Hybrid privacy-aware semantic search: SVD-truncated document geometry and CKKS-encrypted query reranking under a restricted threat model Sergey M. Kurilenko
arXiv:2606.26373v1 [cs.CR] 24 Jun 2026
Moscow Institute of Physics and Technology [email protected]
June 26, 2026
Abstract Dense vector embeddings underpin modern semantic search and Retrieval-Augmented Generation (RAG), yet a growing body of work shows that an embedding can be inverted back into the text that produced it with alarming fidelity: once a vector database leaks, the documents behind it leak with it. The two textbook defences lie at opposite extremes—encrypting the entire search with fully homomorphic encryption is cryptographically sound but far too slow for corpora of millions of documents, whereas injecting privacy-preserving noise degrades ranking quality long before it provides meaningful protection. We study a middle path built on an asymmetry between the static document collection and the dynamic user query. The collection is protected geometrically: every document vector is compressed onto a lower-dimensional subspace and then rotated by a secret orthogonal transformation held only by the data owner. The query is protected cryptographically: it is processed under homomorphic encryption so that the server—which honestly follows the protocol but may inspect everything it stores—never observes the query values or the similarity scores it computes. The encryption parameters are fixed by a small, reproducible offline benchmark over the discrete CKKS grid rather than by manual trial and error. Beyond the construction itself, we contribute mathematically proven theoretical results: we derive a tight lower bound on the reconstruction error of any attacker confined to the protected subspace, making precise how much information the geometric projection provably removes. Large-scale experiments on a one-million-document corpus and five contemporary text encoders corroborate the empirical side—the protection preserves retrieval quality and, on the strongest encoders, even slightly improves it by acting as a linear denoiser; query latency stays comfortably below one second; and an off-the-shelf text-reconstruction attack confined to the protected space collapses to the noise floor. We then deliberately step outside that comfortable regime and measure what happens against stronger adversaries: a knownplaintext attacker recovers the secret rotation by orthogonal Procrustes from roughly as many leaked pairs as the retained dimension, the public product-quantization codes preserve most nearest-neighbour structure, and a calibrated-noise and random-projection baseline suite positions the trade-off against natural alternatives; a BEIR check shows the truncation is an encoder-dependent accuracy cost rather than a free denoiser on graded-relevance tasks. We therefore state the boundaries plainly: query confidentiality is cryptographic, but document protection rests on SVD truncation and a secret rotation that are an empirical obfuscation layer—not a cryptographic primitive—and we delimit precisely the threat model under which each claim holds.
Keywords: homomorphic encryption, CKKS, privacy-preserving information retrieval, semantic search, embedding inversion, non-adaptive attacker, restricted threat model, SVD truncation, product quantization, retrieval-augmented generation.
1
1
Introduction
The privacy of vector representations of text—“embeddings”—has become a first-class concern in production retrieval systems. State-of-the-art encoders (Sentence-BERT [1], multilingual-E5 [2], GTR [3], BGE-M3 [4]) push the per-document representation through a ∼ 102 -dimensional bottleneck that nevertheless preserves enough information to reconstruct the original text with high BLEU. Vec2Text [7] reports BLEU ≈ 97.3% on 32-token inputs when the attacker has query access to the encoder; GEIA [8] and TEIA [9] show that even snapshot attacks (an adversary with read access to the vector database) recover personally identifiable information at high rates. For Retrieval-Augmented Generation pipelines whose vector stores typically contain customer support tickets, internal corporate documents and personal data, this rule of thumb—“a leak of the embedding is a leak of the text”—is now well documented [14]. The defensive landscape is bracketed by two extremes that, individually, do not satisfy industrial requirements. Differential privacy [18, 19] adds calibrated noise per-record but, in the naive coordinate-Gaussian formulation on retrieval-quality embeddings, destroys ranking quality long before the privacy budget reaches a level considered useful. Fully homomorphic encryption [23, 28] allows arbitrary computation on ciphertexts, but the ciphertext-ciphertext (ct-ct) regime is too expensive for top-k search across 106 documents. Nature and positioning of this work. This is a scientific study, not a systems-engineering paper. SVD truncation, random orthogonal rotation, product quantisation and CKKS are individually well known; we do not claim a new system or a deployable product. The research questions are: (RQ1) what does projection provably remove—is there a formal lower bound on what any projection-restricted decoder can reconstruct? (RQ2) how do SVD truncation and an unknown secret rotation jointly reshape the privacy–accuracy–latency trade-off of semantic search at 106 -document scale? (RQ3) does data-driven SVD truncation behave as a destructive lossy step, or—as we find—as a linear denoiser for retrieval-trained encoders? Accordingly, the secret rotation is studied as an empirical obfuscation phenomenon, not proposed as a cryptographic primitive, and the formal lemma is a projection bound, not an inversion-security theorem. Object of study and scientific contribution. The object we analyse is an asymmetric hybrid construction (described below); the contribution is its theoretical and empirical characterisation under a credible—but explicitly restricted—threat model, not its engineering realisation: • For the static side (the database), we apply a deterministic SVD truncation Vk with k = d/2, immediately followed by a Haar-uniform secret orthogonal rotation R ∈ O(k). The truncation is chosen so that the proxy criterion σrec ≥ 0.10 (Section 6) is met uniformly for all tested encoders; the rotation hides the orientation of the basis from any attacker that does not know R. We then publish a Product-Quantisation artefact (codebook + per-document PQ codes), trained in the rotated space, so that stage-1 candidate filtering can be performed locally by the client without sending the query to the server. • For the dynamic side (the query), we apply CKKS encryption. The protocol is engineered so that the server-side reranking over the short-list of Kcands candidates only needs the ciphertextplaintext (ct-pt) mode—the costly relinearisation step specific to ct-ct multiplication is avoided—bringing the cryptographic budget for one query well below one second. • The CKKS parameters (Npoly , log2 Q, dproj , ∆) are fixed by a small, reproducible offline micro-benchmark over the discrete parameter grid (Section 5): we keep the minimum-latency configuration that satisfies the conservative security tables and an accuracy tolerance. The selected configuration (Npoly = 8192, [60, 40, 60], ∆ = 240 ) yields a ≈ 1.7× speed-up over the TenSEAL stock setting [60, 40, 40, 60] at the same parameter-table security bound. This is a deterministic engineering choice over a published grid; we make no machine-learning claim. 2
Notation. To avoid the overloading of the symbol N , we use Npoly for the CKKS polynomialmodulus degree, Ndocs for the corpus size, and Kcands for the stage-1 short-list length throughout. Theorem and an empirical link. We prove a tight lower bound on the L2 reconstruction error of any decoder whose image is constrained to span(Vk ) (Lemma 1). The bound makes σrec a meaningful proxy of the difficulty an inverter faces; its empirical relation to the BLEU of an off-the-shelf Vec2Text attack is then formalised as Empirical Hypothesis 1 and tested on GTR-base embeddings. Relation to a preliminary version. A short preliminary version of this hybrid design appeared in [50], where the static collection is protected by random projections. The present paper replaces random projection with data-driven SVD truncation plus a secret rotation, adds the projection lower-bound lemma (Lemma 1) and the reproducible CKKS parameter selection, scales the evaluation to 106 documents and five encoders, and adds the stronger-attacker analysis (known-plaintext recovery of the rotation, PQ-code leakage, a baseline suite and a BEIR check) of Section 8. Roadmap. Section 2 reviews the related literature; Section 3 introduces the threat model, separating document, query and access-pattern privacy, and gives both a coverage table and a claimsvs-evidence table; Section 4 describes the asymmetric architecture, including a cryptographicreproducibility subsection; Section 5 states the reproducible CKKS parameter selection; Section 6 proves the projection-decoder lemma and delimits its scope; Section 7 presents four experiments; Section 9 discusses limitations, required attack experiments and open work.
2
Related Work
Embedding inversion. Vec2Text [7] trains an encoder–decoder model that iteratively rewrites a candidate hypothesis until its embedding matches a target vector; on 32-token MSMARCO inputs the attack achieves BLEU ≈ 97.3% and ≈ 92% exact recovery. GEIA [8] instead trains a generative decoder that maps a target embedding to a prompt and reconstructs the whole sentence in a single pass. TEIA [9] removes the need to query the victim encoder, training a surrogate inverter that transfers across embedding models. Adjacent work on membershipinference [16] and on extracting training texts from large language models [17] confirms that the risk surface of dense retrievers is broader than the embedding-inversion literature alone suggests. Modern inversion attacks (2024–2026). Since Vec2Text the threat has strengthened along two axes that matter for any geometric obfuscation. Few-shot alignment attacks such as ALGEN [10] learn a linear map between embedding spaces from ∼ 103 leaked pairs and reach Vec2Text-level recovery without query access to the victim encoder; zero-shot attacks such as ZSInvert [11] invert with no encoder-specific training; the unsupervised translator vec2vec [12] aligns two embedding spaces with no paired data at all and argues that a leaked vector store should be treated as plaintext; and Zero2Text [13] updates an online token-by-token regression. These attacks are alignment-based or adaptive and exploit the universal geometry of embedding spaces, so a single secret rotation—which only hides the orientation of a fixed basis—does not by itself neutralise them. They therefore lie outside the non-adaptive threat model under which our construction is analysed (Section 3); we quantify the closest members of this family—knownplaintext linear alignment and an aligned off-the-shelf inverter—directly in Section 8, and flag the fully learned variants as the main residual gap in Section 10.
