PRAG: End-to-End Privacy-Preserving Retrieval-Augmented Generation

Abstract: Retrieval-Augmented Generation (RAG) is essential for enhancing LLMs with external knowledge, but its reliance on cloud environments exposes sensitive data to privacy risks. Existing privacy-preserving solutions often sacrifice retrieval quality due to noise injection or only provide partial encryption. We propose PRAG, an end-to-end privacy-preserving RAG system that achieves end-to-end confidentiality for both documents and queries without sacrificing the scalability of cloud-hosted RAG. PRAG features a dual-mode architecture: a non-interactive PRAG-I utilizes homomorphic-friendly approximations for low-latency retrieval, while an interactive PRAG-II leverages client assistance to match the accuracy of non-private RAG. To ensure robust semantic ordering, we introduce Operation-Error Estimation (OEE), a mechanism that stabilizes ranking against homomorphic noise. Experiments on large-scale datasets demonstrate that PRAG achieves competitive recall (72.45%-74.45%), practical retrieval latency, and strong resilience against graph reconstruction attacks while maintaining end-to-end confidentiality. This work confirms the feasibility of secure, high-performance RAG at scale.

• The paper introduces a dual-mode architecture that uses homomorphic encryption to securely conduct similarity search and ranking without exposing sensitive data.
• It leverages encrypted HNSW and ciphertext-level k-means clustering to perform efficient approximate nearest neighbor search while controlling approximation noise.
• Experimental results demonstrate competitive retrieval latency, high recall, and minimized access-pattern leakage compared to conventional non-private RAG systems.

End-to-End Privacy-Preserving Retrieval-Augmented Generation: An Expert Synopsis of PRAG

Introduction and Motivation

The proliferation of LLMs in enterprise and knowledge-intensive applications has positioned Retrieval-Augmented Generation (RAG) as a foundational technology for integrating private, proprietary, or sensitive knowledge into generative workflows. Cloud-hosted RAG, while operationally scalable, elevates systemic privacy risks by exposing both document and query content to untrusted infrastructure. The current state-of-the-art in privacy-preserving RAG is fundamentally limited: approaches based on Differential Privacy, Trusted Execution Environments (TEEs), or secure search primitives typically guarantee only partial protection, leaking either document contents, query information, or access patterns. PRAG ("End-to-End Privacy-Preserving Retrieval-Augmented Generation" (2604.26525)) systematically addresses the challenge of providing formal, cryptographic confidentiality for both documents and queries in cloud-based RAG environments without compromising retrieval scalability and utility.

System Design and Architecture

PRAG proposes a dual-mode encrypted RAG architecture underpinned by a homomorphic encryption (HE) backend (CKKS), supporting end-to-end confidential similarity search, efficient ANN graph indexing, and practical update semantics.

Two operational regimes are defined:

• PRAG-I (Non-Interactive): All retrieval logic—including similarity scoring and ranking—is executed fully homomorphically on the cloud using Chebyshev polynomial approximations to enable numerical comparisons, thus eliminating the need for online client interaction. Approximation and CKKS noise are explicitly modeled and bounded to preserve semantic ranking in the presence of encryption-induced distortions.
• PRAG-II (Interactive): A semi-interactive protocol where distance computations are performed over ciphertexts in the cloud, but critical comparison or ranking steps are resolved via occasional client decryption, mitigating approximation errors and restoring ranking fidelity to match that of non-private plaintext RAG.

The backbone of PRAG's retrieval is an encrypted Hierarchical Navigable Small World (HNSW) graph combined with ciphertext-level k-means clustering, both designed to be operational under the constraints and semantics of HE.

Figure 1: Schematic diagram of the HNSW structure.

PRAG's data owner (client) generates vector embeddings for documents, encrypts both the vectors and index metadata, and uploads these to the cloud server, which operates under an honest-but-curious (semi-honest) threat model. All search, clustering, and index update operations operate strictly on encrypted content. Query preparation is augmented with cluster-aware decomposition/fusion strategies to amplify recall, and traversal paths are obfuscated with dummy requests and periodic index re-randomization to mitigate access-pattern leakage.

