GoldenRetriever: Non-Interactive Homomorphic Encrypted Retrieval for Privacy-Preserving RAG Yang Gao1 , Gang Quan2 , Scott Piersall1, Qian Lou1 , Dongdong Wang3, Liqiang Wang1 1 Department of Computer Science, University of Central Florida, Orlando, FL, USA 2 Electrical and Computer Engineering Department, Florida International University, Miami, FL, USA 3 College of Design, Construction and Planning, University of Florida, Gainesville, FL, USA {yang.gao, sc382961, qian.lou, liqiang.wang}@ucf.edu [email protected] [email protected]
arXiv:2607.29019v1 [cs.CR] 31 Jul 2026
Abstract Retrieval-Augmented Generation (RAG) enhances large language models by incorporating external knowledge, but existing pipelines typically operate on plaintext data, raising significant privacy concerns. Prior work on privacy-preserving retrieval leverages cryptographic techniques such as homomorphic encryption (HE) and private information retrieval (PIR), but often relies on interactive protocols or ranking-based selection mechanisms that incur high latency and potential information leakage. In this paper, we propose a practical noninteractive encrypted retrieval framework for RAG based on threshold selection. Instead of performing expensive top-k ranking under encryption, our approach selects documents whose similarity scores exceed a predefined threshold, reducing computational complexity from quadratic to linear in the corpus size. We implement this design using CKKS-based homomorphic computation, enabling fully encrypted similarity evaluation and document selection without revealing query content, intermediate scores, or selected indices. To bridge the gap between approximate encrypted computation and discrete token reconstruction, we introduce a precision-stable mask polarization method that ensures accurate recovery of selected documents. Experiments on standard retrieval benchmarks demonstrate that our approach achieves competitive retrieval effectiveness while significantly reducing latency compared to rankingbased encrypted methods. These results highlight threshold-based selection as a practical foundation for scalable and secure RAG systems.
1 Introduction Retrieval-Augmented Generation (RAG) has emerged as a dominant paradigm for knowledgeintensive natural language processing tasks,
enabling large language models (LLMs) to incorporate external information during inference. By retrieving relevant documents from a corpus and conditioning generation on them, RAG systems improve factual accuracy and domain adaptability. However, standard RAG pipelines assume that both user queries and document corpora are processed in plaintext on the retrieval server, which raises serious privacy concerns in applications involving sensitive data, such as healthcare, finance, and enterprise knowledge systems. To address these concerns, recent work has explored privacy-preserving retrieval using cryptographic techniques such as homomorphic encryption (HE), private information retrieval (PIR), and secure multi-party computation. While these approaches enhance data confidentiality, many rely on interactive protocols or multi-round communication between the client and server. Such interaction not only increases latency and system complexity, but also introduces additional avenues for information leakage, including access patterns and intermediate similarity scores, which may expose sensitive relationships between queries and documents. In contrast, practical RAG systems typically favor a simple, stateless retrieval interface, motivating the need for non-interactive encrypted retrieval mechanisms. A central challenge in this setting is enabling efficient and secure document selection without interaction. Existing secure retrieval methods often depend on iterative querying or adaptive selection procedures, which further exacerbate communication overhead and leakage risks. A natural approach to non-interactive selection is top-k retrieval; however, implementing top-k ranking under homomorphic encryption is computationally prohibitive due to its reliance on large numbers of pairwise comparisons and costly polynomial approximations. Our experiments confirm this lim-
