mlsanityData to 7 Oct 2026

A Unified Benchmark for Privacy-preserving Vector Search

arXiv 2608.01192 ↗First posted 2 Aug 2026cs.CR cs.DB cs.PFcited by 0

On the map: Retrieval-augmented generation → Privacy and security of RAG

Abstract (arXiv)

Vector search powers semantic search, recommendation systems, and retrieval-augmented generation (RAG). By design, the service answering a query sees both the query embedding and, usually, the corpus against which it is matched. This is a privacy breach for both the user issuing the query and the owner of the corpus. A family of cryptographic schemes (e.g., SAP, EMVP, BNTM, Tip-toe) addresses that leak. However, as each scheme is published and evaluated on its own corpus, threat model, parameter choices, hardware, and metric conventions, the numbers cannot be compared directly. Consequently, a practitioner asking which one to deploy today has no defensible way to choose. We close that gap with a uniform experimental comparison, including a Plaintext baseline and four cryptographic backends running over the same workload, hardware, and metric definitions. Under that ruler, the schemes spread across a Pareto frontier in privacy, performance, and recall rather than imposing a flat penalty on performance. We find that the performance of SAP matches Plaintext, EMVP delivers cryptographic indistinguishability at a 4x throughput cost on CPU, BNTM adds malicious-server verifiability at a further 22x median-latency cost, and Tiptoe hides the cluster choice itself, but incurs a 190x per-query cost compared to Plaintext. GPU acceleration pays off for Plaintext and SAP but not for EMVP or BNTM. All our experiment artifacts are publicly available for reproducibility

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 13 of its 47 references that are in the map. First posted on arXiv 2 Aug 2026.

Builds on

13 of 47 references.

References · 13

  1. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
  2. 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,160
  3. 2020Dense Passage Retrieval for Open-Domain Question Answeringcited by 3,779
  4. 2016MS MARCO: A Human Generated MAchine Reading COmprehension Datasetcited by 1,591
  5. 2020CodeBERT: A Pre-Trained Model for Programming and Natural Languagescited by 1,286
  6. 2022Text Embeddings by Weakly-Supervised Contrastive Pre-trainingcited by 1,216
  7. 2016Efficient and robust approximate nearest neighbor search using Hierarchical Navigable Small World graphscited by 853
  8. 2020Information Leakage in Embedding Modelscited by 199
  9. 2023Recommender Systems with Generative Retrievalcited by 191
  10. 2023Text Embeddings Reveal (Almost) As Much As Textcited by 189
  11. 2018ANN-Benchmarks: A Benchmarking Tool for Approximate Nearest Neighbor Algorithmscited by 130
  12. 2025Practical Secure Delegated Linear Algebra with Trapdoored Matricescited by 4
1 more
  1. 2026Concept-Aware Privacy Mechanisms for Defending Embedding Inversion Attackscited by 2

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026Efficient Privacy-Preserving Retrieval Augmented Generation with Distance-Preserving Encryption
  2. 2024RemoteRAG: A Privacy-Preserving LLM Cloud RAG Service
  3. 2026Pointing the Way, Hiding the Destination: Practical Private Dense Retrieval at Scale
  4. 2024Privacy-Preserving Retrieval-Augmented Generation with Differential Privacy
  5. 2026Quantization Enables Private Dense Retrieval against Malicious Service Providers
  6. 2026Security and Privacy in Retrieval-Augmented Generation: Architectures, Threats, Defenses, and Future Directions for Building Trustworthy Systems
  7. 2025Private-RAG: Answering Multiple Queries with LLMs while Keeping Your Data Private
  8. 2026P2RAG: Efficient Privacy-Preserving RAG Service Supporting Arbitrary Top-k Retrieval