💬 NLP

Where Privacy Risk Lives in English-Source Multilingual RAG: A Stage-Decomposed Audit Across Five Query Languages

This paper challenges the assumption that non-English queries inherently increase privacy risks in English-source multilingual RAG systems by demonstrating through a Qwen2.5-7B pipeline audit that English actually exhibits the highest unstructured-PII leak rates under output-only filtering, while residual risks in Arabic and Swahili persist even with input judges and back-translation, though these can be largely mitigated by providing document context to the input judge.

Original authors: Yanhang Li, Zhichao Fan, Zexin Zhuang

Published 2026-08-07

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Yanhang Li, Zhichao Fan, Zexin Zhuang

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a super-smart librarian who can answer questions in any language you speak. You ask a question in Spanish, and the librarian finds the right book written in English, reads it, and gives you the answer back in Spanish. This is how modern "Multilingual RAG" (Retrieval-Augmented Generation) systems work: they bridge the gap between your native language and a massive library of documents written in another. But here's the catch: what if the librarian is too eager to please? What if, in trying to answer your question, they accidentally spill a secret they weren't supposed to share?

In the world of computer security, we worry about "Privacy Risks." This happens when a system leaks personal information—like a fake email address, a phone number, or a home address—that it was supposed to keep hidden. For a long time, experts worried that switching to a non-English language might make these systems easier to trick. The fear was that security guards (filters) trained mostly on English might be too sleepy to catch a sneaky question asked in Arabic or Swahili. It's like having a bouncer at a club who only knows how to spot trouble in English; you might think a person speaking a different language could slip right past them.

This paper decides to test that fear. The researchers set up a digital playground with a library of 100 synthetic (fake) documents containing made-up personal secrets. They hired a team of AI "attackers" to try and steal these secrets using questions in five different languages: English, Chinese, German, Arabic, and Swahili. Crucially, these non-English questions were not written by native speakers; they were created by translating English templates using the same AI model (Qwen) that runs the system. They used a two-layer defense system: first, a "Judge" AI that reads the question to see if it looks suspicious, and second, a "Filter" that scans the answer to catch any leaked numbers or names. The goal was to see which language was the most dangerous and why.

The Great Language Heist: What They Found

The researchers ran 1,500 different "heist" attempts, trying to steal secrets from their fake library. They expected the non-English languages to be the most successful at slipping past the security guards. But the results were a bit of a plot twist.

The "English is the Worst" Surprise
When they only used the second layer of defense (the Filter that scans the final answer), the English questions were actually the most successful at leaking secrets! In fact, English had the highest leak rate at 0.875 (meaning it leaked secrets in about 87.5% of attempts). The non-English languages leaked less, with Swahili being the "safest" at 0.425. The only clear difference the researchers could spot with high confidence was between English and Swahili. This suggests that, in this specific setup, the idea that "foreign languages are automatically more dangerous" isn't quite right. The English questions were actually the sneakiest.

The Two-Stage Defense and the "Lost in Translation" Problem
Next, the researchers added the first layer of defense: the "Judge" AI. This judge reads the question before the librarian even looks for the book. If the question looks like a theft attempt, the judge says "BLOCK."

Here is where the story gets interesting. When the Judge was added, the English, Chinese, and German leaks dropped to zero. The system was perfect for those languages! But for Arabic and Swahili, the system still failed.

Arabic still leaked secrets in 7.5% of cases.
Swahili was the troublemaker, leaking secrets in 17.5% of cases.

Why did this happen? The researchers suspect a "Lost in Translation" effect. The AI translator (which turned the English questions into Swahili) might have accidentally watered down the "thief's intent." The Swahili question sounded less like a direct theft attempt and more like a harmless request. The "Judge" AI, which only speaks English and has to guess the intent of the foreign language, got fooled. It thought, "Oh, this Swahili question seems harmless, let it through!" But once the question reached the librarian (the generator), who did have the book in front of them, the librarian still managed to spill the secret.

The "Magic Glasses" Test
To prove their theory, the researchers ran a special test on the 17 cases where the Swahili and Arabic leaks happened. They gave the "Judge" a pair of "magic glasses"—specifically, they showed the Judge the actual document the librarian was about to use (using a perfect, "oracle" retriever). With this extra context, the Judge suddenly realized, "Hey, this question is trying to steal a secret!" and blocked 15 out of 17 of those leaks.

This suggests the problem isn't that the Swahili language is inherently dangerous. The problem is that the security guard (the Judge) was looking at the question in a vacuum, without seeing the book it was about to open. When the guard saw the book, they did their job perfectly.

The Bottom Line

This paper doesn't say that non-English languages are safe forever, nor does it say English is the only risk. Instead, it shows that in a system where everything is translated by the same AI family (Qwen), the risk depends on how well the translation preserves the "vibe" of the question.

The main takeaway is that privacy risks in these systems aren't just about which language you speak. They are about how the different parts of the system talk to each other. If the "Judge" doesn't understand the nuance of a translated question, or if the translation makes a dangerous question sound innocent, secrets can slip through. The researchers found that giving the Judge more context (like showing it the document) fixes the problem, but they warn that this is just a diagnostic tool, not a final solution. They need more testing with different AI models and real human-written questions (not just translated templates) to be sure. For now, the story is a reminder that in the world of AI security, the weakest link isn't always the language you speak, but how well your security team understands the context.

