$\pi$-RAG: Oblivious Retrieval via Semantic Quantization and Transcendental Addressing for Large Language Models

Aniket Wattamwar; Mrunal Kakirwar

REVIEW 2 major objections 1 minor 13 references

π-RAG inserts a transcendental layer using digits of π to keep LLMs oblivious to private retrieval data.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.3

2026-06-26 11:41 UTC pith:KHTU2PDY

load-bearing objection π-RAG asserts a mathematical guarantee of oblivious RAG via π-addressing and centroid quantization but provides no equations, proofs, or experiments to support it. the 2 major comments →

arxiv 2606.22153 v1 pith:KHTU2PDY submitted 2026-06-20 cs.CR cs.AIcs.CL

π-RAG: Oblivious Retrieval via Semantic Quantization and Transcendental Addressing for Large Language Models

Aniket Wattamwar , Mrunal Kakirwar This is my paper

classification cs.CR cs.AIcs.CL

keywords oblivious retrievalretrieval-augmented generationsemantic quantizationtranscendental addressingdifferential privacydata securityLLM privacy

verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper proposes π-RAG as an architecture that decouples large language models from direct access to sensitive data during retrieval-augmented generation. It does so by adding a Semantic Quantization Layer that maps inputs to a manifold of Canonical Intent Centroids and then derives a π-key pointer through cryptographic salt. The digits of π supply an immutable source of entropy for this indirection, which the authors claim mathematically guarantees that inference stays oblivious to the underlying records. A sympathetic reader would care because traditional RAG systems risk exposing vector embeddings to inversion, and this method targets privacy needs in regulated domains without altering the core semantic matching step.

Core claim

By replacing direct access to the datastore via the LLM with this transcendental layer, π-RAG mathematically guarantees that the inference remains oblivious to the data. The architecture introduces a Semantic Quantization Layer that projects user inputs onto a pre-computed manifold of Canonical Intent Centroids. These centroids are mapped to deterministic offsets via cryptographic salt to produce a π-key that points to standardized payloads from the actual datastore, unifying deterministic randomness, auditability, and differential privacy.

What carries the argument

The transcendental addressing layer that uses the immutable digits of π as entropy combined with the Semantic Quantization Layer to generate indirection π-keys.

Load-bearing premise

The Semantic Quantization Layer can project arbitrary user inputs onto Canonical Intent Centroids so that the resulting π-key preserves retrieval accuracy while preventing any inversion or leakage to original records.

What would settle it

An adversary who recovers original records or embeddings from a generated π-key alone would demonstrate that the oblivious guarantee fails.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

Share X Bluesky LinkedIn Reddit HN

If this is right

The inference process remains oblivious to the data by design.
The architecture unifies deterministic randomness, auditability, and differential privacy in one retrieval system.
Semantic retrieval accuracy is maintained through centroid mapping while blocking direct data exposure.
The system supports use in high-compliance sectors such as finance and healthcare.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

The same indirection principle could be applied to other generative systems that need to query private stores without direct access.
Pre-computing the centroid manifold once allows the privacy properties to hold across multiple queries without retraining the base model.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Desk Editor's Note

π-RAG asserts a mathematical guarantee of oblivious RAG via π-addressing and centroid quantization but provides no equations, proofs, or experiments to support it.

read the letter

The main point is that this paper claims π-RAG delivers a mathematical guarantee of oblivious inference by using digits of π for an immutable indirection layer and projecting queries onto canonical intent centroids via semantic quantization, then mapping with a cryptographic salt to a π-key pointer. The architecture is meant to keep the LLM from directly accessing sensitive embeddings or records.

The combination of transcendental addressing with deterministic centroid mapping is the new element here. It does flag a real issue with embedding inversion attacks in standard RAG for regulated fields like finance and healthcare, and the goal of adding auditability through fixed offsets is reasonable on the surface.

The soft spot is that the guarantee is simply stated in prose with no formal security model, no definition of the π-key construction, no leakage analysis, and no proof sketch or reduction. The abstract supplies no equations at all, no comparison to existing private information retrieval or oblivious retrieval schemes, and no experimental checks on whether accuracy holds after quantization. The obliviousness property ends up defined by the components themselves rather than shown to hold against an adversary.

This is the sort of conceptual sketch that might interest engineers in compliance-heavy settings who are looking for high-level ideas on privacy-preserving retrieval. It does not show the rigor or evidence needed for a research audience. I would not send it to peer review without the missing formal parts and tests filled in.

