提出SHARD方法，让私密检索系统在被攻击时仍能保持排名准确，防对齐但不保证完全隐私。
SHARD: cell-keyed residual splitting for alignment-resistant private dense retrieval
- 将向量分解为路由前缀和局部正交密钥保护的残差，分散泄露风险
- 在10个BEIR/MIRACL配置中保持原始nDCG@10与召回率，误差<0.080
- 适合需抗对齐攻击的私密检索场景，尤其适用于高敏感数据应用
密集检索系统在向量库泄露时会暴露文档几何结构，全局保护变换常可从已知样本对中被对齐。本文研究SHARD，将PCA坐标拆分为短路由前缀与由独立单元局部正交密钥保护的残差。支持CKKS密文-明文重排序，但评估为泄露权衡而非加密文档隐私保障。修正评分采用中心化文档坐标与非中心化查询评分，保持原始排名至查询相关常数。在十组BEIR/MIRACL配置中复现原始nDCG@10与召回率；双侧中心化导致nDCG最多下降0.080。单元密钥将已知对证据扩散至各区间，但最小范数对齐仍可在远低于完整密钥秩时恢复有效信号，故无硬性去匿名阈值。真实CKKS下最大得分误差为2.29e-6，无顶级项翻转；块打包使查询上传减少74%–87%，但进程内p50延迟增加14%–26%。在强化版GTR场景中，未知密钥使token-F1从0.665降至0.242；宽前缀与八对样本可显著恢复。在25%–90%释放重叠下，不变前缀与干净残差范数可将持久行关联至R@1≥0.9996，尽管单元-格子链接在频繁变更下退化。形式校准高斯发布在ε=1时nDCG@10最高为0.011，仅三处严格效用匹配出现在ε=32768，且链接R@1≥0.995。SHARD保留检索性能并隔离对齐证据，但不提供差分隐私、不可链接性或可撤销模板。
原文摘要 · Abstract (English)
Dense retrieval systems expose document geometry when vector stores are compromised, and a global protective transform can often be aligned from known pairs. We study SHARD, which splits PCA coordinates into a short routing prefix and a residual protected by independent cell-local orthogonal keys. It supports CKKS ciphertext--plaintext reranking but is evaluated as a leakage trade-off, not a cryptographic document-privacy guarantee. Corrected scoring uses centered document coordinates and an uncentered scoring query, preserving raw ranking up to a query-dependent constant. Across ten BEIR/MIRACL configurations it reproduces raw nDCG@10 and recall, whereas centering both sides loses up to 0.080 nDCG. Cell keys spread diffuse known-pair evidence across compartments, but minimum-norm alignment recovers useful signal far below full key rank, so there is no hard de-anonymization threshold. Real CKKS has maximum score error 2.29e-6 and no top-1 flips; block packing cuts query upload by 74--87% but raises in-process p50 latency by 14--26%. In a strengthened GTR case, an unknown key lowers token-F1 from 0.665 to 0.242; a wide prefix and eight pairs restore much. Under 25--90% release overlap, the unchanged prefix and clean residual norm link persistent rows with R@1 at least 0.9996, although cell-Gram linkage degrades under churn. A formally calibrated Gaussian release gives nDCG@10 at most 0.011 at epsilon=1; its only three strict utility matches occur at epsilon=32768 with linkage R@1 at least 0.995. SHARD preserves retrieval and compartmentalizes alignment evidence, but does not provide DP, unlinkability, or cancellable templates.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。