Give the Generator Less to Leak: KFS-RAG Moves Privacy to the Retrieval Boundary

TL;DR for operators

An enterprise assistant may retrieve a long internal document because one sentence is relevant to a user question. If the entire passage is then handed to the generator, the model receives much more information than it needs—and a successful prompt injection has more material available to disclose.

KFS-RAG addresses that exposure point after retrieval but before generation. Instead of forwarding raw passages, it identifies query-relevant evidence and converts it into a compact set of facts. In the paper’s open-domain QA evaluation, this reduced untargeted chunk recovery from 70.8% with Vanilla RAG to 21.03%, while answer BLEU-1 and ROUGE-L remained close to the raw-context baseline.

For enterprise RAG, the architectural question is therefore not only how to stop malicious instructions. It is also how much retrieved information the generator should be allowed to see. The paper supports a least-privilege answer: expose the facts needed for the current query, not the retrieved document by default. The trade-off is task-dependent: multi-hop questions need more evidence, fact extraction adds latency, and reconstructing richer context can restore utility while also increasing leakage.

The generator cannot disclose context it never receives

The paper by Zhang et al., Mitigating Database Leakage in RAG Systems with Keyword-Grounded Fact Substitution, starts from an architectural weakness rather than a better system prompt.¹

A conventional RAG pipeline retrieves passages and places them directly into the generator’s context. That is efficient for answer quality, but it also means retrieval determines what information becomes accessible to the model. If an injected instruction later asks the model to reproduce retrieved material, the defense must persuade the generator not to reveal information it already possesses.

KFS-RAG changes that boundary. The database is not rewritten, and retrieval itself remains intact. The intervention occurs after retrieval: raw passages are transformed into a length-bounded collection of facts linked to the current query. The final generator receives those facts rather than the original text.

That distinction matters operationally. This is not database-wide sanitization, access-control replacement, or proof that disclosure has been eliminated. It is an information-minimization layer between retrieval and generation.

Selective exposure preserves more utility than simply suppressing context

The central evidence comes from comparative benchmark tests across open-domain QA, 2WikiMultiHopQA, and HealthcareMagic.

On open-domain QA, Vanilla RAG achieved BLEU-1 of 0.083 and ROUGE-L of 0.141. KFS-RAG-Fact reached 0.096 and 0.140 respectively. Under targeted leakage attacks, meanwhile, BLEU-1 overlap with sensitive retrieved content fell from 0.754 to 0.039, ROUGE-L from 0.913 to 0.238, and token F1 from 0.804 to 0.368. Untargeted chunk recovery fell from 70.8% to 21.03%.

The result is not equally favorable on every task. On 2WikiMultiHopQA, KFS-RAG-Fact reduced untargeted chunk recovery from 21.5% to 5.6%, but answer utility also fell: BLEU-1 declined from 0.408 to 0.335 and ROUGE-L from 0.593 to 0.474.

That is consistent with the task structure. A straightforward factual query may need only a small evidence set. A multi-hop question can depend on several pieces of information connected across passages. Restricting the fact pool too aggressively can remove part of the reasoning chain.

The paper’s fact-quantity tests reinforce this interpretation: adding more facts is not uniformly helpful. Extra evidence can introduce noise and leakage in simpler QA, while multi-hop reasoning benefits from retaining a larger factual set.

For operators, this makes the control tunable rather than binary. The relevant setting is not “RAG or no RAG.” It is how much retrieved evidence should cross into generation for a particular class of task.

Attention proposes candidates; perturbation checks whether they matter

Once the system decides to expose only relevant facts, it needs a way to identify which parts of the retrieved text matter.

KFS-RAG uses a two-stage Attention-Perturbation process. First, attention rollout provides a cheap shortlist of candidate words associated with a provisional answer. Second, the system masks or removes those candidates and measures how much the model’s loss on that provisional answer changes. Candidates whose removal materially changes the loss are treated as more influential.

The division of labor is important. Attention is used as a screening mechanism, not treated as definitive evidence of relevance. Perturbation provides a stronger local test, but running it over every possible token would be expensive.

