发表机构
Northeastern University; University of Illinois Urbana-Champaign; Southern Methodist University（东北大学; 伊利诺伊大学厄巴纳-香槟分校; 南卫理公会大学）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
该研究针对RAG的黑盒隐私分数解读难题，提出活跃路径审计方法，通过梳理源级钩子、映射泄漏通道、金丝雀验证，复现分析DP与LPRAG防御的隐私效果，贡献方法论与案例研究。
AI 中文摘要
检索增强生成（RAG）的黑盒隐私分数难以解读，除非知晓被审计防御的活跃流水线钩子。我们提出一种活跃路径审计：梳理检索、检索内容及生成环节的源级钩子；将各指标映射到其观测的泄漏通道；并通过精确匹配金丝雀验证生成文本的效果。在我们的基准复现中，DP风格防御仅修改检索分数：其生成钩子为标记为TODO的存根，返回响应不变。该活跃路径解释了为何这些防御会影响成员推断行为，但在生成文本命名实体泄漏（以NEL_strict衡量）上跟踪无防御情况。相比之下，端到端LPRAG路径在邮件通道上经金丝雀验证，在无防御时恢复53/150个金丝雀，在LPRAG时恢复0/150个。这些发现涉及我们在自身栈上的复现，而非已发布的防御或防御家族；贡献为一种方法论与案例研究，而非通用排名。
英文摘要
Black-box privacy scores for retrieval-augmented generation (RAG) are difficult to interpret unless the audited defense's active pipeline hook is known. We propose an active-path audit: inventory source-level hooks over retrieval, retrieved content, and generation; map each metric to the leakage channel it observes; and validate generated-text effects with exact-match canaries. In our benchmark reimplementations, the DP-style defenses modify retrieval scores only: their generation hooks are TODO-flagged stubs that return responses unchanged. This active path explains why they affect membership-inference behavior but track No-Defense on generated-text named-entity leakage, measured by NEL_strict. By contrast, the end-to-end LPRAG path is canary-validated on the email channel, recovering 53/150 canaries under No-Defense and 0/150 under LPRAG. These findings concern our reimplementations on our stack, not released defenses or defense families; the contribution is a methodology and case study, not a universal ranking
Comments6 pages, 1 figure. Accepted as a regular paper at the 25th IEEE International Conference on Machine Learning and Applications (ICMLA 2026)
