Trans-RAG: Query-Centric Vector Transformation for Secure Cross-Organizational Retrieval Yu Liu1,2 , Kun Peng1,2 , Wenxiao Zhang3 , Fangfang Yuan1(B) , Cong Cao1 , Wenxuan Lu1,2 , and Yanbing Liu1,2(B) Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China {liuyu,pengkun,yuanfangfang,caocong,luwenxuan,liuyanbing}@iie.ac.cn 2 School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China 3 Department of Computer Science and Software Engineering, The University of Western Australia, Perth, Australia [email protected]
arXiv:2604.09541v1 [cs.CR] 10 Apr 2026
1
Abstract. Retrieval Augmented Generation (RAG) systems deployed across organizational boundaries face fundamental tensions between security, accuracy, and efficiency. Current Encryption methods expose plaintext during decryption, while federated architectures prevent resource integration and incur substantial overhead. We introduce Trans-RAG, implementing a novel vector space language paradigm where each organization’s knowledge exists in a mathematically isolated semantic space. At the core lies vector2Trans, a multi-stage transformation technique that enables queries to dynamically "speak" each organization’s vector space "language" through query-centric transformations, eliminating decryption overhead while maintaining native retrieval efficiency. Security evaluations demonstrate near-orthogonal vector spaces with 89.90° angular separation and 99.81% isolation rates. Experiments across 8 retrievers, 3 datasets, and 3 LLMs show minimal accuracy degradation (3.5% decrease in nDCG@10) and significant efficiency improvements over homomorphic encryption. Keywords: Retrieval Augmented Generation · Cross-organizational Security · Vector Transformation · Secure Information Retrieval · PrivacyPreserving Embeddings Security
Document Encryption
No Trust Retrival
No Trust
Federated Architectures
Retrival
Retrival
No Trust Retrival
Accuracy
No Trust
Efficiency
Homomorphic Encryption
Fig. 1. Cross-organizational retrieval with no trust faces the security-accuracy-efficiency triangle.
2
Y. Liu et al.
1
Introduction
Cross-organizational collaboration increasingly requires knowledge sharing while preserving data sovereignty across institutional boundaries. In healthcare, multiinstitutional research must analyze distributed patient data without violating strict privacy regulations [4,9,20]. In supply chains, partners integrate confidential supplier information while protecting competitive advantages [19]. Recent advances in retrieval-augmented generation (RAG) further amplify the need for secure cross-organizational retrieval, as embedding-based systems introduce new privacy risks [18,36]. As illustrated in Figure 1, cross-organizational retrieval without mutual trust inevitably encounters the security–accuracy–efficiency trade-off. Current secure retrieval approaches face limitations across three critical dimensions. 1) From a computational perspective, traditional encryption techniques necessitate decryption of multiple candidate documents during retrieval, introducing prohibitive overhead that recent studies show renders systems impractical for real-time applications [39,15]. 2) From an architectural perspective, these document-centric security paradigms fundamentally misalign with the vectorcentric nature of modern dense retrieval systems [14,35], creating friction that manifests as performance bottlenecks and deployment complexities [31]. 3)From a security perspective, recent research demonstrates that vector embeddings themselves leak substantial semantic information [12,26], with reconstruction attacks recovering significant portions of original text, revealing vulnerabilities that document-level protections cannot address [37]. To address these challenges, we present Trans-RAG, a comprehensive framework implementing a vector space language paradigm that fundamentally shifts security from document-level protection to query-level transformation. Instead of encrypting stored documents, Trans-RAG creates organization-specific vector space "languages"—mathematically isolated semantic spaces where each organization’s knowledge exists in a unique coordinate system, akin to natural languages providing security through mutual unintelligibility. At the core lies vector2Trans, a novel multi-stage transformation technique that enables queries to dynamically "speak" each organization’s vector space language through combining orthogonal matrices, bounded non-linearity, key-based permutation, and cryptographic blinding. This query-centric approach aligns naturally with vector-based architectures [14], eliminating traditional security-performance tensions while operating transparently with existing vector databases and embedding models. By maintaining separate transformation keys for each organization, Trans-RAG ensures complete organizational control over knowledge assets while enabling collaborative intelligence through secure query processing, requiring no modifications to organizational infrastructure. Our contributions are three-fold: 1. We introduce Trans-RAG1 , implementing query-centric vector transformations that shift security from document encryption to mathematical space isolation for cross-organizational retrieval. 1
Codes: https://github.com/Ameame1/TransRAG
Trans-RAG: Query-Centric Vector Transformation
3
2. We develop vector2Trans, a multi-stage, key-derived transformation technique combining orthogonal matrices, bounded non-linearity, key-based permutation, and cryptographic blinding to create computationally isolated vector spaces with minimal retrieval degradation. 3. Comprehensive theoretical analysis and experimental validation demonstrate strong security properties against reconstruction and probing attacks, minimal accuracy degradation across diverse retrievers and datasets, and substantial efficiency improvements over cryptographic alternatives, confirming deployment compatibility with existing infrastructure.
2
Related Work
2.1
RAG Systems and Limitations
RAG has become a key paradigm for injecting external knowledge into LLMs [18], but its assumption of open corpus access is at odds with cross-organizational data-sovereignty constraints. Prior work shows that well-crafted queries can elicit sensitive information [36]. Existing defenses largely secure documents via access control or encryption; however, these document-centric mechanisms conflict with the vector-centric nature of dense retrieval [14,35], leading to plaintext exposure during decryption and operational overhead. This gap motivates a security model aligned with vector operations rather than document plaintext. 2.2
Secure Information Retrieval
Secure retrieval spans trade-offs: access control and content encryption expose plaintext during retrieval (or re-ranking), and even advanced searchable encryption can leak sensitive signals [31,11]. Homomorphic encryption offers stronger guarantees but remains impractical for real-time vector retrieval due to computational overhead [39,15]. Other directions either depend on specialized hardware (TEEs) or face efficiency bottlenecks in high-dimensional similarity search (zeroknowledge systems) [21]. Enterprise federated RAG typically focuses on result aggregation, not on securing the vector retrieval process itself. 2.3
Vector Transformations
Vector transformations have been applied mainly to dimensionality reduction and model distillation [26], with limited use as a security mechanism. Meanwhile, embeddings are vulnerable to reconstruction attacks that risk leakage of source content [12,37]. Although mathematical transformations have supported privacy in other domains—such as random projections for biometric template protection [1] and orthogonal transforms for privacy-preserving data mining [24]—their application to forming isolated vector spaces for cross-organizational retrieval has seen limited exploration.
