A new multilingual RAG audit challenges the simple idea that asking in a non-English language automatically makes personal information easier to extract.
The study uses an English-source synthetic personal-information corpus, five query languages, and a two-stage defense made of an input judge and a regex output filter. The authors stress that their findings are pipeline-conditional because the translator, judge, back-translator, and generator all use Qwen2.5-7B.
Under output-only filtering, English had the highest observed unstructured personal-information leak rate. After adding the input judge, residual leaks remained for Arabic and Swahili, and back-translating the query did not close the gap. Adding the gold corpus document to the input judge blocked most residual cases, but the authors frame that as a diagnostic, not a deployable defense.
The practical lesson is that privacy risk in multilingual RAG lives across retrieval, translation, judging, and generation stages. Teams need stage-level audits rather than broad assumptions about which language is safest.