A new arXiv preprint describes a private search system designed to hide a user's precise query and final selection while keeping retrieval close to full-corpus float search. With a shortlist of 500 candidates, the two tested encoders retained 98.84% to 100.21% of the reference top-10 ranking score on four of five tested corpora and slightly raised it on the fifth.
The aim is a practical form of retrieval-augmented generation, or RAG, in which a language model uses retrieved passages to answer a question. The paper frames private retrieval as revealing only documents a user is authorized to receive from a provider-held corpus. It is a methods study based on research benchmarks, not a test of people or a production system.
A search service with less to reveal
The system works in two passes. A learned deep-hash code, a compact binary representation, first creates a randomized coarse shortlist. Encrypted arithmetic then reranks those candidates, while oblivious transfer, a cryptographic exchange, hides which positions are selected as payload keys. The stated security goals cover the released coarse code, the query, a score release limited to K candidates and the final selection.
A formal theorem puts a separate limit on access to the underlying text: under the paper's assumptions, a malicious receiver completing one accepted round can recover at most k distinct content keys and payloads, regardless of the larger candidate budget K, except with negligible probability. That bound applies to one accepted round; it does not erase other leakage channels. The stated model still lists exact scores, padded lengths, stable ciphertext linkage, timing, message lengths and cross-round inference as explicit sources of leakage.
Accuracy held up at a 500-candidate shortlist
Training used MS MARCO passage ranking, followed by zero-shot tests on five BEIR corpora ranging from 25,657 to 5.4 million documents. E5 used 256-bit codes and BGE used 512-bit codes. The paper uses NDCG@10, a top-10 ranking score, to compare the shortlist with full-corpus float retrieval.
At K = 500, both encoders retained 98.84% to 100.21% of full-corpus NDCG@10 on SciDocs, NQ, DBpedia-Entity and FEVER. On Climate-FEVER, NDCG@10 was higher than the full-corpus reference by 0.0158 for E5 and 0.0012 for BGE. Those figures show a ranking difference in the tested benchmark, not why the difference occurred or whether the filter caused it.
The learned filter also outperformed the listed alternatives. Against BPR, it improved mean Recall@500 by 0.0357 and mean Stage 2 NDCG@10 by 0.0084. Its Stage 2 NDCG@10 was 0.0051 above the strongest unsupervised baseline. These are reported point estimates without confidence intervals or significance tests.
Privacy had a measurable price
In the reported differential-privacy sweep, utility and protection cost varied with the randomization method and candidate budget. RDP-vMF retained 99.2% at K = 1,000, while Gaussian retained 99.2% and pure-vMF 99.4% at K = 2,000. The corresponding protection costs were 0.37, 0.73 and 0.73 seconds, with the K = 3,000 endpoint adding at most 1.10 seconds.
On 500 NQ questions, every tested two-forward operating point stayed within 0.2 exact-match points and 0.20 token-F1 points of full-corpus float retrieval. At epsilon = 64 and K = 3,000, pure-vMF recorded 50.0 exact match and 62.89 token F1, compared with 50.0 and 63.09 for the float reference. Exact match and token F1 are the study's two reported answer-quality measures.
The abstract reports that the protocol added 0.73 seconds, or 10%, to a 128-token Qwen3-32B RAG pipeline over the full 2.68-million-passage NQ corpus on a 10-Gbps link. The detailed efficiency measurements show that the candidate budget is a direct cost driver: compute rose from 104.1 milliseconds at K = 200 to 1,096.2 milliseconds at K = 3,000, while traffic rose from 1.64 MB to 13.64 MB. At K = 500, total latency was 198.9 milliseconds on 10 Gbps and 430.9 milliseconds on 100 Mbps; at K = 3,000, it reached 1.107 and 2.187 seconds, respectively.
In a matched comparison with other private-RAG systems, the proposed protocol was reported to be 2.1 to 69.2 times faster than P2 RAG and 5.0 to 33.1 times faster than RemoteRAG across three settings. PANTHER took 19.40 seconds on SciDocs and 40.41 seconds on Touché, and exhausted 256 GB during its NQ-1M PIR answer. The comparison depends on differences in hardware, thread counts, preprocessing, implementations and benchmark contracts.
Attack tests point to a narrower privacy story
An embedding-inversion attack tries to recover information from a released numerical representation. In the E5 evaluation, pure-vMF at epsilon = 64 produced a search cosine similarity of 0.423, versus 0.638 for no-DP hashing and 0.824 for float representations. Search success was 0.325, versus 0.590 and 0.920. Generation token F1 was 0.205, versus 0.368 and 0.545, while generation cosine was 0.328, versus 0.584 and 0.784 in the same order. The lower scores indicate weaker reconstruction in the evaluated attack, although results depend on the attacker, auxiliary data and attack budget.
Property-inference attacks, which try to predict attributes of source data, were also weaker after protection. Mean macro F1 was 0.3875 for Gaussian at epsilon = 8, compared with 0.6133 for learned hash and 0.6911 for float. The reported tests covered topic, sentiment and authorship properties, and the paper reports that tighter epsilon further weakened inference.
What the benchmark cannot answer
The record identifies the work as arXiv:2608.25735v1, dated 26 August 2026. The evaluation used public academic benchmarks, and the paper states that no new data collection or human-subject interaction occurred. The evidence is therefore limited to benchmark results and prototype or simulated measurements rather than production-scale behavior. Reported results are point estimates, with no confidence intervals, p-values or formal inferential tests.
The security guarantee is conditional on an honest-but-curious Owner, conforming encrypted inputs, authenticated identities and transport, and uncompromised endpoints. Sybil resistance, availability, inference from released exact scores and several other side channels remain outside the stated model. How the shortlist and protections transfer to proprietary corpora, additional encoders and live multi-user workloads remains open.
Paper data and sources
Original title: Pointing the Way, Hiding the Destination: Practical Private Dense Retrieval at Scale
Authors: Peichun Hua, Danyang Chen, Junan Zhang et al.
Journal/Repository: arXiv
Status: Preprint, not yet peer-reviewed
First online: 2026-08-26
DOI: Not available
Original paper · Full text