Can a simple projection reduce what RAG systems leak?
Randomly compressing query and document embeddings sharply reduced extraction in four laboratory tests while retaining much of the utility. It is an empirical defence, not a privacy guarantee.
The short version
3 key points
- 1.The study tested two RAG designs on Enron email, European court documents, C4 and HotpotQA using repeated-query and adaptive extraction attacks.
- 2.On Enron standard RAG, the repeated-query attack recovered 217 personal items without protection and three after random projection under the tested settings.
- 3.The method has no formal differential-privacy guarantee and was not evaluated at production scale or on private live data.
The defence changes the retrieval space before an attacker can probe it
A retrieval-augmented chatbot can reveal material from its document store when an attacker repeatedly asks carefully shaped questions. University of Chicago researchers tested a lightweight defence: multiply both document and query embeddings by the same random matrix before searching. The compressed vectors keep much of their relative similarity, but the retrieval path becomes noisy enough to frustrate the extraction attacks used in the paper.
The approach is attractive because projection happens once for stored documents and requires one matrix multiplication per query. The team evaluated a nearest-neighbour language model and a standard retrieve-then-prompt system across four public datasets: Enron email, European Court of Human Rights documents, C4 web text and HotpotQA. Attacks included ten repeated attempts per item and adaptive campaigns of up to 200 queries.[1]
Leakage fell sharply in these tests, with an uneven utility cost
In the Enron repeated-query test, unprotected standard RAG exposed 217 personal items: 36 email addresses, 56 URLs and 125 phone numbers. Random projection reduced that count to three URLs. On European court documents, leakage for standard RAG with a Qwen model fell from 21.30% to 2.05%, while answer F1 moved from 97.32 to 95.43. Results varied by model and dataset, which is why one headline figure cannot describe the whole method.
Against two multi-round HotpotQA attacks, unprotected RAG reconstructed 60% and 75% of targeted chunks; the projected system reached 3% and zero under the paper's criterion. Its answer and supporting-document scores remained close to the unprotected system on several measures. Across the full study, the authors summarise utility as about 7% lower than vanilla RAG while outperforming the tested differential-privacy baselines on utility.[1]
The distinction that matters
What random projection changes
The same hidden transformation is applied to documents and incoming queries before retrieval.
Documents
Project stored embeddings into fewer dimensions
The original embedding space is not searched directly
Queries
Apply the same random matrix
Relevant neighbours remain approximately close
Attack test
Repeat or adapt extraction prompts
Measured recovery falls under the tested attacks
Empirical resistance is not the same as formal privacy
The comparison matters for organisations deciding how to protect an internal knowledge base. Random projection may be a practical extra layer when formal differential privacy is not required, but it does not prove that a new attack cannot recover sensitive content. The authors deliberately measure resistance to known attacks rather than offer a worst-case privacy guarantee. Access controls, data minimisation, output monitoring and incident response therefore remain necessary.
The experiments used public or synthetic material rather than a private production store, and the systems were small enough for laboratory testing. They also selected a projection dimension of 100 after examining the privacy and utility trade-off, so deployment would need its own held-out tuning and monitoring. The paper estimates that its current setup takes about eight seconds per query; a million-query evaluation would take roughly 92 days without optimisation. It reports no funding or competing-interests statement in the accessible version. Independent red-team work should test varied embedding models, languages, document types and adaptive attackers at production scale, while measuring latency and retrieval errors for ordinary users. Until then, random projection is a promising baseline—not a declaration that a RAG datastore is safe.[1]
Evidence check
The evidence is an unreviewed laboratory evaluation on public or synthetic datasets and known attacks. The method has no formal differential-privacy guarantee and lacks production-scale validation.
Reporting basis: Source analysis. Original source date: 15 October 2026.
Explore the full source and evidence record
What this means for people
- Employees and customers can be exposed when a chatbot retrieves private records that were never meant to appear in an answer.
- Security teams may gain a low-complexity defence layer, but must not treat it as a replacement for permissions and data minimisation.
Global context
The method was developed at a US university using internationally available datasets and open models. Privacy duties, threat models and acceptable utility losses vary by jurisdiction and application.
What the evidence does not yet show
- The evidence is an unreviewed laboratory evaluation on public or synthetic datasets and known attacks. The method has no formal differential-privacy guarantee and lacks production-scale validation.
What to watch next
- Independent adaptive attacks, production-scale latency tests and evaluations on diverse languages, embedding models and access-controlled enterprise stores.
Living evidence record
Impact record IAI-102PD4J
Evidence stage
Studied
Confidence
Supported
Reporting basis
Source analysis
Independent or research support
Present
Record status
Monitoring
Last checked
16 October 2026
Source trail
1 direct source across 1 source type.
People impact
Documented in this record.
Uncertainty
Limits and next checks are explicit.
Stages describe the evidence available—not whether a technology is good or bad. See the public method.
Single-source reporting disclosure
This record analyses one direct source. It can establish what Yao, Rabbani and Li (arXiv) published or reported, but it is not independent corroboration of every performance claim or predicted outcome. The confidence label will change only when broader evidence is added.
Evidence trail
Sources used for this report
Links checked 16 October 2026
Research question, topics and regions
Random projection as an empirical defence against RAG datastore extraction
Topics: Privacy · Retrieval-augmented generation · Data extraction · Security · Embeddings
Regions: United States · Global
This report is labelled source analysis. We summarise and analyse source material in our own words; company statements remain attributed claims until independently supported. Translated summaries preserve the meaning of the original source and link back to it. Read our editorial standards.
The Impact Brief · Free
Keep following the stories that matter to you.
Get our weekday briefing on what changed and why it matters. Choose your topics below.
Continue the story
There’s more to this story
Security & Defence
Will Apple’s new consent controls make AI agents safer on Macs?
Apple says it will add controls requiring very explicit user action before an app receives Full Disk Access, warning that autonomous AI raises the risk of exposing files, mail, messages and browsing history. The direction is important, but Apple has not yet published the interface, release version, rollout date or evidence that the design prevents mistaken consent or misuse after permission is granted.
10 min · 5 sources
Security & Defence
How can an approved AI tool read files it never declared?
A large preprint found 150 dynamically confirmed MCP-server instances that could reach beyond an inferred filesystem boundary. The audit used planted secrets, not evidence of real-world theft.
3 min · 1 source
Security & Defence
Can generative AI hide wireless data from eavesdroppers?
A peer-reviewed simulation used a generative flow network to configure a time-switched reflecting surface, preserving signals in intended directions while scrambling others. No radio hardware or real adversary was tested.
6 min · 1 source
Reader commentary
What does this mean where you are?
Tell us what you have seen at work, in your community or in everyday life. A question is welcome too. No account is needed; we review notes before publishing them.
Explore commentary across the portal →Published reader notes
0No published reader notes yet. You can start the evidence-led discussion above.
Prefer a private correction or response? Contact the newsroom.