{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,8]],"date-time":"2026-07-08T17:19:07Z","timestamp":1783531147115,"version":"3.55.0"},"reference-count":39,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,12,1]],"date-time":"2026-12-01T00:00:00Z","timestamp":1796083200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,12,1]],"date-time":"2026-12-01T00:00:00Z","timestamp":1796083200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,6,10]],"date-time":"2026-06-10T00:00:00Z","timestamp":1781049600000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100000780","name":"European Commission","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100000780","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Expert Systems with Applications"],"published-print":{"date-parts":[[2026,12]]},"DOI":"10.1016\/j.eswa.2026.133154","type":"journal-article","created":{"date-parts":[[2026,6,10]],"date-time":"2026-06-10T07:30:03Z","timestamp":1781076603000},"page":"133154","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":1,"special_numbering":"PB","title":["SD-RAG: A framework for secure selective disclosure in retrieval-augmented generation against single-turn prompt-leaking attacks"],"prefix":"10.1016","volume":"331","author":[{"ORCID":"https:\/\/orcid.org\/0009-0001-7040-4292","authenticated-orcid":false,"given":"Aiman","family":"Al Masoud","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3371-307X","authenticated-orcid":false,"given":"Marco","family":"Arazzi","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2120-2341","authenticated-orcid":false,"given":"Antonino","family":"Nocera","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"78","reference":[{"issue":"24","key":"10.1016\/j.eswa.2026.133154_bib0001","doi-asserted-by":"crossref","first-page":"40376","DOI":"10.1109\/JIOT.2024.3452945","article-title":"The semioe ontology: A semantic model solution for an ioe-based industry","volume":"11","author":"Arazzi","year":"2024","journal-title":"IEEE Internet of Things Journal"},{"issue":"4","key":"10.1016\/j.eswa.2026.133154_bib0002","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3762669","article-title":"RAG-IoE: IoT context-aware information retrieval with large language models in industry 5.0","volume":"6","author":"Arazzi","year":"2025","journal-title":"ACM Transactions on Internet of Things"},{"key":"10.1016\/j.eswa.2026.133154_bib0003","doi-asserted-by":"crossref","DOI":"10.1016\/j.jisa.2025.104162","article-title":"Droidttp: Mapping android applications with ttp for cyber threat intelligence","volume":"93","author":"Arikkat","year":"2025","journal-title":"Journal of Information Security and Applications"},{"key":"10.1016\/j.eswa.2026.133154_bib0004","doi-asserted-by":"crossref","unstructured":"Chen, S., Piet, J., Sitawarin, C., & Wagner, D. (2024). Struq: Defending against prompt injection with structured queries.","DOI":"10.1145\/3733799.3762982"},{"key":"10.1016\/j.eswa.2026.133154_bib0005","unstructured":"Comanici, G. et al. (2025). Gemini 2.5: Pushing the frontier with advanced reasoning, multimodality, long context, and next generation agentic capabilities."},{"key":"10.1016\/j.eswa.2026.133154_bib0006","unstructured":"Edge, D., Trinh, H., Cheng, N., Bradley, J., Chao, A., Mody, A., Truitt, S., Metropolitansky, D., Ness, R. O., & Larson, J. (2024). From local to global: A graph rag approach to query-focused summarization. arXiv: 2404.16130."},{"key":"10.1016\/j.eswa.2026.133154_bib0007","doi-asserted-by":"crossref","unstructured":"Deu\u00dfer, T. D., Sparrenberg, L., Berger, A., Hahnb\u00fcck, M., Bauckhage, C., & Sifa, R. (2025). A survey on current trends and recent advances in text anonymization. In 2025 IEEE 12th International Conference on Data Science and Advanced Analytics (DSAA), 1\u20139.","DOI":"10.1109\/DSAA65442.2025.11247969"},{"key":"10.1016\/j.eswa.2026.133154_bib0008","series-title":"Proceedings of the 61st annual meeting of the association for computational linguistics (volume 1: Long papers)","first-page":"1762","article-title":"Precise zero-shot dense retrieval without relevance labels","author":"Gao","year":"2023"},{"key":"10.1016\/j.eswa.2026.133154_bib0009","unstructured":"Gao, Y., Xiong, Y., Gao, X., Jia, K., Pan, J., Bi, Y., Dai, Y., Sun, J., Wang, M., & Wang, H. (2024). Retrieval-augmented generation for large language models: A survey."