3
Differential privacy for embeddings. Lyu et al. [20] investigate per-coordinate Gaussian noise on dense representations; the empirical finding is that retrieval quality degrades sharply long before ε reaches a useful range. Random-projection-based privacy [22, 21] predates modern dense retrieval; the data-dependent SVD projection used here is closer to a noise-removal technique than to a privacy-preserving DP mechanism, although σrec provides a useful proxy quantity. Homomorphic encryption. The CKKS scheme [23] introduced approximate-arithmetic FHE; OpenFHE [28] and TenSEAL provide production-grade implementations. The bootstrapping cost [24] pushes practitioners to leveled circuits; specialised compilers [29, 30] optimise scale and modulus chains. GPU acceleration of CKKS bootstrap [31] and Intel HEXL [32] have made larger leveled circuits feasible. Hybrid privacy-preserving retrieval. Tiptoe [34] combines clustering with PIR for query privacy. SealPIR [35], OnionPIR [37] and SimplePIR [36] provide single-server PIR with practical query sizes. The architecture in this paper is complementary: ct-pt CKKS reranking takes care of the value side of the leakage, while access patterns remain a separate problem for which PIR/ORAM-like primitives are an appropriate composition.
3
Threat Model
We adopt the asymmetric threat model trusted client / honest-but-curious server / non-adaptive attacker / unknown rotation, characterised as follows. • The client is the data owner. It runs the encoder E, generates the secret keys µ, Vk , R, skCKKS and never shares them. The client is trusted in software and key management. • The server runs the search service over the rotated database Erot ∈ RNdocs ×k and the public PQ artefact. It is honest-but-curious: it follows the protocol but attempts to extract textual information from the data it sees and from the queries it processes. • The attacker is non-adaptive: it uses an off-the-shelf Vec2Text model trained without prior knowledge of R. This is the model under which the construction is analysed. We do not stop there: Section 8 steps outside it and empirically measures known-plaintext recovery of R, public-PQ-code leakage and an aligned off-the-shelf inverter, so the boundary of the nonadaptive model is quantified rather than merely asserted. A fully learned decoder retrained end-to-end against the rotated space, and malicious (rather than honest-but-curious) server behaviour, remain out of scope. Three distinct privacy notions. A recurring source of confusion in hybrid designs is the conflation of what is protected. We therefore separate three independent notions and state, for each, exactly which component is responsible: • Document privacy. The plaintext rotated database Erot is visible to the server. It is protected only by SVD truncation (σrec , a proxy quantity) and the secret rotation R (an empirical obfuscation layer). This is not a cryptographic protection; it fails under known-R, known-plaintext, or an adaptive decoder. • Query privacy. CKKS hides the numerical value of the query vector and of the similarity scores from the server. This part is cryptographic, at the chosen security level. • Access-pattern privacy. The candidate IDs reranked per query, and the public PQ codes, are not hidden. CKKS does not address this channel; it requires composition with a PIR/ORAM-style primitive.
4
Table 1: Threat coverage of the proposed protocol. Attack vector
Covered?
Comment
Snapshot of Erot without R (off-the-shelf Vec2Text) Network interception, leakage of similarity scores Known R (known-rotation attacker) Known-plaintext pairs (texti , Erot,i )
Partial
Heuristic; empirically validated against nonadaptive Vec2Text. CKKS at tc128; sk never leaves the client.
Adaptive decoder retrained against rotated space
No
Malicious server (protocol deviation, substitution) Access-pattern leakage on candidate IDs
No
Leakage from the public PQ artefact (rotatedspace codes)
Yes
Reduces to σrec from SVD truncation only. R recovered by Procrustes from ≈ k pairs (Sec. 8.1, Table 8). Aligned off-the-shelf inverter measured (Sec. 8.4); a learned decoder is the main open case. Verifiable computation / TEEs are an orthogonal addition. CKKS hides values, not access patterns; requires PIR/ORAM. Quantified: codes preserve cosine 0.95 and 67% of top-10 neighbours (Sec. 8.3, Table 10).
No No
No No
In particular, the public PQ artefact (codebook + per-document codes, trained in the rotated space) is itself a lossy compressed view of Erot . Whether neighbourhood, cluster or topic structure leaks from the public PQ codes alone is measured directly in Section 8 (Table 10): it does, and we treat the PQ artefact as an exposed channel accordingly. Table 1 summarises the coverage and Table 2 maps each claim to the evidence that supports it. The coverage table is intentionally asymmetric: ct-pt reranking takes care of the value channel, while the access-pattern channel (which document IDs are reranked) is left open and would require composition with a PIR-style primitive, and the public-PQ-artefact and known-plaintext channels—now quantified in Section 8—remain exposed rather than defended.
4
Method
The asymmetric defence is illustrated in Figure 1. The architecture is the union of an offline data-preparation phase (Section 4.1) and the online query protocol (Section 4.2).
4.1
Offline phase
Encoder and centring. The data owner runs the encoder E on a corpus D = {T1 , . . . , TNdocs } to obtain X ∈ RNdocs ×d with L2 -normalised rows. The global centroid µ ∈ Rd is computed and the corpus is centred: Xc = X − µ. SVD truncation. A randomised SVD [38] Xc ≈ Uk Σk Vk⊤ produces the orthonormal matrix Vk ∈ Rd×k that spans the dominant k-dimensional subspace. We use k = d/2 in the canonical operating point: this is the smallest k at which the relative reconstruction error 2 σrec (E; Vk ) =
∥E − πk (E)∥2F = 1 − ηk ∥E∥2F
exceeds the proxy threshold σrec ≥ 0.10 uniformly across all five tested encoders (Section 7). Secret rotation. A Haar-uniform random orthogonal matrix R ∈ O(k) is generated by QRdecomposing a Gaussian matrix and correcting the diagonal of R to obtain a uniform distribution on the group. The protected document representation is vi′ = T (vi ) = R Vk⊤ (vi − µ) ∈ Rk . 5
Table 2: Claims vs. evidence. The table makes explicit which statements are demonstrated and which are deliberately not claimed. Claim
Evidence / status
CKKS hides query values and scores from the server ct-pt is faster than ct-ct for the reranking
Cryptographic construction + parameters (Sec. 5, 4.3); query privacy is cryptographic. Experiment 7.1 (1.44× on the micro-benchmark, 1.7× at the auto-tuned configuration). Experiment 7.2; effect holds only for the tested weakattacker configuration. Experiment 7.3 (within the 5-seed CI).
Secret rotation helps against off-the-shelf, non-adaptive Vec2Text The protective wrapper preserves ranking in span(Vk ) End-to-end query latency < 1 s at 106 docs Experiment 7.4 (loopback PoC). The system is secure against an adaptive Not claimed; aligned off-the-shelf inverter tested inversion attacker (Sec. 8.4), learned decoder open (Sec. 10). The rotation is a cryptographic guarantee Not claimed; it is an empirical obfuscation layer only. Document privacy on the server is crypto- Not claimed; Erot is plaintext on the server. graphic No information leaks from the public PQ Not claimed; codes leak neighbour structure (Sec. 8.3, codes Table 10).
Public PQ artefact. A faiss IndexPQ index is trained in the rotated space Erot with M = k/4 subquantisers and 8 bits per code. Both the codebook and the per-document codes are public; the client downloads them once at on-boarding. Training the PQ artefact in the rotated space removes one trivial cross-space pairing (an attacker cannot compose pairs (Êproj , Erot ) from a non-rotated PQ index to estimate R). It does not, however, make the PQ codes safe: the public codes are a lossy quantised image of Erot and may themselves leak neighbourhood, cluster or topic structure. We treat the PQ artefact as part of the attack surface and measure this leakage directly in Section 8 (Table 10): the public codes preserve mean cosine 0.95 and most top-10 neighbours, so they must be treated as an exposed channel. Client-side state. The client retains µ, Vk , R and the CKKS secret key skCKKS . The server stores Erot ∈ RNdocs ×k in plaintext and the public PQ artefact.
4.2
Online query protocol
The seven-step protocol of Figure 1 processes a query in time pipeline: 1. Encoder. The client computes vq = E(qtext ) ∈ Rd .
