{"id":"ecd654a3-30b1-4420-8d8c-798422ecfad4","arxiv_id":"2412.12775","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"RemoteRAG shows that perturbing query embeddings under an (n,epsilon)-differential privacy style guarantee, then retrieving a slightly larger candidate set, can hide the query from a semi-honest cloud while preserving top-k retrieval in experiments.","lead":"RemoteRAG is a protocol that lets users query a cloud retrieval-augmented generation service without revealing their query, by sending a deliberately perturbed embedding and a homomorphically encrypted copy of the real one. A generalist might read it because it targets a practical privacy bottleneck in commercial RAG and LLM services while claiming to keep retrieval accuracy perfect and overhead small.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Direct-mode privacy is not covered by (n,ε)-DistanceDP: the exact top-k indices are a high-sensitivity function of the query, so the cloud can identify the query from the retrieved set regardless of the mean-angle bound.","rationale":"The paper makes a real contribution: a concrete protocol, a formal privacy definition, experiments on up to 10^6 documents, and a meaningful efficiency comparison. I read the central claim as: the cloud learns nothing about the query beyond the (n,ε)-DistanceDP budget while retrieval stays lossless. For that claim to hold, every message in the protocol must be protected, including the indices sent in Module 2(b). The weakest link is not only the uniform-sphere assumption in Lemma 1—it is the fact that the top-k index set is selected from the true query embedding after PHE decryption, so it is not a post-processing of the DP-protected perturbed embedding. The mean-angle bound in Theorem 3 does not cover the categorical information in the exact set or in document contents. Two close queries can select disjoint sets; the observed set then distinguishes them perfectly, so the privacy loss is unbounded. The uniform-sphere assumption makes this worse because it overestimates ω for clustered embeddings, making the protocol choose the unsafe Direct branch exactly when the cluster structure is most revealing. The reader's weakest_assumption about uniform embeddings is valid and relevant, but it is primarily an accuracy concern; the privacy gap is more load-bearing. For this reason I partially agree with the reader. The verdict should remain conditional, but with an added mandatory condition: either remove the Direct branch (always use OT) and re-report efficiency, or prove a formal DP bound for the full transcript including indices. The proposed test would settle whether Direct mode is salvageable; if the test shows infinite privacy loss, Direct mode must be dropped. This is a major but fixable revision, hence CONDITIONAL rather than REJECT.","tokens_in":16820,"tokens_out":17291,"duration_ms":182605,"concrete_test":"Use the paper's MS MARCO setup and one embedding model (e.g., T5, n=768). Sample pairs of queries (q1,q2) whose embedding distance δ is small (say δ ≤ 0.01) but whose top-5 index sets, computed exactly as in Module 2, are disjoint. For each pair, compute the likelihood ratio of the released message (perturbed embedding plus top-5 indices) under q1 versus q2. If the index sets are disjoint, the ratio is infinite regardless of the perturbation, directly refuting the claimed (n,ε)-DistanceDP bound (εδ finite). Report the minimum δ and the maximum ratio over 100 such pairs; if any ratio exceeds e^{εδ}, the Direct-mode privacy claim fails. As a control, repeat with the OT branch: the cloud's view is only the k' candidate set derived from the DP output, and the max ratio should satisfy the DP bound. This isolates whether the leak comes from revealing indices.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"RemoteRAG's central privacy claim is not established for the efficient 'Direct' branch. In §3.3.2 and §4.1, the authors argue that sending the top-k indices is safe when the mean angle ω between the query embedding and the mean of the top-k document embeddings satisfies ω ≥ Δα_k (≈ n/ε). But the cloud observes the exact index set, not the mean. The index set is a deterministic function of the true query embedding with unbounded sensitivity: two queries can be arbitrarily close in L2 norm (small ‖x−x'‖) yet have disjoint top-k sets. For such a pair, the observed index set has probability 1 under one query and 0 under the other, giving a privacy loss of ∞, which violates (n,ε)-DistanceDP for every finite ε. Theorem 3 bounds only one summary statistic and relies on Lemma 1's uniform-sphere assumption; for clustered real embeddings ω is overestimated, so the Direct-mode condition is met in cases where disclosure is largest. The OT branch (§A.1) does hide indices, but the headline efficiency results (Table 4: 0.67 s, 46.66 KB) are for Direct, and the paper presents Direct as privacy-preserving. The accuracy theorem also inherits the uniform-sphere issue, but the index-set leak is the more load-bearing failure because it invalidates the privacy property itself.