A new arXiv paper challenges the assumption that switching to a non-English query language makes a multilingual RAG system measurably more vulnerable to personal-information leaks. Tested on an English-source synthetic-PII corpus with five query languages and a two-stage defence combining an LLM input judge with a regex output filter, the pipeline found that under output-only filtering, English produced the highest unstructured-PII leak rate, and only the English-versus-Swahili comparison separated cleanly under document-level bootstrap intervals (arXiv abstract).
The researchers built their evaluation using Qwen2.5-7B models for every pipeline component: translator, input judge, back-translator, and generator. Because the same model family runs every stage, the authors explicitly frame their findings as pipeline-conditional rather than a causal ranking of language-inherent risk (DOI record).
Adding the input judge reduced but did not eliminate leaks. Residual PII exposure persisted on Arabic and Swahili queries, and back-translating the non-English query into English failed to close the gap. The authors report this back-translation ablation but caution that it cannot serve as a causal diagnostic, because the back-translator itself is also Qwen-based (arXiv abstract).
In a separate n=17 corner case involving multilingual-prompted judges, attaching the gold corpus document to the input judge blocked PII leakage in 15 of 17 residual cells. The authors frame this as a mechanism diagnostic, not a deployable defence, because it relies on oracle retrieval, measures BLOCK and ALLOW rates on adversarial queries only, and reports no benign-query false-positive rate or answer-utility cost (DOI record).
The paper’s supplementary material includes code, corpora, queries, and per-trial JSON logs. The authors identify independent machine-translation and a non-Qwen judge as the priority replication steps, scoped in their limitations section (arXiv abstract).
For teams building multilingual RAG, the takeaway is that language switching alone is not a reliable safety lever. Output filtering and input judging change the risk surface in non-obvious ways, and any defence should be validated against the specific pipeline components rather than assumed to generalise across languages. Related reporting on ServiceNow MosaicLeaks shows how private data can escape research agents through web queries, reinforcing that PII exposure remains a systemic issue across agentic architectures.
