CPR: Retrieval Augmented Generation for Copyright Protection introduces a novel method for Retrieval Augmented Generation (RAG) with strong copyright protection guarantees in a mixed-private setting for diffusion models. The method, called Copy-Protected Generation with Retrieval (CPR), allows diffusion models to condition on a set of retrieved images while ensuring that unique identifiable information about those examples is not exposed in the generated outputs. CPR achieves this by sampling from a mixture of public (safe) and private (user) distributions by merging their diffusion scores at inference. The method satisfies Near Access Freeness (NAF), which bounds the amount of information an attacker may extract from the generated images. Two algorithms, CPR-KL and CPR-Choose, are proposed for copyright protection. Unlike previous rejection-sampling-based NAF methods, CPR enables efficient copyright-protected sampling with a single run of backward diffusion. The method can be applied to any pre-trained conditional diffusion model, such as Stable Diffusion or unCLIP. Empirical results show that applying CPR on top of unCLIP improves text-to-image alignment while enabling credit attribution, copyright protection, and deterministic, constant time unlearning. The method also reduces the risk of leaking private information contained in the retrieved set. CPR is shown to improve text-to-image alignment, with the TIFA score increasing from 81.4 to 83.17. The method also provides privacy guarantees by allowing instantaneous forgetting of private samples without retraining the model. The approach is efficient and can be applied to various diffusion models, making it a promising solution for copyright protection in RAG.CPR: Retrieval Augmented Generation for Copyright Protection introduces a novel method for Retrieval Augmented Generation (RAG) with strong copyright protection guarantees in a mixed-private setting for diffusion models. The method, called Copy-Protected Generation with Retrieval (CPR), allows diffusion models to condition on a set of retrieved images while ensuring that unique identifiable information about those examples is not exposed in the generated outputs. CPR achieves this by sampling from a mixture of public (safe) and private (user) distributions by merging their diffusion scores at inference. The method satisfies Near Access Freeness (NAF), which bounds the amount of information an attacker may extract from the generated images. Two algorithms, CPR-KL and CPR-Choose, are proposed for copyright protection. Unlike previous rejection-sampling-based NAF methods, CPR enables efficient copyright-protected sampling with a single run of backward diffusion. The method can be applied to any pre-trained conditional diffusion model, such as Stable Diffusion or unCLIP. Empirical results show that applying CPR on top of unCLIP improves text-to-image alignment while enabling credit attribution, copyright protection, and deterministic, constant time unlearning. The method also reduces the risk of leaking private information contained in the retrieved set. CPR is shown to improve text-to-image alignment, with the TIFA score increasing from 81.4 to 83.17. The method also provides privacy guarantees by allowing instantaneous forgetting of private samples without retraining the model. The approach is efficient and can be applied to various diffusion models, making it a promising solution for copyright protection in RAG.