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"RemoteRAG proposes a privacy-preserving protocol for cloud-based retrieval-augmented generation. A user perturbs their query embedding using a Laplace-like mechanism that is claimed to satisfy (n,ε)-DistanceDP, sends the perturbed embedding to the cloud, and requests the top-k' documents for this noisy vector. The user then uses partially homomorphic encryption (PHE) to have the cloud compute cosine distances over this candidate set, decrypts them, and obtains the true top-k indices. To return the documents, either the indices are sent directly to the cloud (when a mean-angle condition is satisfied) or a k-out-of-k' oblivious transfer (OT) is used. The paper claims lossless retrieval (the top-k are always contained in the k' candidates) with a theoretical guarantee based on a uniform-sphere model, and reports high efficiency (0.67 s and 46.66 KB for 10^6 documents) plus resistance to the Vec2Text inversion attack.","tokens_in":16964,"tokens_out":11425,"duration_ms":98876,"significance":"If the stated claims held, RemoteRAG would be a practical contribution to private RAG: it formalizes the problem, introduces a metric-DP notion for embeddings, and combines perturbation, PHE, and OT in one protocol. The derivation of k' from a geometric model is a parameter-free formula that is then verified across a grid of settings (N, k, r, five embedding models), which is a strength relative to purely empirical heuristics. The efficiency results and the 100% recall in the reported experiments are also encouraging. However, the central privacy claim is not established for the efficient 'Direct' branch, and the accuracy guarantee rests on a uniform-distribution assumption that the paper itself acknowledges can fail. These issues are load-bearing for the paper's main contributions, so the work requires substantial revision before the claims are supportable.","major_comments":[{"comment":"The claim that module 2(b) (Direct mode) achieves the stated privacy is not established. The cloud receives the exact top-k index set, which is a deterministic function of the true query embedding with unbounded sensitivity: there exist pairs of queries with arbitrarily small L2 distance whose top-k sets are disjoint. For such a pair, the joint output (perturbed embedding plus index set) has probability zero under one query and nonzero under the other, so the privacy loss is infinite for every finite ε, violating Definition 1. Theorem 3 bounds only the mean angle between the query embedding and the average of the top-k document embeddings; it does not constrain the specific indices, which can identify the query even when the mean is far. The privacy experiments in Section 5.2 test Vec2Text only on the perturbed embedding and do not test index disclosure. The OT branch (module 2(c)) does hide indices, but the headline efficiency numbers in the Abstract and Table 4 are for Direct mode. Please either remove the privacy claim for Direct mode, always use OT, or redesign the index release with a calibrated randomized mechanism and prove its privacy.","section":"§3.3.2, §4.1, Theorem 3, Definition 1"},{"comment":"The theoretical accuracy guarantee is conditional on Lemma 1's assumption that document embeddings are uniformly distributed on the unit n-sphere, but the Abstract and Section 3.2.2 state the guarantee as unconditional. Real text embeddings cluster by topic and are not uniformly distributed. Appendix B.5.2 explicitly acknowledges that \"in some rare exceptions, there might be a chance of RemoteRAG failing to preserve the top-k documents\" and provides a 2D counterexample. The paper offers no quantitative bound on the failure probability or on how k' must be enlarged for non-uniform distributions, so the \"no loss in retrieval\" claim in Section 5.3 and Table 3 is supported only empirically, not by the stated theorems. This is load-bearing for the accuracy contribution. Please either provide a distribution-robust bound (for example, using local intrinsic dimension or covering numbers) or clearly state the guarantee as conditional and qualify the Abstract and conclusion accordingly.","section":"§3.2.2, Lemma 1, Theorem 1, Appendix B.5.2"},{"comment":"The proof of Theorem 3 relies on the approximation that when n is large, the top-k embeddings lie exactly at angle α_k from the query embedding (\"we approximately believe\") and are then treated as uniformly distributed on a