},{"key":"10.1016\/j.eswa.2026.133154_bib0010","doi-asserted-by":"crossref","unstructured":"Grislain, N. (2025). Rag with differential privacy.","DOI":"10.1109\/CAI64502.2025.00150"},{"key":"10.1016\/j.eswa.2026.133154_bib0011","series-title":"Esann 2025 proceedings","first-page":"639","article-title":"Improving privacy benefits of redaction","author":"Gusain","year":"2025"},{"key":"10.1016\/j.eswa.2026.133154_bib0012","unstructured":"Han, H., Wang, Y., Shomer, H., Guo, K., Ding, J., Lei, Y., Halappanavar, M., Rossi, R. A., Mukherjee, S., Tang, X., He, Q., Hua, Z., Long, B., Zhao, T., Shah, N., Javari, A., Xia, Y., & Tang, J. (2025). Retrieval-augmented generation with graphs (graphrag)."},{"key":"10.1016\/j.eswa.2026.133154_bib0013","doi-asserted-by":"crossref","unstructured":"Hu, V. C., Kuhn, D. R., Ferraiolo, D. F., & Voas, J. (2015). Attribute-based access control.","DOI":"10.1109\/MC.2015.33"},{"key":"10.1016\/j.eswa.2026.133154_bib0014","series-title":"Proceedings of the 2024 on ACM sigsac conference on computer and communications security","first-page":"3600","article-title":"Pleak: Prompt leaking attacks against large language model applications","author":"Hui","year":"2024"},{"key":"10.1016\/j.eswa.2026.133154_bib0015","unstructured":"Liang, J., Wang, Y., Li, C., Zhu, R., Jiang, T., Gong, N., & Wang, T. (2025). Graphrag under fire. arXiv: 2501.14050."},{"key":"10.1016\/j.eswa.2026.133154_bib0016","unstructured":"Lichtefeld, J., Cecil, J. A., Hedges, A., Abramson, J., & Freedman, M. (2024). Redacted contextual question answering with generative large language models."},{"key":"10.1016\/j.eswa.2026.133154_bib0017","doi-asserted-by":"crossref","unstructured":"Liu, N. F., Lin, K., Hewitt, J., Paranjape, A., Bevilacqua, M., Petroni, F., & Liang, P. (2023a). Lost in the middle: How language models use long contexts.","DOI":"10.1162\/tacl_a_00638"},{"key":"10.1016\/j.eswa.2026.133154_bib0018","unstructured":"Liu, Y., Deng, G., Li, Y., Wang, K., Wang, Z., Wang, X., Zhang, T., Liu, Y., Wang, H., Zheng, Y., & et al. (2023b). Prompt injection attack against llm-integrated applications. arXiv: 2306.05499."},{"key":"10.1016\/j.eswa.2026.133154_bib0019","series-title":"33rd usenix security symposium (usenix security 24)","first-page":"1831","article-title":"Formalizing and benchmarking prompt injection attacks and defenses","author":"Liu","year":"2024"},{"key":"10.1016\/j.eswa.2026.133154_bib0020","doi-asserted-by":"crossref","DOI":"10.1016\/j.knosys.2024.112945","article-title":"Enhancing text anonymization via re-identification risk-based explainability","volume":"310","author":"Manzanares-Salor","year":"2025","journal-title":"Knowledge-Based Systems"},{"issue":"29","key":"10.1016\/j.eswa.2026.133154_bib0021","doi-asserted-by":"crossref","DOI":"10.21105\/joss.00861","article-title":"Umap: Uniform manifold approximation and projection for dimension reduction","volume":"3","author":"McInnes","year":"2020","journal-title":"Journal of Open Source Software"},{"issue":"1","key":"10.1016\/j.eswa.2026.133154_bib0022","doi-asserted-by":"crossref","DOI":"10.1056\/AIra2400380","article-title":"Rag in health care: A novel framework for improving communication and decision-making by addressing llm limitations","volume":"2","author":"Ng","year":"2025","journal-title":"Nejm AI"},{"issue":"7","key":"10.1016\/j.eswa.2026.133154_bib0023","doi-asserted-by":"crossref","first-page":"3580","DOI":"10.1109\/TKDE.2024.3352100","article-title":"Unifying large language models and knowledge graphs: A roadmap","volume":"36","author":"Pan","year":"2024","journal-title":"IEEE Transactions on Knowledge and Data Engineering"},{"key":"10.1016\/j.eswa.2026.133154_bib0024","series-title":"Cs & it conference proceedings","article-title":"Enhancing privacy and security in rag-based generative AI applications","volume":"Vol. 15","author":"Panda","year":"2025"},{"key":"10.1016\/j.eswa.2026.133154_bib0025","series-title":"Truthful text sanitization guided by inference attacks","first-page":"114013","volume":"185","author":"Pil\u00e1n","year":"2025"},{"key":"10.1016\/j.eswa.2026.133154_bib0026","first-page":"606","article-title":"Efficiently scaling transformer inference","volume":"5","author":"Pope","year":"2023","journal-title":"Proceedings of Machine Learning and Systems"},{"key":"10.1016\/j.eswa.2026.133154_bib0027","unstructured":"Protecto AI (2026). Secure rag. https:\/\/example.com\/secure-rag."