2. Transformation. The rotated query is q ′ = R Vk⊤ (vq − µ) ∈ Rk .
3. Local PQ search. Using the public PQ artefact and the rotated query q̃ = q ′ , the client performs an asymmetric PQ-distance search and returns the top-Kcands candidate IDs Icand . The candidate set is small enough (Kcands = 40 in our experiments) that a CKKS reranking fits within the latency budget. 4. CKKS encryption. The client encrypts q ′ : ctq = Encpk (q ′ ). (j)
5. Server-side reranking. For each j ∈ Icand the server computes ctscore = ctq ⊙ vj′ in the ct-pt mode. The result is a ciphertext encoding the inner product ⟨q ′ , vj′ ⟩ in the rotated projected space. (j)
6. Decryption. The client decrypts sj = Decsk (ctscore ). 7. Sort. The decrypted scores are sorted and the top-K documents returned.
6
Trusted Client
Honest-but-curious Server
Client’s secret keys
Rotated embedding database offline
query text
1
Encoder
2
Projection and secret rotation
3
Local PQ search → N candidate IDs
4
CKKS query encryption
Public PQ artifact
request
Encrypted query + N IDs
Received: enc. query, N IDs
CKKS reranking of N candidates (ciphertext-plaintext mode)
6
Score decryption
7
Sort → top-K
response
client secret
public artifact
CKKS ciphertext
5
N similarity-score ciphertexts
- - → network exchange
Figure 1: Online query flow of the construction under study. Steps 1–7 realise the two-stage protocol: client transformation T (·) and local PQ filtering produce a short-list of Kcands candidate IDs; step 4 encrypts the rotated query under CKKS; step 5 runs ct-pt reranking on the server; steps 6–7 decrypt the scores and sort. The secret keys (µ, Vk , R, skCKKS ) and the rotated database Erot are produced offline by the data owner (Section 4.1). Why ct-pt is sufficient. In step 5 the server multiplies a ciphertext by a plaintext vector. Unlike ciphertext-ciphertext multiplication, this operation produces a ciphertext that stays in the two-component form, no relinearisation is required, and the modulus chain is consumed by exactly one rescale. The sum of slots into a single scalar ⟨q ′ , vj′ ⟩ requires log2 k rotations using Galois keys, but no further multiplications. The result is a sub-second latency at Ndocs = 106 . Choice of Kcands . Since each of the Kcands candidates is processed by one ct-pt operation, the server-side latency grows linearly in Kcands . Conversely, a small Kcands trades against PQ-recall: the relevant document must be in the short-list for the CKKS reranker to score it. We pick Kcands as the smallest value for which PQ-recall@Kcands matches the SVD-projected exact baseline within the 5-seed CI; in our integral experiment this is Kcands = 40, but the parameter is a deployment knob and should be retuned for new encoders or larger corpora.
4.3
Cryptographic reproducibility
For the selected configuration (Npoly = 8192, coefficient-modulus chain [60, 40, 60] bits, log2 Q = 160, scale ∆ = 240 , TenSEAL/Microsoft SEAL backend) we report the parameters needed to reproduce the cryptographic budget rather than only the latency: • Packing. A single rotated query q ′ ∈ Rk is packed into one ciphertext using k ≤ Npoly /2 = 4096 7
Table 3: CKKS configurations on the test workload (one batched ct-pt reranking operation). All rows sit within the conservative tc128 (≥ 128-bit) bound of the HomomorphicEncryption.org tables for the stated Npoly . Configuration
Npoly
log2 Q (bits)
Security
Time (ms)
Speed-up
Default (TenSEAL stock, [60, 40, 40, 60]) Min-latency (Acc@10), [40, 20, 40], ∆ = 220 Selected (Acc@1), [60, 40, 60], ∆ = 240
8192 4096 8192
200 100 160
tc128 (≥ 128) tc128 tc128
419.4 173.7 245.2
1.0× 2.4× 1.7×
slots; for the integral encoders k ∈ {192, 384, 512}, so one ciphertext per query suffices and no cross-ciphertext aggregation is needed. • Operations per score. Each candidate score is one ct-pt multiply, one rescale (one level consumed) and a slot-sum implemented as ⌈log2 k⌉ ciphertext rotations using Galois keys (8–9 rotations for the tested k); no relinearisation and no ciphertext-ciphertext multiply occur. • Level/noise budget. The chain [60, 40, 60] provides one multiplicative level beyond the input; after the single rescale the remaining modulus (60 bits) keeps the additive noise far below the ∆ = 240 scale, so decrypted scores match the plaintext inner product to a relative error < 10−3 (Pearson > 0.9999 vs. exact, Experiment 7.3). • Object sizes. At Npoly = 8192, log2 Q = 160: one fresh ciphertext is ≈ 0.21 MB; the Galois-key set for the required power-of-two rotations is ≈ 6–8 MB and the relinearisation key is not generated (ct-pt only); the public key is ≈ 0.4 MB. Per query the client uploads one ciphertext (≈ 0.21 MB) and downloads Kcands score ciphertexts (≈ 40 × 0.21 ≈ 8.4 MB before base64; the measured on-wire JSON+base64 sizes are reported in Section 7.4). • Security level. We do not assert a generic “standard” label; we report log2 Q = 160 < 218 for Npoly = 8192, which is within the conservative ternary-secret tc128 bound of the HomomorphicEncryption.org tables [25], cross-checked with the lattice-estimator methodology of Albrecht et al. [26]. The standard documents are security guidelines; the concrete estimator/table used is stated so the claim can be re-derived.
5
CKKS Parameter Selection
The CKKS parameter space is large and discrete: Npoly ∈ {212 , . . . , 214 }, multiple coefficientmodulus chains of total bit budget bounded by the conservative security tables of HomomorphicEncryption.org [25] (cross-checked with the lattice estimator [26]), several scale exponents log2 ∆ ∈ {15, 20, 25, 30, 40} and several projection dimensions dproj . Analytic complexity is proportional to Npoly log Npoly , but cache effects, SIMD vectorisation and slot-packing ratios (dproj /(Npoly /2)) cause step-like deviations from the analytic prediction, so we fix the configuration by a small offline micro-benchmark rather than analytically. Selection procedure (reproducible). We enumerate the discrete grid; discard configurations that violate the security tables or the correctness (noise-budget) constraint; time one batched ct-pt operation with rescale for each survivor; and keep the minimum-latency configuration whose retrieval accuracy stays within a tolerance τ of the SVD-projected baseline, |∆Acc@1| ≤ τ . This is a deterministic engineering search over a published grid, reported only so the chosen budget can be reproduced; we make no machine-learning contribution. With τ = 1 p.p. the procedure selects Npoly = 8192, [60, 40, 60], ∆ = 240 (log2 Q = 160 bits, within the conservative 218-bit tc128 bound for Npoly = 8192 [25, 26]), which is ≈ 1.7× faster than the TenSEAL stock setting [60, 40, 40, 60] (log2 Q = 200 bits) at the same parameter-table security bound (Table 3). The full cryptographic budget of this configuration is given in Section 4.3. 8
6
Theoretical Analysis: Decoder Lower Bound
Let x ∈ Rd denote a centred embedding, Vk ∈ Rd×k the orthonormal matrix from the SVD truncation, and πk (x) = Vk Vk⊤ x the orthogonal projection onto span(Vk ). Define σrec (x; Vk ) = ∥x − πk (x)∥2 /∥x∥2 as the per-vector relative reconstruction error and x⊥ = x − πk (x). Lemma 1. Let f : Rd → Rd be any decoder whose image is constrained by f (y) ∈ span(Vk ) for every y ∈ Rd . Then for every x ∈ Rd ∥x − f (πk (x))∥22 ≥ ∥x⊥ ∥22 , with equality at f (y) = y. In relative form, ∥x − f (πk (x))∥2 /∥x∥2 ≥ σrec (x; Vk ). ⊥ Proof. Decompose x = πk (x) + x⊥ with πk (x) ∈ span(Vk ) and x⊥ ∈ span(V k ) . By the image restriction f (πk (x)) ∈ span(Vk ), hence x − f (πk (x)) = πk (x) − f (πk (x)) + x⊥ is the sum of two orthogonal vectors. Pythagoras gives ∥x−f (πk (x))∥22 = ∥πk (x)−f (πk (x))∥22 +∥x⊥ ∥22 ≥ ∥x⊥ ∥22 .