lower-dimensional sphere of radius sin α_k. This is not a rigorous bound: the top-k embeddings lie in a spherical cap, not on a full sphere, and the mean of points from a cap can deviate from the stated formula. Because Theorem 3 is used in Algorithm 2 (line 7) to decide whether the Direct branch is safe, this approximation affects an operational security decision. Please provide a quantified error bound or a rigorous derivation, or state the condition as heuristic.","section":"Appendix C, Theorem 6 proof"}],"minor_comments":[{"comment":"The definition of L(K(x),K(x')) as ln(Pr(K(x)=y)/Pr(K(x')=y)) is ambiguous for continuous mechanisms, where the probability of a single point is zero; it should be stated as a supremum over output sets or using density ratios.","section":"Definition 1"},{"comment":"Please report the number of runs and the worst-case recall per setting, not only the average; the default of 50 experiments appears only in Appendix B.4, and with N=10^6 and k=5, 50 samples may not reveal rare failures.","section":"Section 5.3"},{"comment":"The \"rare exceptions\" limitation is important enough to be stated in the main text or in the Limitations section; its current placement under \"Extra Experimental Results\" understates its significance for the accuracy claim.","section":"Appendix B.5.2"},{"comment":"Typo in the caption: \"Patermeters\" should be \"Parameters\".","section":"Table 5"},{"comment":"For reproducibility, please specify the PHE scheme used in the experiments (e.g., Paillier) and its security parameters, as the communication and computation costs depend on the ciphertext size.","section":"Section 3.3.1, Appendix A.1"}],"recommendation":"major_revision","confidential_remarks":"The reader's report and stress-test concern align with my reading: the Direct-mode privacy claim is the most serious issue, because the exact top-k index set is not covered by the (n,ε)-DistanceDP analysis. The paper could be salvaged by using OT universally or by adding a randomized mechanism for indices, but either path requires a substantive revision. The accuracy guarantee also needs to be scoped to the uniform-distribution model or supplemented with a quantitative robustness bound. The empirical results are solid and the system is promising, so I do not recommend rejection, but the current overclaims in the Abstract and introduction need to be corrected."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"First, the good news: this is the first paper I know that formally defines privacy-preserving cloud RAG, and the system design is thoughtful. The idea of sending a perturbed query embedding to limit the search range is appealing, and the candidate-range theorem is a useful analytic tool under an explicit uniform-sphere assumption. The empirical recall is uniformly 100% across a wide grid, and the efficiency numbers are impressive. The OT fallback branch is a sensible safety net.\n\nThe soft spots are real, though. The central privacy definition is a repackaging of geo-indistinguishability; the paper should credit that line of work more explicitly rather than presenting it as new. More importantly, the claim that the Direct branch (sending top-k indices) is private under (n,ε)-DistanceDP does not hold. The cloud observes the exact index set, not the mean embedding. Two queries can be arbitrarily close in L2 distance yet have disjoint top-k sets; for such a pair, the index set is a deterministic function that distinguishes them with probability 1, which is an unbounded privacy loss. Bounding the mean angle of the top-k documents does not bound the sensitivity of the index set itself. The OT branch avoids this, but the headline efficiency numbers are for Direct, so the paper presents a non-private mode as its main offering.\n\nThe accuracy guarantee is also conditional on a uniform distribution of document embeddings on the sphere, which is false for real text embeddings that cluster by topic. The 'rare exceptions' discussion in Appendix B.5.2 is honest but not a substitute for a quantitative bound or an empirical stress test on clustered data. The k' values used in the experiments may be safe for the tested corpora, but the theory as stated does not support the claim of lossless retrieval in general.\n\nMinor issues: only Vec2Text is tested among the cited inversion attacks, no code or crypto parameters are released, and error bars are missing throughout the efficiency plots.