---
title: Privacy-Preserving Similarity Search
url: https://www.emergentmind.com/topics/privacy-preserving-similarity-search
type: topic
---

# Privacy-Preserving Similarity Search

Privacy-preserving similarity search is the problem of computing similarity, retrieving near neighbors, or performing thresholded matching when the compared objects, the query, the database, or the search infrastructure are privacy-sensitive. In the literature, the protected objects include sets, strings, graphs, biometric templates, genomic profiles, voice features, and dense vector embeddings; the similarity operators include Jaccard similarity, inner products, cosine similarity, Hamming distance, longest common substring similarity, and thresholded distance tests. The field therefore spans private pairwise similarity computation, secure or leakage-aware indexing for sub-linear search, differentially private similarity release, and hybrid systems that combine cryptography with trusted execution or controlled disclosure [1111.5062] [1612.01835] [2502.14291] [2604.17816].

## 1. Problem formulations and similarity models

The basic formulations differ in whether the goal is pairwise similarity evaluation or database search. In pairwise protocols, two parties learn a similarity value or threshold decision for private inputs. In search systems, a server or cloud evaluates one query against many stored items, often under a top-\(k\), \(r\)-neighbor, or thresholded retrieval rule. Some works target exact metrics under restricted operators, while others accept approximate retrieval to obtain scalability [1111.5062] [1612.01835] [2109.01727].

Several similarity measures recur across the literature. For set data, the canonical definition is the Jaccard index
\[
J(A,B)=\frac{|A\cap B|}{|A\cup B|}=\frac{|A\cap B|}{|A|+|B|-|A\cap B|}.
\]
For vector retrieval with one encrypted side, the central score is the inner product
\[
\langle q,x\rangle=\sum_i q_i x_i.
\]
For binary biometric templates, the dominant metric is Hamming distance. For privacy-preserving string matching, the normalized longest-common-substring score is
\[
sim_{lcs}(s_1,s_2)=\frac{lcs(s_1,s_2)}{\max(l_1,l_2)}.
\]
Graph similarity learning uses either binary graph-graph classification labels \(y\in\{0,1\}\) or regression labels \(y\in[0,1]\), while some mHealth voice systems use a squared Euclidean-distance-like score over fixed-length voice features [2502.14291] [2104.03018] [2210.11730] [1809.04583].

| Representation | Similarity notion | Representative approach |
|---|---|---|
| Sets | Jaccard index | PSI-CA and MinHash protocols |
| Dense vectors | Inner product; cosine via preprocessing | AHE/PHE encrypted-plaintext scoring |
| Binary templates | Hamming distance | Secure LSH; obfuscated-distance inference |
| Strings | Longest common substring | Encoded suffix trees |
| Graphs | Graph-graph classification/regression | Privacy-preserved neural graph matching |
| Genomic SNP sets | Thresholded cosine over customized Bloom filters | Hierarchical encrypted search index |

This diversity of similarity notions is not incidental. The operator usually determines the feasible privacy mechanism. Inner products align with additive homomorphism when exactly one operand is encrypted; Jaccard aligns with PSI-CA and MinHash; Hamming distance aligns with binary embeddings, substring indexes, or obfuscated interval tests; and modality-specific systems often redesign the representation so that a restricted private computation becomes possible [2502.14291] [1111.5062] [1711.01587].

## 2. Exact and approximate private similarity computation

A foundational line of work reduces private similarity computation to private set intersection cardinality. In "EsPRESSo" [1111.5062], exact private Jaccard is obtained by securely learning \(c=|A\cap B|\), then computing \(J(A,B)=c/(|A|+|B|-c)\). The same paper gives an approximate protocol based on MinHash signatures
\[
sim(A,B)=\frac{\left|\{\langle a_i,i\rangle\}_{i=1}^k \cap \{\langle b_i,i\rangle\}_{i=1}^k\right|}{k},
\]
with expected error \(O(1/\sqrt{k})\). The contribution is a private similarity primitive rather than a full search engine: repeated pairwise comparisons are still needed in database settings [1111.5062].

