Give the Generator Less to Leak: KFS-RAG Moves Privacy to the Retrieval Boundary
TL;DR for operators An enterprise assistant may retrieve a long internal document because one sentence is relevant to a user question. If the entire passage is then handed to the generator, the model receives much more information than it needs—and a successful prompt injection has more material available to disclose. KFS-RAG addresses that exposure point after retrieval but before generation. Instead of forwarding raw passages, it identifies query-relevant evidence and converts it into a compact set of facts. In the paper’s open-domain QA evaluation, this reduced untargeted chunk recovery from 70.8% with Vanilla RAG to 21.03%, while answer BLEU-1 and ROUGE-L remained close to the raw-context baseline. ...