# P2RAG: Efficient Privacy-Preserving RAG Service Supporting Arbitrary Top-k Retrieval

arXiv: https://arxiv.org/abs/2603.14778 · HTML: https://mlsanity.com/paper/2603.14778/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation.
- Builds on 13 of its 65 references that are in the map.
- First posted on arXiv 16 Mar 2026.

## Placed in

- Retrieval-augmented generation / [Privacy and security of RAG](https://mlsanity.com/rag/privacy-and-security-of-rag/)

## Builds on (most cited first, 13 of 13)

- [Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks](https://mlsanity.com/paper/2005.11401/) (2020)
- [Prompt Cache: Modular Attention Reuse for Low-Latency Inference](https://mlsanity.com/paper/2311.04934/) (2023)
- [Retrieval Augmented Generation or Long-Context LLMs? A Comprehensive Study and Hybrid Approach](https://mlsanity.com/paper/2407.16833/) (2024)
- [MPCFormer: fast, performant and private Transformer inference with MPC](https://mlsanity.com/paper/2211.01452/) (2022)
- [Privacy-Preserving Retrieval-Augmented Generation with Differential Privacy](https://mlsanity.com/paper/2412.04697/) (2024)
- [Long Context vs. RAG for LLMs: An Evaluation and Revisits](https://mlsanity.com/paper/2501.01880/) (2024)
- [RemoteRAG: A Privacy-Preserving LLM Cloud RAG Service](https://mlsanity.com/paper/2412.12775/) (2024)
- [PermLLM: Private Inference of Large Language Models within 3 Seconds under WAN](https://mlsanity.com/paper/2405.18744/) (2024)
- [SANNS: Scaling Up Secure Approximate k-Nearest Neighbors Search](https://mlsanity.com/paper/1904.02033/) (2019)
- [MulVul: Retrieval-augmented Multi-Agent Code Vulnerability Detection via Cross-Model Prompt Evolution](https://mlsanity.com/paper/2601.18847/) (2026)
- [Private-RAG: Answering Multiple Queries with LLMs while Keeping Your Data Private](https://mlsanity.com/paper/2511.07637/) (2025)
- [Express: Lowering the Cost of Metadata-hiding Communication with Cryptographic Privacy](https://mlsanity.com/paper/1911.09215/) (2019)
- [Exploring Privacy Preservation in Outsourced K-Nearest Neighbors with Multiple Data Owners](https://mlsanity.com/paper/1507.08309/) (2015)

## Built on by (most cited first, 1 of 1)

- [Pointing the Way, Hiding the Destination: Practical Private Dense Retrieval at Scale](https://mlsanity.com/paper/2608.25735/) (2026)

## Abstract (arXiv)

Retrieval-Augmented Generation (RAG) enables large language models to use external knowledge, but outsourcing the RAG service raises privacy concerns for both data owners and users. Privacy-preserving RAG systems address these concerns by performing secure top-k retrieval, which is typically implemented using secure sorting to identify relevant documents. However, existing systems face challenges supporting arbitrary k due to their inability to change k, new security issues, and in particular, efficiency degradation with large k. This is a significant limitation because applications such as finance, law, and healthcare require a k that is large enough to cause huge overhead for existing systems. Also, modern long-context models generally achieve higher accuracy with larger retrieval sets. We propose P2RAG, an efficient privacy-preserving RAG service that supports arbitrary top-k retrieval. Unlike existing systems, P2RAG avoids sorting candidate documents. Instead, it uses an interactive bisection method to determine the set of top-k documents. For security, P2RAG uses secret sharing on two semi-honest non-colluding servers to protect the data owner's database and the user's prompt. It enforces restrictions and verification to defend against malicious users and tightly bounds the information leakage of the database. The experiments show that P2RAG is 3--300× faster than the state-of-the-art PRAG for k = 16--1024.