GoldenRetriever: Non-Interactive Homomorphic Encrypted Retrieval for Privacy-Preserving RAG

Dongdong Wang; Gang Quan; Liqiang Wang; Qian Lou; Scott Piersall; Yang Gao

REVIEW 3 major objections 3 minor 9 references

A threshold-based homomorphic retrieval scheme achieves non-interactive private RAG with exact document recovery.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-03 15:14 UTC pith:VCOOGRUD

load-bearing objection Threshold-based encrypted retrieval is a real idea, but the paper's accuracy guarantee only works for well-separated scores, and the evaluation never tests the transition band where it breaks. the 3 major comments →

arxiv 2607.29019 v1 pith:VCOOGRUD submitted 2026-07-31 cs.CR cs.CLcs.IR

GoldenRetriever: Non-Interactive Homomorphic Encrypted Retrieval for Privacy-Preserving RAG

Yang Gao , Gang Quan , Scott Piersall , Qian Lou , Dongdong Wang , Liqiang Wang This is my paper

classification cs.CR cs.CLcs.IR

keywords homomorphic encryptionretrieval-augmented generationthreshold selectionCKKSmask polarizationprivacy-preserving retrievalnon-interactive retrievaltoken reconstruction

verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper establishes that privacy-preserving retrieval for RAG does not need encrypted top-k ranking. It replaces ranking with a threshold test on similarity scores, evaluated homomorphically via a polynomial indicator, and then applies a degree-7 'polarization' polynomial that contracts CKKS approximation errors so the encrypted selection mask behaves as a true 0/1 decision. This makes it possible for the retrieval server to return a fully masked document matrix from which the LLM server recovers the selected tokens exactly, without ever revealing the query, scores, or selected indices. Experiments on standard retrieval benchmarks show recall and token accuracy identical to plaintext baselines at roughly one-sixteenth the latency of ranking-based encrypted retrieval.

Core claim

The central claim is that threshold-based selection, not ranking, is the right abstraction for homomorphic retrieval in RAG. By evaluating a polynomial indicator on encrypted similarity scores, the server selects documents whose score exceeds τ; a dedicated degree-7 polynomial f(x)=35x^4−84x^5+70x^6−20x^7, flat to third order at 0 and 1, then contracts the mask error from about 0.02 to below 8.3×10^-7, which is enough to reconstruct token IDs exactly after rounding. The result is a non-interactive protocol with O(B(D+T)) complexity in which query content, intermediate scores, and selected indices stay hidden from the retrieval server.

What carries the argument

The key mechanism is the mask-polarization polynomial f(x)=35x^4−84x^5+70x^6−20x^7, derived from eight boundary constraints (f and its first three derivatives vanish at 0 and are pinned at 1). Taylor analysis shows it maps an approximate mask b+ε to b+O(ε^4), reducing typical deviations from δ≈0.02 to δ^4≈1.6×10^-7, below the 0.5/V tolerance required for correct rounding of token IDs. It turns the approximate, noisy output of a CKKS indicator into a decisively binary selection, enabling exact encrypted token extraction.

Load-bearing premise

The load-bearing premise is that every similarity score that matters is either comfortably above or comfortably below the threshold, so the encrypted indicator output is unambiguously near 0 or near 1; if a real score lands in the transition band near the threshold, the polarization polynomial cannot decide it and token reconstruction breaks.

What would settle it

Run the pipeline on a query-document pair whose embedding similarity is deliberately set equal to the threshold τ (or within the indicator's transition band). If the recovered mask value stays near 0.5 after polarization, the token sequence will not reconstruct to either the original document or zero, demonstrating that the discrete-recovery guarantee fails for near-threshold scores.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

Replacing top-k ranking with threshold selection reduces encrypted retrieval cost to O(B(D+T)), i.e., linear in the number of documents.
The retrieval server can hide the query, all intermediate similarity scores, and which documents are selected, while returning a full masked matrix that prevents access-pattern leakage.
Because the polarization construction is parametric, it can be scaled to larger vocabularies by increasing polynomial degree, at the cost of more multiplicative depth.
The method keeps retrieval quality (recall and token accuracy) at plaintext levels in the evaluated settings, while cutting latency from over 16,500 seconds to about 1,050 seconds per query.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