4
Y. Liu et al.
Fig. 2. Trans-RAG overview and vector2Trans. Top: system workflow across organization-specific vector spaces (five phases from query encoding to context-enhanced generation) preserving data sovereignty. Bottom: vector2Trans—a multi-stage, keyderived query transformation (permutation, cryptographic blinding, bounded nonlinearity fβ , orthogonal rotation W , and L2 normalization) that yields computationally isolated spaces while retaining retrieval utility.
3
Methodology
3.1
Problem Formulation
Given m organizations {O1 , . . . , Om }, where each Oi maintains a private vector database Vi ⊂ Rd built from embeddings of proprietary documents SmDi , secure cross-organizational RAG aims to retrieve from the unified corpus i=1 Vi under two constraints: (i) no organization may access another’s plaintext vectors; and (ii) retrieval accuracy is preserved within any space it is authorized to query. Traditional defenses encrypt documents or employ federated architectures, but these are misaligned with vector-centric dense retrieval and introduce operational overheads [14,35]. Trans-RAG addresses this by applying query-level transformations that yield per-organization, computationally isolated vector spaces while retaining similarity structure for authorized retrieval. 3.2
Threat Model and Security Objective
Adversary Model. We adopt a semi-honest adversary model where: (1) organizations follow the protocol but may attempt to extract information from observed transformed vectors, (2) the adversary cannot access the transformation keys of other organizations, and (3) cryptographic primitives (e.g., SHA-256 and AES-based PRNGs) behave as pseudorandom functions. Security Objective. The goal is computational isolation: with distinct keys Ki ̸= Kj , an adversary should gain negligible advantage in (a) reconstructing plaintext vectors, (b) inferring cross-space semantic relations, or (c) issuing effective cross-space queries without authorization. 3.3
Trans-RAG Framework Overview
As illustrated in Fig. 2, Trans-RAG operates through five phases: (1) Query Encoding—the user query is encoded into a dense vector vq ∈ Rd using an
Trans-RAG: Query-Centric Vector Transformation
5
embedding model/encoder; (2) Query Transformation—vq is transformed into organization-specific representations {Ti (vq )} using each organization’s key Ki ; (3) Parallel Retrieval—transformed queries are dispatched to authorized organizations’ vector stores in parallel, returning top-k candidates with similarity scores; (4) Context Aggregation—scores are normalized across spaces, results are re-ranked, and access control is verified; (5) Answer Generation— aggregated contexts are forwarded to the LLM for final response synthesis. The core security mechanism lies in the transformation Ti (·), detailed below. 3.4
vector2Trans: Query-Centric Transformation
Overview and design principles. Vector2Trans creates per-organization isolated spaces via multi-stage, key-derived transformations. As illustrated in Fig. 2, each stage applies, in order: key-based permutation (decorrelate coordinates), input-dependent cryptographic blinding (disrupt statistics), bounded non-linearity (similarity-preserving yet non-invertible), and orthogonal rotation with offsets (structure-preserving mixing). All parameters derive deterministically from the organization key Ki ∈ {0, 1}256 . Mathematical formulation. The n-stage transformation is (n)
Ti (v; Ki ) = Ti
(n−1)
◦ Ti
(1)
◦ · · · ◦ Ti
(1)
(v). (j)
Each stage j ∈ {1, . . . , n} integrates key-based permutation Pi , cryptographic (j) (j) blinding Bi , orthogonal rotation Wi , bounded non-linearity fβ (j) , and offset i
(j)
(j)
(j)
(v) = Pi
vectors bi , ci : Ti
(j)−1
(j+n)
(Bi
(j)
(Wi
(j)
(j)
(j)
(j)
· fβ (j) (Bi (Pi (v)) + bi ) + ci )), i
(2)
followed by ℓ2 -normalization. (j) Component definitions. The permutation operator Pi : Rd → Rd reorders vector dimensions: (j)
Pi (v) = [vπ(j) (1) , vπ(j) (2) , . . . , vπ(j) (d) ], i
i
i
(3)
(j)
where πi : {1, . . . , d} → {1, . . . , d} is a cryptographically derived permutation: (j) (j)−1 πi = Shuffle(PRNG(Hash(Ki ∥ j))), and Pi denotes its inverse. (j) d The cryptographic blinding operator Bi : R → Rd adds zero-mean inputdependent noise: (j) (j) (j) Bi (v) = v + δi (v) − µ(δi (v)), (4) where µ(·) denotes the mean (ensuring zero-mean noise), and the blinding noise is generated as: (j)
δi (v) = α ·
PRNG(Hash(Ki ∥ j ∥ Hash(v))) , ∥PRNG(Hash(Ki ∥ j ∥ Hash(v)))∥2
(5)
6
Y. Liu et al.
with α > 0 controlling the blinding intensity. (j) The mathematical transformation combines an orthogonal matrix Wi ∈ (j) (j) Rd×d satisfying (Wi )⊤ Wi = I, generated via QR decomposition of pseudorandom matrices seeded by Hash(Ki ∥ j); a bounded non-linear function fβ (x) = tanh(βx)/β where β > 0 is the non-linearity strength parameter; and (j) (j) offset vectors bi , ci ∈ Rd derived from the organization key. The final output of all n stages undergoes ℓ2 -normalization to ensure unit length. 3.5
Security Properties
Property 1 (Cross-Space Angular Separation). For distinct keys Ki ̸= Kj and unit-norm vectors v drawn from a bounded distribution, E cos Ti (v; Ki ), Tj (v; Kj ) = O(d−1/2 ). Proof (Sketch). Under the PRF assumption (independent key-derived permutations and orthogonals), the outputs are independent random rotations plus zero-mean input-dependent blindings; the bounded odd non-linearity fβ is 1Lipschitz. By concentration on Sd−1 , for x, y ∼ Unif(Sd−1 ) we have E⟨x, y⟩ = 0 and Var(⟨x, y⟩) = 1/d [33]. Hence E[cos] = O(d−1/2 ). Property 2 (Reconstruction Resistance). Without Ki , reconstructing v from Ti (v) requires solving a mixed discrete–continuous, non-convex inverse problem with input-dependent noise; any efficient inversion would contradict standard PRF assumptions and is therefore computationally infeasible. Proof (Sketch). Per stage, the Jacobian is J (j) (v) = P (j)−1 D(j) (v)W (j) P (j) (up to affine shifts/blindings), where D(j) (v) = diag(fβ′ (j) (·)) and fβ′ (z) = sech2 (βz) ∈ (0, 1]. Thus ∥J (j) ∥2 ≤ 1 and saturations yield information loss; over n stages the composition is further contracting on saturated coordinates (non-invertible). Inversion must simultaneously recover unknown permutations (discrete, exponential), orthogonals on O(d) (continuous), and input-dependent blindings tied to Hash(v) (PRF). Any efficient inverter would distinguish PRF outputs from random, contradicting the assumption. Property 3 (Cross-Organizational Query Isolation). A query transformed with Ki yields near-random similarity scores in Vj (j ̸= i), producing random-like retrieval. Proof (Sketch). From Prop. 1, for q̂ = Ti (q) and v̂ = Tj (v) we have ⟨q̂, v̂⟩ concentrated near 0 with variance O(1/d). p Hence scores are sub-Gaussian; the maximum over N items scales as Õ( log N/d), matching random retrieval and strictly below authorized-space signal where aligned transforms preserve neighbors. Scope & assumptions. These arguments rely on: (i) PRF-derived independence across keys; (ii) high-dimensional concentration; (iii) bounded, odd fβ and zeromean blindings; and (iv) semi-honest parties not influencing PRF seeds. Worstcase/adaptive attacks that manipulate input distributions or observe longitudinal correlations are out of scope here and evaluated empirically in Sec. 4.5.