For encrypted vectors, recent work sharpens the distinction between what requires fully homomorphic encryption and what does not. "A Note on Efficient Privacy-Preserving Similarity Search for Encrypted Vectors" [2502.14291] studies the case where only one side is encrypted and the target similarity is the inner product. With a plaintext vector \(\mathbf{x}\) and encrypted vector \(Enc(\mathbf{y})\), the protocol computes
\[
Sim(x,Enc(y))=Enc\left(\sum_{i=1}^{d}x_i y_i\right)=\bigotimes_{i=1}^{d} Enc(y_i)^{x_i},
\]
and proves
\[
Dec(Sim(\mathbf{x},Enc(\mathbf{y})))=\sum_{i=1}^{d} x_i y_i.
\]
Its complexity estimate for one encrypted inner product is
\[
\mathcal{O}\left(d\cdot (T_{PCM}+T_{Add})+T_{Dec}\right),
\]
with the simplified total \(\mathcal{O}(d\log^2 N)\) for additive HE schemes. The same note is explicit that encrypted top-\(k\) selection is not provided, and that AHE alone is insufficient when both operands are encrypted [2502.14291].

A closely related 2025 study extends this restricted design to cosine-style embedding search by moving normalization outside the encrypted domain. "Encrypted Vector Similarity Computations Using Partially Homomorphic Encryption" [2503.05850] pre-normalizes vectors so that cosine similarity reduces to a dot product, then evaluates encrypted-plaintext dot products with additively homomorphic schemes such as Paillier, Damgård-Jurik, and Okamoto-Uchiyama. In that design, the stored vector is encrypted, the query remains plaintext, and the server computes an encrypted score that only the secret-key holder can decrypt. The paper emphasizes tiny score loss for PHE and much smaller keys and similarity ciphertexts than its TenSEAL baseline, while also making clear that query privacy is not protected in the depicted architecture [2503.05850].

Another branch replaces cryptographic secrecy with differential privacy for similarity release. "PrivMin" [1705.07258] studies MinHash-based Jaccard similarity under neighboring-set semantics and argues that ordinary MinHash satisfies only Conditional \(\epsilon\)-DPSO. Its PrivMin algorithm privatizes MinHash signature generation using the Exponential mechanism and Randomized Response, with overall privacy budget
\[
\epsilon=\epsilon_1+\epsilon_2,
\]
and reports substantially better utility than direct Laplace perturbation of the final similarity score on the evaluated text datasets. This is a private similarity estimation mechanism, not a complete nearest-neighbor system [1705.07258].

## 3. Search indexes and scalable retrieval architectures

The central scalability problem is that strong cryptographic similarity evaluation is often linear in database size. One response is to redesign the searchable representation rather than encrypt every arithmetic operation. "Sub-Linear Privacy-Preserving Near-Neighbor Search" [1612.01835] proposes Secure Locality Sensitive Indexing (SLSI), described as the first PP-NNS scheme with sub-linear query time in the honest-but-curious, two-non-colluding-server setting. If the base LSH collision probability is \(P_c\), its secure transformation yields
\[
P_c^{sec}=\frac{P_c^k+1}{2},
\]
so non-neighbor collisions are forced toward \(1/2\) while near-neighbor discrimination is retained. The resulting query complexity remains of LSH form, roughly \(O(n^{\rho'}\log n)\), with \(\rho'\) determined by the secure collision probabilities [1612.01835].

A different route is controlled prefiltering before a heavy private test. "Increasing Adversarial Uncertainty to Scale Private Similarity Testing" [2109.01727] introduces similarity-based bucketization (SBB): the client reveals a noisy, coarse embedding, the server constructs a candidate bucket \(B'\subseteq B\), and a downstream private similarity protocol runs only on \(B'\). On the evaluated social-media image setting, the paper reports average bucket sizes of \(9.3\%\) of the database, retained correctness above \(95\%\), and speedups of at least \(29\times\) compared to using the downstream protocol without SBB [2109.01727].

Large-scale vector retrieval has also motivated hybrid ANN systems. "Privacy-Preserving Product-Quantized Approximate Nearest Neighbor Search Framework for Large-scale Datasets via A Hybrid of Fully Homomorphic Encryption and Trusted Execution Environment" [2604.17816] proposes PPPQ-ANN, which combines product quantization, CKKS-based FHE, and TEE. The framework covers codebook generation, database encoding, database indexing, and search. Its packing strategy reduces many encrypted computations to \(O(N_{WOP})\) ciphertext work per query, and the paper reports database generation in less than 2 hours and more than 50 QPS in a sequential search on million-scale datasets while preserving privacy [2604.17816].

Other systems use modality-specific compressed indexes. "Privacy-Preserving Search for a Similar Genomic Makeup in the Cloud" [1912.02045] builds a hierarchical search structure over hospital-randomized customized Bloom filters, supports merged multi-hospital search, and reports that under its experimental settings the scheme is more than \(60\) times faster than Wang et al.'s protocol and \(95\) times faster than Asharov et al.'s solution. "Privacy-Preserving Identification via Layered Sparse Code Design" [1806.08658] instead uses ambiguized sparse ternary codebooks: a public untrusted server performs fast coarse search on privacy-protected codes, and a private trusted server or local client performs refined search with clean layered reconstructions and authorization-dependent fidelity [1912.02045] [1806.08658].