Scope: a projection bound, not an inversion-security theorem. Lemma 1 bounds the L2 error of decoders whose image is contained in span(Vk ). It is a statement about information lost to the projection, not about the security of text inversion. A realistic attacker is not so constrained: it may output arbitrary text, whose re-embedding generally has a non-zero x⊥ component, and it may exploit corpus priors or memorisation to partially recover the discarded component. The lemma therefore does not lower-bound the achievable inversion BLEU, token overlap or PII recovery. We use it only to make the proxy criterion σrec ≥ 0.10 precise within the projection-restricted class, and we stress that the threshold 0.10 is an engineering proxy, calibrated on one encoder (GTR-base) against one off-the-shelf attacker, not a security threshold. A per-encoder ablation of σrec against BLEU, token overlap and typed-PII recovery (names, addresses, e-mail, phone, medical terms) is listed as a remaining open experiment (Section 10). Empirical Hypothesis 1. For an off-the-shelf inversion attack Vec2Text [7], the expected 2 (E; V ): BLEU of recovering the original text from πk (x) is monotone in ηk = 1 − σrec k E BLEU(f (πk (x)), T (x)) ≈ BLEU0 + γf ηk , where BLEU0 is the BLEU of a “random semantically close” text and γf is a decoder-specific constant. Hypothesis 1 is validated numerically in Section 7.2; we deliberately separate the formal lemma from the empirical observation.
7
Experiments
We report four experiments: (1) CKKS modes (ct-pt vs ct-ct); (2) off-the-shelf Vec2Text attack against SVD-truncated (and possibly rotated) embeddings; (3) the integral multi-encoder experiment over a 106 -document Russian-Wikipedia corpus; (4) end-to-end latency on a client-server PoC. Hardware and software. All experiments run on a single workstation: Intel Core i5-14400F, 32 GB DDR5-4800, NVIDIA RTX 5060 (8 GB VRAM), Windows 11, Python 3.11. To make the runs reproducible we pin exact versions and record the commit/build hashes of the security-relevant libraries in the supplementary environment.lock: PyTorch 2.10 + CUDA 12.8, TenSEAL 0.3.16 (Microsoft SEAL 4.1 backend), faiss-cpu 1.13.0, transformers 4.57.0, scikit-learn 1.5.x, sacrebleu for BLEU [45]. The pinned hashes matter because CKKS noise behaviour and faiss PQ training depend on the backend build. 9
Table 4: Ciphertext-plaintext vs. ciphertext-ciphertext for the dot product against N = 10 000 documents (mean of 50 trials, 95% CI). Mode
Operation
ct-ct (baseline) ct-pt (proposed)
Enc(v1 ) · Enc(v2 ) Enc(v1 ) · Plain(v2 )
Relin.
Latency Tquery
QPS
Speed-up
yes (heavy) no
19.15 ± 0.15 s 13.28 ± 0.10 s
0.052 0.075
1.00× 1.44×
Figure 2: ct-pt vs. ct-ct: distribution of per-batch latencies over 50 trials. Removing relinearisation moves the median by ∼ 6 s and tightens the upper tail.
7.1
Experiment 1: ciphertext-plaintext speed-up
We benchmark a batched dot-product of an encrypted 192-dimensional query with N = 10 000 plaintext documents. The CKKS parameters are N = 8192, coeff_mod_bit_sizes = [60, 40, 40, 60], ∆ = 240 (security level ≥ 128 bits). Two regimes are compared: ct-ct (both query and database encrypted, with relinearisation per multiplication) and ct-pt (only the query is encrypted, no relinearisation). Each is run for 50 independent trials and the mean is reported with a 95% Gaussian confidence interval.
7.2
Experiment 2: Vec2Text attack
We instantiate Vec2Text on GTR-base embeddings (d = 768). The attack is applied to a synthetic 100-document corpus containing PII (names, addresses, card numbers, medical phrasing). Three threat models are compared at five values of k/d: (a) no rotation; (b) rotation with the matrix R known to the attacker; (c) rotation with R unknown. The implementation budget of the attacker is fixed (greedy decoding, 10 corrector iterations, no beam search, 8 GB GPU); under this budget the unprotected baseline reaches BLEU0 = 0.156 instead of the 0.973 reported by Morris et al. [7], because the postulated PII corpus, greedy decoding and beam-free regime are intentionally weaker than [7]’s strongest configuration; the experiment measures the relative effect of SVD truncation and secret rotation in a fixed weakattacker configuration. Strength of the attacker: an explicit caveat. This is the single most important limitation of this particular experiment: it establishes the effect of R against an artificially weak inverter only. A stronger attacker—beam search with a large width, many more corrector iterations, an adaptive decoder fine-tuned on (text, Erot ) pairs, or a modern universal/zero-shot inversion model—is not evaluated here. We therefore do not rest the security narrative on this table. Section 8 measures the two decisive stronger channels: a known-plaintext recovery of R by orthogonal Procrustes [27] (Table 8), which succeeds from ≈ k leaked pairs, and an aligned off-the-shelf inverter with a larger 10
Table 5: Off-the-shelf Vec2Text on GTR-base embeddings under the three threat models. BLEU and Token Overlap with 95% bootstrap CIs in brackets. k/d
Rotation
Knowledge of R
BLEU
Token Overlap
1.00 1.00 1.00 0.75 0.75 0.50 0.50 0.25 0.25 0.10 0.10
off on on off on off on off on off on
— known unknown — unknown — unknown — unknown — unknown
0.156 [0.123; 0.186] 0.156 [0.127; 0.187] 0.007 [0.006; 0.008] 0.077 [0.063; 0.093] 0.007 [0.007; 0.008] 0.057 [0.046; 0.069] 0.007 [0.007; 0.008] 0.024 [0.020; 0.028] 0.007 [0.006; 0.007] 0.010 [0.009; 0.011] 0.007 [0.007; 0.008]
0.385 [0.351; 0.417] 0.385 [0.351; 0.416] 0.053 [0.046; 0.060] 0.325 [0.304; 0.345] 0.061 [0.054; 0.067] 0.285 [0.270; 0.300] 0.050 [0.045; 0.055] 0.196 [0.181; 0.208] 0.045 [0.040; 0.051] 0.113 [0.104; 0.123] 0.053 [0.047; 0.059]
Figure 3: Vec2Text BLEU as a function of k/d under three threat models (left); zoom on k/d = 1.0 comparing no-rotation, known-R and unknown-R (right). Lines for “no rotation” and “known-R” overlap; the “unknown-R” line stays at the noise level. budget (Table 11). Every sentence about the rotation in isolation should accordingly be read as “against the tested off-the-shelf, non-adaptive Vec2Text configuration”, with the boundary now quantified in Section 8. Findings. • A known R does not provide protection beyond SVD truncation: the columns “no rotation” and “known-R” are statistically indistinguishable. • Under the tested off-the-shelf configuration, an unknown R reduces BLEU to the observed noise floor (∼ 0.007) for all k/d values, including k/d = 1.0 (no truncation at all). The ratio BLEUoff /BLEUunknown is 22× at k/d = 1.0, 11× at 0.75, 8× at 0.50. This is an effect against a non-adaptive attacker only and is not evidence of robustness against an adaptive or known-plaintext adversary. • Empirical Hypothesis 1 is consistent with the no-rotation column: a linear regression of BLEU 2 gives R2 ≈ 0.93. This is consistent with, but does not formally derive, the on ηk = 1 − σrec BLEU → σrec link. • In the operating point of the integral experiment (k/d = 0.5, rotation enabled, unknown R) the expected BLEU is at the noise level. 11
7.3
Experiment 3: integral multi-encoder evaluation
We run the full pipeline on the canonical operating point k = d/2 across five encoders: • intfloat/multilingual-e5-small (d = 384), • intfloat/multilingual-e5-base (d = 768), • sentence-transformers/paraphrase-multilingual-mpnet-base-v2 (d = 768), • intfloat/multilingual-e5-large (d = 1024), • BAAI/bge-m3 (d = 1024). The corpus is one million Russian-Wikipedia paragraphs; queries are 500 self-retrieval requests sampled at seed 42; the rotation is averaged over 5 seeds {11, 23, 47, 31, 53}. PQ uses M = k/4 subquantisers with 8 bits each, yielding artefacts of 48/96/128 MB. The CKKS configuration is the auto-selected one (Npoly = 8192, [60, 40, 60], ∆ = 240 ). On the use of self-retrieval. Self-retrieval (the query is the first sentence of the target paragraph) is a controlled geometry probe, not a production IR benchmark: it isolates whether the defensive transform T (·) preserves the ranking induced by the encoder, with a deterministic, leakage-free ground truth at 106 -scale. It is sufficient for the paper’s actual claim—that the PQ+CKKS wrapper is metric-preserving in span(Vk )—but it does not establish production retrieval quality. Re-running the integral experiment on standard IR benchmarks (BEIR, MIRACL, MS MARCO) is listed as a generality experiment in Section 10; the present numbers should be read as a transform-fidelity measurement, not as a retrieval-quality benchmark. The protective layer is essentially free in the projected space. The difference (proposed) vs. (baseline_proj) is within the ±0.001 5-seed CI for every metric and every encoder. The Pearson correlations between CKKS-decrypted scores and exact plaintext scores exceed 0.9999 in all cases. The proxy criterion σrec ≥ 0.10 holds uniformly. The actual quality cost is paid by SVD truncation, not by the protective wrapper. The split ∆SVD = baseline_proj − baseline_dense is +0.004/ + 0.018/ + 0.014 for retrieval-trained encoders with d ≥ 768 (e5-base / e5-large / bge-m3), −0.080 for the compact e5-small (d = 384, halftruncation removes half the embedding volume) and −0.066 for paraphrase-mpnet (a paraphrasedistilled model that does not concentrate retrieval signal in the top singular directions). The end-to-end accuracy budget is met for retrieval-trained d ≥ 768. The end-to-end criterion ∆Acc@1 ≥ −0.05 relative to the raw baseline holds for e5-base (+0.003), e5-large (+0.018) and bge-m3 (+0.014); for the compact e5-small and the paraphrase-distilled mpnet it is violated and the limitation is documented as an encoder-selection recommendation. Linear-denoiser side effect. On the two retrieval-trained encoders with d = 1024, half SVD truncation improves the four ranking metrics over the raw baseline (+0.018 Acc@1 on e5-large, +0.014 on bge-m3). This is consistent with the interpretation of Vk -projection as a linear denoiser: the trailing singular directions, dominated by fp16 inference noise, get filtered out, and the ranking in span(Vk ) is cleaner than in the raw Rd .
