用户查询前先转换嵌入,保护隐私同时保持检索精度。
Transform Before You Query: A Privacy-Preserving Approach for Vector Retrieval with Embedding Space Alignment
- 用不同模型间语义空间对齐,生成查询的近似嵌入。
- 召回率下降小于5%,百万级文本库中比基线高20%。
- 无需修改服务器,防御嵌入逆向攻击,适合医疗金融场景。
向量数据库(VDB)能高效索引和搜索来自非结构化数据的高维嵌入,对生成式AI与推荐系统等现代AI应用至关重要。当前多数VDB服务依赖专有黑箱模型,用户需通过API暴露原始查询文本以获取向量检索服务。若查询涉及金融或医疗等敏感信息,将导致严重隐私泄露。为此,我们提出STEER(Secure Transformed Embedding Vector Retrieval)框架,利用不同嵌入模型间的语义空间对齐关系,生成查询文本的近似嵌入。STEER在原VDB内使用近似嵌入完成检索,无需服务器端修改。理论与实验分析表明,STEER有效保护查询隐私,同时维持检索精度:即使近似嵌入是专有模型嵌入的近似,仍可防止服务提供商通过嵌入逆向攻击(EIA)恢复查询文本。大量实验显示,STEER的Recall@100下降不足5%;在包含数百万条目的文本库中,Recall@20比现有基线高出20%。
原文摘要 · Abstract (English)
Vector Database (VDB) can efficiently index and search high-dimensional vector embeddings from unstructured data, crucially enabling fast semantic similarity search essential for modern AI applications like generative AI and recommendation systems. Since current VDB service providers predominantly use proprietary black-box models, users are forced to expose raw query text to them via API in exchange for the vector retrieval services. Consequently, if query text involves confidential records from finance or healthcare domains, this mechanism inevitably leads to critical leakage of user's sensitive information. To address this issue, we introduce STEER (\textbf{S}ecure \textbf{T}ransformed \textbf{E}mbedding v\textbf{E}ctor\textbf{ R}etrieval), a private vector retrieval framework that leverages the alignment relationship between the semantic spaces of different embedding models to derive approximate embeddings for the query text. STEER performs the retrieval using the approximate embeddings within the original VDB and requires no modifications to the server side. Our theoretical and experimental analyses demonstrate that STEER effectively safeguards query text privacy while maintaining the retrieval accuracy. Even though approximate embeddings are approximations of the embeddings from proprietary models, they still prevent the providers from recovering the query text through Embedding Inversion Attacks (EIAs). Extensive experimental results show that Recall@100 of STEER can basically achieve a decrease of less than 5\%. Furthermore, even when searching within a text corpus of millions of entries, STEER achieves a Recall@20 accuracy 20\% higher than current baselines.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。