The approach's practicality hinges on the threshold τ being chosen so that no real query-document similarity lands in the indicator's transition band; in un-curated corpora, scores near τ would make the mask ambiguous and token recovery fail. This is a testable limitation the paper does not address.
The polynomial contraction makes the method robust to small approximation noise, but it cannot fix a mask that starts near 0.5; extending the method to handle near-threshold scores would require a different construction, e.g., a wider polarization plateau or an explicit handling of the transition zone.
A natural next step is to adapt the same threshold-selection idea to other approximate homomorphic schemes or to use batching to amortize the token-extraction cost, which currently dominates latency.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Desk Editor's Note

Threshold-based encrypted retrieval is a real idea, but the paper's accuracy guarantee only works for well-separated scores, and the evaluation never tests the transition band where it breaks.

read the letter

Quick take: the core idea is sound and worth a look — replace homomorphic top-k with threshold selection and clean up the mask with a degree-7 polarization polynomial. The latency reduction from ~16.5k to ~1k seconds is real in their setup, and the complexity argument O(B(D+T)) is straightforward. But the evaluation is constructed so that the hard cases never happen, and the correctness proof does not cover documents whose similarity lands near the threshold. As written, the 'accurate recovery' claim only holds for contrived candidate sets.

What's genuinely good: the design is clean. Using Mazzone et al.'s polynomial indicator under CKKS, combining it with a Hermite-type polynomial that has flat derivatives at 0 and 1, and returning the full masked matrix to hide access patterns are all sensible engineering choices. The derivation of the degree-7 polynomial is self-contained, and the error contraction analysis is at least plausible for the regime it considers.

Now the soft spots, in proportion. First, the evaluation. Every query has exactly two well-separated positive documents, with negatives sampled from other queries and apparently far below the threshold. That makes recall and token accuracy essentially guaranteed by construction. The comparison to plaintext and to ranking-based HE is trivial when there is no realistic score distribution. 'Competitive retrieval effectiveness' is not demonstrated; it's just not falsified.

Second — and this is the load-bearing issue — the token-recovery guarantee breaks for scores in the indicator's transition band. Section 4.4 assumes m = b + epsilon with b in {0,1} and small epsilon. But the polynomial indicator has a nonzero transition region: for s near tau, m is intermediate, e.g., ~0.5. The polarization polynomial satisfies f(0.5)=0.5 and is flat only at 0 and 1, so it does not push an intermediate mask toward either binary value. Then the masked token is off by ~0.5x, violating Eq. (8). This is not a marginal numerical inconvenience; it is a correctness failure for the boundary documents that real retrieval systems have to handle. The paper never tests scores near tau; Section 6.5 carefully picks thresholds that avoid them. That gap needs to be acknowledged, or the claim needs to be restricted.

Minor items: Eq. (9) has a factor-of-10 arithmetic slip (0.5/60,000 is 8.33e-6, not 8.33e-7) — because the error is conservative, it doesn't break anything, but it shows sloppiness. No code, no CKKS parameters, no dataset subset details, so reproducibility is low. And Figure 1 still has a leftover 'PIR' label that doesn't match the text.

Practicality: 1051 seconds per query for 100 documents (and 4361s for 1000) is not practical by any real-world standard, though it is an improvement over top-k HE. That should be stated more honestly.

Bottom line: the paper deserves a serious referee. The core pipeline is plausible and the complexity reduction is real, but the central correctness claim is unsupported for realistic score distributions. A good reviewer could push for a realistic evaluation and an explicit treatment of the transition band. As it stands, I'd lean reject with major-revision potential.

Referee Report

3 major / 3 minor

Summary. The paper proposes GoldenRetriever, a non-interactive encrypted retrieval framework for RAG based on threshold selection under CKKS homomorphic encryption. Documents are selected if their encrypted cosine similarity to an encrypted query exceeds a public threshold; the selection mask is produced by a polynomial indicator and then 'polarized' by a degree-7 polynomial so that masked token values can be decrypted and rounded to integers. The authors claim that this pipeline achieves linear O(B(D+T)) complexity, competitive retrieval effectiveness, and accurate token/document reconstruction, and they report experiments on constructed candidate sets showing identical recall/token accuracy to plaintext and ranking-based HE baselines with substantially lower latency. The core technical claims are that Eq. (8) can be satisfied by the polarization polynomial and that threshold-based selection is a practical substitute for top-k retrieval under encryption.

