Large Language Models (LLMs) have transformed natural-language access to complex information. Transformer architectures [2] and subsequent pretrained language models such as BERT [3] established the technical foundation for modern question answering, summarization, and knowledge-intensive language processing. In scientific research, these capabilities create an opportunity to expose decades of experimental documentation through conversational interfaces rather than requiring researchers to manually search heterogeneous laboratory systems.

Scientific repositories, however, differ from general-purpose information collections. They may contain proprietary formulations, unpublished experimental observations, process conditions, confidential project information, and regulated data. Our preceding study, “Privacy-Preserving LLM Integration with Scientific NoSQL Repositories: A Differential Privacy Approach,” introduced a layered framework for protecting scientific NoSQL content using local sensitivity analysis, differential-privacy-calibrated transformations, privacy-aware embeddings, and a controlled LLM interface [1]. That work demonstrated the importance of treating privacy as a first-class architectural requirement rather than relying only on conventional access control. Related work on LLM-NoSQL integration for experiment documentation also provides an earlier foundation for scientific knowledge access [4].

Privacy alone does not make an AI-generated scientific answer trustworthy. Researchers must also be able to determine what evidence supports a conclusion, whether the evidence is consistent, how entities and experiments are related, and whether the system is uncertain. Retrieval-Augmented Generation (RAG) addresses part of this problem by combining parametric language models with external non-parametric memory [5]. RAG improves grounding and allows domain knowledge to be updated independently of model retraining, but conventional implementations remain primarily document- or chunk-oriented [6].

Scientific knowledge is inherently relational. A compound may occur in a formulation, the formulation may be tested under a process condition, the experiment may generate an analytical measurement, and that measurement may support or contradict a later conclusion. Knowledge graphs provide an explicit representation of such entities and relationships [7]. Recent work has emphasized the complementary strengths of LLMs and knowledge graphs: LLMs provide flexible language understanding, whereas knowledge graphs provide explicit factual structure and interpretable relationships [8].

Explainability introduces an additional requirement. XAI research emphasizes transparency, accountability, and the need to adapt explanations to their intended audience [9]. For generative scientific retrieval, explanation should not mean exposing hidden chain-of-thought. Instead, a scientifically useful explanation should identify observable evidence, provenance, and relationships that support a generated claim. This paper therefore defines explainability as evidence-level traceability.

To address these requirements, this paper proposes Explainable Privacy-Preserving Scientific Retrieval (EPPSR), which extends the privacy-preserving NoSQL-LLM architecture in [1] with a Scientific Knowledge Graph, dual-channel retrieval, privacy-aware evidence ranking, provenance mapping, calibrated confidence, and claim verification. The central research question is whether scientific retrieval can be simultaneously private, evidence-grounded, explainable, and useful.

The contributions are fivefold: 1) a unified EPPSR architecture integrating formal DP for explicitly defined aggregate releases with scientific knowledge graphs, retrieval, provenance, and evidence-level explainability; 2) a formal privacy threat model that distinguishes epsilon-DP guarantees from application-layer sensitive-information exposure through answers, citations, graph paths, explanations, and repeated queries; 3) a dual-channel retrieval and privacy-aware evidence-ranking mechanism combining semantic, graph, provenance, consistency, and disclosure-risk signals; 4) reproducible explanation metrics based on evidence coverage, provenance completeness, graph-path traceability, and citation support rather than an arbitrary composite explanation score; and 5) a V2 synthetic benchmark with epsilon sweeps, repeated-query privacy accounting, bootstrap confidence intervals, and ablation analysis.

A. LLMs and Retrieval-Augmented Generation

The transformer architecture replaced recurrence with attention and enabled scalable contextual representation learning [2]. BERT subsequently demonstrated the value of deep bidirectional pretraining for language understanding [3]. Although modern LLMs can encode substantial factual knowledge, parametric know- ledge can become stale and may not provide reliable provenance. Lewis et al. introduced RAG to combine sequence generation with retrieved non-parametric memory [4]. Later surveys describe the evolution from naive RAG toward advanced and modular architectures incorporating improved retrieval, reranking, and generation control [5]. Broader language-model and retrieval research includes unsupervised multitask language models, text-to-text transfer learning, few-shot learning, dense passage retrieval, late-interaction ranking, heterogeneous retrieval benchmarks, retrieval-supported generation, retrieval-augmented pretraining, and transformer-based text ranking [10]-[18].

