POLICY-AWARE INFORMATION-FLOW MONITORING FOR SENSITIVE-DATA LEAKAGE IN RETRIEVAL-AUGMENTED AI SYSTEMS

Abstract

Retrieval-augmented generation (RAG) enables enterprise assistants to answer questions using organizational records, but retrieved evidence may carry confidential facts across authorization boundaries into prompts and generated responses. Existing defenses apply to the selected stages, but relatively less has been done to apply user-, tenant-, role-, and purpose-dependent disclosure rules to the entire retrieval-to-output path. Policy-Aware Information-Flow Monitoring (PAIFM) described in this article is the framework that combines sensitivity classification, the attribute-aware authorization, document-to-response provenance, strict and semantic leakage identification, and the control of responses based on policies. The material of the public RAGBench and a hypothetically created corpus of 600 fictional enterprise documents were used to create a controlled comparative design. The evaluation scheme defines 2,000 queries, half of them benign and the other half adversarial, and contrasts PAIFM with unsecured RAG, retrieval-level role-based access control, output redaction, and conservative taint tracking. Prespecified metrics include leakage accuracy, recollection, F1-precision, successful attack, false positive, certified answer, and latency; component tests and paired statistical testing are used to study the security-utility-efficiency trade off. The contribution is a provable, providence-sensitive enforcement design and not a novel-information-flow formalism, and reproducible adjudication specifications. Since experimentation and adjudication are unprovided, performance estimates and empirical conclusions are purposefully withheld awaiting implementation of the entire experimental protocol specified here.