Significance. If the central claims held, the paper would be a useful step toward practical privacy-preserving RAG: it offers a concrete non-interactive design, a clear complexity advantage over homomorphic ranking, and a thoughtful treatment of the approximate-to-discrete gap. The polynomial polarization idea is interesting and the complexity analysis is sensible. However, the two load-bearing correctness arguments are not sound as written: the Taylor bound in Section 4.4 ignores the leading constant and the method fails for scores in the indicator transition band, which the evaluation deliberately avoids. The experimental protocol is too contrived to support the 'competitive retrieval effectiveness' claim. These are not local presentation issues; they undermine the paper's central guarantees.

major comments (3)

[§4.4, Eqs. (15)–(17)] The error-contraction analysis drops the coefficient of the leading term. For f(x)=35x^4−84x^5+70x^6−20x^7, one has f^(4)(0)=840 and f^(4)(1)=−840, so |f(b+ε)−b| ≈ 35ε^4. With the claimed δ≈0.02 this gives 35·(0.02)^4 = 5.6×10^−6, which exceeds the required tolerance 0.5/60,000 = 8.33×10^−7 by a factor of about 6.7. Thus even under the paper's own assumption that m=b+ε with b∈{0,1}, the degree-7 polynomial does not meet the Eq. (8)/(18) precision requirement. The statement that 'δ^4 ≈ 1.6×10^−7 satisfies the required tolerance' is incorrect; the missing constant is load-bearing.
[§4.4, Eq. (14); §6.5, Tables 1 and 3] The analysis only considers perturbations around b=0 or b=1, but the polynomial indicator has a transition band around the threshold. For a document whose similarity is near τ, the mask m is intermediate, e.g., m≈0.5, and since f(0.5)=0.5 with flat derivatives only at 0 and 1, the polarized mask remains near 0.5. Then |f(m)−b|≈0.5 for either b, and the masked token x̂=m·x is off by roughly 0.5x, violating Eq. (8) for any nonzero token. This is not a small numerical issue: boundary documents are unavoidable in un-curated corpora. The experiments sidestep the problem by constructing candidate sets with exactly two well-separated positives and by using thresholds (0.2, 0.5, 0.7) for which no reported score falls in the transition region. No experiment measures token accuracy or recall for scores at τ±δ, so the paper's central guarantee of accurate reconstruction for arbitrary queries is uns
[§6.1–§6.2, Table 1] The evaluation is not sufficient to support 'competitive retrieval effectiveness.' Each candidate set contains exactly two relevant documents, and threshold selection with avg. 2 selected documents trivially yields recall 1.0. This construction gives no information about precision–recall trade-offs, score distributions, or behavior when negatives have similarity scores close to the threshold—the regime where threshold-based selection is most fragile. The ranking-based HE baseline is also not described (algorithm, top-k method, parameters), making the 16× latency comparison hard to interpret. A realistic evaluation on un-curated score distributions, with multiple positives per query and boundary cases, is needed before the retrieval-effectiveness claim can be accepted.

minor comments (3)

[Figure 1] The figure includes a 'PIR' label, but the paper does not use private information retrieval; this appears to be a leftover and should be removed or explained.
[§5.1 vs Table 1] Section 5.1 states 'end-to-end latency for B=20 documents is on the order of 10^3 seconds,' while Table 1 reports 1051.8 s for B=100. Please clarify the discrepancy.
[§4.3] The indicator function from Mazzone et al. is cited but its approximation error, transition width, and cost are not specified. Since the polarization argument depends on a concrete bound δ, the manuscript should state the measured or guaranteed δ and how it relates to the indicator degree.

Circularity Check

0 steps flagged

No significant circularity: the polarization polynomial is derived in-paper from boundary constraints, and no predictive claim reduces by construction to its inputs.

full rationale

The paper's central derivation chain is self-contained. The degree-7 polarization polynomial in Eq. (14) is obtained by solving a stated linear system with eight boundary constraints (Eqs. 10–13); it has no free parameters fitted to the token-recovery outcome. The indicator construction is adopted from an external work (Mazzone et al., 2025), not from the authors' own prior results, so there is no self-citation chain. The empirical value δ ≈ 0.02 is used to justify that the degree-7 polynomial contracts error sufficiently (Eqs. 15–17); this is a calibration/verification step, not a definitional reduction, because the polynomial itself is not fitted to the reported token accuracy. The main weaknesses—the unaddressed transition band for scores near τ, the reliance on a controlled candidate-set evaluation, and the absence of external benchmarks for the indicator error—are correctness and robustness gaps, not circularity. No quoted equation reduces to its inputs by construction, and no load-bearing claim is imported solely from the authors' prior work. Therefore the circularity score is 0.