itation: homomorphic top-k selection incurs extremely high latency (e.g., exceeding 104 seconds per query even at modest scales), rendering it impractical for real-world deployment. This exposes a fundamental mismatch between conventional retrieval paradigms and the constraints imposed by encrypted computation. In this paper, we propose a practical noninteractive encrypted retrieval framework based on threshold selection as an alternative to top-k ranking. Instead of explicitly sorting or ranking documents, our method selects documents whose similarity scores exceed a predefined threshold, reducing computational complexity from quadratic to linear in the corpus size. We implement this selection using polynomial indicator functions under the CKKS homomorphic encryption scheme, enabling fully encrypted similarity evaluation and document filtering without interaction. To support downstream generation, we further design a precision-safe token extraction pipeline that ensures accurate reconstruction of selected documents despite the approximate nature of the CKKS homomorphic encryption scheme We evaluate our framework on multiple retrieval benchmarks and demonstrate that thresholdbased encrypted retrieval achieves comparable effectiveness to plaintext baselines while significantly reducing latency compared to top-k-based approaches. Our results highlight the necessity of rethinking retrieval design under homomorphic encryption and establish threshold-based selection as a practical foundation for secure RAG systems. Contributions. We summarize our contributions as follows: • We present a novel threshold-based noninteractive encrypted retrieval framework for privacy-preserving RAG, eliminating the need for homomorphic top-k ranking while preserving retrieval quality. • We introduce a precision-stable mask polarization method that enables reliable discrete token reconstruction from approximate CKKS computations. • We show both theoretically and empirically that threshold selection reduces encrypted retrieval complexity from quadratic-ranking style computation to linear document-wise evaluation.
• Extensive experiments demonstrate that our approach preserves retrieval effectiveness while substantially reducing latency compared with homomorphic ranking-based retrieval.
2
Related Work
Privacy-preserving RAG. Recent work has begun to explore privacy-preserving retrievalaugmented generation (RAG) systems. RemoteRAG (Cheng et al., 2025) studies cloudbased RAG with privacy-aware query processing, combining embedding perturbation and secure distance computation to reduce information leakage. SecureRAG (Bassit and Boddeti, 2025) further considers end-to-end security risks in RAG, including prompt injection and retrieval leakage, and integrates secure retrieval with controlled document access. Other systems such as ppRAG (Ye et al., 2025) and p2RAG (Ming et al., 2026) explore privacy-preserving RAG in outsourced or untrusted environments using combinations of cryptographic primitives and system-level defenses. However, these approaches typically rely on multistage or interactive retrieval procedures, which introduce additional communication overhead and potential leakage of access patterns. Secure and encrypted retrieval. A large body of work studies privacy-preserving retrieval through private information retrieval (PIR), secure multi-party computation (MPC), and homomorphic encryption (HE). These techniques enable hiding query content or retrieval behavior, but many require multiple rounds of interaction or iterative probing (Chor et al., 1998; Gentry, 2009). Recent work on encrypted dense retrieval extends these ideas to embedding-based search, allowing similarity computation over encrypted vectors (Mazzone et al., 2025). While effective for secure ranking, these methods typically focus on retrieval itself and do not address the downstream requirement of reconstructing discrete token sequences for generation. Homomorphic ranking and approximate computation. Homomorphic comparison, sorting, and top-k selection under CKKS have been studied using polynomial approximation techniques (Cheon et al., 2017; Mazzone et al., 2025). These methods enable ranking over encrypted data, but the approximate nature of CKKS intro-
duces numerical errors that lead to near-binary outputs rather than exact decisions. Such approximation is often acceptable for ranking metrics, but it becomes problematic when subsequent operations require discrete correctness, such as token extraction in RAG pipelines. Our contribution. In contrast to prior work, we study a complementary design point: a non-interactive encrypted retrieval framework for RAG, where a retrieval server processes a single encrypted query and returns encrypted results in one shot without interaction. Furthermore, we explicitly address the gap between approximate homomorphic selection and discrete token reconstruction, ensuring reliable document extraction for downstream generation.