RAG is particularly relevant to enterprise science because proprietary information can remain in organizational repositories while only selected evidence is passed to the model. Nevertheless, retrieval quality and generation faithfulness remain separate failure points. Hallucination research has shown that fluent generation can remain factually inconsistent or unsupported [19]. Scientific use therefore requires not only retrieval but explicit evidence verification.

Research on chain-of-thought prompting, factual consistency, truthfulness, and machine-comprehension benchmarks further shows the importance of reasoning and evidence-based evaluation in language systems [19]-[22].

B. Knowledge Graphs and Graph-Enhanced Retrieval

Knowledge graphs represent entities and relations in a form suitable for querying, validation, reasoning, and integration across heterogeneous information sources [7]. Construction commonly involves knowledge acquisition, refinement, entity resolution, relation extraction, and graph evolution [23]. These capabilities align closely with scientific repositories in which experiments, materials, conditions, methods, measurements, and outcomes form a connected evidence network. Foundational work on neural tensor networks, translational embeddings, relational machine learning, knowledge-graph embeddings, and large-scale knowledge-graph systems established important methods for representing and reasoning over multi-relational knowledge [24]-[28].

Pan et al. categorize LLM-KG integration into KG-enhanced LLMs, LLM-augmented KGs, and synergized LLM-KG systems [7]. Graph-based retrieval extends RAG by retrieving nodes, neighborhoods, paths, or graph-derived summaries rather than relying exclusively on independent text chunks. Such approaches can support multi-hop questions, but graph structure does not inherently provide privacy. Sensitive scientific relationships can themselves disclose intellectual property.

C. Differential Privacy and Privacy-Preserving Language Systems

Differential Privacy (DP) provides a formal mechanism for bounding the effect of an individual record on released outputs [29][30]. DP has been extended to machine learning through techniques such as differentially private stochastic gradient descent [30]. Privacy risks in language models also include memorization and extraction of rare training sequences [31], motivating privacy controls at training, retrieval, and inference boundaries. Privacy research has also examined model inversion, membership inference, privacy analysis of deep learning, privacy-preserving knowledge transfer, federated learning, and decentralized training [32]-[37]. These studies show that privacy risk can arise from both model outputs and the broader learning architecture.

Our prior work [1] applied DP concepts directly to scientific NoSQL retrieval and LLM interaction. The present study treats that architecture as the privacy foundation and investigates the next problem: how to add evidence traceability and relational reasoning without allowing the explanation itself to become a disclosure channel.

D. Explainable and Trustworthy AI

Explainable AI encompasses methods for making model behavior understandable to users and stakeholders [9]. Local surrogate approaches such as LIME [38] and additive attribution approaches such as SHAP [39] are widely used for predictive models. These methods are not sufficient by themselves for generative scientific retrieval because a researcher needs source evidence and provenance rather than only feature attribution. Broader XAI research has examined black-box explanation, rigorous interpretability, limits of interpretability, counterfactual explanations, and general XAI taxonomies [9][40]-[42]. These perspectives reinforce [43] the need for explanations that are measurable and appropriate to the scientific retrieval setting.

Trustworthy scientific generation therefore requires evidence-grounded explanation: generated claims should map to authorized experimental records, graph paths, and provenance. This requirement also creates a privacy-explainability tension. Greater transparency may reveal protected information, while aggressive privacy controls may make explanations scientifically uninformative. EPPSR explicitly places explanation downstream of privacy enforcement.

EPPSR is designed around five requirements: privacy preservation, evidence grounding, relational reasoning, explainability and traceability, and confidence awareness. It separates storage, retrieval, privacy processing, reasoning, generation, and verification so that the LLM never receives unrestricted access to the underlying scientific repository. The layered architecture and controlled privacy boundary are shown in Figure 1.

Figure 1. Layered system architecture of the proposed EPPSR framework.

A. Scientific Data and Knowledge Representation

Let the scientific repository be D = { d 1 , d 2 , ⋯ , d n } , where each di is a scientific record containing structured, semi-structured, or unstructured experimental information. The Scientific Knowledge Graph is G = ( V , E ) , where V contains entities such as Experiment, Compound, Formulation, Condition, Measurement, Method, and Outcome, and E contains typed relations such as contains, testedIn, measuredBy, supports, validates, or contradicts.

