{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,20]],"date-time":"2026-07-20T08:02:13Z","timestamp":1784534533321,"version":"3.55.0"},"publisher-location":"Cham","reference-count":36,"publisher":"Springer Nature Switzerland","isbn-type":[{"value":"9783032332592","type":"print"},{"value":"9783032332608","type":"electronic"}],"license":[{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026]]},"DOI":"10.1007\/978-3-032-33260-8_17","type":"book-chapter","created":{"date-parts":[[2026,7,20]],"date-time":"2026-07-20T07:07:20Z","timestamp":1784531240000},"page":"325-344","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Information Flow Control for\u00a0Retrieval-Augmented LLM Chatbots"],"prefix":"10.1007","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-3274-6101","authenticated-orcid":false,"given":"Md Fazle","family":"Rasul","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0002-5712-2116","authenticated-orcid":false,"given":"Hamed","family":"Aghayarzadeh","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0714-7676","authenticated-orcid":false,"given":"Indrakshi","family":"Ray","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2026,7,21]]},"reference":[{"key":"17_CR1","doi-asserted-by":"crossref","unstructured":"Almheiri, S., et al.: Role-Aware Language Models for Secure and Contextualized Access Control in Organizations. In: IJCNLP-AACL 2025, Mumbai, India, December 20-24, 2025, pp. 490\u2013511 (2025)","DOI":"10.18653\/v1\/2025.ijcnlp-long.29"},{"key":"17_CR2","unstructured":"Balaguer, A., et al.: RAG vs fine-tuning: pipelines, tradeoffs, and a case study on agriculture. arXiv preprint arXiv:2401.08406 (2024)"},{"key":"17_CR3","doi-asserted-by":"crossref","unstructured":"Bell, D.E., La Padula, L.J.: Secure computer system: Unified exposition and Multics interpretation. Tech. Rep. (1976)","DOI":"10.21236\/ADA023588"},{"key":"17_CR4","unstructured":"Bhatt, S.S., et\u00a0al.: Enterprise AI must enforce participant-aware access control. arXiv preprint arXiv:2509.14608 (2025)"},{"key":"17_CR5","doi-asserted-by":"crossref","unstructured":"Broomfield, J., et al.: The structural safety generalization problem. In: ACL (Findings) 2025, pp. 22134\u201322173 (2025)","DOI":"10.18653\/v1\/2025.findings-acl.1142"},{"key":"17_CR6","unstructured":"Dam, S.K., Hong, C.S., Qiao, Y., Zhang, C.: A complete survey on LLM-based AI chatbots. arXiv preprint arXiv:2406.16937 (2024)"},{"issue":"5","key":"17_CR7","doi-asserted-by":"publisher","first-page":"236","DOI":"10.1145\/360051.360056","volume":"19","author":"DE Denning","year":"1976","unstructured":"Denning, D.E.: A lattice model of secure information flow. Commun. ACM 19(5), 236\u2013243 (1976)","journal-title":"Commun. ACM"},{"issue":"12","key":"17_CR8","doi-asserted-by":"publisher","first-page":"382","DOI":"10.1007\/s10462-025-11389-2","volume":"58","author":"Y Dong","year":"2025","unstructured":"Dong, Y., et al.: Safeguarding large language models: A survey. Artif. Intell. Rev. 58(12), 382 (2025)","journal-title":"Artif. Intell. Rev."},{"key":"17_CR9","doi-asserted-by":"publisher","first-page":"119884","DOI":"10.1109\/ACCESS.2024.3450629","volume":"12","author":"R Dwivedi","year":"2024","unstructured":"Dwivedi, R., Elluri, L.: Exploring generative artificial intelligence research: A bibliometric analysis approach. IEEE Access 12, 119884\u2013119902 (2024)","journal-title":"IEEE Access"},{"key":"17_CR10","doi-asserted-by":"crossref","unstructured":"Feretzakis, G., Verykios, V.S.: Trustworthy AI: Securing sensitive data in large language models. AI 5(4), 2773\u20132800 (2024)","DOI":"10.3390\/ai5040134"},{"key":"17_CR11","unstructured":"Fleshman, W., Khan, A., Marone, M., Van Durme, B.: Adapterswap: Continuous training of LLMs with data removal and access-control guarantees. arXiv preprint arXiv:2404.08417 (2024)"},{"key":"17_CR12","doi-asserted-by":"crossref","unstructured":"Frisoni, G., Mizutani, M., Moro, G., Valgimigli, L.: Bioreader: a retrieval-enhanced text-to-text transformer for biomedical literature. In: EMNLP, pp. 5770\u20135793 (2022)","DOI":"10.18653\/v1\/2022.emnlp-main.390"},{"key":"17_CR13","unstructured":"Gupta, S., Ranjan, R., Singh, S.N.: A comprehensive survey of Retrieval-Augmented Generation (RAG): Evolution, current landscape and future directions. arXiv preprint arXiv:2410.12837 (2024)"},{"key":"17_CR14","unstructured":"Hackett, W., Birch, L., Trawicki, S., Suri, N., Garraghan, P.: Bypassing LLM guardrails: An empirical analysis of evasion attacks against prompt injection and jailbreak detection systems. In: Proceedings of the The First Workshop on LLM Security (LLMSEC), pp. 101\u2013114 (2025)"},{"issue":"3","key":"17_CR15","doi-asserted-by":"publisher","first-page":"383","DOI":"10.1002\/wps.21352","volume":"24","author":"Y Hua","year":"2025","unstructured":"Hua, Y., et al.: Charting the evolution of artificial intelligence mental health chatbots from rule-based systems to large language models: a systematic review. World Psychiatry 24(3), 383\u2013394 (2025)","journal-title":"World Psychiatry"},{"key":"17_CR16","unstructured":"Jayaraman, B., Marathe, V.J., Mozaffari, H., Shen, W.F., Kenthapadi, K.: Permissioned LLMs: Enforcing access control in Large Language Models. arXiv preprint arXiv:2505.22860 (2025)"},{"key":"17_CR17","doi-asserted-by":"publisher","DOI":"10.1016\/j.lindif.2023.102274","volume":"103","author":"E Kasneci","year":"2023","unstructured":"Kasneci, E., et al.: ChatGPT for good? On opportunities and challenges of large language models for education. Learn. Individ. Differ. 103, 102274 (2023)","journal-title":"Learn. Individ. Differ."},{"key":"17_CR18","doi-asserted-by":"crossref","unstructured":"Klisura, \u0110., Khoury, J., Kundu, A., Krishnan, R., Rios, A.: Role-conditioned refusals: evaluating access control reasoning in large language models. In: EACL, pp. 6018\u20136034 (2026)","DOI":"10.18653\/v1\/2026.findings-eacl.316"},{"key":"17_CR19","unstructured":"Lazier, L.M., Dhar, A., Stambolic, V., Cavigelli, L.: AC-LORA:(Almost) Training-Free Access Control-Aware Multi-Modal LLMs. arXiv preprint arXiv:2505.11557 (2025)"},{"key":"17_CR20","unstructured":"Lewis, P., et\u00a0al.: Retrieval-Augmented Generation for knowledge-intensive NLP tasks. Adv. Neural Inf. Process. Syst. 33, 9459\u20139474 (2020)"},{"key":"17_CR21","unstructured":"Lorenzo, M., Drago, I., Salvadori, D., Vayr, F.R.: ARBITER: AI-Driven Filtering for Role-Based Access Control. arXiv preprint arXiv:2512.20535 (2025)"},{"key":"17_CR22","doi-asserted-by":"crossref","unstructured":"Lukas, N., Salem, A., Sim, R., Tople, S., Wutschitz, L., Zanella-B\u00e9guelin, S.: Analyzing leakage of personally identifiable information in language models. In: 2023 IEEE Symposium on Security and Privacy (SP), pp. 346\u2013363. IEEE (2023)","DOI":"10.1109\/SP46215.2023.10179300"},{"key":"17_CR23","unstructured":"\u00d6zg\u00fcr, A., Uygun, Y.: A Simple Architecture for Enterprise Large Language Model Applications based on Role-based security and Clearance Levels using Retrieval-Augmented Generation or Mixture of Experts. arXiv preprint arXiv:2407.06718 (2024)"},{"key":"17_CR24","doi-asserted-by":"crossref","unstructured":"Salerno, F., Al-Kaswan, A., Izadi, M.: How much do code language models remember? An investigation on data extraction attacks before and after fine-tuning. In: MSR, pp. 465\u2013477. IEEE (2025)","DOI":"10.1109\/MSR66628.2025.00080"},{"key":"17_CR25","unstructured":"Sanyal, D., et al.: Orgaccess: A benchmark for role-based access control in organization-scale LMS. arXiv preprint arXiv:2505.19165 (2025)"},{"key":"17_CR26","doi-asserted-by":"crossref","unstructured":"Shen, X., Chen, Z., Backes, M., Shen, Y., Zhang, Y.: \"Do anything now\": Characterizing and evaluating in-the-wild jailbreak prompts on large language models. In: ACM 