RePCS: Diagnosing Data Memorization in LLM-Powered Retrieval-Augmented Generation

TL;DR

RePCS is a lightweight, model-agnostic diagnostic tool that detects whether retrieval-augmented generation models rely on memorized data or actual retrieved evidence, ensuring safer and more reliable LLM outputs.

Contribution

RePCS introduces a novel, gradient-free method to diagnose data memorization in RAG systems by comparing inference paths using KL divergence, with theoretical guarantees and practical efficiency.

Findings

RePCS achieves 0.918 ROC-AUC on Prompt-WNQA.

Outperforms prior methods by 6.5 percentage points.

Requires less than 5% additional latency.

Abstract

Retrieval-augmented generation (RAG) has become a common strategy for updating large language model (LLM) responses with current, external information. However, models may still rely on memorized training data, bypass the retrieved evidence, and produce contaminated outputs. We introduce Retrieval-Path Contamination Scoring (RePCS), a diagnostic method that detects such behavior without requiring model access or retraining. RePCS compares two inference paths: (i) a parametric path using only the query, and (ii) a retrieval-augmented path using both the query and retrieved context by computing the Kullback-Leibler (KL) divergence between their output distributions. A low divergence suggests that the retrieved context had minimal impact, indicating potential memorization. This procedure is model-agnostic, requires no gradient or internal state access, and adds only a single additional forward pass. We further derive PAC-style guarantees that link the KL threshold to user-defined false positive and false negative rates. On the Prompt-WNQA benchmark, RePCS achieves a ROC-AUC of 0.918. This result outperforms the strongest prior method by 6.5 percentage points while keeping latency overhead below 4.7% on an NVIDIA T4 GPU. RePCS offers a lightweight, black-box safeguard to verify whether a RAG system meaningfully leverages retrieval, making it especially valuable in safety-critical applications.