3 Problem Setup and Threat Model We consider a three-party architecture consisting of a client, a retrieval server, and an LLM server. The document corpus is stored in plaintext on the retrieval server. The LLM server generates a public/secret key pair under the CKKS homomorphic encryption scheme, along with the required evaluation keys (e.g., relinearization and rotation keys). The public key is distributed to both the client and the retrieval server, while the evaluation keys are provided to the retrieval server to enable homomorphic computation. The secret key remains exclusively on the LLM server. The client encodes a query into an embedding, encrypts it using the public key, and submits the encrypted query to the retrieval server. The retrieval server is assumed to be honest-butcurious: it follows the prescribed protocol but may attempt to infer sensitive information from observable data. Since the server does not possess the secret key, it cannot decrypt the query, intermediate similarity scores, or final outputs. All similarity computation and document selection are performed in the encrypted domain using homomorphic operations. To enable non-interactive retrieval, the server applies a threshold-based selection mechanism over encrypted similarity scores to identify relevant documents, without iterative querying or multi-round communication. The server then performs masked token extraction and returns an encrypted representation of the candidate set to the LLM server. In this representation, selected documents preserve their original token values, while
non-selected documents are masked to zero within the ciphertext. Consequently, the retrieval server gains no information about which documents are selected. The LLM server decrypts the received ciphertexts, reconstructs the selected documents, and performs downstream generation. Because the full corpus structure is preserved and no indices are revealed during retrieval, our framework prevents access-pattern leakage. Our design ensures that the retrieval server does not observe the query content, similarity scores, or selected document indices. We emphasize that our threat model protects query privacy and selection privacy, while the document corpus itself remains in plaintext on the retrieval server. Our objective is to enable accurate RAG-style retrieval under strong privacy constraints, ensuring (1) query confidentiality, (2) protection of intermediate similarity scores, and (3) concealment of selected document indices, all within a noninteractive retrieval pipeline. Our framework is designed for deployment scenarios where the document corpus is owned by or intentionally exposed to the retrieval service, while user queries and retrieval outcomes remain confidential. Protecting the document corpus itself is outside the scope of this work.
4
Method
We propose a non-interactive encrypted retrieval framework for retrieval-augmented generation (RAG). Our approach performs similarity computation, threshold-based selection, and document extraction entirely in the encrypted domain, without revealing query content or selection results to the retrieval server. In the following subsections, we describe each component in detail. 4.1
Architecture Overview
Our framework enables non-interactive encrypted retrieval for RAG through a three-party architecture consisting of a client, a retrieval server, and an LLM server. The design ensures that encrypted retrieval integrates seamlessly with downstream generation while preserving query and selection confidentiality. 4.1.1
Key Generation and Query Encryption.
The LLM server generates a public–secret key pair under the CKKS homomorphic encryption
Ans
USER (pk) Make query
LLM (pk/sk) Q
Q
Retriever (pk) Retrieve docs Grader [0.7273, 0.8931, 0.1645, …, 0.0012]
Threshold Selection [0.7273 > 0.6 0.8931 > 0.6 0.1645 > 0.6 …, 0.0012 > 0.6
1.01, 1.02, 0.02, 0.03]
Polarization
PIR
[1.0000001, 1.0000002, 0.0000002, …, 0.0000001]
[1.0000001 9703, 1.0000002 13602, 0.0000002 2075, …, 0.0000001 1037]
Figure 1: Overview of the proposed non-interactive encrypted retrieval framework for privacy-preserving RAG.
scheme, along with evaluation keys (e.g., relinearization and rotation keys). The public key is distributed to the client, while the evaluation keys are provided to the retrieval server. The secret key remains exclusively on the LLM server. Upon receiving a user query, the client encodes it into a normalized embedding vector q ∈ RD , encrypts it using the public key, and submits the encrypted query to the retrieval server. 4.1.2 Encrypted Retrieval. The retrieval server stores the document corpus in plaintext form. Each document is represented in two formats: • Embedding matrix D ∈ RB×D , where each row di is a normalized embedding of document i. • Token matrix X ∈ ZB×T , where each row contains the fixed-length token ID sequence of document i. These two matrices share the same row index, ensuring that similarity computation and token extraction remain consistent. Given the encrypted query embedding, the retrieval server computes encrypted cosine similarity scores for all documents, applies thresholdbased selection using a homomorphic indicator function, and produces an encrypted binary mask indicating selected documents. All selection operations are executed without decryption and without interaction with the client.