Privacy-preserving search in Hamming space can also be based on obfuscated evidence rather than exact distance. "Inference-Based Similarity Search in Randomized Montgomery Domains for Privacy-Preserving Biometric Identification" [1711.01587] partitions a binary template into substrings, computes an obfuscated collision count \(m\), and derives the distance interval
\[
2(L-m)\le d(\mathbf{p},\mathbf{q}) \le s(L-m)+2m.
\]
It then uses statistical inference for \(r\)-neighbor testing and top-\(k\) retrieval, while randomized Montgomery-domain signatures protect the indexing structures themselves [1711.01587].

## 4. Leakage, attacks, and security models

The security models in this area are heterogeneous. Some works adopt standard IND-CPA style ciphertext privacy; some permit searchable-encryption leakage such as size, search, and access patterns; some operate in the semi-honest model; some quantify privacy by adversarial posterior confidence; and some provide differential privacy for score release rather than cryptographic confidentiality [2502.14291] [1912.02045] [2109.01727] [1705.07258].

A recurring theme is that similarity structure itself can be the disclosure channel. "Vulnerabilities in the use of similarity tables in combination with pseudonymisation" [1712.00871] is a security critique of an ONS privacy-preserving record-linkage design using HMACs plus similarity tables for names. The paper models the released similarity table as a directed weighted graph over pseudonyms and shows that the graph is highly identifying. On approximately 351,070 Australian surnames, it reports that over \(56\%\) of the sets of similarity scores are unique; with the full graph, the recovery rate is \(93\%\); and with one seeded common name such as “Smith,” many neighbors become identifiable through propagation [1712.00871].

This critique generalizes beyond record linkage. Searchable representations that reveal stable neighborhoods, exact pairwise distances, or reusable distance profiles may remain vulnerable even when the labels are keyed or encrypted. That lesson reappears in work on modern learned models. "Privacy-Preserved Neural Graph Similarity Learning" [2210.11730] introduces the notion of an attackable representation: the representation directly involved in cross-graph computation and therefore communicated off device. PPGM is designed so that attackable representations are graph-level messages and obfuscated features rather than node embeddings, with the explicit goal of avoiding reconstruction attacks and reducing graph-property inference leakage [2210.11730].

Several systems therefore make leakage explicit rather than pretending it is absent. The genomic similar-patient-search system defines a leakage function
\[
\mathcal{L}=\{C_{SNP}, C_{ind}, C_{ASI}, Q, TK, \mu, \nu, \xi\},
\]
where \(\mu\) is a size pattern, \(\nu\) a search-pattern matrix, and \(\xi\) an access pattern [1912.02045]. The AHE inner-product note is explicit that it does not formalize leakage after score decryption, access patterns, ranking results, repeated queries, or auxiliary information [2502.14291]. PPPQ-ANN explicitly states that it does not address attacks based on access patterns in the search process [2604.17816].

Privacy can also fail under repeated interaction even when single-query leakage looks mild. In SBB, the single-query privacy target is adversarial uncertainty about a predicate such as exact perceptual-hash matching, but the paper shows that repeated randomized embeddings of the same image rapidly destroy that protection: by \(q=2\), the conditioned precision of the matching attacker is almost \(100\%\), and by \(q\ge 3\) it is essentially perfect [2109.01727]. This suggests that composition, statefulness, and system-level query control are central issues, not implementation details.

## 5. Modality-specific systems

The field is strongly shaped by representation. For strings, "Accurate and Efficient Suffix Tree Based Privacy-Preserving String Matching" [2104.03018] replaces q-gram-set similarity with encoded suffix trees and chained hashing. It supports longest common substring length, longest common prefix, longest common suffix, longest common middle, and the normalized score
\[
sim_{lcs}(s_1,s_2)=\frac{lcs(s_1,s_2)}{\max(l_1,l_2)}.
\]
Its main point is that set-based encodings lose positional structure, whereas suffix-tree matching preserves contiguous-substring semantics for strings such as account numbers, IBANs, and telephone numbers [2104.03018].