7.4
Experiment 4: end-to-end client-server latency
We package the pipeline as a FastAPI service, with the client and the server running as two independent processes on the same machine, communicating via HTTP/JSON over loopback. The setup measures the realistic HTTP framing, base64 serialisation of CKKS ciphertexts, FastAPI/uvicorn stack and JSON (de-)serialisation, but without physical network latency. The encoder is multilingual-e5-small (d = 384, k = 192, M = 48, Kcands = 40, Ndocs = 106 ), averaged over 500 queries × 5 rotation seeds. 12
Table 6: Integral experiment at k = d/2 on a 106 -document corpus across five encoders. Reported are the raw baseline (no defence), the SVD-projected baseline (FAISS-IP exact in span(Vk ), no rotation, no CKKS), the proposed pipeline (mean ±95% t-CI half-width over 5 rotation seeds), and the delta of Acc@1 from the raw baseline. Encoder Metric
Baseline (raw d) Baseline_proj (SVD k)
multilingual-e5-small (d = 384, k = 192, M = 48, σrec = 0.239) Acc@1 0.782 0.702 Acc@10 0.890 0.834 MRR 0.817 0.747 NDCG@10 0.834 0.768 multilingual-e5-base (d = 768, k = 384, M = 96, σrec = 0.129) Acc@1 0.830 0.834 Acc@10 0.934 0.924 MRR 0.862 0.865 NDCG@10 0.880 0.879
Proposed ∆ from raw Server p95 (ms) 0.701 ± 0.001 0.831 ± 0.002 0.746 ± 0.001 0.767 ± 0.001
−0.081 −0.059 −0.071 −0.067
314
0.833 ± 0.001 0.924 ± 0.001 0.864 ± 0.001 0.879 ± 0.000
+0.003 −0.010 +0.002 −0.001
356
−0.067 −0.047 −0.070 −0.066
351
+0.018 +0.040 +0.024 +0.027
219
+0.014 +0.016 +0.015 +0.016
221
paraphrase-multilingual-mpnet-base-v2 (d = 768, k = 384, M = 96, σrec = 0.107) Acc@1 0.716 0.650 0.649 ± 0.001 Acc@10 0.842 0.796 0.795 ± 0.001 MRR 0.762 0.693 0.692 ± 0.001 NDCG@10 0.782 0.717 0.717 ± 0.000 multilingual-e5-large (d = 1024, k = 512, M = 128, σrec = 0.101) Acc@1 0.796 0.814 0.814 ± 0.000 Acc@10 0.880 0.922 0.920 ± 0.000 MRR 0.824 0.848 0.848 ± 0.000 NDCG@10 0.838 0.866 0.865 ± 0.000 BAAI/bge-m3 (d = 1024, k = 512, M = 128, σrec = 0.128) Acc@1 0.818 0.832 Acc@10 0.908 0.926 MRR 0.848 0.863 NDCG@10 0.862 0.878
0.832 ± 0.000 0.924 ± 0.000 0.863 ± 0.000 0.878 ± 0.000
On-wire payload sizes. For the same configuration the measured HTTP payloads are: request body ≈ 0.29 MB (one CKKS query ciphertext, base64-encoded JSON, inflated ≈ 1.37× over the 0.21 MB raw ciphertext); response body ≈ 11.4 MB (Kcands = 40 score ciphertexts, base64 JSON). One-off on-boarding transfers the public PQ artefact (48 MB at k = 192) and the CKKS public/Galois keys (≈ 8 MB); these are not part of the per-query budget. Reporting sizes alongside p95 is necessary because the dominant scaling pressure for larger Kcands or distributed deployments is the response payload, not CPU time.
8
Security Analysis Under Known-Plaintext and Stronger Attackers
The experiments above establish the construction’s behaviour inside its non-adaptive threat model (Section 3). A privacy paper that stopped there would be open to the objection that the only tested adversary is also the weakest one. We therefore deliberately step outside the model and measure four stronger channels—known-plaintext recovery of the rotation, a text-level referencecorpus lookup, leakage from the public PQ artefact, and an aligned off-the-shelf inverter—followed by a baseline suite and a benchmark-generality check. Several of these are negative results for broad document-privacy claims; reporting them is what licenses the deliberately narrow framing of Sections 9–11.
13
Figure 4: Per-seed Acc@10 of the proposed pipeline relative to baseline_proj on five rotation seeds; the spread is below the 5-seed CI of the baseline. Table 7: Latency decomposition at the canonical operating point (k = 192) on a 106 -document corpus. The k-dependent server-side ct-pt rerank is measured on the 5-seed integral run; the k-independent client-side and HTTP stages are measured on the client-server HTTP-loopback PoC. The encoder forward pass is independent of the defence layer and excluded from the total. Stage Encoder forward pass (client) Projection to span(Vk ) (client) Local PQ search (client, faiss) CKKS encryption (client) Server CKKS rerank, ct-pt HTTP + serialisation (req+resp) CKKS decrypt + sort (client) Total (excluding encoder)
8.1
p95 (ms) ∼ 200 0.1 22.8 4.9 283 38 20.7 ≈ 370 ms
Notes encoder-dependent; excluded from total negligible M = 48, Kcands = 40, 106 docs one rotated query, Npoly = 8192 40 ct-pt ops at k = 192 (5-seed integral run) base64 ciphertexts over loopback 40 score ciphertexts p95 , full pipeline
Known-plaintext recovery of the secret rotation
The secret rotation R is the only document-side layer beyond SVD truncation. We test it against a known-plaintext attacker who holds m pairs (E(xi ), Erot,i ) and estimates the orientation with the orthogonal Procrustes solution [27]. The setup uses e5-small projected to k = 192, five rotation seeds, 400 held-out probes and a 10 000-document gallery; the attack is scored in embedding space, where a successful alignment lets a probe recover its own projected vector and retrieve the matching gallery document. This is the relevant precursor to a few-shot alignment attack because it hands the inverter the native projected space. The result is unambiguous (Table 8, Fig. 6): the rotation is useful only while aligned plaintext anchors are unavailable. Even 50 pairs—well below the retained dimension k = 192—already retrieve the target in the top 10 for 92.5% of probes in a 10 000-document gallery, and at m ≈ k the orientation is numerically exact. The rotation therefore raises the bar against an attacker with no aligned plaintext, but it is not a defence against known plaintext; this is reflected directly in the threat-coverage table.
