Safeguarding Privacy of Retrieval Data against Membership Inference Attacks: Is This Query Too Close to Home? (2025)

Abstract: Retrieval-augmented generation (RAG) mitigates the hallucination problem in large language models (LLMs) and has proven effective for personalized usages. However, delivering private retrieved documents directly to LLMs introduces vulnerability to membership inference attacks (MIAs), which try to determine whether the target data point exists in the private external database or not. Based on the insight that MIA queries typically exhibit high similarity to only one target document, we introduce a novel similarity-based MIA detection framework designed for the RAG system. With the proposed method, we show that a simple detect-and-hide strategy can successfully obfuscate attackers, maintain data utility, and remain system-agnostic against MIA. We experimentally prove its detection and defense against various state-of-the-art MIA methods and its adaptability to existing RAG systems.

## introduction large language models (llms) @xcite have demonstrated strength for general and common knowledge. however, they struggle to answer domain-specific or personalized questions, resulting in hallucinations that fabricate non-truth answers from the training set @xcite . retrieval-augmented generation (rag) @xcite ) mitigates hallucination by giving information from external data retrieval into llms. rag can provide reliable information by extracting relevant documents from an external database. membership inference attacks (mias) @xcite are malicious machine learning attacks that attempt to determine whether the target document was used in the training dataset. recent work has examined mias and extraction attacks on language models to study the privacy leakage @xcite . even though mias achieve lower success rates on llms due to the massive size of training data samples @xcite , privacy risks in rag systems are significant @xcite . as rag retrieves a few top-k documents and conveys them directly to llms, various attack methods @xcite have succeeded in inferring whether a target document is stored in a private retrieval database or not. however, safeguarding llms against mia has no practical solution due to the huge model size or properties of language domains @xcite . within rag systems, the agent-based query filtering system is the only defense explored so far, but it is also broken by stealth attacks that evade detection @xcite . thus, in this paper, we present a new safeguarding framework against mias by focusing on the observation that current mias on the rag system rely on queries similar to only a single target document in the database. in detail, we measure the similarity between an input query and the retrieved data points. then, we check whether this similarity exceeds a threshold based on the gumbel distribution @xcite or not, which models the maximum values of data samples. for an input query that exceeds the threshold, indicating that the query is overly correlated with one specific document in the retrieval, we hide the data in the top-k document conveyed to the llms. we summarize our contributions as follows: ## scenarios following the previous studies @xcite , we assume three parties in our scenario: 1) the operator of the rag system with private external database, 2) the benign users of the rag, and 3) the malicious attackers attempting mias to the rag system. for instance, "a healthcare ai operator deploys a medicaldiagnosis chatbot that retrieves private patient records. benign users consult the chatbot to assess their health, but attackers attempt mias. the operator must preserve privacy against attackers while providing accurate answers to benign users." types of queries based on the scenario, we divide the queries for rag systems into three types: member attack query q m a by attackers of malicious questions in the external database, non-member attack query q n a by attackers of malicious questions but not in the external database, and benign query q b of benign users without malicious intention. details about attacker given a target document d, an attacker aims to decide whether d is contained in the external database d by classifying its associated query q a as a member attack query q m a or a non-member attack query q n a . we assume the attacker cannot access d or the parameters of llms. ## conclusion in this paper, we propose mirabel, a mia detection method that classifies member attack queries based on similarity using the gumbel distribution. we also introduce a simple defense strategy, detect-andhide, which effectively defends against attacks with minimal utility degradation. our method is modelagnostic, incurs almost no additional computation overhead, and can be easily applied to existing rag systems. experimental results show that our method achieves defense performance comparable to dp-rag, while incurring negligible utility loss on benign queries.