For voice search, "Efficient and Privacy-preserving Voice-based Search over mHealth Data" [1809.04583] keeps raw voice files under AES and feature vectors under homomorphic encryption. Each clip is reduced to a 36-dimensional averaged feature vector, and the server computes
\[
E(dis_{v,v'})=E\!\left(\sum_{i=1}^{36}(\bar v_i-\bar v_i')^2\right).
\]
The system is threshold-based rather than top-\(k\) ranked, using thresholds \(T_m\) and \(T_w\), and the reported average accuracy across its three matching tasks is \(80.8\%\) [1809.04583].

For graph similarity, the challenge is that strong neural graph matching often relies on communicated node-level representations. PPGM keeps node-level GNN states local, exchanges graph-level messages via attention,
\[
\mathbf{g}_{2,i}=\operatorname{MHAttn}(\mathbf{c}_i,\mathbf{H}^{(L)}_2,\mathbf{H}^{(L)}_2),
\]
forms pair-conditioned obfuscated features, and predicts similarity from those obfuscated representations. On the reported binary-code graph benchmarks, it achieves the lowest property-inference attack AUCs among the tested methods while retaining competitive graph-similarity AUC [2210.11730].

For biometrics and other binary-template systems, the literature includes both secure embeddings and inference-based search. SLSI focuses on secure binary embeddings for sub-linear search [1612.01835], whereas the Montgomery-domain biometric framework deliberately conceals exact Hamming distance in a dynamic interval and then retrieves likely candidates statistically [1711.01587]. In document, multimedia, and biometric set representations, EsPRESSo shows that secure Jaccard evaluation can act as a building block for threshold matching and shortlist generation, even though it does not itself provide a private search index [1111.5062].

Dense-vector applications now range well beyond classical multimedia. The AHE/PHE vector papers explicitly cite confidential recommender systems, secure federated learning, reverse image search, recommendation engines, and LLM embeddings as motivating workloads [2502.14291] [2503.05850]. PPPQ-ANN makes the same shift explicit by targeting LLMs, VLMs, semantic search, and vector databases at million scale [2604.17816]. This suggests that modern privacy-preserving similarity search is increasingly an embedding-systems problem rather than only a record-linkage or biometric one.

## 6. Limitations and research directions

Several limitations recur across otherwise different designs. One-encrypted-side inner-product methods do not solve the both-sides-encrypted case, and they typically leave ranking and top-\(k\) selection to a decrypting party [2502.14291] [2503.05850]. Set-based protocols such as EsPRESSo provide private pairwise similarity primitives but no private indexing or sublinear retrieval structure [1111.5062]. ANN-oriented systems such as PPPQ-ANN and SBB scale far better, but they do so by accepting approximation, hybrid trust assumptions, or controlled leakage [2604.17816] [2109.01727].

Representation issues remain equally important. Real-valued embeddings often require quantization, fixed-point encoding, or normalization pipelines that are left implicit or only partially analyzed [2502.14291] [2503.05850]. String systems with richer substring semantics incur higher matching cost than bit-array baselines [2104.03018]. Voice systems compress variable-length feature matrices to 36-dimensional averages, which makes encrypted matching feasible but also discards temporal structure [1809.04583]. Hybrid PQ systems omit residual re-encoding to keep private indexing practical, trading accuracy for cost [2604.17816].

Threat models are still narrower than deployment reality. Multiple papers assume semi-honest or honest-but-curious parties, non-collusion, trusted hardware, or trusted cloud components [1612.01835] [1711.01587] [2604.17816] [1705.07258]. Several papers explicitly do not cover access-pattern leakage, richer output leakage, repeated-query attacks, or malicious robustness [2502.14291] [1912.02045] [2109.01727] [2604.17816]. The ONS critique shows why these omissions matter: even when cryptographic labels are sound, a reusable similarity graph may suffice for large-scale deanonymisation [1712.00871].

Three research directions recur across the literature. First, scalable systems increasingly separate coarse candidate generation from stronger private scoring, whether by secure LSH, SBB, hierarchical Bloom-filter trees, or public/private layered search [1612.01835] [2109.01727] [1912.02045] [1806.08658]. Second, many methods privatize only the most revealing computation or representation rather than the entire pipeline, as in one-sided homomorphic scoring, attackable-representation minimization, and hybrid FHE+TEE ANN [2502.14291] [2210.11730] [2604.17816]. Third, modality-aware design remains decisive: privacy-preserving similarity search succeeds when the similarity operator, encoding, and leakage model are chosen together rather than independently. A plausible implication is that future systems will continue to combine restricted cryptographic computation, approximate indexing, and explicit leakage accounting instead of pursuing a single universal primitive for all data types and all threat models.

Source: https://www.emergentmind.com/topics/privacy-preserving-similarity-search