The ablation in Table 5 is therefore primarily an efficiency test of the selector design. Perturbation-only keyword scoring required 2.09 seconds for the keyword stage, compared with 0.16 seconds for the combined method. Total per-query latency was 8.60 seconds for perturbation-only versus 6.67 seconds for KFS-RAG-Fact. The attention-only variant was slightly faster at 6.63 seconds total, but its reported utility was lower than the combined version.

The architectural pattern extends beyond this specific implementation: use a cheap, high-recall mechanism to narrow the search space, then spend the more expensive verification step on a small set of candidates.

Reconstructing richer context also reconstructs leakage capacity

Fact substitution removes more than sensitive detail. It can also remove style, sequencing, and discourse structure that help the downstream model produce a natural answer.

KFS-RAG therefore includes an optional re-synthesis stage that converts the extracted facts back into a more natural, domain-consistent passage. The paper labels this fuller pipeline KFS-RAG-Full.

The results show why this should be a policy choice rather than a default upgrade. On ODQA, the full version improved utility to BLEU-1 0.103 and ROUGE-L 0.154, compared with 0.096 and 0.140 for the fact-only version. But untargeted chunk recovery also rose from 21.03% to 22.37%. On HealthcareMagic, it increased from 16.4% to 22.1%.

The effect is modest in some metrics, but the direction is operationally informative. Restoring richer context can also restore details that the sanitization stage was designed to withhold.

A privacy-sensitive internal search tool may therefore prefer fact-only evidence. A domain where conversational form or discourse continuity materially affects usefulness may justify re-synthesis, but that decision should be evaluated as an explicit utility-versus-exposure trade-off.

The stress tests support the boundary, not universal immunity

The paper also embeds adversarial instructions inside retrieved documents rather than only in user prompts. This is best read as a robustness test of the post-retrieval boundary.

On ODQA under the untargeted context-side attack, chunk recovery was 72.4% for Vanilla RAG, 33.4% for SAGE, and 24.03% for KFS-RAG. On 2WikiMultiHopQA, the corresponding rates were 23.4%, 8.4%, and 7.2%.

These results matter because a defense that only hardens the user-facing prompt can fail when malicious instructions arrive through retrieved content. KFS-RAG reduces the amount of source material reaching the generator even when the retrieved document itself is adversarial.

The appendix also varies the Attention-Perturbation backbone and fact-extraction model. Privacy and utility shift with those choices, sometimes materially. That sensitivity argues against treating the reported numbers as properties of the architecture independent of implementation. What appears more stable is the broader pattern: selective fact exposure reduces leakage relative to raw-context RAG across the tested configurations.

What Cognaptus infers for enterprise RAG

For organizations deploying RAG over internal documents, source code, support records, or private knowledge bases, the paper suggests a stronger design rule than relying on generation-time instructions alone: retrieved context should be governed as an access surface.

The affected decision belongs to system architects and security owners choosing what representation crosses from retrieval into generation. Where a query can be answered from a small factual subset, forwarding full passages grants the generator unnecessary information access. A post-retrieval transformation layer offers an intermediate option between unrestricted context and disabling retrieval.

The ROI question is not simply whether leakage scores improve. Operators must price the additional extraction step, roughly the 0.64-second end-to-end increase reported for KFS-RAG-Fact over Vanilla RAG in the paper’s latency ablation, against the sensitivity of the underlying corpus and the cost of disclosure.

That calculation will differ between a public documentation assistant and a system connected to confidential customer, engineering, or medical information.

Where the evidence stops

The experiments are comparative benchmark evidence, not a universal security proof. The paper reports no statistical uncertainty or aggregate evaluation sample count, and its coverage is limited to the tested attack variants.

More importantly for deployment, the evaluation covers single-turn, text-only RAG using large language models. It does not establish the same privacy-utility behavior in multi-turn conversations, where information can accumulate across exchanges, or in multimodal systems, where retrieved evidence may include images, audio, or structured artifacts.

KFS-RAG also reduces disclosure rather than eliminating it. Even the strongest fact-based configuration still exposes information selected as relevant to the user’s query, and the extraction components themselves influence which information survives the boundary.

The defensible architectural conclusion is narrower: when a generator does not need the entire retrieved passage, giving it the entire passage creates avoidable disclosure capacity. KFS-RAG shows one technically concrete way to reduce that capacity while retaining useful retrieval—and also shows that the right amount of retained evidence depends on the task.

Cognaptus: Automate the Present, Incubate the Future.