Privacy preserving retrieval augmented generation system, method, electronic device, and storage medium

Abstract

This invention discloses a privacy-preserving retrieval enhancement generation system, method, electronic device, and storage medium, relating to the fields of artificial intelligence and network security technology. In the system, a server-side superset retrieval module retrieves and returns a document superset containing documents with multiple different semantic clusters from a vector database based on obfuscated query vectors; a local sparse reordering module generates a mixed request list containing document identifiers of real documents and fake document identifiers; a blind document acquisition module acquires the full text of the encrypted document corresponding to each document identifier in the mixed request list; and an inverse mapping module generates an initial result, performs inverse mapping on the initial result to filter generation noise introduced by the document content corresponding to fake document identifiers, and outputs the final response. This invention achieves finer-grained privacy protection throughout the entire retrieval enhancement generation chain, while avoiding excessive communication overhead and semantic loss, and does not rely on a specific hardware environment.

Description

Technical Field

[0001] This invention relates to the fields of artificial intelligence and cybersecurity, and in particular to a privacy-preserving retrieval enhancement generation system, method, electronic device, and storage medium. Background Technology

[0002] Retrieval augmentation enhances the accuracy of facts generated by large language models by introducing external knowledge bases, thus solving the model illusion problem. However, in the standard retrieval augmentation process, sending user queries containing sensitive information directly to cloud servers for retrieval and inference inevitably exposes the user's query intent and private data. How to effectively protect user privacy while leveraging the powerful computing capabilities and rich knowledge bases of the cloud has become a pressing technical problem.

[0003] Currently, privacy protection solutions for retrieval-enhanced generation scenarios can be mainly categorized into the following technical paths. The first category is based on private information retrieval architectures, such as the PIR-RAG system. It employs a "clustering-acquisition" architecture, the core idea of ​​which is to cluster database documents, allowing users to covertly download all documents from the target cluster using a private information retrieval protocol and reorder them locally. The second category is based on trusted execution environments, such as the Petridish system. This utilizes confidential virtual machines and secure partitioning decoding technology to split the inference process into user and service processes, protecting critical intermediate states within a hardware-protected trusted execution environment. The third category is dynamic desensitization and masking techniques, such as Presidio, which protects privacy by identifying and replacing sensitive entities in the query and context with generic placeholders, and then performing inverse mapping restoration after inference. The fourth category is based on differential privacy techniques, such as DPSparseVoteRAG, which achieves privacy protection by introducing a noise voting mechanism or sparse vector technology during the model's token generation process to consume the privacy budget.

[0004] The existing solutions described above have significant shortcomings in practical applications. Private information retrieval architectures face a trade-off between communication overhead and privacy granularity: to amortize the cost of private information retrieval protocols, it is typically necessary to download all documents for the entire target cluster, resulting in significant downlink bandwidth pressure. Simultaneously, while the server cannot know the specific documents retrieved by the user, it can infer the topic of the cluster visited. This coarse-grained topic information itself constitutes a serious privacy breach in highly sensitive fields such as healthcare and finance. Dynamic anonymization and masking techniques lead to semantic loss; simple placeholder replacements disrupt the coherence and integrity of the text context, affecting the understanding of semantics by large language models and thus impairing the quality of the generated results. Trusted execution environment architectures are highly dependent on specific hardware support, resulting in high deployment costs and limited flexibility. Differential privacy methods continuously consume privacy budgets during the generation process, potentially affecting the usability of the generated content.

[0005] Therefore, there is an urgent need for a new technical solution that can achieve finer-grained privacy protection throughout the entire process of retrieval enhancement generation, while avoiding excessive communication overhead and semantic loss, and is not dependent on a specific hardware environment. Summary of the Invention