4.1.3
Encrypted Document Extraction and Generation.
Using the encrypted selection mask, the retrieval server performs masked token extraction over the document matrix and returns encrypted token sequences corresponding to selected documents. These ciphertexts are sent to the LLM server, which decrypts them using the secret key and proceeds with standard RAG-style generation. This separation ensures that (1) the retrieval server never observes plaintext queries or selected document indices, (2) the client never accesses the secret key, and (3) the LLM server only receives selected documents after encrypted filtering. A central technical challenge lies in ensuring that approximate homomorphic computation produces selection masks sufficiently precise for discrete token extraction, which we address in Section 4.4. 4.2
Encrypted Cosine Similarity
We adopt embedding-based dense retrieval using cosine similarity. All document embeddings are precomputed, normalized, and stored in plaintext on the retrieval server. Let D ∈ RB×D
(1)
denote the embedding matrix, where each row di is unit-normalized. Given a normalized query embedding q ∈ RD , the client encrypts q using CKKS and submits the
ciphertext to the retrieval server. Cosine similarity reduces to a dot product: si = qT di
(2)
Because document embeddings are stored in plaintext, similarity computation is performed as ciphertext–plaintext multiplications followed by homomorphic additions. This design significantly reduces computational depth and noise growth compared to ciphertext–ciphertext operations. To enable efficient batched evaluation over B documents, we leverage CKKS SIMD packing. The encrypted query vector is replicated across slots corresponding to document embeddings, allowing parallel evaluation of multiple similarity scores within a single ciphertext. The resulting encrypted score vector s ∈ RB
(3)
Specifically, given a threshold τ , we compute mi ≈ Ind(si − τ ),
(5)
where Ind(·) is an indicator function that outputs values close to 1 when the input lies within a target interval and close to 0 otherwise. In practice, this is implemented in CKKS as a Chebyshevapproximated interval indicator function, following (Mazzone et al., 2025), where the target rank range is encoded as a homomorphic range test. Non-Interactive Property. The thresholdbased formulation allows all documents to be evaluated independently without iterative refinement or multi-round interaction. This enables a fully non-interactive retrieval process, where the server computes selection results in a single pass over the encrypted score vector.
4.3 Threshold-Based Selection
Discussion. Unlike fixed-size selection mechanisms, threshold-based selection produces a variable number of retrieved documents. In practice, the threshold τ can be tuned to balance retrieval quality and output size. We study the impact of this trade-off in Section 6.
Given the encrypted similarity score vector
4.4
contains approximate similarity values for all documents and serves as input to the threshold-based selection mechanism.
Threshold-based selection under homomorphic encryption produces an approximate binary mask
s ∈ RB , where each element si represents the similarity between the query and document i, our goal is to identify relevant documents in a non-interactive manner. Selection via Thresholding. We adopt a threshold-based selection strategy, where documents with similarity scores exceeding a predefined threshold τ are selected. The selection mask is defined as mi = 1(si > τ ),
Precision-Stable Mask Polarization
m = b + ǫ,
Homomorphic Implementation. Under homomorphic encryption, the indicator function cannot be evaluated directly. We adopt the indicator function construction introduced in (Mazzone et al., 2025), which enables evaluating range conditions over encrypted values using polynomialbased techniques.
|ǫ| ≤ δ,
(6)
where b denotes the ideal binary selection result and ǫ captures approximation errors introduced by CKKS encoding, rescaling, and polynomial evaluation of the indicator function. Precision Requirement. ID x ∈ [0, V ), we obtain
After masking a token
x̃ = mx.
(4)
where 1(·) denotes the indicator function. This formulation avoids explicit ranking and enables document selection using only pointwise operations over the score vector.
b ∈ {0, 1},
(7)
To guarantee correct integer reconstruction after decryption and rounding, we require |x̃ − x| < 0.5.