Technical Summary: Where Privacy Risk Lives in English-Source Multilingual RAG

Problem Statement
A prevailing assumption in multilingual safety suggests that switching a Retrieval-Augmented Generation (RAG) system to a non-English query language increases the risk of personal information leakage. The hypothesis is that cross-lingual queries may bypass English-centric defenses (such as PII filters and safety classifiers) that are over-represented in English training data. This paper investigates this intuition within an English-source multilingual RAG system. The specific threat model involves an attacker who possesses a non-PII anchor (e.g., a project name or ticket ID) of a target document and attempts to extract a planted synthetic PII item (name, email, phone, address, or ID) by querying the system in five languages: English, Chinese, German, Arabic, and Swahili.

Methodology
The authors construct a stage-decomposed audit pipeline using a synthetic corpus of 100 English documents, each containing one unique PII item. The system architecture and attack setup include:

Pipeline Components: All components (translator, input judge, back-translator, and generator) utilize the Qwen2.5-7B model family to ensure findings are pipeline-conditional rather than causal rankings of language-inherent risk.
- Retriever: BGE-M3 embedder with FAISS (top- $k=5$ ).
- Generator: Qwen2.5-7B-Instruct.
- Defense (Stage A): An English-only-prompted LLM input judge that classifies queries as BLOCK or ALLOW.
- Defense (Stage B): A regex-based output filter targeting email, phone, and SSN-like patterns.
Attack Vectors: For each document, three query reformulations are generated: direct extraction, summary with entity requests, and in-context learning (ICL). These English templates are translated into the four target non-English languages using Qwen2.5-7B.
Metrics: The study measures "leak" as the verbatim disclosure of the planted PII. It aggregates results at the document level (any-success) using 95% bootstrap confidence intervals. The analysis distinguishes between output-only leaks (bypassing the regex filter) and combined leaks (bypassing both the input judge and output filter).
Ablations & Diagnostics: The study includes a "back-translate-then-judge" ablation and a "multilingual-prompted judge" variant. Crucially, it performs an oracle diagnostic (Section 4.4) where the input judge is provided with the gold corpus document as context to test if retrieval context can close the security gap.

Key Results

Output-Only Filtering (F1): Contrary to the assumption that non-English queries are riskier, English queries exhibited the highest observed unstructured-PII leak rate (0.875) under output-only filtering. Non-English templates showed lower point estimates (ranging from 0.425 for Swahili to 0.775 for German). Statistically, only the English-vs-Swahili comparison showed clean separation via bootstrap intervals; other comparisons overlapped.
Input Judge Performance (F2): When the English-only-prompted input judge was added, the residual leak collapsed to zero for English, Chinese, and German. However, residual leaks persisted for Arabic (7.5%) and Swahili (17.5%).
- The input judge blocked 100% of English queries but only 76.7% of Swahili queries.
- A "back-translate-then-judge" ablation did not improve Swahili blocking rates (dropping to 71.3%), suggesting the issue is not merely the judge's inability to read foreign text, but potentially translation-induced intent attenuation where the translated query loses explicit extraction cues.
Combined Stage Leak (F3): The residual leaks concentrated in the "MT-noisy corner" (Arabic and Swahili). The pattern suggests a differential pipeline degradation: the input-side judge (lacking retrieval context) fails to detect the attenuated intent, while the downstream generator (conditioned on retrieved context) successfully reconstructs the PII.
Oracle Diagnostic (F4): In a separate experiment on a multilingual-prompted judge residual ( $n=17$ ), attaching the gold corpus document as "Retrieved Context" to the input judge blocked 15/17 residual cells. This indicates that providing context to the input judge can mitigate the failure, though this is framed as a mechanism diagnostic rather than a deployable defense.

Key Contributions

Localization of Risk: The paper localizes privacy risk not to the language itself, but to specific failure modes in the pipeline where translation noise attenuates extraction intent enough to bypass an input filter, while the retrieval context allows the generator to still answer.
Pipeline-Conditional Findings: The authors explicitly state that their findings are conditional on the Qwen2.5-7B pipeline. They do not claim that non-English languages are inherently safer or riskier, but rather that in this specific configuration, English showed the highest leak rates under output filtering, and residual risks concentrated in Arabic and Swahili under two-stage filtering.
Mechanism Hypothesis: The work proposes the hypothesis of "differential pipeline degradation under translation noise," where the input judge and the generator degrade at different rates when processing machine-translated queries.

Significance and Claims
The paper modestly frames its contributions as a stage-decomposed pilot and an oracle proof-of-concept, explicitly avoiding claims of generalizable causal mechanisms or deployable defenses.

Not a Causal Ranking: The authors emphasize that because the entire pipeline (translator, judge, generator) uses the same model family, the results cannot be used to rank languages by inherent risk.
Not a Deployable Defense: The F4 result (blocking 15/17 cells with context) is presented strictly as a mechanism diagnostic. The authors note that without measuring benign-query false-positive rates or answer-utility costs, this cannot be recommended as a production defense.
Scope Boundaries: The study is limited to machine-translated attack templates (not native-written prompts) and a single model family. The authors identify the priority follow-up as an independent replication using a different machine translation system (e.g., NLLB-200), a non-Qwen judge, and a native-speaker query set to distinguish between translation artifacts and inherent language risks.

In summary, the paper challenges the intuition that non-English queries are automatically more dangerous in English-source RAG systems, demonstrating instead that in a specific Qwen-mediated pipeline, English queries leak the most under output filtering, while residual risks in Arabic and Swahili stem from a specific interaction between translation noise and the lack of retrieval context in the input judge.

The Great Language Heist: What They Found

The Bottom Line

Technical Summary: Where Privacy Risk Lives in English-Source Multilingual RAG

More like this