Referee Report

2 major / 1 minor

Summary. The paper introduces π-RAG, a novel architecture for oblivious retrieval that decouples LLMs from sensitive data storage. It uses the digits of π as a source of transcendental entropy to create an immutable indirection layer. A Semantic Quantization Layer projects user inputs onto a pre-computed manifold of Canonical Intent Centroids; these are mapped via cryptographic salt to a π-key that serves as a pointer to standardized payloads from the datastore. The architecture is claimed to mathematically guarantee that inference remains oblivious to the data while unifying deterministic randomness, auditability, and differential privacy for high-compliance sectors such as finance and healthcare.

Significance. If a formal security model and proof could be supplied to establish the claimed mathematical guarantee of obliviousness, the result would constitute a significant contribution to privacy-preserving RAG techniques, offering a potential mechanism to mitigate embedding inversion attacks while preserving semantic retrieval in regulated domains.

major comments (2)

[Abstract] Abstract: The assertion that 'π-RAG mathematically guarantees that the inference remains oblivious to the data' is made without any formal security definition, leakage or inversion analysis, security reduction, proof sketch, or equations defining the π-key construction, the salt mapping, or the centroid projection.
[Abstract] Abstract: The obliviousness property is defined entirely in terms of the proposed components (Semantic Quantization Layer, Canonical Intent Centroids, cryptographic salt, π-key) with no external benchmark, independent derivation, or falsifiable test, rendering the guarantee circular and equivalent to the architecture by construction.

minor comments (1)

[Abstract] Abstract: The sentence 'The value π provides immutability, is uneditable and math governs it.' is grammatically awkward and should be revised for clarity and precision.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for their review and for identifying key gaps in the formal presentation of our security claims. We address each major comment below and indicate the revisions we will make to the manuscript.

read point-by-point responses

Referee: [Abstract] Abstract: The assertion that 'π-RAG mathematically guarantees that the inference remains oblivious to the data' is made without any formal security definition, leakage or inversion analysis, security reduction, proof sketch, or equations defining the π-key construction, the salt mapping, or the centroid projection.

Authors: We agree that the abstract asserts a mathematical guarantee without the supporting formal elements. The current manuscript does not contain security definitions, leakage analysis, reductions, or explicit equations for the π-key, salt mapping, or centroid projection. In the revised version we will qualify or remove the strong claim from the abstract and add a dedicated security section that supplies these definitions, equations, and a proof sketch under standard cryptographic assumptions. revision: yes
Referee: [Abstract] Abstract: The obliviousness property is defined entirely in terms of the proposed components (Semantic Quantization Layer, Canonical Intent Centroids, cryptographic salt, π-key) with no external benchmark, independent derivation, or falsifiable test, rendering the guarantee circular and equivalent to the architecture by construction.

Authors: The referee correctly notes that the present wording risks making the obliviousness claim circular. We will revise the abstract, introduction, and evaluation sections to reference external benchmarks from the differential privacy and embedding-inversion literature, include independent falsifiable tests, and explicitly separate the architectural description from the claimed security properties. revision: yes

Circularity Check

1 steps flagged

Obliviousness guarantee is self-definitional with the proposed architecture

specific steps

self definitional [Abstract]
"By replacing direct access to the datastore via LLM with this transcendental layer, π-RAG mathematically guarantees that the inference remains oblivious to the data."

The transcendental layer is defined as the indirection mechanism that decouples LLM from data (via π-digits, centroids, and π-key), and the 'mathematical guarantee' of obliviousness is then claimed as its consequence. The guarantee is therefore equivalent to the definition of the layer itself, with no separate derivation or external property invoked.

full rationale

The paper asserts that its architecture 'mathematically guarantees' oblivious inference, but this property is introduced and defined precisely through the components (transcendental layer, semantic quantization to centroids, π-key via salt) that are said to produce it. No equations, security model, or independent derivation appear; the claim therefore reduces directly to the architecture's own definition by construction. This matches the self-definitional pattern with no external benchmark or reduction shown.