Axiom & Free-Parameter Ledger

5 free parameters · 6 axioms · 0 invented entities

The central derivation rests on standard crypto assumptions plus one empirical constant (delta~0.02) that is measured, not guaranteed; the missing CKKS parameters are a reproducibility issue rather than a circularity issue.

free parameters (5)

threshold tau = 0.5 (default; 0.2/0.7 in sensitivity experiments)
Selection threshold; controls the number of retrieved documents (Section 6.5). Chosen by the system designer, not fitted on a held-out set, but the evaluation shows the choice materially changes recall (tau=0.7 leads to recall 0.5).
empirical mask deviation delta = ~0.02
Measured mask error used in Section 4.4 to justify the degree-7 polarization polynomial; not derived from CKKS parameters and no error bounds are given for this estimate.
vocabulary size V = 60,000
Assumed token-ID upper bound for the precision requirement (Eq. 9); not tied to the actual embedding tokenizer used in the experiments.
CKKS parameter set (ring degree, scale, level budget) = not disclosed
Determines the actual noise/error delta of the scheme; absent from the paper, so the error analysis is not reproducible.
token length T = not specified
Fixed-length token sequences per document; the value is required for the O(BT) cost and for reconstruction, but is never reported.

axioms (6)

standard math CKKS is IND-CPA semantically secure
Query confidentiality (Section 5.2) rests on the semantic security of CKKS.
domain assumption Retrieval server is honest-but-curious
Threat model (Section 3); excludes malicious servers, side-channel attacks, and decryption-oracle attacks on CKKS.
domain assumption The Mazzone et al. indicator function approximates the threshold indicator with bounded error delta<=0.02
The threshold indicator (Section 4.3) is 'adopted' from a cited paper; the error bound is an empirical observation on the authors' system, not a proven property.
domain assumption Similarity scores of relevant documents are separated from the threshold tau
Accurate token recovery requires the mask to be near 0 or 1; documents whose scores are in the indicator transition band produce intermediate masks that the polarization polynomial cannot resolve (Section 4.4, Eq. 14).
standard math Cosine similarity equals dot product for unit-normalized embeddings
Used in Eq. (2); standard for normalized embeddings.
domain assumption Same-row alignment between the embedding matrix D and token matrix X
Masking consistency in Section 4.5 depends on row i of D and row i of X representing the same document.

pith-pipeline@v1.3.0-daily-deepseek · 8930 in / 25880 out tokens · 265901 ms · 2026-08-03T15:14:40.133352+00:00 · methodology

0 comments

read the original abstract

Retrieval-Augmented Generation (RAG) enhances large language models by incorporating external knowledge, but existing pipelines typically operate on plaintext data, raising significant privacy concerns. Prior work on privacy-preserving retrieval leverages cryptographic techniques such as homomorphic encryption (HE) and private information retrieval (PIR), but often relies on interactive protocols or ranking-based selection mechanisms that incur high latency and potential information leakage. In this paper, we propose a practical non-interactive encrypted retrieval framework for RAG based on threshold selection. Instead of performing expensive top-$k$ ranking under encryption, our approach selects documents whose similarity scores exceed a predefined threshold, reducing computational complexity from quadratic to linear in the corpus size. We implement this design using CKKS-based homomorphic computation, enabling fully encrypted similarity evaluation and document selection without revealing query content, intermediate scores, or selected indices. To bridge the gap between approximate encrypted computation and discrete token reconstruction, we introduce a precision-stable mask polarization method that ensures accurate recovery of selected documents. Experiments on standard retrieval benchmarks demonstrate that our approach achieves competitive retrieval effectiveness while significantly reducing latency compared to ranking-based encrypted methods. These results highlight threshold-based selection as a practical foundation for scalable and secure RAG systems.

