A new arXiv study on multilingual RAG privacy challenges the assumption that non-English queries increase personal-information leak risk. Under basic output-only filtering, English queries produced the highest unstructured PII leak rate in tests, and only the English-versus-Swahili comparison separated cleanly under document-level bootstrap intervals arXiv cs.CL, 2026.
The researchers built an English-source synthetic-PII corpus and ran queries in five languages through a Qwen2.5-7B pipeline with a two-stage defence combining an LLM input judge and a regex output filter. Because every component uses the same model family, the findings are pipeline-conditional rather than a causal ranking of language-inherent risk arXiv cs.CL, 2026.
Adding the input judge reduced but did not eliminate leaks. Residual PII exposure persisted on Arabic and Swahili queries, and back-translating non-English queries into English failed to close the gap. The authors report this ablation but note it cannot serve as a causal diagnostic because the back-translator is also Qwen-based arXiv cs.CL, 2026.
In a separate n=17 corner case with multilingual-prompted judges, attaching the gold corpus document to the input judge blocked PII leakage in 15 of 17 residual cells. The authors frame this as a mechanism diagnostic, not a deployable defence, since it relies on oracle retrieval, measures BLOCK and ALLOW rates on adversarial queries only, and reports no benign-query false-positive rate or answer-utility cost arXiv cs.CL, 2026.
Supplementary material includes code, corpora, queries, and per-trial JSON logs. The authors list independent machine-translation and a non-Qwen judge as priority replication steps in their limitations section arXiv cs.CL, 2026.
For teams building multilingual RAG, language switching alone is not a reliable safety lever. Output filtering and input judging reshape the risk surface in non-obvious ways, so defences should be validated against specific pipeline components. Related reporting on ServiceNow MosaicLeaks shows how private data can escape research agents through web queries, reinforcing that PII exposure remains systemic across agentic architectures arXiv cs.CL, 2026.