[0006] The technical problem to be solved by the present invention is to address the shortcomings of the prior art, and specifically provides a privacy-preserving retrieval enhancement generation system, method, electronic device, and storage medium, as detailed below: 1) In a first aspect, the present invention provides a privacy-preserving retrieval enhancement generation system, the specific technical solution of which is as follows: Includes: client-side semantic offset generator, server-side superset retrieval module, local sparse reordering machine, blind document acquisition module, and inverse mapping module; The client-side semantic offset generator is used to: receive user queries, generate an original query vector based on the user queries, and generate a confused query vector by adding a semantic offset vector to the original query vector; The server-side superset retrieval module is used to: receive obfuscated query vectors, retrieve documents from the vector database based on the obfuscated query vectors, and return a document superset containing documents with multiple different semantic clusters. The document superset contains the document identifier and corresponding encrypted digest of each document. The local sparse reorderer is used to: reorder and filter the encrypted digests of the document superset based on the original query vector, in order to determine the document identifiers of real documents related to the original query vector from the document superset, and generate a mixed request list containing the document identifiers of real documents and fake document identifiers. The blind document acquisition module is used to: send a mixed request list to the server to request and retrieve the full text of the encrypted document corresponding to each document identifier in the mixed request list; The inverse mapping module is used to: input the full text of the acquired encrypted document into the trained large language model for inference to generate initial results, perform inverse mapping on the initial results to filter out generation noise introduced by the document content corresponding to the fake document identifier, and output the final response.

[0007] The beneficial effects of the privacy-preserving retrieval enhancement generation system provided by this invention are as follows: The client-side semantic offset generator effectively protects the true semantic intent of the original query vector by generating and sending obfuscated query vectors. This prevents the server from inferring the specific topic of the user's query, overcoming the privacy risk of coarse-grained topic leakage in existing private information retrieval architectures. The server-side superset retrieval module returns a superset of documents from multiple different semantic clusters based on the obfuscated query vectors. Combined with a local sparse reordering module, it only needs to download and process encrypted digests, significantly reducing the communication overhead required for data transmission. The local sparse reordering module performs precise filtering and generates a mixed request list locally based on the original query vectors. Combined with the blind document acquisition module's mixed requests for real and fake document identifiers, it achieves privacy protection for access patterns during document acquisition. The inverse mapping module ensures the semantic accuracy and coherence of the final response by filtering generation noise introduced by fake document content, avoiding the semantic loss caused by traditional dynamic desensitization methods. The entire solution is implemented at the software level, without relying on specific hardware such as trusted execution environments, and has broader applicability.

[0008] Based on the above solution, the privacy-preserving retrieval enhancement generation system of the present invention can be further improved as follows.

[0009] Furthermore, the client-side semantic offset generator is also used to: randomly select a semantic direction orthogonal to the true semantic intent represented by the original query vector as a noise direction vector, and multiply the noise direction vector with a preset coefficient to obtain the semantic offset vector.

[0010] The beneficial effects of adopting the above-mentioned further scheme are as follows: By randomly selecting noise direction vectors orthogonal to the original query vector and applying preset coefficients to generate semantic offset vectors, the query vector is obfuscated and actively shifted to multiple cluster boundary regions in the semantic space. This prevents the server-side superset retrieval module from accurately inferring the true semantic intent of the user's original query, effectively preventing privacy leaks based on clustering topics. The introduction of orthogonal noise directions ensures that the offset vector is semantically separated from the original intent to the greatest extent, improving the strength and reliability of privacy protection.

[0011] Furthermore, the local sparse reorderer is specifically used to: calculate the similarity score between the original query vector and each encrypted digest in the document superset, sort the encrypted digests in descending order of similarity score, select the top k encrypted digests based on the sorting result to determine the document identifiers of the corresponding real documents, generate m fake document identifiers, and combine the document identifiers of the k real documents with the m fake document identifiers to form a mixed request list.

[0012] The beneficial effects of adopting the above-mentioned further scheme are as follows: The local sparse reorderer accurately filters out real document identifiers by calculating the similarity score between the original query vector and the encrypted digest, and generates fake document identifiers to form a mixed request list. This method significantly reduces the amount of data that needs to be downloaded from the server, transmitting only the encrypted digest instead of the full text, thus reducing communication overhead. At the same time, the mixed request list obfuscates the real access pattern, making it impossible for the server to identify the user's true needs, thereby enhancing privacy protection during the document acquisition process.

[0013] Furthermore, the inverse mapping module is specifically used to: when the full text of the encrypted document is input into the trained large language model, send a prompt instruction with an encrypted attention mask to the trained large language model. The encrypted attention mask is used to instruct the trained large language model to ignore the document content corresponding to the fake document identifier during the inference process. The trained large language model generates an initial result based on the full text of the encrypted document and the prompt instruction. Combined with the fake document identifier, the initial result is cleaned by inverse mapping using the fake document features stored locally on the client to filter out generated noise, and the cleaned final response is obtained and output.