Trans-RAG: Query-Centric Vector Transformation
4
Experiments
4.1
Experimental Setup
7
Datasets and Settings. We evaluate retrieval effectiveness using three BEIR datasets [32]: NFCorpus [3] (3,633 docs; 323 queries), FiQA [25] (5,778 docs; 648 queries), and SciFact [34] (5,183 docs; 1,109 queries). In the cross-organizational setting (m = 10), each dataset is partitioned across organizations via stratified sampling (preserving label/topic distributions); unless otherwise specified, all organizations are authorized for querying. For efficiency and scaling evaluation, we construct auxiliary corpora with sizes {1K, 10K, 100K, 1000K} documents, used exclusively for latency and throughput tests (disjoint from BEIR). Models. We evaluate 8 dense retrievers across different embedding dimensions: Ember, UAE, GTE [22] (1024d), MPNet [29], BGE [5] (768d), Jasper [38] (512d), Linq [6] (4096d), and Stella [38] (8192d). For answer synthesis, we use generation models LLaMA 3.1-8B [10], DeepSeek-V3 [23], and Claude Sonnet 4 [2]. Queryside transformation latency is independent of the LLM. Baselines and Metrics. We compare Trans-RAG against: (1) Naive Retrieval (no security) as an upper bound [14]; (2) AEAD (AES-GCM-256) content protection [31], where ranking is performed on decrypted embeddings (ranking accuracy is unchanged); (3) Partial Homomorphic Encryption (PHE) using Paillier-2048 [27] for encrypted dot-product similarity (Python phe library). We evaluate retrieval effectiveness using nDCG@10, top-k overlap with the naive baseline (Jaccard), and Spearman correlation [30]. Efficiency metrics include perquery transformation and retrieval latency, scaling behavior with corpus size, and incremental update time. For security, we report cross-space angular separation, isolation rate, k-NN neighborhood purity/preservation, and information-theoretic measures (entropy, mutual information, KL divergence). Implementation Details. For similarity computation, we use cosine similarity with ℓ2 -normalized embeddings and top-k = 10 results. Trans-RAG employs a 256bit key seed, with n = 3 transformation stages, non-linearity β = 0.1, and blinding intensity α = 0.1; retriever dimensions are matched to d. We use FAISS [13,8] for indexing: IndexFlatIP for BEIR datasets, and IndexIVFFlat with nlist = 100 and nprobe = 10 for scalability experiments. All experiments are repeated 10 times with fixed random seeds, with standard deviations of less than 2% across all metrics. Mutual information is estimated using a k-NN entropy estimator averaged across dimensions. We used 4×NVIDIA A100 for indexing/embedding; CPU specs for PHE/AEAD are Intel Xeon Gold 6248R with 128 GB RAM. 4.2
Retrieval Accuracy
We evaluate Trans-RAG’s retrieval quality across multiple datasets and retrievers, comparing it with unprotected and alternative secure methods. As shown in Table 1, Trans-RAG effectively preserves retrieval quality, with nDCG@10 scores showing minimal degradation of only 3.1%–3.6% (average 3.5%) compared to the unprotected Naive baseline. The absolute differences range from 0.011 to 0.022, confirming that Trans-RAG maintains strong retrieval performance while
8
Y. Liu et al. Table 1. Retrieval accuracy across datasets (nDCG@10/Overlap%/Spearman)
Dataset
Method
Ember (1024d)
UAE (1024d)
GTE (1024d)
MPNet (768d)
BGE (768d)
Jasper (512d)
Stella (8192d)
Linq (4096d)
Avg
NFCorpus
Naive Trans-RAG
0.314/100.0/1.000 0.303/92.8/0.860
0.320/100.0/1.000 0.309/92.7/0.845
0.204/100.0/1.000 0.197/92.8/0.855
0.289/100.0/1.000 0.279/92.4/0.811
0.362/100.0/1.000 0.349/91.8/0.762
0.390/100.0/1.000 0.375/92.3/0.804
0.227/100.0/1.000 0.219/93.7/0.931
0.310/100.0/1.000 0.299/92.9/0.862
0.302/100.0/1.000 0.291/92.7/0.841
FiQA
Naive Trans-RAG
0.443/100.0/1.000 0.427/92.5/0.856
0.445/100.0/1.000 0.430/92.4/0.847
0.228/100.0/1.000 0.220/92.3/0.843
0.496/100.0/1.000 0.478/92.4/0.851
0.424/100.0/1.000 0.408/92.4/0.850
0.556/100.0/1.000 0.535/91.2/0.737
0.200/100.0/1.000 0.194/93.2/0.921
0.460/100.0/1.000 0.444/92.7/0.858
0.407/100.0/1.000 0.392/92.4/0.845
SciFact
Naive Trans-RAG
0.737/100.0/1.000 0.712/93.2/0.844
0.743/100.0/1.000 0.716/93.2/0.843
0.354/100.0/1.000 0.343/93.4/0.857
0.634/100.0/1.000 0.613/92.9/0.809
0.747/100.0/1.000 0.721/92.7/0.791
0.770/100.0/1.000 0.745/92.2/0.747
0.531/100.0/1.000 0.513/94.4/0.950
0.725/100.0/1.000 0.701/93.2/0.841
0.655/100.0/1.000 0.633/93.2/0.835
Overall
Naive Trans-RAG
0.498/100.0/1.000 0.481/92.8/0.853
0.503/100.0/1.000 0.485/92.8/0.845
0.262/100.0/1.000 0.253/92.8/0.852
0.473/100.0/1.000 0.457/92.6/0.824
0.511/100.0/1.000 0.493/92.3/0.801
0.572/100.0/1.000 0.552/91.9/0.763
0.319/100.0/1.000 0.309/93.8/0.934
0.498/100.0/1.000 0.481/92.9/0.854
0.455/100.0/1.000 0.439/92.8/0.840
Reduction Trans-RAG ↓3.4%/↓7.2%/↓14.7% ↓3.6%/↓7.2%/↓15.5% ↓3.4%/↓7.2%/↓14.8% ↓3.4%/↓7.4%/↓17.6% ↓3.5%/↓7.7%/↓19.9% ↓3.5%/↓8.1%/↓23.7% ↓3.1%/↓6.2%/↓6.6% ↓3.4%/↓7.1%/↓14.6% ↓3.5%/↓7.2%/↓16.0% ∗
NaivenDCG@10/Overlap/Spearman ≈ PHEnDCG@10/Overlap/Spearman ≈ AEADnDCG@10/Overlap/Spearman .