2024, pp. 1671\u20131685 (2024). ISBN 979-8-4007-0636-3","DOI":"10.1145\/3658644.3670388"},{"key":"17_CR27","unstructured":"Suruliraj, N.: What is LLM inference? https:\/\/www.ibm.com\/think\/topics\/llm-inference, Accessed 03 Apr 2026"},{"issue":"7","key":"17_CR28","doi-asserted-by":"publisher","first-page":"219","DOI":"10.3390\/fi16070219","volume":"16","author":"K Wangsa","year":"2024","unstructured":"Wangsa, K., Karim, S., Gide, E., Elkhodr, M.: A systematic review and comprehensive analysis of pioneering AI chatbot models from education to healthcare: ChatGPT, Bard, Llama. Ernie and Grok. Future Internet 16(7), 219 (2024)","journal-title":"Ernie and Grok. Future Internet"},{"key":"17_CR29","doi-asserted-by":"crossref","unstructured":"Xie, J., Li, B., Fu, H., Gao, C., Xu, Z., Han, F.: Securing LLM-as-a-Service for Small Businesses: An Industry Case Study of a Distributed Chatbot Deployment Platform, pp. 86\u201391. AISC (2026)","DOI":"10.1145\/3793638.3793648"},{"key":"17_CR30","unstructured":"Yao, H., Shi, H., Chen, Y., Jiang, Y., Wang, C., Qin, Z.: Controlnet: A firewall for RAG-based LLM system. arXiv preprint arXiv:2504.09593 (2025)"},{"key":"17_CR31","doi-asserted-by":"crossref","unstructured":"Zafar, A., Parthasarathy, V.B., Van, C.L., Shahid, S., Shahid, A., et\u00a0al.: Building trust in conversational AI: A comprehensive review and solution architecture for explainable, privacy-aware systems using LLMs and knowledge graph. arXiv preprint arXiv:2308.13534 (2023)","DOI":"10.36227\/techrxiv.24009351.v1"},{"key":"17_CR32","unstructured":"Zhang, Q., Wang, E.E., Li, J., Wang, X.: Burn-After-Use for Preventing Data Leakage through a Secure Multi-Tenant Architecture in Enterprise LLM. arXiv preprint arXiv:2601.06627 (2026)"},{"key":"17_CR33","unstructured":"Zhang, Z., et al.: Activation-Space Anchored Access Control for Multi-Class Permission Reasoning in Large Language Models. arXiv preprint arXiv:2601.13630 (2026)"},{"key":"17_CR34","unstructured":"Zhou, P., Feng, Y., Yang, Z.: Privacy-aware RAG: Secure and isolated knowledge retrieval. arXiv preprint arXiv:2503.15548 (2025)"},{"key":"17_CR35","unstructured":"Zhou, P., Feng, Y., Yang, Z.: Provably secure retrieval-augmented generation. arXiv preprint arXiv:2508.01084 (2025)"},{"key":"17_CR36","doi-asserted-by":"crossref","unstructured":"Zisad, S.N., Hasan, R.: LLMAC: A global and explainable access control framework with large language model. In: CCNC, pp. 1\u20136. IEEE (2026)","DOI":"10.1109\/CCNC65079.2026.11366514"}],"container-title":["Lecture Notes in Computer Science","Data and Applications Security and Privacy XL"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-032-33260-8_17","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,20]],"date-time":"2026-07-20T07:07:25Z","timestamp":1784531245000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-032-33260-8_17"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026]]},"ISBN":["9783032332592","9783032332608"],"references-count":36,"URL":"https:\/\/doi.org\/10.1007\/978-3-032-33260-8_17","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026]]},"assertion":[{"value":"21 July 2026","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"DBSec","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"IFIP Annual Conference on Data and Applications Security and Privacy","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Arlington, VA","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"USA","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2026","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"28 July 2026","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"30 July 2026","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"40","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"dbsec2026","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/dbsec2026.gmu.edu\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}