8.2
Reference-corpus lookup after alignment
The Procrustes test is in embedding space. We next ask whether the same failure becomes a text-level channel without training any generative inverter. The attacker is given the protected 14
Figure 5: Left: per-stage latency decomposition at k = 192 (the server-side ct-pt rerank dominates). Right: CDF of the server-side rerank latency over 500 queries × 5 seeds (p95 ≈ 283 ms); the full end-to-end p95 ≈ 370 ms (Table 7) stays well below the 1 s SLA. Table 8: Known-plaintext Procrustes attack against the secret rotation (m leaked pairs, means over five seeds). With ≈ k pairs the orientation is numerically recovered. Known pairs m
Mean cosine
Rel. L2 error
Target R@1
Target R@10
0 10 50 100 192 500
−0.004 0.098 0.377 0.621 1.000 1.000
1.417 1.343 1.116 0.870 1.8×10−5 4.9×10−7
0.000 0.005 0.722 1.000 1.000 1.000
0.001 0.039 0.925 1.000 1.000 1.000
vectors, m known pairs for estimating R, and a reference corpus of candidate paragraphs with native e5-small embeddings—modelling the realistic case where some private documents also appear in a public or previously leaked corpus. We use 500 targets, 100 000 decoys, five seeds and the same k = 192 subspace; the overlapping reference contains the targets, the disjoint reference removes them and serves only as a lexical nearest-neighbour proxy. The overlap case is severe (Table 9): with only 50 known pairs the attacker recovers the exact source paragraph at 53.5% top-1 among 100 500 candidates, rising to 99.8% at m = 100. This is the text-level analogue of the Procrustes result and makes the static-side limitation concrete: if a public or leaked reference corpus overlaps the private collection, rotation secrecy is insufficient. The disjoint-reference column is reported as a boundary condition—token Jaccard stays at 0.034 (m = 100), so a non-overlapping reference needs semantic metrics or a generative inverter before text reconstruction can be claimed. Table 9: Reference-corpus lookup after known-plaintext alignment (overlapping reference: 500 targets + 100 000 decoys; Jaccard is token-set overlap with the top-1 retrieved paragraph; means over five seeds). Known pairs m
Exact R@1
Exact R@10
Jaccard overlap-ref
Jaccard disjoint-ref
0 10 25 50 100 192
0.000 0.000 0.044 0.535 0.998 1.000
0.000 0.009 0.132 0.784 1.000 1.000
0.006 0.009 0.055 0.543 0.999 1.000
0.006 0.009 0.012 0.018 0.034 0.043
15
Figure 6: Known-plaintext alignment destroys the unknown-rotation assumption: with about k leaked pairs the rotation is recovered. The x axis uses a symlog scale to include m = 0.
Figure 7: Reference-corpus lookup after alignment. When the reference overlaps the protected collection, alignment turns the protected vector into an exact paragraph lookup; with a disjoint reference this token-overlap proxy stays low.
16
Table 10: Leakage from the public PQ codes (rotated e5-small, 20 000 documents; neighbour overlap excludes the query document). M
Bits
Bytes/vector
Cosine to Erot
NN overlap@10
24 48 48
8 8 6
24 48 36
0.837 0.953 0.904
0.384 0.674 0.529
Table 11: Aligned off-the-shelf Vec2Text stress test (120 held-out texts; m is the number of pairs used for alignment). Exact match and typed-PII recall are zero in every row—but so is the raw control, so this corrector cannot certify protection. Case
Token F1
BLEU
Exact
PII recall
0.133 0.138 0.121 0.126 0.141 0.134 0.135
0.0133 0.0134 0.0129 0.0126 0.0127 0.0132 0.0133
0.000 0.000 0.000 0.000 0.000 0.000 0.000
0.000 0.000 0.000 0.000 0.000 0.000 0.000
Raw embedding Known-R oracle Unknown R (= Procrustes m=0) Procrustes, m = 50 Procrustes, m = 100 Procrustes, m = 192 Procrustes, m = 500
8.3
Leakage from the public PQ artefact
Stage-1 candidate filtering publishes a product-quantization codebook plus per-document codes, trained in the rotated space. We quantify how much of Erot this public artefact alone reconstructs on a 20 000-document e5-small sample (Table 10). The canonical configuration (M = 48, 8 bits) preserves mean cosine 0.953 to Erot , 67.4% of exact top-10 neighbours, and 97.1% of exact top-10 neighbours inside the approximate top-40 candidate set—that is, the public codes alone almost perfectly reproduce the candidate set the server reranks. These numbers do not weaken the CKKS query-privacy contribution, but they do narrow the document-privacy interpretation: both the known-plaintext anchor channel and the public PQ artefact must be treated as exposed. A deployment that needs stronger static-side confidentiality requires either a different static primitive or a composition that hides the PQ artefact itself.
8.4
Aligned off-the-shelf inversion stress test
Finally we run a generative inverter against the aligned space. The attacker is given GTR-base embeddings (d = 768), SVD truncation to k = d/2, the secret-rotation setting, and up to m = 500 known pairs for Procrustes alignment; the inverter is the off-the-shelf Vec2Text corrector with a larger budget than Experiment 7.2 (24 corrector iterations, max input length 96). For deterministic reproducibility on a host that could not fetch external corpora the run uses the script’s offline synthetic-news+PII corpus (120 held-out texts). The decisive control is the raw-embedding row. The reading is honest but limited (Table 11): no exact document or typed PII is recovered even by a known-R oracle, yet the raw embedding row is also at the BLEU floor (0.013), so this off-the-shelf corrector is too weak to certify the transform. It does not contradict the exact-lookup failure of Section 8.2; the remaining open risk is a learned or corpus-adapted decoder trained end-to-end on the rotated space, which we keep as the highest-priority future experiment (Section 10).
17
Table 12: Acc@1 under lightweight projection baselines at k = d/2 (random baselines: mean ± s.d. over three seeds). Encoder
Raw
SVD
Gaussian RP
Orthogonal RP
e5-small e5-base mpnet e5-large bge-m3
0.782 0.830 0.716 0.796 0.818
0.702 0.834 0.650 0.814 0.832
0.688 ± 0.016 0.781 ± 0.011 0.698 ± 0.003 0.765 ± 0.010 0.789 ± 0.004
0.737 ± 0.010 0.804 ± 0.017 0.705 ± 0.008 0.769 ± 0.009 0.810 ± 0.002
Table 13: SVD truncation vs. independent Gaussian noise at matched mean relative distortion (100 000-document gallery). NN overlap@10 is the overlap with raw-space neighbours; lower means less raw geometry preserved.
8.5
Encoder
k/d
σrec
SVD Acc@1
SVD NN@10
Noise Acc@1
Noise NN@10
e5-small e5-small e5-small e5-small e5-base e5-base e5-base e5-base
0.125 0.250 0.500 0.875 0.125 0.250 0.500 0.875
0.385 0.332 0.237 0.079 0.354 0.268 0.129 0.023
0.318 0.600 0.814 0.880 0.708 0.872 0.916 0.920
0.232 0.333 0.468 0.551 0.370 0.501 0.578 0.592
0.750 0.788 0.828 0.872 0.864 0.886 0.902 0.910
0.283 0.367 0.531 0.830 0.503 0.641 0.829 0.969
Baseline suite: projection and calibrated noise
To position the transform against natural alternatives rather than against the raw system alone, we compare SVD projection with Gaussian random projection and random orthogonal projection [43] at the same k = d/2 (Table 12), and with calibrated isotropic Gaussian noise matched at equal mean relative distortion (Table 13). Two engineering conclusions follow. First, the projection choice is encoder-dependent: SVD is strongest on the retrieval-trained d ≥ 768 encoders that are the method’s operating region, but random orthogonal projection beats SVD on mpnet and e5-small—so a deployment should run a baseline sweep, not assume SVD is universally best. Second, σrec is not a privacy metric: at k/d = 0.875 matched noise preserves almost all raw neighbours, and at the main k/d = 0.5 operating point SVD removes far more raw-neighbour structure than matched noise (0.578 vs. 0.829 NN overlap@10 on e5-base) while keeping Acc@1. The defensible claim is thus the narrow one: SVD is an encoder-dependent utility/leakage trade-off, not a noise mechanism that dominates all alternatives.
Figure 8: Utility/leakage diagnostic for SVD truncation and calibrated Gaussian noise (dashed: matched-σrec noise baselines).
18
Table 14: SVD truncation (k = d/2) vs. the raw space on BEIR. ∆ = SVD − raw; brackets are paired-bootstrap 95% CIs (104 resamples). Every ∆ nDCG@10 CI excludes 0.
8.6
Encoder Dataset
σrec raw nDCG@10 SVD nDCG@10
∆ nDCG@10 (95% CI)
e5-large e5-base e5-small e5-base e5-small
0.072 0.090 0.183 0.085 0.172
−0.069 [−0.091, −0.047] −0.051 [−0.072, −0.032] −0.079 [−0.103, −0.055] −0.022 [−0.032, −0.013] −0.025 [−0.035, −0.014]
SciFact SciFact SciFact NFCorpus NFCorpus
0.643 0.637 0.598 0.327 0.302
0.574 0.586 0.519 0.305 0.277
Benchmark generality on BEIR
The integral experiment uses one-million-document self-retrieval, a controlled geometry probe. To check that the metric-preservation reading is not an artefact of self-retrieval, we repeat the raw-vs-SVD comparison on two standard BEIR [44] datasets with graded relevance judgements— SciFact (5,183 docs, 300 queries) and NFCorpus (3,633 docs, 323 queries)—fitting Vk on the corpus at k = d/2 and comparing exact inner-product retrieval in Rd and in span(Vk ). Table 14 is a deliberate corrective to the self-retrieval reading. On both graded-relevance datasets and for every encoder, half-SVD truncation significantly reduces nDCG@10 (all CIs exclude zero, drops of 2–8 points). Decisively, e5-large—the one encoder that gained on the 106 self-retrieval probe—loses 0.069 nDCG@10 on SciFact. The denoiser effect is therefore real but task-dependent: on real graded IR the discarded spectrum still carries relevance, so k must be treated as a tunable accuracy cost via a k-sweep, exactly as the encoder-selection discussion below recommends. (Full end-to-end CKKS reranking on BEIR is left to future work; this experiment isolates the projection-fidelity property that the reranking preserves.)
