Parametric RAG: Moving Security Knowledge Into the Model

Parametric RAG, or P-RAG, changes the location of retrieved knowledge. Standard RAG places selected documents in the model context at inference time. Parametric approaches try to encode external documents into model parameters, often through a parameterization or adaptation stage, and can be combined with ordinary retrieval.

That distinction matters when a domain corpus is used repeatedly and the cost of sending the same long context is high.

1. Two memory paths

Let $M_\theta$ be the base model and $D$ a domain corpus. Contextual RAG computes:

$$y \sim M_\theta(q, C_k(q;D)).$$If the formula does not fit, focus it and use the left and right arrows, or scroll horizontally.

Parametric augmentation produces adapted parameters $\theta_D$ and then generates:

$$y \sim M_{\theta_D}(q).$$If the formula does not fit, focus it and use the left and right arrows, or scroll horizontally.

A hybrid system can use both. The first path is easier to update and cite. The second can reduce repeated context and make common domain patterns easier to access.

2. What moves into the parameters

Encoding knowledge into parameters does not create a perfect database. It changes the model's statistical behavior. A parameterized memory may compress facts, relations and style while losing exact provenance or blending old and new versions.

In security, this raises a strict requirement: the model must not be treated as the authoritative source for a changing policy, indicator or incident fact. A current document retriever may still be required at answer time.

3. Evaluation questions

Compare P-RAG and contextual RAG on:

• answer quality and domain adaptation,
• update time after a source changes,
• provenance and citation coverage,
• interference with unrelated knowledge,
• refusal behavior when a fact is absent,
• inference cost and context length,
• privacy and memorization risk.

The key question is not simply whether the adapted model answers more questions correctly. It is whether the gain survives updates and remains inspectable.

4. A safer hybrid pattern

Use parameterized knowledge for stable, repeated concepts and retrieve current evidence for volatile claims. The response should state which facts came from current documents and which capabilities reflect model adaptation.

P-RAG is therefore best understood as a memory design choice, not as a replacement for retrieval governance.

P-RAG is not simply another name for fine-tuning

Parametric Retrieval Augmented Generation, introduced as a 2025 preprint, proposes parameterizing documents in the model's feed-forward networks. This is a specific formulation; not every document-based fine-tune or domain adapter implements it. The equations above describe the memory design at a high level, not the paper's complete algorithm.

Separate three costs when studying its utility: document preparation, parameterization and querying. Inference savings can disappear when the corpus changes continuously. In security, policy update frequency can matter as much as response latency.

An experiment with expiring knowledge

I propose a laboratory corpus containing a stable policy and two incompatible revisions of a procedure. Evaluate before and after introducing the new revision. Check whether the system cites the correct version, retains the previous version as history and avoids treating both as simultaneously valid.

Compare the base model, contextual RAG, parametric adaptation and a hybrid using identical cases. Include questions whose answers do not exist in the corpus. Recalling a known fact and recognizing a missing fact are different capabilities.

Deletion, permissions and provenance

Removing a document from an index does not guarantee removing knowledge encoded in parameters. If users can access different corpora, the service must control which adaptation is loaded and what its answers may disclose. A tenant label in a prompt does not replace isolation.

Provenance cannot be inferred from the model claiming to remember a source. For volatile claims, require a current, retrieved and verifiable document. The contextual RAG guide develops this evidence path; LLM metrics help compare cost, updates and correctness without collapsing them into one score.