GEPI: Differentially Private Relational Evidence Release for Language Generation

Differentially private retrieval-augmented generation (RAG) aims to answer questions using sensitive corpora while limiting the influence of any individual record on its outputs. Yet retrieved documents often expose a finer granularity of information than an answer requires. This raises a central question: *what evidence should a system access and release to support an answer?* We distinguish queries seeking non-statistical facts or rules, population patterns, case-conditioned population evidence, and specific records, including combinations of these needs. Together with access policy, these distinctions separate when an answer can rely on public evidence, when privacy-protected aggregate evidence is appropriate, and when authorized record-level access is required. In a preliminary GPT-based audit, relational representations preserve all required source-linked evidence for 88.3% of clinical and 88.8% of legal queries. Removing relationships while retaining the same terms and values reduces these rates to 30.0% and 61.3%, respectively. These results motivate GEPI (Global Evidence for Private Statistical Inference), which separates private evidence release from language generation. GEPI predefines relational measurements for a supported workload, aggregates document-local evidence into corpus-level differentially private statistics, and lets a language model answer from the released synopsis rather than source documents. The same synopsis can support repeated answers without reopening protected documents or incurring additional privacy cost. We compare GEPI with privacy-preserving release baselines at matched privacy budgets, measuring alignment with gold answers and attribute inference from released evidence. Our experiments show that preserving relationships is critical for private evidence, motivating relational statistics as the foundation of GEPI.