Retrieval‑Augmented Generation (RAG) improves large language models by grounding responses in an external corpus, thereby reducing hallucinations and factual errors. Yet adversaries can craft queries that force the retriever to expose personally identifiable information (PII). We introduce RAG‑CT, a lightweight defense that flags malicious queries by examining their entropy and margin distributions. First, the entropy of a query’s retrieved scores is computed to gauge result uncertainty; then the margin between top‑ranked scores is measured to detect unusually confident returns. The combined score is compared against a threshold to decide if the query is suspicious. Extensive experiments on two public datasets, covering four state‑of‑the‑art attacks and four baseline defenses, show that RAG‑CT markedly cuts PII leakage while preserving generation quality, all without modifying the underlying LLM or retriever.
Review