[0014] The beneficial effects of adopting the above-mentioned further scheme are as follows: the inverse mapping module instructs the trained large language model to ignore fake document content through an encrypted attention mask, and performs inverse mapping cleaning using locally stored fake document features after generating the initial results. This process effectively filters out generation noise introduced by fake documents, ensuring that the final response is based on the real document context and maintaining semantic accuracy and coherence. The use of encrypted attention masks protects privacy during the inference process and prevents the server from inferring the existence of fake documents.

[0015] 2) Secondly, the present invention also provides a privacy-preserving retrieval enhancement generation method, the specific technical solution of which is as follows: Receive user queries, generate original query vectors based on user queries, and generate obfuscated query vectors by adding semantic offset vectors to the original query vectors; Receives a scrambled query vector, retrieves and returns a document superset containing documents with multiple different semantic clusters from the vector database based on the scrambled query vector, and the document superset contains the document identifier and corresponding encrypted digest of each document; Based on the original query vector, the encrypted digests in the document superset are reordered and filtered to determine the document identifiers of real documents related to the original query vector from the document superset, and a mixed request list containing document identifiers of real documents and fake document identifiers is generated. Send the mixed request list to the server to request and retrieve the full text of the encrypted document corresponding to each document identifier in the mixed request list; The acquired encrypted document is input into the trained large language model for inference to generate initial results. The initial results are then subjected to inverse mapping to filter out generation noise introduced by the content of documents corresponding to fake document identifiers, and the final response is output.

[0016] Based on the above scheme, the privacy-preserving retrieval enhancement generation method of the present invention can be further improved as follows.

[0017] Furthermore, it also includes: randomly selecting a semantic direction orthogonal to the true semantic intent represented by the original query vector as a noise direction vector, and multiplying the noise direction vector with a preset coefficient to obtain a semantic offset vector.

[0018] Furthermore, the encrypted digests in the document superset are reordered and filtered based on the original query vector to determine the document identifiers of real documents related to the original query vector from the document superset, and a mixed request list containing document identifiers of real documents and fake document identifiers is generated, including: The similarity score between the original query vector and each encrypted digest in the document superset is calculated, and the encrypted digests are sorted in descending order of similarity score. Based on the sorting result, the top k encrypted digests are selected to determine the document identifiers of the corresponding real documents, and m fake document identifiers are generated. The document identifiers of the k real documents and the m fake document identifiers are combined to form a mixed request list.

[0019] Furthermore, the acquired full-text encrypted document is input into the trained large language model for inference to generate initial results. The initial results are then subjected to inverse mapping to filter out generation noise introduced by the content of documents corresponding to fake document identifiers. The final response is then output, including: When the full text of the encrypted document is input into the trained large language model, a prompt instruction with an encrypted attention mask is sent to the trained large language model. The encrypted attention mask is used to instruct the trained large language model to ignore the document content corresponding to the fake document identifier during the inference process. The trained large language model generates an initial result based on the full text of the encrypted document and the prompt instruction. Combined with the fake document identifier, the initial result is cleaned by inverse mapping using the fake document features stored locally on the client to filter out generated noise, and the cleaned final response is obtained and output.

[0020] 3) In a third aspect, the present invention also provides an electronic device, the electronic device including a processor coupled to a memory, the memory storing at least one computer program, the at least one computer program being loaded and executed by the processor to enable the electronic device to implement any of the above-mentioned privacy-preserving retrieval enhancement generation methods.

[0021] 4) In a fourth aspect, the present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements any of the above-described privacy-preserving retrieval enhancement generation methods.

[0022] It should be noted that the beneficial effects of the technical solutions of the second to fourth aspects of the present invention and their corresponding possible implementations can be found in the above description of the technical effects of the first aspect and its corresponding possible implementations, and will not be repeated here. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments of the present invention will be briefly introduced below: Figure 1 This is a schematic diagram of the structure of a privacy-preserving retrieval enhancement generation system according to an embodiment of the present invention; Figure 2 This is a schematic flowchart of a privacy-preserving retrieval enhancement generation method according to an embodiment of the present invention. Detailed Implementation

[0024] The principles and features of the present invention are described below. The examples given are only for explaining the present invention and are not intended to limit the scope of the present invention.