providing robust security guarantees. Additionally, overlap coefficients range from 92.4% to 93.2%, representing reductions of 6.2% to 8.1% (average 7.2%), and Spearman correlation coefficients range from 0.835 to 0.845, showing reductions of 6.6% to 23.7% (average 16.0%) across all datasets. High-dimensional retrievers show exceptional compatibility with Trans-RAG— particularly Stella (8192d), which achieves overlap coefficients as high as 94.4% and Spearman coefficients up to 0.950. This superior performance with highdimensional embeddings can be attributed to greater redundancy in high-dimensional spaces, allowing better preservation of semantic structure after transformation. Our analysis reveals consistently strong performance across diverse retrieval scenarios, with minimal variation across configurations (overlap coefficient standard deviation <0.6%). Trans-RAG’s model-agnostic design ensures compatibility with embeddings ranging from 512d to 8192d, making it a versatile security solution adaptable to various retrieval architectures. 4.3
Security Evaluations
We rigorously evaluated Trans-RAG’s security properties across multiple dimensions, focusing on vector space separation, neighborhood structure, and information-theoretic properties. Vector Space Isolation. We measure pairwise angular separation across 10 organizations before and after transformation. Fig. 3 shows the transformation increases angular separation from 58.33° to 89.90°, achieving near-orthogonal vector spaces across all organization pairs. To quantify this isolation more precisely, we compute the isolation success rate—the proportion of vector pairs with cosine similarity below 0.1. Fig. 4 shows that all organization pairs achieve isolation rates exceeding 99.5% after transformation. These results empirically validate Properties 1 and 3. The 89.90° angular separation closely aligns with the theoretical O(d−1/2 ) expected cosine similarity for high-dimensional vectors, confirming near-orthogonal isolation. Neighborhood Structure Analysis. Beyond global separation, we analyze local topology via k-nearest neighbors (k-NN). Specifically, we compute: (1) neighborhood purity as the percentage of same-organization neighbors, PNi |{j∈NN[p]:j∈orgi }| defined as Purityi = N1i p=1 . k (2) neighborhood preservation as the overlap between original and transformed PNi |NNorig [p]∩NNtrans [p]| neighbors, given by Preservationi = N1i p=1 . k (3) disturbance rate, quantifying topological change.
Trans-RAG: Query-Centric Vector Transformation Transformed Angular Separation (°)
63.6
64.4
org2
44.0
0.0
44.6
66.4
58.4
64.0
65.3
63.3
59.8
64.1
org3
49.3
44.6
0.0
63.6
65.4
58.5
62.8
63.8
61.6
63.6
63.1
66.4
63.6
0.0
52.6
50.6
56.7
60.3
61.3
61.8
120
94.0
60.3
100
87.6
80
86.0
94.0
87.6
86.0
94.4
87.6
94.0
93.7
0.0
86.0
94.0
93.0
87.1
94.4
93.5
93.6
87.6
86.0
0.0
93.3
93.9
88.1
88.5
88.7
87.8
87.8
94.0
93.3
0.0
86.8
86.8
93.1
93.4
93.7
86.9
93.0
93.9
86.8
0.0
94.1
94.0
88.5
87.8
88.5
100
87.1
88.1
86.8
94.1
0.0
87.9
87.9
86.0
86.0
80
org7
87.7
87.7
94.4
94.4
88.5
93.1
94.0
87.9
0.0
88.4
87.5
88.1
org8
94.1
180
94.1
87.6
93.5
88.7
93.4
88.5
87.9
88.4
0.0
87.7
87.7
org9
0.0
94.0
93.6
87.8
93.7
87.8
86.0
87.5
87.7
0.0
88.5
org10
org1
58.7
org2
58.0
org3
60.8
org4
64.5
org5
63.1
org6
org1
49.3
org4
180
44.0
93.7
87.6
87.8
86.9
88.5
86.0
88.1
87.7
88.5
0.0
org1
org2
org3
org4
org5
org6
org7
org8
org9
org10
58.4
65.4
52.6
0.0
org6
60.8
64.0
58.5
50.6
org7
58.0
65.3
62.8
56.7
org8
58.7
63.3
63.8
org9
63.6
59.8
64.4 org1
48.1
65.3
48.1
0.0
65.3
59.9
60.3
60.7
61.6
61.3
64.1
63.6
org2
org3
160
140
60.7
62.6
59.9
60.8
65.4
64.2
0.0
43.4
47.2
49.5
60.8
43.4
0.0
48.4
45.3
62.6
65.4
47.2
48.4
0.0
49.2
61.8
60.3
64.2
49.5
45.3
49.2
0.0
org4
org5
org6
org7
org8
org9
org10
Angle (°)
org5
64.5
org10
160
60
40
140
120
60
40
20
90.3°
91.3°
91.1°
56.9°
90.4°
59.3°
org1
org2
0
56.5°
org4
90.2°
89.8°
90.3°
59.6°
org3
20
90.1°
59.5°
Angle (°)
Original Angular Separation (°) 0.0
9
org5
90.1° 55.6°
org8
org7
org6
89.7° 55.7°
54.0°
57.3°
0
56.3°
org9
org10
Fig. 3. Angular separation between vector spaces before and after transformation. The transformation increases average separation from 58.33° to 89.90°, approaching perfect orthogonality. Avg Cosine Similarity: 0.506→0.009 (Impr: 0.497).
