Privacy-Preserving Conversational RAG

Retrieval-Augmented Generation (RAG) is increasingly used in conversational applications such as customer support chatbots, where users may disclose personal information beyond what is needed to answer their questions. Under regulations such as GDPR or PIPEDA, unnecessary disclosure can increase privacy and compliance burdens. While recent work studies data minimization for direct large language model (LLM) prompting, RAG introduces two distinct exposure points: retrieval and generation. We specifically ask: What is the minimum user information that must be exposed at each stage of a RAG pipeline while preserving end-to-end answer utility? To address this, we propose a lightweight framework that separately minimizes sensitive information exposure during retrieval and generation. A trusted local layer first detects sensitive attributes using GLiNER, a lightweight NER model that supports custom labels. Before retrieval, detected values are abstracted to entity types (e.g., Zurich → LOCATION), so the original personal values are not sent to the retriever or reranker. We employ a standard RAG pipeline featuring a vector database and a local LM reranker. Following retrieval, we perform a local counterfactual probability test using a white-box small language model (SLM) to identify which personal attributes are relevant to final generation. For each attribute, we substitute its value with a plausible alternative and measure how this changes the likelihood of the reference answer. Influential attributes are retained, while the rest remain abstracted in the minimized query sent to the downstream LLM. For example, investment eligibility may depend on age or location while not requiring gender or education. To evaluate our framework, we construct a synthetic conversational RAG benchmark using financial documents from FinDoc-RAG and multi-attribute personas from PersonaMem-V2. Questions are generated to depend on controlled subsets of persona attributes, with irrelevant attributes injected as distractors to provide ground-truth relevance labels. We evaluate the framework across three dimensions: (1) privacy-utility trade-off, using an LLM-as-a-judge to compare answer correctness between minimized and unredacted queries; (2) retrieval fidelity, measuring Recall@k before and after query sanitization; and (3) latency overhead, profiling attribute detection and counterfactual testing with local SLMs. These experiments characterize the privacy-utility trade-off of relevance-aware data minimization across the RAG pipeline.