Secure Multi-Party Retrieval

The query vector is cryptographically split into random shares using additive secret sharing. Each party receives a mathematically useless fragment. The original query can only be reconstructed if a threshold of parties colludes, ensuring no single node sees the plaintext query.

• Uses Shamir's Secret Sharing or additive schemes
• Prevents honest-but-curious servers from logging sensitive queries
• Computational overhead is linear in the number of parties

Parties jointly compute similarity scores (e.g., cosine similarity or Euclidean distance) using SMPC protocols without revealing their private vector shards. The computation is performed over secret-shared values using secure addition and multiplication gates.

• Implements Beaver triples for efficient secure multiplication
• Supports approximate nearest neighbor (ANN) algorithms like HNSW
• Prevents leakage of intermediate distance calculations

Once the winning indices are identified, Oblivious Transfer (OT) allows the querier to retrieve the final metadata or payload without the data owner learning which specific record was accessed. This breaks the correlation between the query and the retrieved result.

• Uses 1-out-of-N OT extensions for bandwidth efficiency
• Hides access patterns from the data custodians
• Critical for preventing inference attacks on retrieval logs

Before the final result is returned, calibrated Laplacian or Gaussian noise is added to the similarity scores or the aggregated result vector. This provides a mathematical guarantee against membership inference and attribute reconstruction attacks.

• Satisfies (ε, δ)-differential privacy guarantees
• Privacy budget is consumed per query and tracked by a privacy accountant
• Balances utility loss against formal privacy bounds

The protocol incorporates robust aggregation to defend against malicious parties that may send corrupted vector shards or falsified distance computations. Techniques like Krum or trimmed mean filter out anomalous contributions before finalizing the search result.

• Tolerates up to f out of n malicious nodes
• Uses cross-checks and zero-knowledge proofs for computation integrity
• Ensures correct retrieval even under adversarial conditions

Performance-critical SMPR steps can be accelerated inside Trusted Execution Environments (TEEs) like Intel SGX or AMD SEV. Vector shards are decrypted and processed within an encrypted enclave, isolated from the host operating system.

• Provides hardware-rooted attestation of code integrity
• Reduces cryptographic overhead compared to pure SMPC
• Protects against a compromised cloud provider or privileged insider

A privacy-preserving computation method that allows similarity searches to be performed directly on encrypted vectors without ever decrypting the underlying data. In an SMPR context, this enables a central coordinator to compute nearest neighbors across multiple encrypted datasets, returning only the aggregated result. The data owners never expose their plaintext embeddings, and the querier learns nothing beyond the final top-k matches.

Embeddings that have been mathematically calibrated with calibrated noise to allow semantic analysis while providing a provable guarantee against the reconstruction of individual source data. When multiple parties contribute to a joint retrieval, differential privacy ensures that the presence or absence of any single record cannot be inferred from the query output. This is often combined with SMPR to bound information leakage during cross-silo searches.

A security mechanism that enforces access control at the granularity of individual vector embeddings. In multi-party retrieval, this ensures that even if a cryptographic protocol permits a joint search, a user can only retrieve semantically similar data they are explicitly permitted to see. Authorization policies are evaluated cryptographically alongside the similarity computation, preventing one party from accidentally leaking privileged embeddings to another.

The process of applying a reversible or irreversible transformation to a vector to mask its true semantic meaning from unauthorized observers. In SMPR, parties may apply a one-way function or secret rotation to their embeddings before sharing them with the aggregation protocol. This prevents honest-but-curious intermediaries from learning the raw semantic content of private datasets while still enabling accurate distance calculations.

A multi-tenancy architecture that logically or physically partitions vector indexes to ensure strict data isolation between different organizations. When multiple parties participate in a federated retrieval network, tenant-aware indexing ensures that each party's embeddings remain in their own namespace. The SMPR protocol orchestrates cross-partition queries without violating the isolation boundaries or requiring a single merged index.

Defensive techniques, including output perturbation and query pattern analysis, used to prevent adversaries from reconstructing sensitive source data from model outputs. In an SMPR setting, an attacker might submit thousands of carefully crafted queries to infer the distribution of another party's private vectors. Mitigations include query fingerprinting, semantic rate limiting, and injecting calibrated noise into the final similarity scores.