Metraipolis › archive › dc_a33338a8f2ef

Mind the Hook: Source-Level Auditing of Privacy Defenses in Retrieval-Augmented Generation — arXiv:2608.09001

Source: arXiv (en)
Original: https://arxiv.org/abs/2608.09001
License (as archived): CC0-1.0
Archived: 2026-10-19T08:58:18.258Z
SHA-256 of the archived text: cdde2ce798c59ae6afcc350860035724faa46b3cff1bbb181e94c4d4249c82bc
Stable URL of this page: https://metraipolis.com/documento/dc_a33338a8f2ef

How to cite

Mind the Hook: Source-Level Auditing of Privacy Defenses in Retrieval-Augmented Generation — arXiv:2608.09001 — arXiv (en), https://arxiv.org/abs/2608.09001 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_a33338a8f2ef (Metraipolis archive dc_a33338a8f2ef, sha256 cdde2ce798c59ae6afcc350860035724faa46b3cff1bbb181e94c4d4249c82bc)

BibTeX

@misc{dca33338a8f2ef,
  title = {Mind the Hook: Source-Level Auditing of Privacy Defenses in Retrieval-Augmented Generation — arXiv:2608.09001},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2608.09001},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_a33338a8f2ef; sha256 cdde2ce798c59ae6afcc350860035724faa46b3cff1bbb181e94c4d4249c82bc},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2608.09001. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Black-box privacy scores for retrieval-augmented generation (RAG) are difficult to interpret unless the audited defense's active pipeline hook is known. We propose an active-path audit: inventory source-level hooks over retrieval, retrieved content, and generation; map each metric to the leakage channel it observes; and validate generated-text effects with exact-match canaries. In our benchmark reimplementations, the DP-style defenses modify retrieval scores only: their generation hooks are TODO-flagged stubs that return responses unchanged. This active path explains why they affect membership-inference behavior but track No-Defense on generated-text named-entity leakage, measured by NEL_strict. By contrast, the end-to-end LPRAG path is canary-validated on the email channel, recovering 53/150 canaries under No-Defense and 0/150 under LPRAG. These findings concern our reimplementations on our stack, not released defenses or defense families; the contribution is a methodology and case study, not a universal ranking

Tema degli esploratori: fiducia digitale e crittografia (retro-catalogo arXiv: annunci del 2026-08-11 in cs.CR).
Categorie arXiv: Cryptography and Security (cs.CR) ; Machine Learning (cs.LG).
Pagina del lavoro: https://arxiv.org/abs/2608.09001 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-19T08:54:24.955Z dalla pagina https://arxiv.org/catchup/cs.CR/2026-08-11?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).