(8)
Assuming a conservative vocabulary upper bound V = 60,000, this imposes |m − 1| <
0.5 = 8.33 × 10−7 . V
(9)
A symmetric bound applies when m should equal 0. Therefore, the polarization function must reduce mask deviation below this tolerance.
Polynomial Construction. We construct a polynomial f (x) satisfying the following boundary constraints: f (0) = 0,
f (1) = 1,
(10)
′
f (0) = 0,
′
f (1) = 0,
(11)
′′
f (0) = 0,
′′
f (1) = 0,
(12)
′′′
′′′
(13)
f (0) = 0,
f (1) = 0.
These eight independent constraints require a polynomial of degree at least seven. Solving the resulting linear system yields the minimal-degree solution: f (x) = 35x4 − 84x5 + 70x6 − 20x7 .
(14)
This polynomial exhibits third-order flatness at both 0 and 1, ensuring strong contraction of small perturbations near binary values. Error Contraction Analysis. For m = b + ǫ with b ∈ {0, 1} and small ǫ, Taylor expansion gives f (b + ǫ) = b +
f (4) (b) 4 ǫ + O(ǫ5 ). 4!
(15)
Therefore, the output error scales as |f (m) − b| = O(ǫ4 ).
(16)
Given empirical mask deviation δ ≈ 0.02, we obtain δ4 ≈ 1.6 × 10−7 , (17) which satisfies the required tolerance up to a moderate constant factor. This confirms that the chosen degree-7 polynomial achieves sufficient precision for discrete token recovery. HE Cost Consideration and Generalization. The degree of the polarization polynomial is determined by the required output precision, which in turn depends on the vocabulary size V . Specifically, to guarantee correct token recovery after rounding, the mask error must satisfy |m − b| <
0.5 . V
(18)
Given an upper bound on the input deviation δ, the polynomial degree can be chosen such that the contracted error O(δr ) meets this requirement, where r is determined by the order of flatness at the boundaries.
In our setting with V = 60,000 and empirical δ ≈ 0.02, a degree-7 polynomial (with thirdorder flatness) is sufficient. For different vocabulary sizes or precision requirements, the same construction procedure can be applied to select an appropriate polynomial degree. Larger vocabularies require stricter output precision and may necessitate higher-degree polynomials, while smaller vocabularies allow lower-degree approximations. The degree-7 polynomial can be evaluated using Horner-style computation with three multiplicative levels under CKKS, maintaining manageable noise growth. Increasing the degree improves error contraction but incurs additional multiplicative depth and rescaling cost, highlighting a tradeoff between precision and efficiency. 4.5
Secure Token Extraction
After obtaining the polarized mask vector m ∈ {0, 1}B , we extract selected documents in the encrypted domain without revealing their indices. Recall that the corpus is represented as a token matrix X ∈ ZB×T , where each row corresponds to a document and each column corresponds to a token position. Column-wise Masking. For each token position j ∈ {1, . . . , T }, we construct the column vector xj = X:,j ∈ ZB . We then compute the masked column x̃j = m ⊙ xj ,
(19)
where ⊙ denotes element-wise multiplication. Since m is encrypted and xj is stored in plaintext, this operation corresponds to ciphertext–plaintext multiplication under CKKS. The resulting x̃j remains encrypted and contains nonzero entries only for selected documents. Full-Structure Return. To prevent index leakage and access-pattern exposure, we return all B rows of the masked matrix to the LLM server, including rows corresponding to non-selected documents (which evaluate to zero after masking). The retrieval server does not observe which rows are effectively selected.
Formally, the retrieval server outputs encrypted columns {x̃1 , . . . , x̃T }, which together represent the masked document matrix. Decryption and Reconstruction. Upon receiving the encrypted masked matrix, the LLM server decrypts each column and reconstructs token sequences. Due to the precision guarantees established in Section 4.4, masked token values satisfy |x̃ − x| < 0.5, ensuring correct integer recovery via rounding.