Original Isolation Success Rate (%)
Transformed Isolation Success Rate (%)
11.7
0.0
9.7
15.3
17.5
18.7
19.1
13.5
17.3
19.6
100
org1
13.5
0.0
99.6
99.6
100.0
99.7
99.9
99.8
99.9
99.8
99.8
org2
17.2
99.6
0.0
99.7
99.8
99.9
99.8
99.9
99.8
99.8
99.8
org3
16.7
99.6
99.7
0.0
99.9
99.9
99.9
99.7
99.9
99.9
100.0
org4
13.9
100.0
99.8
99.9
0.0
99.9
99.9
99.8
99.9
99.7
100.0
org5
18.1
99.7
99.9
99.9
99.9
0.0
99.8
99.7
100.0
99.9
99.9
org6
17.1
99.9
99.8
99.9
99.9
99.8
0.0
99.9
99.7
99.7
99.9
org7
18.4
99.8
99.9
99.7
99.8
99.7
99.9
0.0
99.6
99.8
99.5
org8
10.9
99.9
99.8
99.9
99.9
100.0
99.7
99.6
0.0
99.6
99.7
org9
org1
11.7
org2
100
0.0
99.8
99.8
99.9
99.7
99.9
99.7
99.8
99.6
0.0
99.8
99.8
99.8
100.0
100.0
99.9
99.9
99.5
99.7
99.8
0.0
org1
org2
org3
org4
org5
org6
org7
org8
org9
org10
org3
10.9
9.7
0.0
16.6
14.7
17.0
19.3
14.9
15.6
16.5
org4
80
18.4
15.3
16.6
0.0
11.3
9.7
19.0
15.3
16.0
19.9
80
org5
17.1
17.5
14.7
11.3
0.0
5.3
17.7
14.1
13.4
19.2
org6
60
18.1
18.7
17.0
9.7
5.3
0.0
14.0
18.5
14.2
14.4
60
org7
13.9
19.1
19.3
19.0
17.7
14.0
0.0
6.4
6.1
6.2
org8
40
16.7
13.5
14.9
15.3
14.1
18.5
6.4
0.0
5.1
6.3
40
org10
17.2
17.3
15.6
16.0
13.4
14.2
6.1
5.1
0.0
20
5.1
13.5
19.6
16.5
19.9
19.2
14.4
6.2
6.3
5.1
0.0
org1
org2
org3
org4
org5
org6
org7
org8
org9
org10
org10
org9
20
0
0
80
60
40
org3-org7
org4-org10
org2-org10
org2-org7
org5-org10
org6-org8
org4-org7
org2-org6
org1-org4
org1-org6
org5-org7
org2-org9
org1-org9
org2-org5
org3-org6
org1-org5
org3-org4
org1-org8
org4-org9
org3-org10
org3-org9
org2-org4
org4-org8
org6-org9
org3-org8
org3-org5
org5-org8
org6-org7
org6-org10
org1-org7
org1-org10
org5-org9
org1-org2
org2-org8
org1-org3
org4-org5
org4-org6
org2-org3
org7-org8
org7-org10
org8-org9
org7-org9
org8-org10
0
org5-org6
20
org9-org10
Isolation Success Rate Improvement (%)
Average Improvement: 85.59%
Organization Pairs
Fig. 4. Isolation success rates (Cosine Similarity <0.1) across organization pairs. All pairs achieve isolation rates exceeding 99.5% (Minimum) after transformation. Avg: 14.22%→99.81% (Impr: 85.59%).
10
Y. Liu et al. Table 2. Neighborhood structure metrics before and after transformation
Metric org1 org2 org3 org4 org5 org6 org7 org8 org9 org10 Avg Original Purity (%) 43.8 26.2 25.1 34.6 42.1 44.8 33.6 37.2 32.5 32.5 35.24 Transformed Purity (%) 100.0 100.0 100.0 100.0 100.0 100.0 100.0 100.0 100.0 100.0 100.0 Neighborhood Preservation (%) 22.51 25.60 32.92 22.74 26.20 38.27 28.63 24.26 28.56 30.29 28.00 Disturbance Rate (%) 56.2 73.8 74.9 65.4 57.9 55.2 66.4 62.8 67.5 67.5 64.76 ∗ . Disturbancei = Puritytrans − Purityorig i i Transformed Neighbor Distribution (%)
26.2
9.7
7.5
8.2
7.6
7.5
7.8
8.1
7.6
org1
9.7
100
100.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
org2
5.8
0.0
100.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
org3
5.8
0.0
0.0
100.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
org4
6.2
0.0
0.0
0.0
100.0
0.0
0.0
0.0
0.0
0.0
0.0
org5
6.3
0.0
0.0
0.0
0.0
100.0
0.0
0.0
0.0
0.0
0.0
org6
6.0
0.0
0.0
0.0
0.0
0.0
100.0
0.0
0.0
0.0
0.0
org7
5.8
0.0
0.0
0.0
0.0
0.0
0.0
100.0
0.0
0.0
0.0
org8
5.8
0.0
0.0
0.0
0.0
0.0
0.0
0.0
100.0
0.0
0.0
org9
org1
7.0
org2
100
7.3
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
100.0
0.0
7.9
7.7
8.4
7.9
7.9
8.1
7.9
6.9
6.7
6.9
34.6
8.0
8.2
7.5
7.2
7.1
7.0
org5
6.0
6.5
6.0
7.1
42.1
7.5
5.9
6.4
6.2
6.3
org6
60
6.0
5.7
6.1
6.8
7.1
44.8
6.1
5.9
5.7
5.8
org7
7.3
6.5
6.7
7.3
6.5
7.1
33.6
8.6
8.3
8.1
org8
40
6.7
6.4
6.3
6.6
6.6
6.5
8.1
37.2
7.7
7.9
80
Neighbor Proportion
25.1
Query Organization
org3
9.9
Query Organization
9.4
org4
80
60
40
6.9
7.2
7.1
7.1
7.1
6.8
8.5
8.4
32.5
8.4
6.9
6.8
7.0
7.0
7.2
6.9
8.4
8.7
8.5
32.5
org1
org2
org3
org4
org5
org6
org7
org8
org9
org10
20
org10
org10
org9
20
0
Neighbor Proportion
Original Neighbor Distribution (%) 43.8
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
100.0
org1
org2
org3
org4
org5
org6
org7
org8
org9
org10
0
Fig. 5. Neighborhood purity before and after transformation. Avg (35.24%→100%)
Fig. 5 reveals the transformation’s impact on local vector relationships using k = 20. The original space shows substantial cross-organizational mixing (diagonal elements: 25.1%–44.8%), while the transformed space achieves perfect diagonal isolation (100%), eliminating cross-organizational nearest neighbors. Table 2 confirms Property 3 with 100% neighborhood purity and 28.00% preservation rate. The disturbance rate (avg. 64.76%) varies adaptively, balancing organizational separation with intra-organizational retrieval utility. Information-Theoretic Analysis. Information theory provides a rigorous framework for quantifying vector2Trans’s security-utility balance [28,7]. We analyze entropy, self-mutual information [16], and Kullback-Leibler divergence [17]. Self-mutual information (SMI) measures shared informationPbetween original n
MIj λj
j=1 and transformed spaces, and is defined as MI(Viorig , Vitrans ) = P , where n j=1 λj MIj represents the mutual information of the j-th component, and λj are the corresponding weights. Near-identical entropy values (9.909 vs. 9.911 bits) confirm information capacity preservation (Table 3). Self-mutual information of 6.141 bits (62.0% preservation) enables effective retrieval while concealing sufficient information for security. High KL divergence (24.960 bits) establishes a statistical barrier between distributions, quantifying the security-utility balance. Scalability to Large Consortia. Although our experiments involve 10 organizations, Property 1 indicates that the expected cross-space cosine similarity
Trans-RAG: Query-Centric Vector Transformation
11
Table 3. Information-theoretic measurements across organizations Metric org1 org2 org3 org4 org5 org6 org7 org8 org9 org10 Avg Entropy-Orig (bits) 9.912 9.917 9.917 9.904 9.880 9.913 9.952 9.866 9.946 9.879 9.909 Entropy-Trans (bits) 9.915 9.920 9.919 9.906 9.882 9.915 9.954 9.869 9.948 9.881 9.911 6.226 6.265 6.146 6.280 6.148 6.121 6.171 6.048 6.015 5.985 6.141 Self-MI (bits) KL Divergence (bits) 24.544 24.243 26.598 25.592 23.868 26.251 24.081 24.394 24.720 25.306 24.960
Table 4. Efficiency vs. scale by retriever (ms) Query Latency Overhead
Data Processing Overhead
10K
100K
1000K
10K
100K
1000K
1,117.5 3.6×107 286.4
1,007.5 NA 3,127.6
999.5 NA 38,752.8
113.4 4.4×107 68.6
335.5 NA 203.4
1,037.3 NA 626.8
Trans-RAG (768d) 73.3 68.7 Trans-RAG (1024d) 111.6 103.6 Trans-RAG (4096d) 1,635.4 1,504.6 Trans-RAG (8192d) 6,649.9 6,016.7 ∗ Timeoverhead = Timebaseline − Timenaive .