The NoSQL repository remains the authoritative evidence source. The graph acts as a relational index and each edge retains provenance linking it to one or more source records. This design avoids treating graph-derived relationships as detached facts. An example of this traceable scientific evidence path is shown in Figure 2.

Figure 2.Example scientific knowledge graph and evidence path.

B. Query Understanding and Privacy Boundary

A query q is transformed into Q ( q ) = { I q , V q , C q , S q } , representing intent, detected scientific entities, contextual constraints, and sensitivity indicators. Authorization determines which records, graph entities, and attributes may participate in retrieval. Differential privacy is then used where formal statistical disclosure protection is appropriate; it is not treated as a substitute for access control.

For a numerical function f(D), the Laplace mechanism is M ( D ) = f ( D ) + Lap ( Δ f / ε ) , where Δf denotes sensitivity and ε is the privacy budget [25][26].

C. Dual-Channel Retrieval and Graph Reasoning

EPPSR retrieves evidence through two coordinated channels. Semantic retrieval ranks NoSQL records using query-record similarity, while graph retrieval traverses entities and paths relevant to the query. The candidate set is the union of both channels.

R ( q ) = R D B ( q ) ∪ R K G ( q ) . The resulting dual-channel semantic and graph retrieval flow is illustrated in Figure 3.

Figure 3.Dual-channel semantic and graph-based retrieval.

For multi-hop scientific questions, candidate paths π are scored using semantic relevance, relational relevance, provenance strength, and a length penalty. This allows concise evidence paths to be preferred over long or weakly supported chains.

D. Privacy-Aware Evidence Ranking

Candidate evidence is ranked using a composite score. In contrast with conventional RAG, highly relevant evidence can be demoted when disclosure risk is high. This mechanism creates an explicit privacy-utility trade-off.

The highest-ranked privacy-approved evidence E* is provided to the generator. Sensitive identifiers may be redacted, and eligible numerical outputs may be perturbed using DP. The explanation layer receives only the same authorized and privacy-processed evidence. The privacy-aware evidence and explanation release boundary is shown in Figure 4.

Figure 4.Privacy-aware evidence and explanation release boundary.

E. Evidence-Grounded Generation, Confidence, and Verification

The generation stage is constrained to the approved evidence set and relevant graph paths. A response is represented as O = { A , E , X , C , P } , containing the answer, released evidence, privacy-compliant explanation, calibrated confidence, and privacy summary. Confidence is derived from evidence strength, graph support, agreement, and provenance rather than the LLM’s verbal certainty.

Generated claims are verified against the approved evidence. For claims C A = { c 1 , ⋯ , c m } , evidence coverage is E C ( A ) = Σ V ( c i ) / m , where V ( c i ) = 1 when sufficient supporting evidence exists. Unsupported claims can be removed, regenerated, or explicitly marked as inference.

A. Privacy Threat Model

The V2 evaluation defines an explicit adversary and release surface. The adversary is assumed to have legitimate access to the natural-language query interface and to observe answer text, citations or released record identifiers, graph-path or relationship summaries, provenance/confidence metadata, and outputs from repeated queries. Protected information includes sensitive record identity, sensitive graph relationships, and exact numeric values used in aggregate releases. This model intentionally treats explanations and graph paths as potential disclosure channels rather than assuming that only source documents are sensitive.

Two privacy concepts are evaluated separately. First, formal differential privacy is applied only to a bounded numeric aggregate release. Second, Sensitive Information Exposure Rate (SIER) measures application-layer disclosure of sensitive record identifiers or graph edges. A zero SIER therefore means that no such unredacted disclosure occurred under the benchmark release policy; it is not, by itself, an epsilon-DP guarantee.

B. Formal Differential-Privacy Release

For each benchmark query, the protected numeric output is the mean effect percentage across a fixed-size cohort of m = 6 matching records. Neighboring datasets D and D’ use replace-one adjacency: both contain six records and differ in exactly one record. Each effect value is clipped to [L, U] = [−18, 18]. The global sensitivity of the bounded mean is therefore:

The released statistic uses the Laplace mechanism:

The per-query privacy budget ε_q was swept over {0.1, 0.5, 1.0, 2.0, 5.0}. For repeated releases, pure sequential composition is used: ε_total ≤ Σε_q. Consequently, if all 80 releases were issued at ε_q = 1.0, the basic worst-case composed budget would be ε_total ≤ 80. A second experiment allocates fixed total budgets across all 80 releases to show the utility consequences of repeated-query accounting.

