Shadow Queries for Private Retrieval in Vector Databases

2026-09-04

AI Summary

为解决云基向量数据库中嵌入易受嵌入反转攻击的问题，提出SHAQ方法，通过生成影子查询分解文档语义并解耦存储的嵌入与源文本，从而在保护隐私的同时保持检索效用。

Abstract

Large language models (LLMs) increasingly rely on information retrieval (IR) systems, such as Retrieval-Augmented Generation (RAG), to incorporate domain-specific knowledge without costly re-training. These systems often store pre-computed document embeddings in cloud-based vector databases. However, such embeddings are vulnerable to embedding inversion attacks (EIAs), which can reconstruct their underlying text. Existing defenses, such as adding noise or scaling embeddings, often provide limited privacy or significantly reduce retrieval utility. We propose SHAQ (shadow query generation), a semantic-decomposition and embedding-decoupling defense against EIAs. SHAQ is based on the insight that EIAs rely on the strong coupling between an embedding and its original text. Instead of storing document embeddings directly, SHAQ uses a generative language model to create diverse shadow queries that capture different semantic aspects of each document. These queries are then encoded and stored in place of the original document embeddings, thereby decomposing document semantics and decoupling stored embeddings from the source text. Experiments across diverse IR datasets show that SHAQ substantially improves privacy while preserving retrieval utility, achieving a recovery rate as low as 0.2104, defending up to 19.50% more tokens than baseline defenses, and reaching up to 0.7967 MAP@10 with up to 5.53% utility improvement. These results demonstrate that semantic decomposition and embedding decoupling provide an effective alternative to directly modifying embeddings for defending against EIAs.

Problem

• Embedding Inversion Attacks
• Privacy
• Information Retrieval
• Document Embeddings
• Cloud-based Vector Databases

Innovation

• Shadow Query Generation
• Semantic Decomposition
• Embedding Decoupling
• Privacy Protection
• Information Retrieval