70.7 95.9 1,482.0 6,164.8
72.9 105.3 148.7 135.5
215.6 311.6 439.7 400.7
665.8 962.1 1,357.9 1,237.3
Method Trans-RAG (Avg) PHE (Avg) AEAD (Avg)
decays as O(d−1/2 ) and remains independent of the organization count m under key independence assumptions. Thus, isolation quality is governed primarily by embedding dimensionality rather than consortium size. Under parallel execution, query dispatch incurs O(m) communication cost, while result aggregation scales as O(mk). Since k is constant and typically much smaller than |Vi | in practical retrieval settings, the overall overhead grows approximately linearly with m, supporting practical deployment for large-scale consortia. 4.4
Retrieval Efficiency
Table 4 reveals distinct performance profiles: Trans-RAG achieves balanced latency (1,117.5 ms at 10K docs, 999.5 ms at 1000K) with minimal overhead for standard dimensions (68.7–111.6 ms for 768d–1024d). Table 5 confirms consistency across LLM architectures (55.5–113.8 ms overhead for LLaMA 3.1-8B, DeepSeekV3, Claude Sonnet 4). While standard dimensions achieve sub-100ms overhead, ultra-high-dimensional retrievers like Stella (8192d) exhibit 6s latency due to the O(nd2 ) cost of multi-stage orthogonal transformations. Mitigation strategies such as GPU optimization or dimensionality reduction remain promising future directions. PHE introduces prohibitive computation (3.6×107 ms at 10K docs, 32,216× slower than Trans-RAG), rendering it impractical despite formal cryptographic guarantees. AEAD shows low initial latency (286.4 ms at 10K) but scales poorly (38,752.8 ms at 1000K) and requires decrypting all candidates, exposing 100% plaintext across organizational boundaries.
12
Y. Liu et al. Table 5. Trans-RAG query latency overhead across retrievers and LLMs (ms)
Models
Ember
UAE
GTE
MPNet
BGE
Jasper
Stella
Linq
LLaMA 3.1-8B DeepSeek-V3 Claude Sonnet 4
112.3 109.5 113.8
108.7 103.6 105.9
103.2 106.8 101.4
71.2 68.7 72.8
70.5 73.8 69.3
58.7 55.5 57.1
6,235.4 6,016.7 6,329.2
1,527.3 1,504.6 1,513.8
∗
Timeoverhead = Timebaseline − Timenaive . Table 6. Document addition processing time comparison (in seconds)
Scenario (Original + New Docs) Full Rebuild Incremental Update Speedup 10K + 1K (11K total) 228.7 36.2 6.3× 100K + 1K (101K total) 2,314.4 36.2 63.9× 100K + 10K (110K total) 2,517.5 363.2 6.9× 1000K + 1K (1001K total) 27,509.0 36.2 760.0× 76.3× 1000K + 10K (1010K total) 27,623.1 362.0 1000K + 100K (1100K total) 28,765.2 2,671.1 10.8× ∗ Results averaged across retrievers from 512d to 8192d dimensions. Values are rounded; identical entries may reflect different underlying measurements.
Overhead Source Analysis. Overhead sources differ fundamentally: TransRAG incurs O(nd2 ) transformation cost plus TopK aggregation. PHE requires homomorphic dot products with O(d · k 3 ) complexity over 2048-bit integers, prohibitive for high-dimensional vectors. AEAD decrypts all candidates, with overhead scaling linearly with document count. Data Processing Efficiency. Table 6 shows incremental updates achieve 760.0× speedup when adding 1K documents to 1000K repositories, beneficial for production environments with frequent updates. 4.5
Security Against Practical Attacks
We evaluate vector2Trans under the semi-honest adversary model (Sec. 3.2) against cross-organizational probing, which directly tests Property 3. Experiments employ 10 organizations (90 directed pairs) with 100K documents per organization. Cross-organizational probing attack analysis Setup. For each directed pair (Oi → Oj ) with i ̸= j, we transform queries using Ki and retrieve from Vj . Results. Evaluating cross-organizational probing, vector2Trans reduces average nDCG@10 from 0.407 to 0.037 (90.8% reduction), achieving levels statistically indistinguishable from random retrieval (Fig. 6). This demonstrates query privacy preservation: queries transformed with one organization’s key return only topically irrelevant documents from other organizations’ databases, concealing query intent while maintaining operational functionality.
