Private-RAG: Answering Multiple Queries with LLMs while Keeping Your Data Private

TL;DR

This paper introduces two differentially private RAG algorithms for multi-query scenarios, enabling private document retrieval with high utility across multiple queries in large language models.

Contribution

It proposes MURAG and MURAG-ADA algorithms that extend differential privacy guarantees to multi-query RAG systems, improving privacy-utility trade-offs.

Findings

Scalable to hundreds of queries within a practical privacy budget

Maintain meaningful utility while ensuring privacy

Effective across multiple LLMs and datasets

Abstract

Retrieval-augmented generation (RAG) enhances large language models (LLMs) by retrieving documents from an external corpus at inference time. When this corpus contains sensitive information, however, unprotected RAG systems are at risk of leaking private information. Prior work has introduced differential privacy (DP) guarantees for RAG, but only in single-query settings, which fall short of realistic usage. In this paper, we study the more practical multi-query setting and propose two DP-RAG algorithms. The first, MURAG, leverages an individual privacy filter so that the accumulated privacy loss only depends on how frequently each document is retrieved rather than the total number of queries. The second, MURAG-ADA, further improves utility by privately releasing query-specific thresholds, enabling more precise selection of relevant documents. Our experiments across multiple LLMs and datasets demonstrate that the proposed methods scale to hundreds of queries within a practical DP budget ($\varepsilon\approx10$), while preserving meaningful utility.