Protocols and Cryptographic Mechanisms

Secure retrieval, dynamic updates, and practical ranking operations comprise the core contributions:

1. Encrypted HNSW Construction: The system supports two-level abstraction combining encrypted k-means clustering with encrypted HNSW per cluster. All ANN navigation, greedy routing, and neighbor selection is performed with only polynomial operations supported by CKKS (with minimax/Chebyshev surrogates for selection functions in PRAG-I). Encrypted index updates use weigh-and-link routines for dynamic inserts and soft deletes.
2. Operation-Error Estimation (OEE): Recognizing that approximate homomorphic arithmetic distorts real-value ranking, PRAG formalizes the error propagation and establishes explicit margin constraints—the ranking of results is preserved except when candidates are inherently ambiguous due to close embedding proximity, tightly bounding adversarial inference abilities.
3. Dual-Mode Retrieval and Ranking: PRAG-I achieves low-latency, single-shot retrieval with approximation-preserving ranking, while PRAG-II leverages occasional client interactivity (e.g., decrypting cluster scores or candidate distances) for high-fidelity semantic ordering at the cost of higher communication overhead.

Figure 2: Architecture of PRAG-I and PRAG-II modes, highlighting divergent steps and data flow.

Security and Leakage Analysis

PRAG provides formal proofs of security, covering:

• IND-CPA Security of CKKS: Ensures ciphertext indistinguishability, guaranteeing that the server cannot infer semantic content from document/query vectors, distances, or rankings.
• Leakage Control: Only minimal, quantifiably noisy access patterns are exposed, with the extent of leakage sharply bounded by explicit protocol parameters (e.g., dummy traversal rate, re-encryption epoch). Experiments and theory demonstrate sharply reduced susceptibility to graph reconstruction attacks.
• Ranking Confidentiality: OEE ensures that only rankings with margins below the CKKS/approximation noise budget are potentially ambiguous, which aligns adversary uncertainty with the true semantic indistinguishability boundary.

Experimental Evaluation

Benchmarks on a 100,000-document TriviaQA subset substantiate PRAG's claims:

• Retrieval Latency: PRAG-I achieves $1.29$ s per query; PRAG-II makes a favorable trade-off ($7.91$ s per query) to maximize semantic ranking fidelity.
• Recall@10: PRAG-I achieves 72.45%, PRAG-II up to 74.45%—both competitive with non-private RAG.
• Update and Communication Cost: PRAG supports efficient updates ($<7.28$ ms per operation in PRAG-I) with the lowest communication cost among baselines (4.1 MB/query).
• Resilience to Graph Reconstruction: With access-pattern obfuscation ($\rho=0.3$, epoch $E=1000$), edge recovery by adversaries falls below 1.1%, while maintaining only a minor recall drop.

Figure 3: Setup time and retrieval time comparison across privacy-preserving retrieval schemes.

Figure 4: Update time and communication cost comparison across schemes, showcasing PRAG's competitive efficiency.

Implications, Limitations, and Future Work

PRAG exemplifies the synthesis of cryptographically strong document and query privacy with cloud-scale ANN retrieval. By separating data-level and access-pattern-level confidentiality, it offers a rigorous and operationally practical framework for confidential RAG deployments. The dual-mode architecture allows flexible deployment: PRAG-I for latency- and bandwidth-critical use cases, PRAG-II for scenarios where the user can tolerate additional interaction to maximize retrieval quality.

The protocol's assumption of a single-client trust domain and honest-but-curious adversaries delimits the security model. Future work entails extending PRAG to decentralized or multi-key settings—potentially incorporating threshold HE or multi-party functional encryption—and hardware/software acceleration to mitigate the computational overhead inherent to HE.

Conclusion

PRAG sets a new benchmark for privacy-preserving RAG, demonstrating that end-to-end encrypted retrieval and generation can be achieved at scale with tolerable amortized costs and minimal trade-offs in retrieval quality. The framework's combination of advanced HE-compatible index structures, formal noise-aware ranking, and practical system engineering establishes a template for future confidential AI serving and RAG deployments in untrusted cloud environments.