[0025] The technical solution of the present invention and how the technical solution of the present invention solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of the present invention will now be described with reference to the accompanying drawings.

[0026] like Figure 1 As shown, an embodiment of the present invention provides a privacy-preserving retrieval enhancement generation system, comprising: a client-side semantic offset generator, a server-side superset retrieval module, a local sparse reordering generator, a blind document acquisition module, and an inverse mapping module; The client-side semantic offset generator is used to: receive user queries, generate an original query vector based on the user queries, and generate a confused query vector by adding a semantic offset vector to the original query vector; The process of receiving user queries and generating raw query vectors based on those queries is as follows: 1) The client-side semantic offset generator receives input from the user interface, which is a natural language text string expressing information needs or instructions, i.e., the user query. To improve the consistency and effectiveness of subsequent embedding model processing, the original user query text needs to be preprocessed for normalization. Preprocessing operations include, but are not limited to: removing redundant spaces and special control characters, converting full-width characters to half-width characters, and uniformly standardizing the text to Unicode. This step aims to obtain a clean, structured query text as input to the embedding model.

[0027] 2) Input the preprocessed user query text into a pre-trained text embedding model. This embedding model is a bidirectional Transformer encoder or a similar neural network trained on a large-scale corpus. Its function is to map variable-length text sequences into a fixed-dimensional, high-dimensional, dense vector that captures the deep semantic information of the text. The specific calculation can be represented as follows: ,in, This represents the preprocessed user query text. The mapping function represents the embedded model. This represents the generated, unnormalized raw semantic vector. The vector's dimension is consistent with the output dimension of the embedding model, such as 768 or 1024 dimensions, and each numerical feature in the vector collectively represents the semantics of the user query.

[0028] 3) To ensure that the direction, rather than the length, of the vector becomes the dominant factor in subsequent similarity calculations, L2 norm standardization is typically required. This operation transforms the vector into a unit vector, facilitating the calculation of metrics such as cosine similarity in vector space. The standardization process is as follows: ,in, Representing vectors The L2 norm (i.e., the Euclidean length). This represents the final raw query vector obtained after standardization. This raw query vector is a unit vector whose direction uniquely corresponds to the semantic intent of the user query in the semantic space. The client-side semantic offset generator will use the standardized raw query vector... The output serves as the result of this stage. This original query vector is the direct input for generating subsequent obfuscated query vectors and is also the baseline semantic representation relied upon by the local sparse reorderer when reordering documents.

[0029] Specifically, a semantic direction orthogonal to the true semantic intent represented by the original query vector is randomly selected as the noise direction vector, and the noise direction vector is multiplied by a preset coefficient to obtain the semantic offset vector. The specific implementation process is as follows: 1) First, generate a random vector with the same dimensions as the original query vector. Each element of this random vector is a random number independently sampled from a standard normal distribution. This random vector serves as an initial, unfiltered noise source. Let the original query vector be... Its dimensions are The generated random vector is denoted as... ,satisfy and ,in yes A 3D identity matrix, representing the standard normal distribution.

[0030] 2) To ensure that the direction of the final added noise is orthogonal to the true semantic intent of the original query vector, the random vector generated in the previous step needs to be... Projected onto the original query vector In the vertical subspace. This process is achieved by subtracting the component of the random vector along the direction of the original query vector from the random vector, specifically using the formula for vector projection. First, calculate the projection component of the random vector along the direction of the original query vector: , where the operator This represents the dot product operation of vectors. Next, subtracting this projected component from the original random vector yields the component orthogonal to the original query vector, which is the initial noise direction vector. : After this operation, the vector with vector The dot product is zero, that is... This achieves mathematical orthogonality.

[0031] 3) The orthogonal components obtained in the previous step It could be a zero vector (the probability of which is extremely low when the random vector is in the exact same or opposite direction as the original query vector) or a non-zero vector. To avoid zero vectors causing invalid offsets and to ensure the pure directionality of noise vectors, it is necessary to... Perform judgment and standardization. If The L2 norm is greater than a minimum threshold (For example Then, L2 normalization is applied to obtain the noise direction vector per unit length. : ,if The norm is less than the threshold Then you need to go back to the first step and regenerate a different random vector. Repeat steps two and three above until a valid, non-zero noise direction vector is obtained. Standardized It is a unit vector whose direction represents a pure semantic direction that is completely orthogonal to the original semantic intent.

