Privacy-Preserving RAG via Multi-Agent Semantic Rewriting: Achieving Confidentiality Without Compromising Contextual Fidelity

2026-06-23

AI Summary

This work addresses the vulnerability of retrieval-augmented generation (RAG) systems to privacy leakage through malicious prompts in sensitive scenarios. To mitigate this risk, the authors propose the first multi-agent semantic rewriting framework specifically designed for RAG, which employs three specialized agents—privacy extractor, semantic analyzer, and reconstructor—that collaboratively remove personally identifiable information while preserving core semantic content. The framework incorporates an asynchronous preprocessing mechanism, enabling zero online inference latency and seamless compatibility with various large language models. Experimental results on the ChatDoctor and Wiki-PII datasets demonstrate that the approach reduces sensitive information exposure in LLaMA-3-8B from 144 instances to just one, achieving a BLEU-1 score of 0.122 and significantly outperforming existing methods such as SAGE.

Abstract

Retrieval-Augmented Generation enhances large language models by incorporating external knowledge, but deploying it in sensitive scenarios risks privacy leakage via malicious prompts. To address this, we propose a multi-agent framework that sanitizes retrieved content through semantic rewriting. By employing three specialized agents for privacy extraction, semantic analysis, and reconstruction, our approach collaboratively removes sensitive identifiers while preserving the semantic core. We evaluate the framework on the ChatDoctor and Wiki-PII datasets across six large language models. Experimental results demonstrate a significant reduction in privacy leakage under targeted attacks. For instance, we reduced targeted information exposure in LLaMA-3-8B from 144 instances in the baseline to just 1. Furthermore, we maintain strong contextual fidelity with a BLEU-1 score of 0.122, outperforming the existing SAGE method's 0.117. Finally, the framework operates as an asynchronous preprocessing module, introducing no additional latency to online inference, as all rewriting is executed as a one-time offline preprocessing step. To promote reproducibility, the source code of this work is publicly available at https://github.com/foursoils/Privacy-Preserving-RAG.

Problem

• Privacy-Preserving
• Retrieval-Augmented Generation
• Privacy Leakage
• Contextual Fidelity
• Sensitive Information

Innovation

• Privacy-Preserving RAG
• Multi-Agent System
• Semantic Rewriting
• Contextual Fidelity
• PII Sanitization