Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

$p^2$RAG: Privacy-Preserving RAG Service Supporting Arbitrary Top-$k$ Retrieval

Yulong Ming, Mingyue Wang, Jijia Yang, Cong Wang, Xiaohua Jia

Abstract

Retrieval-Augmented Generation (RAG) enables large language models to use external knowledge, but outsourcing the RAG service raises privacy concerns for both data owners and users. Privacy-preserving RAG systems address these concerns by performing secure top-$k$ retrieval, which typically is secure sorting to identify relevant documents. However, existing systems face challenges supporting arbitrary $k$ due to their inability to change $k$, new security issues, or efficiency degradation with large $k$. This is a significant limitation because modern long-context models generally achieve higher accuracy with larger retrieval sets. We propose $p^2$RAG, a privacy-preserving RAG service that supports arbitrary top-$k$ retrieval. Unlike existing systems, $p^2$RAG avoids sorting candidate documents. Instead, it uses an interactive bisection method to determine the set of top-$k$ documents. For security, $p^2$RAG uses secret sharing on two semi-honest non-colluding servers to protect the data owner's database and the user's prompt. It enforces restrictions and verification to defend against malicious users and tightly bound the information leakage of the database. The experiments show that $p^2$RAG is 3--300$\times$ faster than the state-of-the-art PRAG for $k = 16$--$1024$.

$p^2$RAG: Privacy-Preserving RAG Service Supporting Arbitrary Top-$k$ Retrieval

Abstract

Retrieval-Augmented Generation (RAG) enables large language models to use external knowledge, but outsourcing the RAG service raises privacy concerns for both data owners and users. Privacy-preserving RAG systems address these concerns by performing secure top- retrieval, which typically is secure sorting to identify relevant documents. However, existing systems face challenges supporting arbitrary due to their inability to change , new security issues, or efficiency degradation with large . This is a significant limitation because modern long-context models generally achieve higher accuracy with larger retrieval sets. We propose RAG, a privacy-preserving RAG service that supports arbitrary top- retrieval. Unlike existing systems, RAG avoids sorting candidate documents. Instead, it uses an interactive bisection method to determine the set of top- documents. For security, RAG uses secret sharing on two semi-honest non-colluding servers to protect the data owner's database and the user's prompt. It enforces restrictions and verification to defend against malicious users and tightly bound the information leakage of the database. The experiments show that RAG is 3--300 faster than the state-of-the-art PRAG for --.
Paper Structure (19 sections, 3 figures, 1 table, 3 algorithms)

This paper contains 19 sections, 3 figures, 1 table, 3 algorithms.

Table of Contents

  1. Introduction
  2. Problem Formulation
  3. System Model
  4. Threat Model
  5. Security Goals
  6. Preliminary
  7. System Design
  8. Distance Calculation
  9. Distance Bisection
  10. Text Retrieval
  11. Construction of $p^2$RAG
  12. Analysis
  13. Performance Analysis
  14. Security Analysis
  15. Experiments
  16. ...and 4 more sections

Figures (3)

  • Figure 1: The workflow of $p^2$RAG. During the offline stage, the data owner sets up the secret-shared database. During the distance calculation, the servers compute the secret-shared distances between each document and the user's prompt. During the distance bisection, the user determines a distance threshold $d_k$ for the top-$k$ documents. The bisection iteration ends when $d_k$ is found, or the number of iterations exceeds an upper bound. During the text retrieval, the user retrieves textual documents using the indices of the top-$k$ documents.
  • Figure 2: Recall and relevance score (higher is better) with varying numbers of retrieved documents $k'$
  • Figure 3: Server time (lower is better) with varying numbers of documents $N$ and retrieved documents $k'$. $k' = 16$ and $N = 2^{17}$ for the two figures, respectively.

Theorems & Definitions (4)

  • Definition 3.1: Comparison Functions
  • Definition 3.2: Distributed Comparison Functions
  • Claim 6.1: $p^2$RAG's Privacy
  • proof