[0032] 4) A configurable coefficient is preset. This coefficient is a non-negative scalar real number used to control the intensity of the semantic offset. The normalized noise direction vector... With this preset coefficient Perform scalar multiplication to generate a semantic offset vector. : The result of the operation is a vector. Its direction and Maintain consistency, meaning it is orthogonal to the original query vector; its magnitude (size) is equal to a preset coefficient. .coefficient The value can be adjusted according to the needs of privacy protection and search performance; a larger value indicates a higher level of privacy protection. This can lead to a larger semantic deviation. The client-side semantic offset generator will calculate the semantic offset vector. Output. This vector is then used in conjunction with the original query vector. Add them together to generate a confused query vector. This completes the entire query obfuscation process. Semantic offset vector The generation of the obfuscated query vector ensures that the obfuscated query vector is actively and controllably pushed away from the original true intent direction in the semantic space and instead points to an irrelevant semantic region. This is the basis for realizing subsequent document superset obfuscated retrieval.

[0033] The explanation of "a semantic direction orthogonal to the true semantic intent represented by the original query vector" is as follows: In the high-dimensional semantic vector space defined by the embedding model, each direction corresponds to a certain potential semantic concept or feature. The direction of the original query vector accurately represents the true semantic intent of the user's query. A semantic direction "orthogonal" to the direction of this original query vector mathematically means that the dot product between the two vectors is zero, that is, they are perpendicular to each other in the vector space. Semantically speaking, choosing such an orthogonal direction as the basis for noise addition means that the introduced offset aims to point the semantics of the query to a semantic concept region that is least relevant to, or even completely unrelated to, the original intent. This operation is not to modify the original intent, but to construct a confusing query vector pointing to a different semantic topic for the purpose of protecting privacy.

[0034] The generation of the semantic offset vector is a crucial operation for the client-side semantic offset generator after obtaining the original query vector. The goal of this process is to construct a semantic noise vector, which is added to the original query vector to produce a confused query vector pointing in the direction of the obfuscated semantics. The implementation follows explicit mathematical and procedural steps.

[0035] The process of generating a confused query vector by adding a semantic offset vector to the original query vector is as follows: 1) The client-side semantic offset generator already has two input vectors. The first input vector is the original query vector, denoted as... The first input vector is a normalized unit vector whose direction precisely represents the user's true semantic intent in the query. The second input vector is a semantic offset vector, denoted as... This vector is created by interpolating the noise direction vector with preset coefficients. The product is obtained by multiplying, and its direction is orthogonal to the original query vector. Its magnitude is equal to the preset coefficient. The two vectors have the same dimension. Ensure that mathematical operations can be performed. (This refers to the original query vector.) With semantic offset vector Perform element-wise addition. This is a basic vector operation, mathematically represented as: Among them, the addition operator Indicates two The corresponding dimension values ​​of the vector are added together. The result is a new... A dimensional vector, denoted as This is called the initial confusion vector. Geometrically, this addition operation is equivalent to adding the original query vector in the vector space. The endpoint along the semantic offset vector The direction has changed by a distance .because and Orthogonal, the new vector after the shift It deviates from the original true semantic intent and points to a new point in a semantic space.

[0036] 2) To make the obfuscated query vector suitable for cosine similarity-based vector database retrieval, the initial obfuscated vector needs to be... Convert to a unit vector. Calculate the L2 norm (Euclidean length) of the initial confusion vector: ,in, Representing vectors In the The values ​​in each dimension are then divided by their L2 norm to obtain the standardized obfuscated query vector. : This step obfuscates the query vector. It becomes a unit vector with a magnitude of 1. Its direction is determined by both the original query vector and the semantic offset vector, and is different from both.

[0037] 3) The client-side semantic offset generator generates obfuscated query vectors. Verification is then performed. Verification primarily confirms that the vector is non-zero and is a valid array of floating-point numbers. Subsequently, the query vector is obfuscated. This vector is officially output as the final product of the client-side semantic offset generator. It will then be sent to the server-side superset retrieval module to initiate an obfuscated retrieval request. The obfuscated query vector generated through this process mathematically ensures semantic separation from the original query while maintaining full compatibility of the vector format with standard retrieval interfaces, achieving technical feasibility while prioritizing privacy.

