针对合成英语RAG探针中文化标记谓词触发的PII放大的分析性无检测探索：谓词资源混淆审计

中文摘要 AI 辅助

我们探究针对带有文化标记人群的刻板印象查询，是否会比其他等效的中性查询从检索增强生成（RAG）系统中泄露更多个人身份信息（PII）。我们预先注册了一项针对四种文化（盎格鲁英语、拉丁美洲西班牙语、阿拉伯语、印地语）的审计，基于合成英语PII语料库，比较了五个我们称为刻板印象触发泄露差值（STLD）的查询分支。首先有两个注意事项：我们锁定的验证性估计器从未运行，因此本文中的所有测试均为探索性或敏感性测试，所有计划偏差均列在附录中；且姓名泄露指标受到提示回声人工制品的污染，模型常仅重新输出我们询问的姓名，这在无任何检索的情况下就夸大了表观泄露。在更干净的渠道（电子邮件、电话、类似社会安全号码、地址）上，经多重比较校正后，我们未发现四种文化中存在刻板印象驱动的放大。由于我们的样本仅对中等规模效应有统计效力，且文化标记探针将刻板印象内容与文化标记及遗产实践混合，因此我们将此呈现为未检测到，而非无效应证据，即与底层资源混淆的文化标记谓词泄露。

英文摘要

We ask whether stereotype-loaded queries about culturally marked people leak more personal information from a retrieval-augmented generation (RAG) system than otherwise-equivalent neutral queries. We pre-register a four-culture audit (en-Anglo, es-LATAM, Arabic, Hindi) on a synthetic English PII corpus, comparing five query arms we call the Stereotype-Trigger Leakage Delta (STLD). Two caveats up front. Our locked confirmatory estimator was never run, so every test in the paper is exploratory or sensitivity, with all plan deviations listed in the appendix. And the name-leakage metric is contaminated by a prompt-echo artifact: the model often just re-emits the name we asked about, which inflates apparent leakage without any retrieval at all. On the cleaner channels (email, phone, ssn-like, address), we find no stereotype-driven amplification on any of the four cultures after multiple-comparison correction. Because our sample is only powered for mid-sized effects, and because the culturally marked probes mix stereotype content with cultural markers and heritage practices, we present this as no detection, not evidence of no effect, of culturally marked predicate leakage that is confounded with the underlying resource.

发表机构

• Northeastern University（东北大学）
• University of Illinois Urbana-Champaign（伊利诺伊大学厄巴纳-香槟分校）
• Southern Methodist University（南卫理公会大学）

机构由 AI 辅助整理，请以论文原文为准。