# FairRAG: A Privacy-Preserving Framework for Fair Financial Decision-Making
## 2 Related Work
### Privacy-Preserving Synthetic Data Generation  
Synthetic data generation as a method for data security and classification fairness has been extensively studied and has shown promising results. Techniques such as Generative Adversarial Networks [36] and SMOTE [37] have been widely explored to create synthetic datasets that mirror the statistical properties of real-world data without revealing sensitive details. Some of these studies [38] have used GANs to generate synthetic data for sensitive financial contexts such as fraud detection. However, LLMs have demonstrated improved performance in generation and predictive tasks compared to GANs [39; 40]. Notably, recent advances have focused on integrating differential privacy into these methods. For example, Google's work on protecting users with differentially private synthetic training data [15] introduces an approach that uses LLMs and DP mechanisms to generate synthetic training data. They pre-trained an 8B-parameter decoder-only LLM on public text and then privately fine-tuned it using LoRa and prompt-based tuning on disjoint sensitive datasets to generate synthetic data. They relied on a next token prediction framework:  
\[p=[\text{TaskName}]\left[\text{LabelName}_{y}\right] \tag{2}\]  
where \([\text{LabelName}_{y}]\) is set to \([\text{negative}]\) if \(y=0\) and \([\text{positive}]\) if \(y=1\). The training example is tokenized into a prefix \(p=\{z_{1},\dots,z_{k}\}\) and a target sequence \(x=\{z_{k+1},\dots,z_{n}\}\).  
In their unique prefix-LM formulation, the weights for prefix tokens are set to zero (i.e., \(\forall i\leq k:w_{i}=0\)); thus, they used a modified version of the weighted next token prediction cross-entropy loss:  
\[L_{\text{PrefixLM}}(\vec{z},\vec{w},\theta)=-\sum_{i=k+1}^{n}z_{i}\log P(z_{ i}\mid z_{<i},\theta) \tag{3}\]  
With this prefix-LM setup, the loss function is computed only over the target tokens, while the prefix \(p\) token distributions need not be learned. This study demonstrates that classifiers trained on private LLM-generated synthetic data can outperform those directlytrained on the original sensitive data with differential privacy. However, their prefix-LM approach is fundamentally designed for unstructured text generation and relies on privately fine-tuning a large model on the sensitive dataset. This process can be computationally expensive and complex to implement. Furthermore, their method generates new examples in isolation. Our proposed framework, FairRAG, in contrast, is designed for structured tabular data. By using retrieval-augmented generation, we leveraged the LLM's zero-shot reasoning capabilities, providing it with context from both original and private synthetic records at inference time. This allows our system to reason about a new customer by comparing them to similar privacy-protected historical cases, a paradigm distinct from the fine-tuning approach. [PERSON] et al. explained that privacy concerns for LLMs need to be addressed in both the training and inference steps [41]. Furthermore, studies have shown the need to develop stronger methods that guarantee privacy and fairness in LLM generation [42,43]. However, when we include DP mechanisms in both these steps, we inevitably lose some important contextual information, which raises concerns in more complicated and conceptual domains.