Privacy Policy Enforcement Guardrails for Data-Sensitive Retrieval-Augmented Generation

Retrieval-augmented generation (RAG) has become the default deployment pattern in medicine, finance, and law, domains where every generated answer is grounded in corpora that are sensitive in nature. The privacy defenses are primarily constructed under the assumption that data leakage manifests as a Social Security number, an email address, or a name. However, this is not invariably the case. The most perilous form of leakage is contextual in nature, which standard token-level Personally Identifiable Information (PII) filters fail to detect. For instance, the sentence “52-year-old female litigator from Omaha with two children and a recent custody filing” contains five attributes, none of which are individually regulated, that collectively identify a single individual. Token-level filters and named-entity pipelines are blind to this by construction, and emerging representation-based detectors often learn the style of leaky text rather than the leak itself, achieving high benchmark scores while missing the underlying threat. We address this gap with a privacy policy enforcement framework (PPE) for quasi-identifier (QI) cluster leakage in RAG outputs, built on a dual one-class density estimator over fused text embeddings with a calibrated abstain region for inputs that are out-of-distribution to both the safe and unsafe densities. Because real breaches cannot provide training data at the required scale, we introduce an axis-stratified (non-overlapping subsets of a domain), multi-LLM synthetic data generation pipeline and instantiate it across three independent domains: medicine, finance, and law. This three-domain setup exposes a case-style confound: a Gaussian Mixture baseline reaches AUROC ≥ 0.94 within-distribution, but collapses to [0.72 - 0.79] on a borderline-safe stress test that strips the QIs but maintains the tone referring to the client, patient, or matter. The detector has been latching onto the register, not content. A T3 detector with one-class SVM (T3+OCSVM) trained on the safe distribution data, augmented with borderline-safe records, achieves a promising borderline AUROC of 0.93 or higher across all three domains. It also significantly lowers the borderline false positive rate at a 95% true positive rate (FPR95) by 44–55 percentage points, while keeping abstention rates below 11% and operating at millisecond-level latency.

Submitted to PETS 2027