\n\nAll in all, the paper is a serious systems contribution that deserves referee time, but the privacy proof needs restructuring. I would not cite the Direct branch as a privacy-preserving method until the index-set leak is addressed. If the authors can fix that, or reposition the paper around the OT branch, it becomes a strong result. As is, conditional accept is optimistic; major revision is warranted.","headline":"Real problem, clever system, but the Direct branch's privacy proof does not survive contact with the index-set leak.","tokens_in":17627,"tokens_out":2720,"would_cite":false,"duration_ms":25468,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"RemoteRAG claims that a cloud RAG service can answer a user's query with bounded privacy leakage and no retrieval loss by sending a perturbed embedding and searching a small, provably sufficient candidate set.","keywords":["privacy-preserving RAG","(n,epsilon)-DistanceDP","embedding perturbation","differential privacy","retrieval-augmented generation","oblivious transfer","homomorphic encryption","semantic leakage"],"falsifier":"Build a document collection whose embeddings form tight, well-separated topical clusters, compute $k'$ from Theorem 1 as if the embeddings were uniform on the sphere, then check whether the $k'$ nearest neighbors of a perturbed query embedding still contain the true top-$k$ for queries drawn from one cluster; one missing document refutes the guarantee as stated. A second, simpler check is to run the paper's recall experiment on such a clustered collection and look for recall below 100%.","tokens_in":16496,"feed_emoji":"🔒","tokens_out":7659,"duration_ms":63292,"temperature":0.7,"pith_summary":"The paper tries to establish that a user can query a cloud retrieval-augmented generation service without exposing the semantic content of the query, and without sacrificing retrieval accuracy. The proposed protocol, RemoteRAG, sends the cloud a perturbed version of the query embedding, guided by a new privacy definition called $(n,\\epsilon)$-DistanceDP, and restricts the search to a small set of $k'$ documents whose size is derived from spherical geometry. The paper proves that under its uniform-sphere model this candidate set always contains the true top-$k$ documents, and reports 100% recall in experiments spanning $10^4$ to $10^6$ documents, several values of $k$, several perturbation magnitudes, and five embedding models. It also reports resistance to a known embedding-inversion attack and a per-query cost of 0.67 seconds and 46.66 KB for a $10^6$-document collection, compared with 2.72 hours and 1.43 GB for the fully cryptographic baseline. If correct, this gives a practical middle path between sending queries in plaintext and encrypting the whole document store.","feed_headline":"Cloud RAG queries stay private with zero retrieval loss","feed_subtitle":"A noisy query embedding plus encrypted ranking keeps retrieval lossless at 0.67 seconds per query.","key_machinery":"The load-bearing object is $(n,\\epsilon)$-DistanceDP together with the spherical-cap calculus of Lemma 1 and Theorem 1. The mechanism adds radial noise $r \\sim \\mathrm{Gamma}(n, 1/\\epsilon)$ with a uniformly random direction to the query embedding, giving an average displacement $n/\\epsilon$, and the cloud searches only the $k'$ nearest neighbors of the resulting perturbed point. Lemma 1 relates the count $k$ to the polar angle $\\alpha_k$ under the assumption that $N$ embeddings are uniformly distributed on the unit $n$-sphere, and Theorem 1 computes the extra count $\\Delta k = k' - k$ needed to absorb the perturbation angle $\\Delta\\alpha_k$; this identity is what carries the lossless-retrieval guarantee. Encrypted cosine-distance computation (partially homomorphic encryption) and $k$-out-of-$k'$ oblivious transfer carry the final selection of the true top-$k$ documents.","core_discovery":"RemoteRAG's central claim is that privacy and lossless retrieval are compatible in cloud RAG: perturb the query embedding under $(n,\\epsilon)$-DistanceDP, expand the search radius according to Theorem 1, and the $k'$ documents nearest the perturbed embedding will contain the top-$k$ documents nearest the original query. The perturbation draws a radial distance from a Gamma$(n, 1/\\epsilon)$ distribution and a uniformly random direction, so on average it moves $n/\\epsilon$ in embedding space. Lemma 1 converts a desired number $k$ of documents into a polar angle $\\alpha_k$ on the unit $n$-sphere, and Theorem 1 sets $k' - k$ equal to the surface area between $\\alpha_k$ and $\\alpha_k + \\Delta\\alpha_k$; this is the mechanism that makes the guarantee quantitative. The final top-$k$ selection happens without the cloud seeing the query: cosine distances are computed on encrypted values under partially homomorphic encryption, and the document indices are sent directly only when the mean embedding of the top-$k$ cluster is within the privacy budget, otherwise a $k$-out-of-$k'$ oblivious transfer is used. The paper reports 100% recall in all tested settings and a sharp drop in reconstruction-attack success