Threshold-Based Selection. Threshold-based selection operates independently on each similarity score, resulting in O(B) homomorphic evaluations. Each selection is implemented via a polynomial-based indicator function, requiring only a small number of multiplicative levels. This design avoids sorting or pairwise comparisons and enables efficient single-pass selection over the encrypted score vector. Mask Polarization. Mask polarization applies a fixed-degree polynomial to each element of the selection mask, resulting in O(B) operations. In our implementation, the degree-7 polynomial requires three multiplicative levels and introduces only modest overhead compared to similarity computation.
Security Considerations. Because masking and extraction occur entirely in the encrypted domain, the retrieval server does not learn the query content, similarity scores, or selected document indices. Returning the full B × T structure further prevents access-pattern leakage during retrieval.
Token Extraction. Masked token extraction requires O(BT ) ciphertext–plaintext multiplications, as each column of the token matrix is multiplied with the encrypted mask vector. This stage dominates the overall computational cost due to the size of the document matrix.
5 Complexity and Security Analysis
Overall Complexity. The total computational complexity of our framework is
We analyze the computational cost of each component in our encrypted retrieval pipeline to understand its scalability under homomorphic encryption. Our framework is designed to avoid iterative interaction and ranking procedures, enabling a single-pass evaluation over the document corpus. As a result, the overall complexity is linear in the number of documents, with the dominant cost arising from similarity computation and token extraction. Below, we break down the complexity of each stage. 5.1 Computational Complexity Let B denote the number of documents, D the embedding dimension, and T the fixed token length per document. Similarity Computation. Encrypted cosine similarity requires O(BD) ciphertext–plaintext multiplications and homomorphic additions. Since document embeddings are stored in plaintext, this stage avoids ciphertext–ciphertext multiplication, significantly reducing multiplicative depth and noise growth. By leveraging CKKS SIMD packing, multiple similarity scores can be computed in parallel within a single ciphertext.
O(BD + B + BT ) = O(B(D + T )), which scales linearly with the corpus size. In practice, the dominant cost arises from similarity computation and token extraction. In our current implementation, end-to-end latency for B = 20 documents is on the order of 103 seconds per query. While slower than plaintext retrieval, this cost reflects a fully non-interactive encrypted pipeline with strong privacy guarantees. Future optimizations may reduce latency through improved batching strategies, more efficient packing schemes, or hardware acceleration. 5.2
Security Analysis
We assume an honest-but-curious retrieval server that follows the protocol but may attempt to infer sensitive information from observable data. Query Confidentiality. Query confidentiality follows directly from the semantic security of the CKKS encryption scheme. Since the retrieval server only receives ciphertexts encrypted under the public key and never possesses the secret key, it cannot recover the plaintext query embedding beyond negligible probability.
Score Confidentiality. All similarity scores and intermediate values remain encrypted throughout computation. The retrieval server observes only ciphertexts and cannot recover plaintext similarity values. Selection Privacy and Access-Pattern Protection. Unlike conventional top-k retrieval, our framework never reveals document indices during encrypted computation. Document selection is performed entirely in the encrypted domain, and the retrieval server always returns a masked representation of the complete candidate set rather than only the selected documents. Selected documents retain their token values, while non-selected documents are masked to zero. Because the output preserves the full candidate-set structure and exposes no explicit indices, the retrieval server cannot distinguish which documents satisfy the retrieval criterion, thereby mitigating access-pattern leakage. Security Assumptions Our analysis assumes the semantic security of the CKKS encryption scheme and an honest-but-curious retrieval server. We do not consider side-channel attacks or malicious adversaries deviating from the protocol. Limitations. The document corpus is stored in plaintext on the retrieval server and is therefore not protected. Our framework focuses on protecting query privacy and selection privacy, and does not aim to conceal the corpus itself.
