换表，另一个用于评估整个框架。实验结果表明，该框架效果良好。在用户指标方面（衡量模型在隐藏敏感信息的同时提供正确回答的能力），所有SEAG模型准确率均超过80%。进一步分析显示，Qwen-3、LLaMA-3.2和Phi-4模型对文档中敏感实体的隐藏总准确率分别为77.83%、76.73%和74.91%。
原文摘要 · Abstract (English)
Retrieval-Augmented Generation (RAG) is widely used to improve the performance of Large Language Models (LLMs) in answering user queries. Existing privacy research on RAG has focused on preventing unauthorized users from accessing sensitive data. However, another important problem that is often overlooked in RAG privacy research is that external generators have access to the query and the retrieved documents, which may contain confidential information that could potentially be misused or accessed for unintended purposes. In this paper, we introduce the Sensitive Entity Alias Generator (SEAG), a privacy-preserving framework that empowers users to utilize powerful third-party generators without disclosing sensitive information. SEAG introduces a lightweight model that locates sensitive entities, generates corresponding aliases, and constructs an entity replacement table. The table is used to replace sensitive words in the user's query and in the retrieved documents before they are forwarded to an external generator. For this purpose, two datasets were constructed: one for fine-tuning SEAG models to generate entity replacement tables, and another for evaluating the entire SEAG framework. The experimental results demonstrate the success of the SEAG framework. As for the User metric, which measures the ability of the model to provide a correct response to the user while hiding sensitive information from the external generator, all SEAG models achieved over 80% accuracy. Additional analysis further evaluated the ability of SEAG models Qwen-3, LLaMA-3.2, and Phi-4 to hide all sensitive entities within given documents. The results show good performance with total accuracies of 77.83%, 76.73%, and 74.91%, respectively.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。