[0038] The server-side superset retrieval module is used to: receive obfuscated query vectors, retrieve documents from the vector database based on the obfuscated query vectors, and return a document superset containing documents with multiple different semantic clusters. The document superset includes the document identifier and corresponding encrypted digest of each document. The specific implementation process is as follows: 1) The server-side superset retrieval module receives the obfuscated query vector sent from the client's semantic offset generator via a network interface. This vector is a high-dimensional, normalized array of floating-point numbers, denoted as . Upon receiving the data, the server performs format validation to ensure that its dimensions match the document vector dimensions stored in the vector database and that it is a valid numerical vector, preparing it for subsequent retrieval operations. The server-side superset retrieval module will then obfuscate the query vector. As input to the query, the search interface of the vector database is invoked. Internally, the vector database utilizes pre-built indexes (such as HNSW graphs, IVF-PQ, etc.) for rapid computation. With all document vectors in the library The similarity. Here, This represents the total number of documents in the vector database. Indicates the first The standardized semantic vectors of the documents. Similarity calculation typically uses cosine similarity because the vectors are already standardized, and cosine similarity is equivalent to the dot product operation: ,in, This indicates the confusion between the query vector and the first... The similarity score between document vectors indicates their relevance within the current confounding semantic space; a higher score signifies greater "relevance." The index structure of the vector database allows it to avoid traversing all... Instead of finding a single vector, it efficiently finds the vector with... The most similar batch of candidate vectors.

[0039] 2) Vector database returns similarity scores. The first in descending order A list of the most relevant document identifiers. Quantity It is a system-preset number of documents that is far greater than the final number required by the client. The numerical value. For example, When it is 5 o'clock, It can be set to 100. This is due to obfuscating the query vector. The semantic reference is offset and located at the edges of multiple clusters, therefore this The original semantic vector of the highest-scoring document The distribution in the vector space does not closely revolve around the original true query intent, but rather is scattered across multiple different semantic clusters. This achieves the goal of returning documents that "contain multiple different semantic clusters". The server-side superset retrieval module, based on the Top-N document identifier list obtained in the previous step, retrieves the corresponding document summary information from the associated metadata storage. These summaries are concise representations of the document content and have been encrypted before storage to protect the information; these are the "encrypted summaries" referred to in the technical solution. The module pairs the document identifier of each document with its corresponding encrypted summary to form a list containing... A list of entries. This list is the “document superset,” which is essentially a temporary, excessive collection of candidate documents with mixed semantic sources.

[0040] 3) The server-side superset retrieval module transmits the assembled document superset over the network back to the client's local sparse reorderer. The returned data structure explicitly contains two parts: one is... The system provides two sets of documents: a list of document identifiers and a unique encrypted digest corresponding to each document identifier. This completes the task of the server-side superset retrieval module. It does not need to know, nor can it infer, which documents the user truly needs, because it simply provides a standard retrieval response to a semantically ambiguous query vector, thus effectively protecting the privacy of the user's query intent.

[0041] Vector databases are database systems specifically designed for the efficient storage, indexing, and retrieval of high-dimensional vector data. Unlike traditional databases that rely on exact value matching for retrieval, the core capability of vector databases lies in performing approximate nearest neighbor searches based on the similarity between vectors (such as cosine similarity and Euclidean distance). In this system, each document in the external knowledge base is pre-converted into a high-dimensional semantic vector using an embedding model and stored in the vector database. When the server-side superset retrieval module receives a confused query vector, it performs a rapid similarity comparison within this database to find the set of documents that are semantically closest.

[0042] In this context, semantic clustering refers to document groups automatically formed within the semantic vector space of a vector database based on the similarity relationships between document vectors. Each cluster contains several semantically similar documents that collectively point to a relatively focused topic or conceptual domain. For example, multiple documents on "cardiovascular disease treatment" might form a semantic cluster. During retrieval, an unobfuscated query vector typically hits one or a few closely related semantic clusters. This solution, however, uses obfuscated query vectors to intentionally cross multiple different semantic clusters, rather than focusing on a single cluster, thus creating a hybrid document superset.

[0043] The encrypted digest refers to the summary text generated after preprocessing and compression of the original document. This text is then encrypted using a symmetric encryption algorithm to produce ciphertext. The encrypted digest retains the core semantic information of the original document but is much shorter than the full text. In the server-side superset retrieval module, the encrypted digest is stored along with the document vector. Transmitting the encrypted digest instead of the full text significantly reduces network bandwidth consumption. Before use, the client-side local sparse reorderer must decrypt the digest using a pre-shared key to recover the plaintext digest text for subsequent semantic analysis.

