Privacy-Preserving RAG via Multi-Agent Semantic Rewriting: Achieving Confidentiality Without Compromising Contextual Fidelity

Research Problem

Retrieval-Augmented Generation (RAG) improves large language models by allowing them to access external, domain-specific knowledge. However, this reliance on external corpora creates a significant privacy vulnerability. Malicious prompts can trick the model into leaking sensitive information from the retrieved documents, such as patient records in healthcare settings. Existing defenses, such as Differential Privacy or synthetic data generation, often struggle to balance the need for strict privacy with the requirement for high-quality, coherent, and factually accurate text.

Proposed Approach

The authors introduce a multi-agent framework that operates as an asynchronous, offline preprocessing module. This approach avoids the latency issues of real-time sanitization by processing documents before they are ever used in the RAG pipeline. The framework utilizes three specialized agents:

1. Privacy Extraction Agent: Combines rule-based methods (for explicit identifiers) and generative LLM inference (for latent quasi-identifiers) to identify sensitive content.
2. Semantic Analysis Agent: Deconstructs the original text into structured knowledge tuples (subject-predicate-value-weight), stripping away the original linguistic structure that might contain implicit privacy signals.
3. Reconstruction Agent: Generates a sanitized, readable version of the text using only the safe semantic tuples, ensuring that the final output retains the core factual content while removing sensitive identifiers.

This research addresses the fundamental "objective entanglement" problem in RAG, where private identifiers and useful semantic information are often tightly interwoven. By decoupling the extraction of privacy-sensitive data from the preservation of semantic facts, the authors demonstrate that it is possible to achieve robust privacy protection without the performance degradation typically associated with noise-injection methods or the loss of factual detail seen in synthetic data approaches. The framework's ability to operate offline ensures that it can be integrated into existing RAG architectures without adding latency to user-facing inference.