Axiom & Free-Parameter Ledger

2 free parameters · 2 axioms · 3 invented entities

Ledger entries are extracted solely from the abstract because the full manuscript text was not available for review.

free parameters (2)

cryptographic salt
Used to produce deterministic offsets from centroids; no value or generation method is specified.
Canonical Intent Centroids manifold
Pre-computed set of intent points; construction, dimensionality, and coverage are not described.

axioms (2)

ad hoc to paper The digits of π supply immutable transcendental entropy that cannot be edited or inverted.
Invoked as the source of the indirection layer between LLM and datastore.
domain assumption Projection onto Canonical Intent Centroids preserves sufficient semantic information for accurate retrieval.
Required for the quantization step to replace direct vector similarity without loss of function.

invented entities (3)

π-key no independent evidence
purpose: Deterministic pointer to standardized payload in the datastore
New addressing token created from centroid plus salt plus π digits.
Semantic Quantization Layer no independent evidence
purpose: Maps inputs to the manifold of Canonical Intent Centroids
New architectural component introduced to enable the indirection.
Canonical Intent Centroids no independent evidence
purpose: Fixed reference points for semantic quantization
Pre-computed entities that replace raw embeddings.

pith-pipeline@v0.9.1-grok · 5744 in / 1778 out tokens · 19587 ms · 2026-06-26T11:41:07.555154+00:00 · methodology

0 comments

Cite this review

Pith. "Pith review of $\pi$-RAG: Oblivious Retrieval via Semantic Quantization and Transcendental Addressing for Large Language Models." pith.science (2026). https://pith.science/paper/KHTU2PDY

@misc{pith2026260622153,
  author       = {Pith},
  title        = {Pith review of: $\pi$-RAG: Oblivious Retrieval via Semantic Quantization and Transcendental Addressing for Large Language Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/KHTU2PDY}},
  note         = {Machine review of arXiv:2606.22153}
}

Share X Bluesky LinkedIn Reddit HN

read the original abstract

This paper introduces $\pi$-RAG, a novel architecture for oblivious retrieval that decouples Large Language Models (LLMs) from sensitive data storage without sacrificing semantic understanding. Traditional Retrieval-Augmented Generation (RAG) architectures expose raw vector embeddings to potential inversion attacks and nondeterministic retrieval failures. To address this, we utilize the digits of $\pi$ as a source of transcendental entropy, creating an immutable indirection layer between the LLM and private records. The value $\pi$ provides immutability, is uneditable and math governs it. The architecture also introduces a Semantic Quantization Layer. This layer projects user inputs onto a pre-computed manifold of Canonical Intent Centroids. RAG performs vector cosine similarity but here it maps the centroids to deterministic offsets via cryptographic salt. The resulting $\pi$-key is a pointer to standardized payload from the actual datastore. By replacing direct access to the datastore via LLM with this transcendental layer, $\pi$-RAG mathematically guarantees that the inference remains oblivious to the data. This architecture unifies deterministic randomness, auditability, and differential privacy, demonstrating high efficacy for high-compliance sectors such as finance and healthcare.

Figures

Figures reproduced from arXiv: 2606.22153 by Aniket Wattamwar, Mrunal Kakirwar.

**Figure 1.** Figure 1: The π-RAG Split-Brain Architecture. The system is architecturally divided into two isolated zones. Zone A (Untrusted) handles semantic reasoning and intent classification using the LLM, but possesses zero access to the data. Zone B (Trusted) handles data retrieval and execution but possesses no semantic intelligence. The only communication between zones is the transmission of an opaque, immutable π-Key … view at source ↗

**Figure 2.** Figure 2: using Gemma 3:1b [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗

**Figure 3.** Figure 3: using Gemma3n:e4b Once the intents are categorized our next step is creating the πkeys based on the method introduced [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗

discussion (0)

Reference graph

Works this paper leans on

13 extracted references · 8 canonical work pages · 1 internal anchor

[1]

Proceedings of the Machine Learning Research (MLR) , year =

Deduplication of Data for Privacy , author =. Proceedings of the Machine Learning Research (MLR) , year =
[2]

Proceedings of the USENIX Security Symposium , year =

Extracting Training Data from Large Language Models , author =. Proceedings of the USENIX Security Symposium , year =
[3]

Unveiling Privacy Risks in

Unveiling Privacy Risks in LLM Agent Memory , author =. Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , year =. doi:10.18653/v1/2025.acl-long.1227 , url =

work page doi:10.18653/v1/2025.acl-long.1227 2025
[4]

arXiv preprint arXiv:2110.06500 , year =

Differentially Private Fine-Tuning of Language Models , author =. arXiv preprint arXiv:2110.06500 , year =

work page arXiv
[5]

