Hybrid privacy-aware semantic search: SVD-truncated document geometry and CKKS-encrypted query reranking under a restricted threat model

A new preprint proposes a hybrid defense for vector databases that combines geometric obfuscation of stored documents with cryptographic protection of user queries, aiming to block embedding-inversion attacks without the performance cost of fully homomorphic encryption at scale [1]. The scheme, posted to arXiv on 24 June 2026, addresses a known vulnerability in semantic search systems: when a vector database is compromised, attackers can reconstruct the original text from the stored embeddings [1]. Fully homomorphic encryption can prevent this, but the authors note it is “too slow at million-document scale” [1]. Adding privacy noise, the other common countermeasure, degrades ranking quality before it provides meaningful protection [1]. The preprint instead splits the problem. The static document collection is protected by projecting each vector onto a lower-dimensional subspace using singular value decomposition (SVD) and then applying a secret orthogonal rotation known only to the data owner [1]. The dynamic query is reranked under CKKS homomorphic encryption, so a server operating under an honest-but-curious model never sees the query or the resulting scores [1]. The authors report that on a corpus of 1 million documents and across five different encoders, the method preserves ranking quality — and slightly improves it on stronger encoders, which they characterize as a linear denoising effect — while keeping latency under one second [1]. An off-the-shelf inversion attack run against the protected space collapses to the noise floor [1]. The preprint also tests stronger adversaries. A known-plaintext attacker can recover the secret rotation via orthogonal Procrustes analysis using roughly as many leaked document-embedding pairs as the retained dimension [1]. Public product-quantization codes, they add, preserve most of the nearest-neighbor structure [1]. The work is explicit about its limits. Query confidentiality relies on cryptographic guarantees, but document protection is described as “an empirical obfuscation layer … not a cryptographic primitive” [1]. The threat model is carefully delimited for each claim [1]. The paper appears on arXiv, an open-access repository that hosts preprints across physics, mathematics, and computer science and has grown to a submission rate of about 24,000 articles per month as of late 2024 [7]. The repository, founded in 1991, passed the two-million-article milestone at the end of 2021 [7].