← All questions
Data, Privacy & LegalHard· RAG· Access Control· Risk Assessment

How should you evaluate the risk of a RAG system that l...

Evaluating risk based on a flat 10% base rate is inaccurate because it ignores the compounding probability of retrieving restricted content. When drawing multiple chunks (e.g., k=8) from a pool, the probability of selecting at least one restricted item follows a hypergeometric distribution. This calculation demonstrates that the risk of surfacing restricted content is much higher than the base rate suggests. Consequently, implementing a retrieval-time filter is mandatory to prevent unauthorized data exposure.

Code playground (Python)