9
Discussion
Encoder selection is part of the protocol. The protective wrapper is essentially metricpreserving in the projected space; the end-to-end deviation from the raw baseline is dominated by what SVD truncation does on the chosen encoder. Models trained with contrastive retrieval objectives (e5-*, bge-*) concentrate the retrieval signal in the top singular directions and recover most of the original quality after k = d/2 truncation; some of them even benefit from the truncation (linear-denoiser effect). Paraphrase-distilled models (mpnet) and very compact models (e5-small) do not show this concentration, and we recommend either replacing them with a retrieval-trained equivalent or running a k-sweep before deployment to find a k that simultaneously satisfies the application’s accuracy budget and σrec ≥ 0.10. The role of the rotation R: obfuscation, not a primitive. The secret rotation is an empirical obfuscation layer, not a cryptographic primitive. It contributes a defence channel orthogonal to SVD truncation, and even at k/d = 1.0 the unknown-R regime reduces off-the-shelf Vec2Text BLEU to the noise floor. Its limits are now measured rather than asserted (Section 8): a known-R attacker gains nothing beyond SVD; a known-plaintext attacker recovers R by orthogonal Procrustes from ≈ k leaked pairs (Table 8), which becomes an exact paragraph lookup when a reference corpus overlaps the collection (Table 9); and an end-to-end learned decoder remains the main untested case. The rotation’s value is therefore that it is the cheapest architectural layer with a measurable effect on an attacker who lacks aligned plaintext—not a security guarantee. The contribution of this paper is the measured privacy/latency/accuracy trade-off and its quantified boundaries, not the rotation in isolation. What CKKS hides and what it does not. The CKKS layer hides the numerical representation of the query and the exact similarity scores from the server. Two things it does not hide are 19
the identifiers of the candidates produced by stage-1 PQ filtering and the L2 -distances among them implicit in the order in which they are sent. An access-pattern attacker can therefore, over many queries, build a co-occurrence model of which documents are co-retrieved. Composing the pipeline with a PIR-style retrieval primitive (Tiptoe [34], SealPIR [35], OnionPIR [37], SimplePIR [36]) is the natural remedy; ours is engineered to be PIR-friendly because the ct-pt operations on the server are stateless and cluster-local. Parameter selection vs. hand-tuning. Compared with hand-tuned TenSEAL stock parameters, the configuration chosen by the offline grid search (Section 5) achieves a ≈ 1.7× speed-up at the same security level and the same ranking quality (within ∆Acc@1 ≤ 1 p.p. of the SVD-projected baseline). The selection is a one-off offline cost and adds nothing at run time; porting to a different hardware platform only requires re-running the same small benchmark grid.
10
Limitations and Required Experiments
We separate intrinsic limitations (properties of the construction under study) from the remaining open experiments. The stronger-attacker, baseline and generality experiments that earlier drafts listed as mandatory future work are now reported in Section 8; what is listed below as open is the genuinely residual set, kept as named scoped experiments rather than vague “future work” as a deliberate hedge against overclaiming. Intrinsic limitations. • Document privacy is not cryptographic. Erot is plaintext on the server; it is protected only by SVD truncation (a proxy) and the secret rotation (an empirical obfuscation layer). A known-R, known-plaintext or adaptive adversary defeats this layer. • Access patterns and PQ codes are exposed. CKKS hides values, not which candidates are reranked, and the public PQ codes are a lossy view of Erot . Production use requires composition with a PIR/ORAM layer plus a PQ-leakage analysis. • Encoder-dependence of the accuracy budget. The strict end-to-end criterion ∆Acc@1 ≥ −5 p.p. holds only on retrieval-trained encoders with d ≥ 768. Compact or paraphrase-distilled encoders need either replacement or a less aggressive k (which then violates the σrec ≥ 0.10 proxy). • Single-machine evaluation. The latency numbers in Experiment 7.4 are taken on loopback HTTP; a geographically distributed deployment will add (uncharacterised) network latency. Completed in this revision. The stronger-attacker programme is now executed (Section 8): known-plaintext Procrustes recovery of R (Table 8); the text-level reference-corpus lookup (Table 9); public-PQ-code leakage (Table 10); an aligned off-the-shelf inverter (Table 11); a projection and calibrated-noise baseline suite covering random projection, SVD-without-rotation and matched-distortion Gaussian noise (Tables 12–13); and a BEIR generality check on the projection step (Table 14). Remaining open experiments. 1. End-to-end learned decoder (highest priority). The aligned off-the-shelf corrector of Section 8.4 is too weak to certify protection—its raw control is already at the BLEU floor. The decisive test is an inversion model trained on rotated/SVD embeddings of part of the corpus and evaluated on a holdout; the current narrative explicitly does not claim robustness against it.
20
2. Typed-PII, multi-encoder σrec ablation. Replace the single-encoder, BLEU-only calibration of the σrec = 0.10 proxy with a multi-encoder ablation reporting BLEU, token overlap and typed-PII recovery (names, addresses, e-mail, phone, medical terms), which is what justifies (or refutes) the threshold. 3. Modern attack suite and full-pipeline benchmarks. Repeat the inversion study against the 2024–2026 attack generations that exploit the universal geometry of embedding spaces rather than a fixed basis orientation—few-shot alignment (ALGEN [10]), zero-shot inversion (ZSInvert [11]), unsupervised cross-space translation (vec2vec [12]) and online crossdomain inversion (Zero2Text [13])—with real text, and run the complete CKKS reranking (not only the projection step measured in Table 14) on BEIR, MIRACL and MS MARCO.
11
Conclusion
This paper is a scientific study of how SVD truncation and an unknown secret rotation reshape the privacy–accuracy–latency trade-off of semantic search; it is not a systems-engineering report and does not claim a deployable system. Three findings answer the research questions. (RQ1) A formal lower-L2 bound (Lemma 1) characterises exactly what a projection-restricted decoder cannot recover; it is a projection bound, not an inversion-security theorem, and it makes the proxy criterion σrec ≥ 0.10 precise only within that decoder class, the threshold itself being an engineering proxy. (RQ2) At 106 -document scale the construction’s protective layer is metricpreserving in span(Vk ) (within the 5-seed CI), the query side is cryptographically protected by CKKS at sub-second p95 , while document and access-pattern privacy are not cryptographic and the public PQ artefact is an exposed channel whose leakage we now quantify (Section 8)—so the secret rotation is characterised as an empirical obfuscation effect against an off-the-shelf inverter, not as a guarantee. (RQ3) For retrieval-trained encoders with d ≥ 768, data-driven SVD truncation to k = d/2 acts as a linear denoiser, improving the four ranking metrics over the raw baseline rather than degrading them—a finding of independent interest beyond the privacy setting. We do not claim the privacy problem is solved. This work delivers a measured privacy, accuracy and latency operating point and a characterised denoising phenomenon under a clearly delimited threat model, together with a stronger-attacker analysis (Section 8) that quantifies where the document-side obfuscation fails—known-plaintext recovery of R, reference-corpus lookup and public-PQ-code leakage—and leaves an end-to-end learned decoder as the principal open question. Composing the protocol with a PIR-style access-pattern hider—natural given the stateless server-side ct-pt operations—is the most attractive architectural extension.
Reproducibility All scripts, notebooks, configuration files and JSON output of the experiments are released at https://github.com/sergkurilenko/research/tree/article1. The integral experiment is driven by a single Python script with deterministic seeds and a JSON output file; the CKKS parameter-selection benchmark ships its configuration grid and timings as a CSV. The corpus (one-million Russian-Wikipedia paragraphs) is reproducibly sliced from a public Wikipedia dump with the date and content checksum recorded.
References [1] N. Reimers and I. Gurevych, “Sentence-BERT: Sentence Embeddings using Siamese BERT-Networks,” in Proc. EMNLP, 2019, pp. 3982–3992.