6 Experiments
Unless otherwise specified, the main experiments use Q = 50 queries, each with B = 100 candidate documents. To study scalability, we further increase the candidate set size to B = 500 and B = 1000 while keeping the number of queries fixed. Because homomorphic computation remains expensive, this controlled construction allows us to systematically evaluate retrieval effectiveness and runtime under encrypted settings. Token Representation. Each document is tokenized into a fixed-length sequence of length T , where token IDs are represented as integers. Implementation Details. All experiments were conducted on a server equipped with dual Intel Xeon Silver 4114 CPUs (20 physical cores, 40 hardware threads, 2.20 GHz), 251 GB RAM, running Ubuntu 24.04.4 LTS. The implementation was built using OpenFHE 1.1.2. No GPU acceleration was used. Evaluation Metrics. metrics:
We report the following
• Recall: fraction of relevant documents successfully selected. • Token Accuracy: percentage of correctly recovered tokens after decryption. • Document Accuracy: percentage of documents whose full token sequences are correctly reconstructed.
6.1 Experimental Setup Datasets. We evaluate the proposed framework on several retrieval benchmarks, including MS MARCO, Natural Questions, HotpotQA, and FiQA. For each dataset, we build evaluation subsets consisting of Q queries and their corresponding candidate document sets. Embedding Model. We use the BGE-base dense retrieval model to encode both queries and documents into 384-dimensional normalized embeddings. Corpus Construction. For each query, we construct a candidate set containing two relevant (positive) documents and a collection of non-relevant (negative) documents. Negative documents are sampled from documents associated with other queries to provide a diverse yet controlled retrieval setting.
• Latency: end-to-end runtime per query. • Avg. Selected Documents: average number of documents selected per query. Due to the high computational cost of homomorphic evaluation, we adopt a controlled evaluation protocol following common practice in homomorphic-encryption research. Rather than evaluating over the full benchmark corpora, we construct candidate sets with controlled sizes, allowing systematic comparison of retrieval effectiveness, reconstruction accuracy, and computational cost under different encrypted retrieval strategies. We further evaluate scalability by increasing the candidate set size from 100 to 1000 documents. This controlled setting isolates the effect of the retrieval algorithm from the overwhelming computational cost of large-scale homomor-
phic inference, enabling reproducible and meaningful comparisons across methods. 6.2 Main Results We compare our threshold-based encrypted retrieval framework against a plaintext baseline and a ranking-based encrypted baseline. As shown in Table 1, the proposed thresholdbased method achieves the same retrieval and reconstruction accuracy as the plaintext and rankingbased encrypted baselines on this evaluation setting. However, compared with ranking-based encrypted retrieval, our method substantially reduces end-to-end latency, decreasing runtime from 16579.9 seconds to 1051.8 seconds. Although plaintext retrieval remains much faster, the proposed method provides a practical non-interactive encrypted alternative while preserving full reconstruction quality in our experiments. 6.3 Latency Breakdown To better understand the computational bottlenecks of the proposed pipeline, we report the runtime contribution of each major stage. The latency breakdown shows that similarity computation is the single largest component, accounting for 31.9% of the total runtime. Token decryption and token reconstruction together contribute nearly half of the overall cost, indicating that document recovery remains a major bottleneck in the end-to-end pipeline. In contrast, threshold selection and mask polarization introduce relatively modest overhead, which supports the efficiency advantage of threshold-based selection over ranking-based encrypted retrieval. 6.4 Scaling Analysis We next evaluate scalability by varying the number of candidate documents B. The results show that retrieval quality remains stable as the corpus size increases, with recall and token accuracy unchanged across all tested settings. At the same time, latency grows with the number of candidate documents, which is consistent with the increasing cost of similarity evaluation and token extraction over larger candidate sets. This trend suggests that the proposed framework scales predictably while maintaining correct document recovery.