C. Synthetic Dataset and Query Generator

The generator uses random seed 20260914. The base design contains 8 compounds, 3 process conditions, and 4 measurement categories, yielding 96 compound-condition-measurement cohorts. Six evidence records are generated per cohort (576 base records): three reliable observations sampled from Normal(μ, 1.6) with provenance U(0.85, 1.00); one contradictory observation sampled from Normal (-μ, 2.5) with provenance U(0.25, 0.50); one partial-text observation sampled from Normal (μ, 2.2) with provenance U(0.60, 0.80); and one sensitive strong-evidence observation sampled from Normal (1.15μ, 1.0) with provenance U(0.90, 1.00). The latent μ has random sign and magnitude U(4,14), and all observed effects are clipped to [−18, 18].

An additional 96 lexical distractor records contain query-like canonical terms while their structured condition and measurement fields refer to different concepts, producing 672 total records. Sensitive graph edges are assigned to every sensitive record plus an additional Bernoulli (0.10) sample. Eighty of the 96 cohorts are sampled without replacement to create benchmark queries; query wording alternates between canonical terminology and synonymized wording. The gold answer direction is the sign of the mean reliable evidence, and the gold citation is the highest-provenance reliable non-sensitive source when one is available. Table 1 summarizes the complete V2 synthetic dataset configuration.

Table 1.V2 synthetic dataset configuration.

D. Shared Retrieval Implementation and Baselines

All architectures share the same synthetic corpus and query set. Semantic retrieval uses scikit-learn TfidfVectorizer with unigram and bigram features, lowercase normalization, sublinear term frequency, and cosine similarity. No neural embedding model is claimed in V2. The Scientific Knowledge Graph is deterministically derived from record fields connecting compound, formulation, experiment, condition, measurement, and outcome. Graph relevance is the normalized match over compound, condition, and measurement, corresponding to a conceptual traversal depth of at most three relations.

RAG uses semantic similarity only. PP-RAG uses the same semantic score with a 0.20 privacy-risk penalty. GraphRAG combines semantic and graph relevance with weights 0.55 and 0.45. Full EPPSR uses semantic = 0.40, graph = 0.25, provenance = 0.15, consistency = 0.20, and subtracts privacy risk with weight 0.20. Top-k is fixed at five. The implementation is a CPU-local Python simulation using NumPy, pandas, scikit-learn, and Matplotlib; no external LLM, GPU, or remote inference service is used. The shared implementation and experimental parameters are summarized in Table 2.

Table 2.V2 experimental parameters.

E. Evaluation Metrics

Answer accuracy is the fraction of queries for which the evidence-weighted predicted direction matches the gold direction. Recall@5 indicates whether the designated gold citation appears in the top-five set. Citation accuracy requires the top-ranked citation to equal the designated gold citation. SIER is defined as N_sensitive-unredacted/N_queries and is reported independently of formal DP.

The former composite explanation score is removed. Explainability is instead decomposed into four observable measures: Evidence Coverage, the fraction of required answer dimensions (compound, condition, measurement, and direction) represented by top-five evidence; Provenance Completeness, the mean generated provenance-quality score of top-five evidence; Graph-Path Traceability, whether at least one top-five record provides a complete compound-condition-measurement graph match; and Citation Support, whether the top citation exactly matches the query entities and supports the generated direction.

F. Statistical Analysis and Ablation Design

Each of the 80 queries is evaluated under RAG, PP-RAG, GraphRAG, and EPPSR, yielding 320 main query-method observations. Query-level results are retained. Five-thousand-sample nonparametric bootstrap confidence intervals are computed for the principal rates and explanation components. The EPPSR ablation study evaluates the full system, removal of provenance, removal of consistency, removal of the privacy-risk scoring term, and a semantic-plus-graph-only configuration. The DP epsilon sweep uses 300 independent Laplace releases per query per epsilon value to estimate numerical error and direction utility. The formal DP privacy-utility evaluation design is illustrated in Figure 5.

Figure 5.V2 formal-DP privacy-utility evaluation design: mean absolute error across per-query epsilon values.