Proceedings of the ACM Conference , year =

Information Leakage in Embedding Models , author =. Proceedings of the ACM Conference , year =
[6]

arXiv preprint arXiv:2503.15548

Privacy-Aware RAG: Secure and Isolated Knowledge Retrieval , author =. arXiv preprint arXiv:2503.15548 , year =

work page arXiv
[7]

arXiv preprint arXiv:2510.20296 , year =

RAG-Stack: Co-Optimizing RAG Quality and Performance , author =. arXiv preprint arXiv:2510.20296 , year =

work page arXiv
[8]

arXiv preprint arXiv:2402.18649 , year =

A New Era in LLM Security: Exploring Security Concerns in Real-World LLM-based Systems , author =. arXiv preprint arXiv:2402.18649 , year =

work page arXiv
[9]

arXiv preprint arXiv:2505.17145 , year =

LLM Access Shield: Domain-Specific LLM Framework for Privacy Policy Compliance , author =. arXiv preprint arXiv:2505.17145 , year =

work page arXiv
[10]

IEEE Journal on Selected Areas in Communications , year =

Exploring LLM-based multi-agent situation awareness for zero-trust space-air-ground integrated network , author =. IEEE Journal on Selected Areas in Communications , year =
[11]

arXiv preprint arXiv:2509.25072 , year =

Optimizing Privacy-Preserving Primitives to Support LLM-Scale Applications , author =. arXiv preprint arXiv:2509.25072 , year =

work page arXiv
[12]

Advances in Neural Information Processing Systems , volume =

Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks , author =. Advances in Neural Information Processing Systems , volume =
[13]

Gemma 3 Technical Report

Gemma 3 Technical Report , author =. arXiv preprint arXiv:2503.19786 , year =

work page internal anchor Pith review Pith/arXiv arXiv

[1] [1]

Proceedings of the Machine Learning Research (MLR) , year =

Deduplication of Data for Privacy , author =. Proceedings of the Machine Learning Research (MLR) , year =

[2] [2]

Proceedings of the USENIX Security Symposium , year =

Extracting Training Data from Large Language Models , author =. Proceedings of the USENIX Security Symposium , year =

[3] [3]

Unveiling Privacy Risks in

Unveiling Privacy Risks in LLM Agent Memory , author =. Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , year =. doi:10.18653/v1/2025.acl-long.1227 , url =

work page doi:10.18653/v1/2025.acl-long.1227 2025

[4] [4]

arXiv preprint arXiv:2110.06500 , year =

Differentially Private Fine-Tuning of Language Models , author =. arXiv preprint arXiv:2110.06500 , year =

work page arXiv

[5] [5]

Proceedings of the ACM Conference , year =

Information Leakage in Embedding Models , author =. Proceedings of the ACM Conference , year =

[6] [6]

arXiv preprint arXiv:2503.15548

Privacy-Aware RAG: Secure and Isolated Knowledge Retrieval , author =. arXiv preprint arXiv:2503.15548 , year =

work page arXiv

[7] [7]

arXiv preprint arXiv:2510.20296 , year =

RAG-Stack: Co-Optimizing RAG Quality and Performance , author =. arXiv preprint arXiv:2510.20296 , year =

work page arXiv

[8] [8]

arXiv preprint arXiv:2402.18649 , year =

A New Era in LLM Security: Exploring Security Concerns in Real-World LLM-based Systems , author =. arXiv preprint arXiv:2402.18649 , year =

work page arXiv

[9] [9]

arXiv preprint arXiv:2505.17145 , year =

LLM Access Shield: Domain-Specific LLM Framework for Privacy Policy Compliance , author =. arXiv preprint arXiv:2505.17145 , year =

work page arXiv

[10] [10]

IEEE Journal on Selected Areas in Communications , year =

Exploring LLM-based multi-agent situation awareness for zero-trust space-air-ground integrated network , author =. IEEE Journal on Selected Areas in Communications , year =

[11] [11]

arXiv preprint arXiv:2509.25072 , year =

Optimizing Privacy-Preserving Primitives to Support LLM-Scale Applications , author =. arXiv preprint arXiv:2509.25072 , year =

work page arXiv

[12] [12]

Advances in Neural Information Processing Systems , volume =

Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks , author =. Advances in Neural Information Processing Systems , volume =

[13] [13]

Gemma 3 Technical Report

Gemma 3 Technical Report , author =. arXiv preprint arXiv:2503.19786 , year =

work page internal anchor Pith review Pith/arXiv arXiv