Trans-RAG: Query-Centric Vector Transformation Original
13
Transformed
0.7 0.6
nDCG@10
0.5 Original Avg: 0.407
0.4 0.3 0.2 0.1
Transformed Avg: 0.037
org1->org2 org1->org3 org1->org4 org1->org5 org1->org6 org1->org7 org1->org8 org1->org9 org1->org10 org2->org1 org2->org3 org2->org4 org2->org5 org2->org6 org2->org7 org2->org8 org2->org9 org2->org10 org3->org1 org3->org2 org3->org4 org3->org5 org3->org6 org3->org7 org3->org8 org3->org9 org3->org10 org4->org1 org4->org2 org4->org3 org4->org5 org4->org6 org4->org7 org4->org8 org4->org9 org4->org10 org5->org1 org5->org2 org5->org3 org5->org4 org5->org6 org5->org7 org5->org8 org5->org9 org5->org10 org6->org1 org6->org2 org6->org3 org6->org4 org6->org5 org6->org7 org6->org8 org6->org9 org6->org10 org7->org1 org7->org2 org7->org3 org7->org4 org7->org5 org7->org6 org7->org8 org7->org9 org7->org10 org8->org1 org8->org2 org8->org3 org8->org4 org8->org5 org8->org6 org8->org7 org8->org9 org8->org10 org9->org1 org9->org2 org9->org3 org9->org4 org9->org5 org9->org6 org9->org7 org9->org8 org9->org10 org10->org1 org10->org2 org10->org3 org10->org4 org10->org5 org10->org6 org10->org7 org10->org8 org10->org9
0.0
Fig. 6. Cross-organizational probing attack analysis (10 organizations, 90 directed pairs). Table 7. Ablation Study of vector2Trans Components (Accuracy & Efficiency) Retrieval Accuracy Computational Efficiency nDCG@10 Overlap % Spearman Query (ms) Process (ms) Complete vector2Trans 0.409 92.2% 0.829 108.6 109.7 w/o Blinding 0.432 (↑0.023) 92.3% (↑0.1%) 0.832 (↑0.003) 105.2 (↓3.4) 95.1 (↓14.6) w/o Permutation 0.410 (↑0.001) 97.5% (↑5.3%) 0.894 (↑0.065) 104.8 (↓3.8) 83.8 (↓25.9) w/o Permutation & Blinding 0.438 (↑0.029) 97.5% (↑5.3%) 0.912 (↑0.083) 99.8 (↓8.8) 70.2 (↓39.5) Naive Baseline 0.462 (↑0.053) 100.0% (↑7.8%) 1.000 (↑0.171) 0.0 (↓108.6) 0.0 (↓109.7) † Ablation experiments use the same experimental setup as the main experiments. Model Configuration
4.6
Ablation Study
To understand how each component contributes to Trans-RAG’s security-performance balance, we conducted an ablation study examining the impact of removing individual security mechanisms across our three evaluation dimensions. Design Rationale. The vector2Trans transformation employs two complementary security mechanisms: Permutation creates structural isolation by decorrelating dimensions, preventing coordinate system recovery. Cryptographic blinding adds input-dependent noise to disrupt statistical patterns. Together, these balance reconstruction resistance with retrieval utility. As shown in Table 7, our analysis reveals three key insights. First, permutation dominates computational overhead: removing permutation reduces processing time by 25.9ms (vs. 14.6ms when removing blinding). Second, blinding has a larger impact on accuracy: removing blinding improves nDCG@10 by +0.023, whereas removing permutation yields only +0.001. Third, components exhibit complementary effects: removing both achieves the best retrieval performance (+0.029 nDCG@10, +5.3% overlap) and the fastest processing (-39.5ms) among ablations. The complete Trans-RAG system achieves the optimal security-performance balance, demonstrating that both components are essential for the security properties established in Section 3: permutation for robust isolation and blinding for refined protection against statistical analysis.
5
Conclusion and Future Work
Trans-RAG introduces a paradigm shift from document-level encryption to querylevel transformation for secure cross-organizational RAG, implementing a vector space language framework where queries dynamically "speak" each organization’s
14
Y. Liu et al.
private semantic space through vector2Trans. This query-centric approach resolves the fundamental tension between security, accuracy, and efficiency: achieving nearorthogonal vector space isolation (89.90° angular separation, 99.81% isolation) with strong attack resistance, while maintaining 96.5% retrieval effectiveness and delivering 32,216× speedup over homomorphic encryption. By operating transparently with existing vector databases and embedding models, Trans-RAG enables practical secure collaborative knowledge sharing across organizational boundaries without infrastructure modifications, establishing a foundation for privacy-preserving vector-based retrieval in federated environments. Future work may extend the vector space language paradigm to stronger adversarial settings, including malicious query manipulation, vector database tampering, and cross-organizational collusion, potentially augmented with lightweight verification or cryptographic consistency mechanisms. In large-scale deployments, efficient key lifecycle protocols for organization onboarding, revocation, and distributed trust establishment become increasingly important without incurring prohibitive system overhead. Additionally, comprehensive end-to-end evaluation of generation quality in full RAG pipelines and optimization of structured transformations for ultra-high-dimensional embeddings remain promising directions. Acknowledgments. This research is supported by the National Key R&D Program of China (No. 2023YFC3303800).
References 1. Ali, A., Migliorati, A., Bianchi, T., Magli, E.: Cancelable templates for secure face verification based on deep learning and random projections. EURASIP Journal on Information Security 2024(1), 7 (2024) 2. Anthropic: Introducing claude 4. https://www.anthropic.com/news/claude-4 (May 2025) 3. Boteva, V., Gholipour, D., Sokolov, A., Riezler, S.: A full-text learning to rank dataset for medical information retrieval. In: European Conference on Information Retrieval. pp. 716–722. Springer (2016) 4. Brauneck, A., Schmalhorst, L., Kazemi Majdabadi, M.M., Bakhtiari, M., Völker, U., Baumbach, J., Baumbach, L., Buchholtz, G.: Federated machine learning, privacyenhancing technologies, and data protection laws in medical research: scoping review. Journal of medical Internet research 25, e41588 (2023) 5. Chen, J., Xiao, S., Zhang, P., Luo, K., Lian, D., Liu, Z.: M3-embedding: Multilinguality, multi-functionality, multi-granularity text embeddings through selfknowledge distillation (2024) 6. Choi, C., Kim, J., Lee, S., Kwon, J., Gu, S., Kim, Y., Cho, M., Sohn, J.y.: Linqembed-mistral technical report (2024) 7. Cover, T.M., Thomas, J.A.: Elements of information theory (wiley series in telecommunications and signal processing). Wiley-interscience (2006) 8. Douze, M., Guzhva, A., Deng, C., Johnson, J., Szilvasy, G., Mazaré, P.E., Lomeli, M., Hosseini, L., Jégou, H.: The faiss library (2025) 9. Eden, R., Chukwudi, I., Bain, C., Barbieri, S., Callaway, L., de Jersey, S., George, Y., Gorse, A.D., Lawley, M., Marendy, P., et al.: A scoping review of the governance of federated learning in healthcare. npj Digital Medicine 8(1), 427 (2025)