6.5
Effect of Threshold
We further study the impact of the threshold parameter τ on retrieval behavior. Table 4 shows that lower and medium thresholds both preserve full recall while selecting, on average, two documents per query. In contrast, a higher threshold reduces the average number of selected documents to one, but also lowers recall to 0.5, indicating that some relevant documents are filtered out. These results illustrate the trade-off controlled by τ : a more aggressive threshold can reduce output size, but may harm retrieval effectiveness if set too high. 6.6
Discussion
Overall, the experimental results demonstrate that threshold-based encrypted retrieval provides an effective compromise between privacy and efficiency. Compared with plaintext retrieval, the encrypted pipeline incurs substantial computational overhead, as expected. However, compared with ranking-based encrypted selection, the proposed method significantly reduces runtime while maintaining perfect token and document reconstruction in our evaluation. These results suggest that threshold-based selection is a practical design choice for non-interactive privacy-preserving retrieval in RAG systems.
References Amina Bassit and Vishnu Boddeti. 2025. SecureRAG: End-to-end secure retrieval-augmented generation. In The Second Workshop on GenAI for Health: Potential, Trust, and Policy Compliance. Yihang Cheng, Lan Zhang, Junyang Wang, Mu Yuan, and Yunhao Yao. 2025. RemoteRAG: A privacy-preserving LLM cloud RAG service. In Findings of the Association for Computational Linguistics: ACL 2025, pages 3820–3837, Vienna, Austria. Association for Computational Linguistics. Jung Hee Cheon, Andrey Kim, Miran Kim, and Yongsoo Song. 2017. Homomorphic encryption for arithmetic of approximate numbers. In International conference on the theory and application of cryptology and information security, pages 409–437. Springer. Benny Chor, Eyal Kushilevitz, Oded Goldreich, and Madhu Sudan. 1998. Private information retrieval. Journal of the ACM (JACM), 45(6):965–981. Craig Gentry. 2009. Fully homomorphic encryption using ideal lattices. In Proceedings of the forty-first annual ACM symposium on Theory of computing, pages 169–178.
Table 1: Main results comparing retrieval effectiveness and efficiency.
Method
Recall
Token Acc (%)
Doc Acc (%)
Latency (s)
Avg. Docs
Plaintext Threshold (Ours) Ranking-based (HE)
1.0 1.0 1.0
100 100 100
100 100 100
3.7 1051.8 16579.9
2 2 2
Table 2: Latency breakdown of the proposed method.
Stage
Time (s)
Percentage
Similarity Computation Threshold Selection Mask Polarization Token Decryption Token Reconstruction Others
335.47 139.22 38.54 262.88 264.92 10.80
31.9% 13.2% 3.7% 24.5% 25.2% 1.0%
Total
1051.8
100%
Table 3: Scaling behavior with respect to corpus size.
B
Latency (s)
Recall
Token Acc
100 500 1000
1051.8 2112.7 4361.2
1.0 1.0 1.0
100 100 100 Table 4: Effect of threshold on retrieval performance.
Federico Mazzone, Maarten Everts, Florian Hahn, and Andreas Peter. 2025. Efficient ranking, order statistics, and sorting under ckks. In 34th USENIX Security Symposium (USENIX Security 25), pages 8541– 8558. Yulong Ming, Mingyue Wang, Jijia Yang, Cong Wang, and Xiaohua Jia. 2026. p2rag: Privacypreserving rag service supporting arbitrary top-k retrieval. arXiv preprint arXiv:2603.14778. Huanyi Ye, Jiale Guo, Ziyao Liu, and Kwok-Yan Lam. 2025. Efficient privacy-preserving retrieval augmented generation with distance-preserving encryption. In 2025 3rd International Conference on Foundation and Large Language Models (FLLM), pages 668–676. IEEE.
τ
Recall
Avg. Docs
Latency
Low (0.2) Medium (0.5) High (0.7)
1.0 1.0 0.5
2 2 1
1051.8 1051.8 1051.8