Efficient Privacy-Preserving Retrieval Augmented Generation with Distance-Preserving Encryption

Retrieval-Augmented Generation (RAG) has emerged as a key technique for enhancing response quality of large language models (LLMs) without incurring high computational cost. It works by retrieving knowledge and fact from external databases, augmenting the prompt with the retrieved data, and enabling the LLM to generate more accurate responses. In traditional architectures, RAG services are provided by a single entity that hosts the dataset and issues queries within a trusted local environment. However, individuals or small organizations often lack the resources to maintain data storage servers, leading them to rely on outsourced, cloud-based storage for scalability. This dependence on untrusted third-party services introduces significant privacy risks, particularly when handling private and sensitive data. Embedding-based retrieval mechanisms, commonly used in RAG systems, are especially vulnerable to privacy leakage such as vector-to-text reconstruction attacks and structural leakage via vector analysis. Several privacy-preserving RAG techniques have been proposed to address such vulnerabilities; however, most existing approaches rely on partially homomorphic encryption, which incurs substantial computational overhead and limits their practicality in real-world deployments.To address these challenges, we propose an efficient privacy-preserving RAG framework (ppRAG) tailored for untrusted cloud environments that defends against vector-to-text attack, vector analysis, and query analysis. At its core, we propose Conditional Approximate Distance-Comparison-Preserving Symmetric Encryption (CAPRISE) that encrypts embeddings while still allowing the cloud to compute similarity between an encrypted query embedding and the encrypted database embeddings. CAPRISE preserves only the relative distance ordering between the encrypted query and each encrypted database embedding, without exposing inter-database distances, thereby enhancing both privacy and efficiency. To further mitigate query analysis risks, we introduce differential privacy by perturbing the query embedding prior to encryption, preventing the cloud from inferring sensitive patterns from query frequency. Experimental results show that ppRAG achieves efficient processing throughput, high retrieval accuracy, strong privacy guarantees, making it a practical solution for resource-constrained users seeking secure, cloud-augmented LLMs.