摘要：检索增强生成（RAG）被广泛用于提升大语言模型（LLM）回答用户查询时的性能。现有针对 RAG 的隐私研究，主要聚焦于防止未经授权的用户访问敏感数据。然而，RAG 隐私研究中另一个常被忽视的重要问题是：外部生成器能够访问查询及检索到的文档，而这些内容可能包含机密信息，并可能被滥用或用于非预期用途。本文提出敏感实体别名生成器（Sensitive Entity Alias Generator，SEAG），这是一个隐私保护框架，使用户能够在不披露敏感信息的情况下使用强大的第三方生成器。SEAG 引入了一个轻量级模型，用于定位敏感实体、生成相应别名，并构建实体替换表。在将用户查询和检索文档转发给外部生成器之前，该表会被用于替换其中的敏感词。为此，研究构建了两个数据集：一个用于微调 SEAG 模型以生成实体替换表，另一个用于评估完整的 SEAG 框架。实验结果证明了 SEAG 框架的有效性。在衡量模型能否在向外部生成器隐藏敏感信息的同时为用户提供正确回答的 User 指标上，所有 SEAG 模型均实现了超过 80% 的准确率。进一步分析还评估了 SEAG 模型 Qwen-3、LLaMA-3.2 和 Phi-4 隐藏给定文档中全部敏感实体的能力。结果显示，它们的总体准确率表现良好，分别为 77.83%、76.73% 和 74.91%。

Abstract:Retrieval-Augmented Generation (RAG) is widely used to improve the performance of Large Language Models (LLMs) in answering user queries. Existing privacy research on RAG has focused on preventing unauthorized users from accessing sensitive data. However, another important problem that is often overlooked in RAG privacy research is that external generators have access to the query and the retrieved documents, which may contain confidential information that could potentially be misused or accessed for unintended purposes. In this paper, we introduce the Sensitive Entity Alias Generator (SEAG), a privacy-preserving framework that empowers users to utilize powerful third-party generators without disclosing sensitive information. SEAG introduces a lightweight model that locates sensitive entities, generates corresponding aliases, and constructs an entity replacement table. The table is used to replace sensitive words in the user's query and in the retrieved documents before they are forwarded to an external generator. For this purpose, two datasets were constructed: one for fine-tuning SEAG models to generate entity replacement tables, and another for evaluating the entire SEAG framework. The experimental results demonstrate the success of the SEAG framework. As for the User metric, which measures the ability of the model to provide a correct response to the user while hiding sensitive information from the external generator, all SEAG models achieved over 80% accuracy. Additional analysis further evaluated the ability of SEAG models Qwen-3, LLaMA-3.2, and Phi-4 to hide all sensitive entities within given documents. The results show good performance with total accuracies of 77.83%, 76.73%, and 74.91%, respectively.