Privacy-Aware Adaptive Differential Privacy for Semantic Retrieval: A Pii-Aware Dynamic Budget Allocation Framework

Abstract

Retrieval-Augmented Generation (RAG) makes it possible to enhance output from Large Language Models (LLMs) with retrieval-based evidence; however, these systems can also introduce privacy vulnerabilities, and in particular, Membership Inference Attacks (MIAs). Specifically, Differential Privacy (DP) is a well-established methodology for protecting privacy; however, applying static perturbation strategies, typically used in low-dimensional spaces, will result in degradation of semantic utility due to the high dimensionality of the embedding spaces. To solve this privacy-utility problem, we present PADP, a sensitivity-aware perturbation framework inspired by differential privacy principles, which provides a plug-and-play, middleware framework that can be easily integrated into enterprise RAG pipelines without requiring costly computations for LLM fine-tuning and reconstruction of vector indices. PADP uses Named Entity Recognition (NER) based on DeBERTa-v3 to perform sensitivity assessments of documents at the document level on an offline basis, computing PII sensitivity scores for each document. These scores are then used to adaptively calibrate the application of Laplace perturbations to dense query embeddings during retrieval. PADP assigns more protection to the higher-risk content and less to the lower-risk content than static perturbation methods would typically do, thereby increasing the effectiveness of retrieval. PADP draws on concepts from Differential Privacy; nonetheless, it does not furnish formal database-level Differential Privacy guarantees under conventional adjacency definitions. Consequently, the proposed framework should be understood as an adaptive privacy-enhancement mechanism rather than as a formally guaranteed Differential Privacy mechanism. Through the evaluation of the performance of PADP across diverse datasets by way of retrieval effectiveness metrics and distinguishability analysis, its comparison with static embedding perturbation baseline methods affords a contextual statistical analysis which indicates that adaptive sensitivity aware perturbation preserves semantic retrievability while dampening membership based distinguishability signals under the conditions of the study. These findings position sensitivity-aware perturbation as a practical approach to enhancing privacy in Retrieval-Augmented Generation systems while preserving utility.