A. Retrieval, Grounding, and Sensitive Exposure

Table 3 summarizes the controlled V2 benchmark. EPPSR achieved 100.00% answer accuracy and 97.50% Recall@5, compared with 66.25% and 75.00% for GraphRAG, 60.00% and 13.75% for PP-RAG, and 58.75% and 10.00% for RAG. The answer-accuracy comparison is visualized in Figure 6. These values should be interpreted within the intentionally structured synthetic benchmark: contradictory low-provenance records, partial text, sensitive high-quality evidence, and lexical distractors were generated specifically to test the signals used by the architectures. They demonstrate controlled architectural behavior rather than general production superiority.

Citation accuracy is substantially more demanding because it requires the top-ranked record to equal a single designated high-provenance non-sensitive gold source. EPPSR reached 46.25% citation accuracy, compared with 8.75% for GraphRAG, 6.25% for PP-RAG, and 5.00% for RAG. EPPSR’s 95% bootstrap interval for citation accuracy was 35.00% - 56.28%. RAG and GraphRAG produced SIER values of 41.25% and 37.50%, respectively, whereas PP-RAG and EPPSR produced 0.00% SIER under the benchmark redaction policy. This result is an application-layer exposure result and is not described as a differential-privacy guarantee. Figure 7 visualizes the SIER comparison across the four architectures.

Table 3.V2 overall results (%).

Figure 6.Answer accuracy across retrieval architectures in the V2 synthetic benchmark.

Figure 7. Sensitive Information Exposure Rate (SIER). SIER is separate from formal differential privacy.

B. Evidence-Level Explainability

EPPSR achieved 100.00% evidence coverage, 88.60% provenance completeness, 97.50% graph-path traceability, and 92.50% citation support. GraphRAG also achieved 100.00% graph-path traceability, as expected from its graph component, but its provenance completeness was 75.07%. Figure 8 compares provenance completeness across the architectures. These component measures replace the previous 92.01% composite explanation score and make the explanation evaluation reproducible: each score has a stated definition and can be recomputed directly from query-level evidence.

Figure 8.Mean provenance completeness of top-five evidence across architectures.

C. Formal Differential-Privacy Utility

The epsilon sweep produces the expected privacy-utility pattern. At ε = 0.1, mean absolute error (MAE) was 59.85 effect-percentage points and direction accuracy was 55.00%. At ε = 0.5, MAE fell to 12.00 and direction accuracy rose to 70.51%. At ε = 1.0, MAE was 6.01 and direction accuracy 82.02%. Utility continued to improve at ε = 2.0 (MAE 3.02; 92.32% direction accuracy) and ε = 5.0 (MAE 1.21; 99.00% direction accuracy). The result illustrates the expected trade-off: lower epsilon provides a stronger per-release privacy bound but injects more noise into this small-cohort aggregate. The full epsilon sweep is reported in Table 4, while Figure 9 and Figure 10 show the corresponding MAE and direction-accuracy trends.

Table 4.Formal dp epsilon sweep.

Figure 9.Mean absolute error versus per-query epsilon for the bounded aggregate release.

Figure 10.Direction accuracy versus per-query epsilon.

D. Repeated-Query Privacy Accounting

Basic sequential composition exposes an important limitation of interpreting ε = 1.0 in isolation. Eighty independent releases at ε_q = 1.0 have a worst-case pure-DP bound ε_total ≤ 80. Conversely, dividing a fixed total privacy budget equally across 80 queries can severely reduce utility in this small m = 6 cohort. For example, ε_total = 8 implies ε_q = 0.1, for which the repeated-query simulation yielded approximately 54.90% direction accuracy and MAE 60.18. Even ε_total = 40, corresponding to ε_q = 0.5, yielded 70.71% direction accuracy and MAE 11.88. The experiment therefore supports explicit budget accounting and discourages presenting a per-query epsilon without a release policy. The fixed-total-budget results across all 80 releases are summarized in Table 5.

Table 5.Fixed total privacy budget across 80 releases.

E. EPPSR Ablation

The ablation study isolates the contribution of EPPSR scoring components. Removing consistency reduced answer accuracy from 100.00% to 91.25%, indicating that agreement with the evidence cohort materially affected answer selection in this benchmark. Removing provenance preserved 100.00% answer accuracy but reduced provenance completeness from 88.60% to 79.36% and citation accuracy from 46.25% to 33.75%, showing that provenance primarily affects evidence quality and source selection. Removing the privacy-risk scoring term preserved answer accuracy but reduced citation accuracy to 26.25%; because release-time redaction remained active, SIER stayed at 0%. Finally, the semantic-plus-graph-only variant fell to 66.25% answer accuracy, matching the utility level of GraphRAG-like scoring and showing that the additional EPPSR signals drive much of the controlled-benchmark gain. Table 6 reports the complete ablation results, and Figure 11 highlights the effect of each configuration on answer accuracy.