Figures

Figures reproduced from arXiv: 2607.29019 by Dongdong Wang, Gang Quan, Liqiang Wang, Qian Lou, Scott Piersall, Yang Gao.

discussion (0)

Reference graph

Works this paper leans on

9 extracted references · 1 linked inside Pith

[1]

34th USENIX Security Symposium (USENIX Security 25) , pages=

Efficient Ranking, Order Statistics, and Sorting under CKKS , author=. 34th USENIX Security Symposium (USENIX Security 25) , pages=
[2]

R emote RAG : A Privacy-Preserving LLM Cloud RAG Service

Cheng, Yihang and Zhang, Lan and Wang, Junyang and Yuan, Mu and Yao, Yunhao. R emote RAG : A Privacy-Preserving LLM Cloud RAG Service. Findings of the Association for Computational Linguistics: ACL 2025. 2025. doi:10.18653/v1/2025.findings-acl.197

doi:10.18653/v1/2025.findings-acl.197 2025
[3]

Amina Bassit and Vishnu Boddeti , booktitle=. Secure. 2025 , url=

2025
[4]

arXiv preprint arXiv:2509.01088 , year=

Privacy-Preserving Reasoning with Knowledge-Distilled Parametric Retrieval Augmented Generation , author=. arXiv preprint arXiv:2509.01088 , year=

arXiv
[5]

2025 3rd International Conference on Foundation and Large Language Models (FLLM) , pages=

Efficient Privacy-Preserving Retrieval Augmented Generation with Distance-Preserving Encryption , author=. 2025 3rd International Conference on Foundation and Large Language Models (FLLM) , pages=. 2025 , organization=

2025
[6]

arXiv preprint arXiv:2603.14778 , year=

p2RAG: Privacy-Preserving RAG Service Supporting Arbitrary Top- k Retrieval , author=. arXiv preprint arXiv:2603.14778 , year=

Pith/arXiv arXiv
[7]

Journal of the ACM (JACM) , volume=

Private information retrieval , author=. Journal of the ACM (JACM) , volume=. 1998 , publisher=

1998
[8]

Proceedings of the forty-first annual ACM symposium on Theory of computing , pages=

Fully homomorphic encryption using ideal lattices , author=. Proceedings of the forty-first annual ACM symposium on Theory of computing , pages=
[9]

International conference on the theory and application of cryptology and information security , pages=

Homomorphic encryption for arithmetic of approximate numbers , author=. International conference on the theory and application of cryptology and information security , pages=. 2017 , organization=

2017

[1] [1]

34th USENIX Security Symposium (USENIX Security 25) , pages=

Efficient Ranking, Order Statistics, and Sorting under CKKS , author=. 34th USENIX Security Symposium (USENIX Security 25) , pages=

[2] [2]

R emote RAG : A Privacy-Preserving LLM Cloud RAG Service

Cheng, Yihang and Zhang, Lan and Wang, Junyang and Yuan, Mu and Yao, Yunhao. R emote RAG : A Privacy-Preserving LLM Cloud RAG Service. Findings of the Association for Computational Linguistics: ACL 2025. 2025. doi:10.18653/v1/2025.findings-acl.197

doi:10.18653/v1/2025.findings-acl.197 2025

[3] [3]

Amina Bassit and Vishnu Boddeti , booktitle=. Secure. 2025 , url=

2025

[4] [4]

arXiv preprint arXiv:2509.01088 , year=

Privacy-Preserving Reasoning with Knowledge-Distilled Parametric Retrieval Augmented Generation , author=. arXiv preprint arXiv:2509.01088 , year=

arXiv

[5] [5]

2025 3rd International Conference on Foundation and Large Language Models (FLLM) , pages=

Efficient Privacy-Preserving Retrieval Augmented Generation with Distance-Preserving Encryption , author=. 2025 3rd International Conference on Foundation and Large Language Models (FLLM) , pages=. 2025 , organization=

2025

[6] [6]

arXiv preprint arXiv:2603.14778 , year=

p2RAG: Privacy-Preserving RAG Service Supporting Arbitrary Top- k Retrieval , author=. arXiv preprint arXiv:2603.14778 , year=

Pith/arXiv arXiv

[7] [7]

Journal of the ACM (JACM) , volume=

Private information retrieval , author=. Journal of the ACM (JACM) , volume=. 1998 , publisher=

1998

[8] [8]

Proceedings of the forty-first annual ACM symposium on Theory of computing , pages=

Fully homomorphic encryption using ideal lattices , author=. Proceedings of the forty-first annual ACM symposium on Theory of computing , pages=

[9] [9]

International conference on the theory and application of cryptology and information security , pages=

Homomorphic encryption for arithmetic of approximate numbers , author=. International conference on the theory and application of cryptology and information security , pages=. 2017 , organization=

2017