},{"key":"10.1016\/j.eswa.2026.133154_bib0028","unstructured":"RoyChowdhury, A., Luo, M., Sahu, P., Banerjee, S., & Tiwari, M. (2024). Confusedpilot: Confused deputy risks in rag-based llms. arXiv: 2408.04870."},{"key":"10.1016\/j.eswa.2026.133154_bib0029","series-title":"The twelfth international conference on learning representations","article-title":"Raptor: Recursive abstractive processing for tree-organized retrieval","author":"Sarthi","year":"2024"},{"key":"10.1016\/j.eswa.2026.133154_bib0030","unstructured":"Singh, A., Ehtesham, A., Kumar, S., & Khoei, T. T. (2025). Agentic retrieval-augmented generation: A survey on agentic rag. arXiv: 2501.09136."},{"key":"10.1016\/j.eswa.2026.133154_bib0031","series-title":"International conference on discovery science","first-page":"379","article-title":"Retrieval-efficiency trade-off of unsupervised keyword extraction","author":"Skrlj","year":"2022"},{"key":"10.1016\/j.eswa.2026.133154_bib0032","article-title":"Defending financial rag systems against jailbreak attacks","author":"Song","year":"2026","journal-title":"Expert Systems with Applications"},{"key":"10.1016\/j.eswa.2026.133154_bib0033","article-title":"Attention is all you need","volume":"30","author":"Vaswani","year":"2017","journal-title":"Advances in Neural Information Processing Systems"},{"key":"10.1016\/j.eswa.2026.133154_bib0034","series-title":"Advances in neural information processing systems","first-page":"80079","article-title":"Jailbroken: How does llm safety training fail?","volume":"Vol. 36","author":"Wei","year":"2023"},{"key":"10.1016\/j.eswa.2026.133154_bib0035","unstructured":"Zhang, Q., Chen, S., Bei, Y., Yuan, Z., Zhou, H., Hong, Z., Chen, H., Xiao, Y., Zhou, C., Dong, J., & et al. (2025). A survey of graph retrieval-augmented generation for customized large language models. arXiv: 2501.13958."},{"key":"10.1016\/j.eswa.2026.133154_bib0036","unstructured":"Zhou, P., Feng, Y., & Yang, Z. (2025). Privacy-aware rag: Secure and isolated knowledge retrieval. arXiv: 2503.15548."},{"key":"10.1016\/j.eswa.2026.133154_bib0037","series-title":"Findings of the association for computational linguistics: Emnlp 2024","first-page":"13014","article-title":"Hyqe: Ranking contexts with hypothetical query embeddings","author":"Zhou","year":"2024"},{"key":"10.1016\/j.eswa.2026.133154_bib0038","series-title":"34th usenix security symposium (usenix security 25)","first-page":"3827","article-title":"PoisonedRAG: Knowledge corruption attacks to retrieval-augmented generation of large language models","author":"Zou","year":"2025"},{"key":"10.1016\/j.eswa.2026.133154_bib0039","unstructured":"Zverev, E., Abdelnabi, S., Tabesh, S., Fritz, M., & Lampert, C. H. (2024). Can llms separate instructions from data? And what do we even mean by that?arXiv: 2403.06833."}],"container-title":["Expert Systems with Applications"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0957417426020646?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0957417426020646?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,7,8]],"date-time":"2026-07-08T16:46:43Z","timestamp":1783529203000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S0957417426020646"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,12]]},"references-count":39,"alternative-id":["S0957417426020646"],"URL":"https:\/\/doi.org\/10.1016\/j.eswa.2026.133154","relation":{},"ISSN":["0957-4174"],"issn-type":[{"value":"0957-4174","type":"print"}],"subject":[],"published":{"date-parts":[[2026,12]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"SD-RAG: A framework for secure selective disclosure in retrieval-augmented generation against single-turn prompt-leaking attacks","name":"articletitle","label":"Article Title"},{"value":"Expert Systems with Applications","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.eswa.2026.133154","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 The Authors. Published by Elsevier Ltd.","name":"copyright","label":"Copyright"}],"article-number":"133154"}}