Table 6.Eppsr ablation results (%).

Figure 11. EPPSR ablation: answer accuracy.

F. Statistical Uncertainty

Bootstrap uncertainty is reported rather than relying on point estimates alone. For answer accuracy, the 95% bootstrap intervals were 47.50% - 70.00% for RAG, 48.75% - 70.00% for PP-RAG, 56.25% - 76.25% for GraphRAG, and 100.00% - 100.00% for EPPSR. Citation-accuracy intervals were 1.25% - 10.00%, 1.25% - 12.50%, 3.75% - 15.00%, and 35.00% - 56.28%, respectively. SIER intervals were 30.00% - 52.50% for RAG, 0.00% - 0.00% for PP-RAG, 26.25% - 47.50% for GraphRAG, and 0.00% - 0.00% for EPPSR. These intervals make clear that small differences among low-frequency rates should not be overinterpreted.

The V2 benchmark is synthetic and intentionally constructed to create retrieval, provenance, contradiction, and privacy conflicts. The strong EPPSR result therefore establishes behavior under controlled assumptions, not superiority on independent scientific corpora. Real repositories contain entity-resolution errors, missing or stale metadata, schema drift, duplicated experiments, complex access policies, and domain-specific semantics that are not fully represented here.

The implementation uses TF-IDF and cosine similarity rather than a neural embedding model and does not execute a production LLM. Consequently, the experiment does not measure model hallucination, generative fluency, prompt-injection robustness, GPU latency, or model-specific faithfulness. The previous simulated hallucination rate and arbitrary composite explanation score have therefore been removed from V2.

Formal DP is deliberately scoped to the bounded aggregate mean-effect release. Authorization, redaction, graph filtering, and privacy-risk reranking are security/privacy controls but do not independently establish epsilon-DP. SIER captures observed application-layer exposure under the specified release policy; 0% SIER does not imply immunity to membership inference, reconstruction, graph inference, collusion, side-channel attacks, or attacks outside the benchmark threat model.

Pure sequential composition is conservative but transparent. More advanced accounting mechanisms, subsampling, larger aggregation cohorts, query caching, privacy filters, and workload-aware budget allocation could improve utility for repeated access. These approaches should be evaluated before deployment. In addition, provenance-quality labels are synthetically generated and should be replaced by auditable real-world provenance criteria and expert validation.

Finally, the 80-query benchmark yields finite-sample uncertainty even with bootstrap reporting. The 100% EPPSR answer-accuracy result is specific to this seeded synthetic design and should be validated through multiple independent seeds, larger benchmark families, external scientific datasets, production embeddings, real knowledge-graph construction pipelines, and blinded domain-expert evaluation.

Future work should move beyond the V2 synthetic proof-of-concept by validating EPPSR on real scientific repositories, production embedding models, multiple LLMs, and independently constructed knowledge graphs. Privacy research should extend the present bounded-aggregate Laplace mechanism with advanced composition/accounting, larger cohorts, privacy filters, and empirical attacks including membership inference, reconstruction, graph inference, and prompt injection. Explainability should be validated through blinded expert studies using the component metrics introduced here rather than an unvalidated composite score.

This paper extends prior privacy-preserving LLM integration with scientific NoSQL repositories [1] by adding knowledge-graph reasoning, evidence ranking, provenance, confidence estimation, and privacy-aware explanation. The resulting EPPSR architecture treats trustworthy scientific retrieval as a multi-objective problem rather than an accuracy-only problem. In the executed synthetic proof-of-concept, GraphRAG achieved the highest raw answer accuracy, whereas EPPSR achieved the strongest combined privacy and explainability profile while retaining competitive accuracy. These findings do not establish production superiority; instead, they provide a reproducible architectural baseline and demonstrate why privacy, evidence grounding, and explainability must be designed together. Real scientific datasets, production LLMs, adversarial privacy testing, and domain-expert evaluation are required for the next stage of validation.