21
[2] L. Wang, N. Yang, X. Huang, et al., “Text Embeddings by Weakly-Supervised Contrastive Pretraining,” arXiv:2212.03533, 2022. [3] J. Ni et al., “Large Dual Encoders Are Generalizable Retrievers,” in Proc. EMNLP, 2022, pp. 9844–9855. [4] J. Chen, S. Xiao, P. Zhang, K. Luo, D. Lian, and Z. Liu, “BGE M3-Embedding: Multi-Lingual, Multi-Functionality, Multi-Granularity Text Embeddings Through Self-Knowledge Distillation,” arXiv:2402.03216, 2024. [5] V. Karpukhin et al., “Dense Passage Retrieval for Open-Domain Question Answering,” in Proc. EMNLP, 2020, pp. 6769–6781. [6] O. Khattab and M. Zaharia, “ColBERT: Efficient and Effective Passage Search via Contextualised Late Interaction over BERT,” in Proc. ACM SIGIR, 2020, pp. 39–48. [7] J. X. Morris, V. Kuleshov, V. Shmatikov, and A. M. Rush, “Text Embeddings Reveal (Almost) As Much As Text,” in Proc. EMNLP, 2023. [8] H. Li, M. Xu, and Y. Song, “Sentence Embedding Leaks More Information than You Expect: Generative Embedding Inversion Attack to Recover the Whole Sentence,” in Findings of ACL, 2023, pp. 14022–14040. [9] Y.-H. Huang, Y. Tsai, H. Hsiao, H.-Y. Lin, and S.-D. Lin, “Transferable Embedding Inversion Attack: Uncovering Privacy Risks in Text Embeddings without Model Queries,” in Proc. ACL (Long), 2024, pp. 4193–4205. [10] Y. Chen, Q. Xu, and J. Bjerva, “ALGEN: Few-shot Inversion Attacks on Textual Embeddings via Cross-Model Alignment and Generation,” in Proc. ACL (Long), 2025, pp. 24330–24348. arXiv:2502.11308. [11] C. Zhang, J. X. Morris, and V. Shmatikov, “Universal Zero-shot Embedding Inversion,” arXiv:2504.00147, 2025. [12] R. Jha, C. Zhang, V. Shmatikov, and J. X. Morris, “Harnessing the Universal Geometry of Embeddings (vec2vec),” arXiv:2505.12540, 2025. [13] D. Kim, D. Kang, K. Lee, H. Baek, and B. B. Kang, “Zero2Text: Zero-Training Cross-Domain Inversion Attacks on Textual Embeddings,” arXiv:2602.01757, 2026. [14] S. Zeng et al., “The Good and the Bad: Exploring Privacy Issues in Retrieval-Augmented Generation (RAG),” in Findings of ACL, 2024, pp. 4505–4524. [15] C. Song and A. Raghunathan, “Information Leakage in Embedding Models,” in Proc. ACM CCS, 2020, pp. 377–390. [16] R. Shokri et al., “Membership Inference Attacks Against Machine Learning Models,” in Proc. IEEE S&P, 2017, pp. 3–18. [17] N. Carlini et al., “Extracting Training Data from Large Language Models,” in Proc. USENIX Security, 2021, pp. 2633–2650. [18] C. Dwork, “Differential Privacy,” in Proc. ICALP, 2006, pp. 1–12. [19] M. Abadi et al., “Deep Learning with Differential Privacy,” in Proc. ACM CCS, 2016, pp. 308–318. [20] L. Lyu, X. He, and Y. Li, “Differentially Private Representation for NLP,” in Findings of EMNLP, 2020, pp. 2355–2365. [21] K. Kenthapadi, A. Korolova, I. Mironov, and N. Mishra, “Privacy via the Johnson-Lindenstrauss Transform,” J. Privacy and Confidentiality, vol. 5, no. 1, 2013. [22] K. Liu, H. Kargupta, and J. Ryan, “Random Projection-Based Multiplicative Data Perturbation for Privacy Preserving Distributed Data Mining,” IEEE TKDE, vol. 18, no. 1, 2006, pp. 92–106.
22
[23] J. H. Cheon, A. Kim, M. Kim, and Y. Song, “Homomorphic Encryption for Arithmetic of Approximate Numbers,” in Advances in Cryptology—ASIACRYPT 2017, LNCS 10624, pp. 409–437. [24] J. H. Cheon, K. Han, A. Kim et al., “Bootstrapping for Approximate Homomorphic Encryption,” in Advances in Cryptology—EUROCRYPT 2018, LNCS 10820, pp. 360–384. [25] M. Albrecht et al., “Homomorphic Encryption Security Standard,” HomomorphicEncryption.org, 2018. [26] M. R. Albrecht, R. Player, and S. Scott, “On the Concrete Hardness of Learning with Errors,” Journal of Mathematical Cryptology, vol. 9, no. 3, 2015, pp. 169–203 (lattice-estimator methodology). [27] P. H. Schönemann, “A Generalized Solution of the Orthogonal Procrustes Problem,” Psychometrika, vol. 31, no. 1, 1966, pp. 1–10. [28] A. Al Badawi et al., “OpenFHE: Open-Source Fully Homomorphic Encryption Library,” in Proc. WAHC ’22, 2022, pp. 53–63. [29] R. Dathathri et al., “EVA: An Encrypted Vector Arithmetic Language and Compiler for Efficient Homomorphic Computation,” in Proc. ACM PLDI, 2020, pp. 546–561. [30] R. Dathathri et al., “CHET: An Optimizing Compiler for Fully-Homomorphic Neural-Network Inferencing,” in Proc. ACM PLDI, 2019, pp. 142–156. [31] W. Jung, S. Kim, J. H. Ahn et al., “Over 100x Faster Bootstrapping in Fully Homomorphic Encryption through Memory-centric Optimisation with GPUs,” IACR TCHES, vol. 2021, no. 4, pp. 114–148. [32] F. Boemer et al., “Intel HEXL: Accelerating Homomorphic Encryption with Intel AVX512-IFMA52,” in Proc. WAHC ’21, 2021, pp. 57–62. [33] R. Gilad-Bachrach et al., “CryptoNets: Applying Neural Networks to Encrypted Data with High Throughput and Accuracy,” in Proc. ICML, 2016, vol. 48, pp. 201–210. [34] A. Henzinger, E. Dauterman, H. Corrigan-Gibbs, and N. Zeldovich, “Private Web Search with Tiptoe,” in Proc. ACM SOSP, 2023. [35] S. Angel, H. Chen, K. Laine, and S. Setty, “PIR with Compressed Queries and Amortised Query Processing,” in Proc. IEEE S&P, 2018, pp. 962–979. [36] A. Henzinger, M. M. Hong, H. Corrigan-Gibbs, S. Meiklejohn, and V. Vaikuntanathan, “One Server for the Price of Two: Simple and Fast Single-Server Private Information Retrieval (SimplePIR),” in Proc. USENIX Security, 2023. [37] M. H. Mughees, H. Chen, and L. Ren, “OnionPIR: Response Efficient Single-Server PIR,” in Proc. ACM CCS, 2021, pp. 2292–2306. [38] N. Halko, P.-G. Martinsson, and J. A. Tropp, “Finding Structure with Randomness: Probabilistic Algorithms for Constructing Approximate Matrix Decompositions,” SIAM Review, vol. 53, no. 2, 2011, pp. 217–288. [39] H. Jegou, M. Douze, and C. Schmid, “Product Quantisation for Nearest Neighbor Search,” IEEE TPAMI, vol. 33, no. 1, 2011, pp. 117–128. [40] Y. A. Malkov and D. A. Yashunin, “Efficient and Robust Approximate Nearest Neighbour Search Using Hierarchical Navigable Small World Graphs,” IEEE TPAMI, vol. 42, no. 4, 2020, pp. 824–836. [41] J. Wang, X. Yi, R. Guo et al., “Milvus: A Purpose-Built Vector Data Management System,” in Proc. ACM SIGMOD, 2021, pp. 2614–2627. [42] C. Eckart and G. Young, “The Approximation of One Matrix by Another of Lower Rank,” Psychometrika, vol. 1, no. 3, 1936, pp. 211–218. [43] W. B. Johnson and J. Lindenstrauss, “Extensions of Lipschitz Mappings into a Hilbert Space,” Contemporary Mathematics, vol. 26, 1984, pp. 189–206.
23
[44] N. Thakur, N. Reimers, A. Rücklé, A. Srivastava, and I. Gurevych, “BEIR: A Heterogeneous Benchmark for Zero-shot Evaluation of Information Retrieval Models,” in Proc. NeurIPS Datasets and Benchmarks Track, 2021. [45] K. Papineni et al., “BLEU: a Method for Automatic Evaluation of Machine Translation,” in Proc. ACL, 2002, pp. 311–318. [46] P. Lewis et al., “Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks,” in Proc. NeurIPS, 2020. [47] A. Asai et al., “Self-RAG: Learning to Retrieve, Generate, and Critique through Self-Reflection,” in Proc. ICLR, 2024. [48] S.-Q. Yan et al., “Corrective Retrieval Augmented Generation,” arXiv:2401.15884, 2024. [49] Y. Gao et al., “Retrieval-Augmented Generation for Large Language Models: arXiv:2312.10997, 2024.
A Survey,”
[50] S. M. Kurilenko, “Hybrid Method for Privacy-Preserving Semantic Search Based on Homomorphic Encryption and Random Projections,” Vestnik Komp’yuternykh i Informatsionnykh Tekhnologiy, no. 3, 2026, pp. 44–49. doi:10.14489/vkit.2026.03.pp.044-049.
24