Guide · Data
RAG Data Leakage and Corpus Governance
Retrieval-augmented generation fails when the index is a dump of everything. Production RAG needs corpus governance—who can index what, who can retrieve what, and how leaks get caught.
RAG leakage is a Data Privacy and Data Governance failure—retrieval needs the same ACLs as your product APIs. Primary control: Data Privacy
Three leaks you will see in the wild
Wrong tenant. One shared vector namespace; retrieval is "top-k similar" only. A user asking about invoices gets another customer's pricing sheet. Encryption at rest does not help—authorization never ran on the query.
Ghost documents. A file is deleted in SharePoint; chunks remain until someone rebuilds the index. The assistant keeps citing yesterday's policy.
Buried secrets. An old Confluence page contains a password. Ingest embeds it. Clever questions (or injection) surface it in answers.
RAG leakage is usually a retrieval AuthZ and corpus lifecycle failure—not a model "being too helpful."
Design the retriever like a product API
Every query must apply the same tenant and ACL filters your download API would. Prompt text that says "only use this user's docs" is not a control. Prefer metadata filters you can unit-test; use separate indexes when you cannot prove filter integrity.
Before embed: secret scanning, classification labels, owner on the source (Data Governance). After delete or ACL change: purge or reindex paths that actually run. Log chunk IDs returned per `request_id` so incidents and audits can reconstruct what was shown.
Prove it before production
Add "must not retrieve" and cross-tenant cases to your Evaluation gate. If a change to the ingest pipeline or filter logic ships without those tests going green, you do not have APRF Data Privacy readiness—only a demo that ranked well on happy-path questions.
Assess against APRF Core
Run the Core Profile quiz — gated pass/fail blockers for AI production readiness, not a vanity score.
Related
Frequently asked questions
- Is encryption enough for RAG privacy?
- No. Encryption protects disks and transit. Leakage usually happens because the wrong chunk is retrieved and sent to the model. You need authorization on retrieval.
- Should each tenant have its own vector index?
- Often yes for strong isolation, or use a shared index with mandatory metadata filters you can prove in tests. APRF Data Privacy expects enforceable boundaries, not prompt-only promises.
- How do I find secrets already in my index?
- Scan source corpora and run offline sweeps over stored chunks for key patterns. Rotate any exposed credentials and purge matching vectors.