DP2-RAG: An Efficient Full-Process Differential Privacy Implementation in Retrieval-Augmented Generation

Abstract

As Retrieval-Augmented Generation (RAG) brings Large Language Models (LLMs) into contact with proprietary and user-specific knowledge bases in sensitive domains, protecting the privacy of both queries and knowledge content becomes a critical requirement. The RAG pipeline, however, exposes sensitive information at two distinct surfaces: (i) during retrieval, embeddings from both queriers and knowledge bases can leak sensitive information, and embedding inversion techniques can reconstruct source text from these representations; and (ii) during generation, exposing raw passages to the LLM jeopardizes proprietary and regulated content. Existing defenses provide partial protection or rely on differential privacy (DP) at the cost of severe utility loss. We propose DP2-RAG, a framework that provides efficient end-to-end DP guarantees for both retrieval and generation while preserving usability. DP2-RAG introduces two mechanisms: Noise-Aware Retrieval with Correction (NARC) enforces chunk-level DP by adding calibrated noise and correcting ranking bias to mitigate accuracy degradation, and Dual Utility-Exponent Mechanism (DUEM) guarantees token-level DP for generated surrogates through a two-layer exponential mechanism while maintaining semantic fidelity. We formally prove $(\epsilon,\delta)$ -DP for both stages and the composed pipeline. Extensive evaluation on six benchmarks shows that DP2-RAG reduces privacy leakage by over 15% relative to strong baselines, retains near-baseline Top- $k$ retrieval accuracy, achieves state-of-the-art semantic consistency among DP-based systems, and incurs minimal latency overhead. These results demonstrate that DP2-RAG makes privacy-preserving RAG practical for sensitive domains.