Trans-RAG: Query-Centric Vector Transformation
15
10. Grattafiori, A., Dubey, A., Jauhri, A., Pandey, A., Kadian, A., Al-Dahle, A., Letman, A., Mathur, A., Schelten, A., Vaughan, A., et al.: The llama 3 herd of models (2024) 11. Gui, Z., Paterson, K.G., Patranabis, S.: Rethinking searchable symmetric encryption. In: 2023 IEEE Symposium on Security and Privacy (SP). pp. 1401–1418. IEEE (2023) 12. Huang, Y.H., Tsai, Y., Hsiao, H., Lin, H.Y., Lin, S.D.: Transferable embedding inversion attack: Uncovering privacy risks in text embeddings without model queries. In: Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). pp. 4193–4205 (2024) 13. Johnson, J., Douze, M., Jégou, H.: Billion-scale similarity search with gpus. IEEE transactions on big data 7(3), 535–547 (2019) 14. Karpukhin, V., Oguz, B., Min, S., Lewis, P., Wu, L., Edunov, S., Chen, D., Yih, W.t.: Dense passage retrieval for open-domain question answering. In: Proceedings of the 2020 conference on empirical methods in natural language processing (EMNLP). pp. 6769–6781 (2020) 15. Kim, D., Lee, G., Oh, S.: Toward privacy-preserving text embedding similarity with homomorphic encryption. In: Proceedings of the Fourth Workshop on Financial Technology and Natural Language Processing (FinNLP). pp. 25–36 (2022) 16. Kong, L., de Masson d’Autume, C., Yu, L., Ling, W., Dai, Z., Yogatama, D.: A mutual information maximization perspective of language representation learning. In: Proceedings of ICLR 2020 (2020) 17. Kullback, S., Leibler, R.A.: On information and sufficiency. The annals of mathematical statistics 22(1), 79–86 (1951) 18. Lewis, P., Perez, E., Piktus, A., Petroni, F., Karpukhin, V., Goyal, N., Küttler, H., Lewis, M., Yih, W.t., Rocktäschel, T., et al.: Retrieval-augmented generation for knowledge-intensive nlp tasks. Advances in neural information processing systems 33, 9459–9474 (2020) 19. Li, L., Zhang, H.: Confidentiality and information sharing in supply chain coordination. Management science 54(8), 1467–1481 (2008) 20. Li, S., Miao, D., Wu, Q., Hong, C., D’Agostino, D., Li, X., Ning, Y., Shang, Y., Wang, Z., Liu, M., et al.: Federated learning in healthcare: a benchmark comparison of engineering and statistical approaches for structured data analysis. Health Data Science 4, 0196 (2024) 21. Li, Y., Ghosh, D., Gupta, P., Mehrotra, S., Panwar, N., Sharma, S.: Prism: Private verifiable set computation over multi-owner outsourced databases. In: Proceedings of the 2021 International Conference on Management of Data. pp. 1116–1128 (2021) 22. Li, Z., Zhang, X., Zhang, Y., Long, D., Xie, P., Zhang, M.: Towards general text embeddings with multi-stage contrastive learning (2023) 23. Liu, A., Feng, B., Xue, B., Wang, B., Wu, B., Lu, C., Zhao, C., Deng, C., Zhang, C., Ruan, C., et al.: Deepseek-v3 technical report (2024) 24. Liu, K., Kargupta, H., Ryan, J.: Random projection-based multiplicative data perturbation for privacy preserving distributed data mining. IEEE Transactions on knowledge and Data Engineering 18(1), 92–106 (2006) 25. Maia, M., Handschuh, S., Freitas, A., Davis, B., McDermott, R., Zarrouk, M., Balahur, A.: Www’18 open challenge: financial opinion mining and question answering. In: Companion proceedings of the the web conference 2018. pp. 1941–1942 (2018) 26. Morris, J., Kuleshov, V., Shmatikov, V., Rush, A.M.: Text embeddings reveal (almost) as much as text. In: Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing. pp. 12448–12460 (2023)
16
Y. Liu et al.
27. Paillier, P.: Public-key cryptosystems based on composite degree residuosity classes. In: International conference on the theory and applications of cryptographic techniques. pp. 223–238. Springer (1999) 28. Shannon, C.E.: A mathematical theory of communication. The Bell System Technical Journal 27(3), 379–423 (1948). https://doi.org/10.1002/j.1538-7305.1948. tb01338.x 29. Song, K., Tan, X., Qin, T., Lu, J., Liu, T.Y.: Mpnet: Masked and permuted pre-training for language understanding. vol. 33, pp. 16857–16867 (2020) 30. Spearman, C.: The proof and measurement of association between two things. The American Journal of Psychology 15(1), 72–101 (1904) 31. Sun, S.F., Steinfeld, R., Lai, S., Yuan, X., Sakzad, A., Liu, J.K., Nepal, S., Gu, D.: Practical non-interactive searchable encryption with forward and backward privacy. In: Usenix Network and Distributed System Security Symposium 2021. The Internet Society (2021) 32. Thakur, N., Reimers, N., Rücklé, A., Srivastava, A., Gurevych, I.: BEIR: A heterogeneous benchmark for zero-shot evaluation of information retrieval models. In: Thirtyfifth Conference on Neural Information Processing Systems Datasets and Benchmarks Track (Round 2) (2021), https://openreview.net/forum?id=wCu6T5xFjeJ 33. Vershynin, R.: High-dimensional probability: An introduction with applications in data science, vol. 47. Cambridge university press (2018) 34. Wadden, D., Lin, S., Lo, K., Wang, L.L., van Zuylen, M., Cohan, A., Hajishirzi, H.: Fact or fiction: Verifying scientific claims. In: Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP). pp. 7534–7550 (2020) 35. Wang, J., Yi, X., Guo, R., Jin, H., Xu, P., Li, S., Wang, X., Guo, X., Li, C., Xu, X., et al.: Milvus: A purpose-built vector data management system. In: Proceedings of the 2021 international conference on management of data. pp. 2614–2627 (2021) 36. Zeng, S., Zhang, J., He, P., Liu, Y., Xing, Y., Xu, H., Ren, J., Chang, Y., Wang, S., Yin, D., et al.: The good and the bad: Exploring privacy issues in retrievalaugmented generation (rag). In: Findings of the Association for Computational Linguistics: ACL 2024. pp. 4505–4524 (2024) 37. Zhang, C., Morris, J.X., Shmatikov, V.: Universal zero-shot embedding inversion (2025) 38. Zhang, D., Li, J., Zeng, Z., Wang, F.: Jasper and stella: distillation of sota embedding models (2024) 39. Zhou, M., Park, A., Zheng, W., Shi, E.: Piano: extremely simple, single-server pir with sublinear server computation. In: 2024 IEEE symposium on security and privacy (SP). pp. 4296–4314. IEEE (2024)