as the perturbation grows.","pith_inferences":["Because real embeddings are topic-clustered, a practical deployment should add a safety margin to Theorem 1's $k'$ or estimate the local embedding density empirically instead of relying on the uniform-sphere formula.","The protocol assumes an embedding model the user can run locally and that stays frozen on both sides; a cloud that switches to a proprietary or updated encoder would break the user's ability to generate the perturbation.","The privacy guarantee is framed against a semi-honest cloud; a malicious cloud that stores perturbed queries across many requests could correlate them over time, a leakage channel the paper does not quantify.","When the oblivious-transfer path is used, communication grows with $k'$ because $k'$ encrypted documents are transferred, so choosing the direct path whenever Theorem 3's angle condition holds is what keeps the reported 46.66 KB transmission small."],"forward_implications":["A user can delegate RAG to a semi-honest cloud while keeping the query's semantic content within a formally bounded leakage budget.","The cloud searches only $k'$ documents instead of all $N$, so per-query computation drops to sub-second levels for a million-document store.","The accuracy of the protocol becomes a theorem rather than an empirical hope, as long as the uniform-sphere premise holds.","The fully cryptographic baseline, encrypting and scanning the whole collection, is unnecessary in the regimes the paper tests.","The same perturb-then-expand recipe could be reused for any similarity search task where privacy of the query vector matters."],"supporting_citations":[{"why":"Supplies the geo-indistinguishability definition that $(n,\\epsilon)$-DistanceDP generalizes to $n$-dimensional embedding space.","marker":"(Andrés et al., 2013)"},{"why":"Establishes the differential-privacy noise-calibration principle behind the Laplace-based perturbation.","marker":"(Dwork et al., 2006)"},{"why":"Provides the text-reconstruction attack used to measure how much semantic information survives the perturbation.","marker":"(Morris et al., 2023)"},{"why":"Supplies the $k$-out-of-$k'$ oblivious-transfer protocol used when the top-$k$ index set needs extra protection.","marker":"(Chou and Orlandi, 2015)"},{"why":"Supplies the passage corpus used to build the document collections in the recall and efficiency experiments.","marker":"(Nguyen et al., 2016)"},{"why":"Provides the embedding encoder used in the perturbation-versus-attack and cost experiments.","marker":"(SentenceTransformers, 2022)"}],"fun_headline_variants":["RemoteRAG: private cloud RAG, zero retrieval loss","Query privacy in cloud RAG without sacrificing recall","Noisy embeddings keep RAG queries private and lossless","Cloud RAG: 0.67s per query, no privacy leaks","Private RAG: retrieval lossless even against inversion"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The lossless-retrieval guarantee rests on the assumption that document embeddings are spread uniformly over the surface of a high-dimensional unit sphere; real embeddings cluster by topic, so Theorem 1's candidate size may be too small when that assumption fails.","fun_headline_variants_meta":{"raw":{"variants":["RemoteRAG: private cloud RAG, zero retrieval loss","Query privacy in cloud RAG without sacrificing recall","Noisy embeddings keep RAG queries private and lossless","Cloud RAG: 0.67s per query, no privacy leaks","Private RAG: retrieval lossless even against inversion"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000716,"raw_usage":{"total_tokens":3286,"prompt_tokens":1081,"completion_tokens":2205,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":697,"completion_tokens_details":{"reasoning_tokens":2122}},"tokens_in":697,"tokens_out":2205,"duration_ms":13145,"temperature":1.0,"reasoning_tokens":2122,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T13:45:05.237055+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Build a document collection whose embeddings form tight, well-separated topical clusters, compute $k'$ from Theorem 1 as if the embeddings were uniform on the sphere, then check whether the $k'$ nearest neighbors of a perturbed query embedding still contain the true top-$k$ for queries drawn from one cluster; one missing document refutes the guarantee as stated. A second, simpler check is to run the paper's recall experiment on such a clustered collection and look for recall below 100%.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the passage corpus used to build the document collections in the recall and efficiency experiments."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the embedding encoder used in the perturbation-versus-attack and cost experiments."}],"review_version":1}