[0044] The document identifier is a string or numeric sequence that uniquely identifies a document in the semantic vector database. Common implementations include globally unique identifiers (UUIDs), auto-incrementing primary keys, or hash values. Each document is assigned a unique document identifier when it is stored in the database, which is associated with the document's semantic vector, cryptographic digest, and cryptographic full text. During the retrieval process, the system uses the document identifier to accurately identify and request specific document content.

[0045] The local sparse reorderer is used to: reorder and filter encrypted digests in a document superset based on the original query vector, in order to determine the document identifiers of real documents related to the original query vector from the document superset, and generate a mixed request list containing document identifiers of real documents and fake document identifiers. Specifically, it calculates the similarity score between the original query vector and each encrypted digest in the document superset, sorts the encrypted digests in descending order of similarity score, selects the top k encrypted digests based on the sorting result to determine the document identifiers of the corresponding real documents, generates m fake document identifiers, and combines the document identifiers of the k real documents with the m fake document identifiers to form a mixed request list. The specific implementation process is as follows: 1) Upon receiving the document superset from the server-side superset retrieval module, the local sparse reorderer initiates a precise reordering process. The document superset contains N entries, each consisting of a document identifier and a corresponding encrypted digest. First, the client uses a locally stored key to decrypt each encrypted digest, obtaining the plaintext digest text. Let the i-th plaintext digest text be denoted as... Next, the client uses a lightweight embedding model (this model can be the same as or different from the model that generated the original query vector, but must be in the same semantic space) to convert each plaintext digest text into a semantic vector. Let the semantic vector of the i-th digest be denoted as . The conversion process is as follows ,in This represents the mapping function of the local embedding model. To ensure comparability, all summary vectors... L2 standardization is also required. Then, the original query vector is calculated. With each summary vector The cosine similarity score. Original query vector. This is the true semantic representation of the user's query. For the i-th summary, its similarity score... The calculation formula is: , operator This represents the dot product operation of vectors. Because... and Since they are all unit vectors, the result of their dot product is the cosine similarity, which ranges from -1 to 1. A higher value indicates greater semantic similarity. All N similarity scores are calculated. Then, the local sparse reordering unit sorts all summaries and their associated document identifiers in descending order of score. After sorting, the top-ranked summaries are selected. The document identifier corresponding to the 1-bit summary. One document identifier was determined as the "document identifier of the real document" most relevant to the user's original query. Quantity This is the final number of documents required as preset by the system.

[0046] 2) To protect privacy and prevent the server from inferring the true intent by analyzing the list of requested documents, the client needs to generate fake document identifiers. The number of fake document identifiers... This is a system preset parameter. There are several technically feasible strategies for generating fake document identifiers. One strategy is to randomly and evenly select identifiers from a global list of document identifiers across the entire document library. One identifier, but it needs to be ensured that this Each identifier is not the same as the one already selected. Each real document is identified as duplicate. Another strategy is to use a pseudo-random algorithm to generate a unique identifier based on a seed from the current session (such as a hash of a timestamp and a user ID). A random string conforming to the document identifier format. Regardless of the strategy used, the generation process must ensure that the fake document identifier is statistically indistinguishable from the real identifier, and the client needs to record this in the local area. A fake document identifier is used to identify and filter the noise introduced by them in the subsequent inverse mapping module.

[0047] 3) After obtaining The document identifier of a real document and After identifying each fake document, the local sparse reorderer merges them into a single list, forming the final mixed request list. A simple merging produces a list containing... A list of identifiers. To further enhance the obfuscation effect, this list can be randomly shuffled after merging, making the positions of real and fake identifiers completely randomized. Random shuffling can be implemented using the Fisher-Yates shuffle algorithm. The final generated mixed request list can be represented, for example, as a list... ,in Indicates the true document identifier, This indicates a fake document identifier. This list will be sent to the blind document retrieval module to request the full text of the document from the server. The server will receive a list containing... The system can identify individual document requests, but it cannot effectively distinguish which ones the user truly needs. This allows for request-level privacy protection by using individual documents.

[0048] The fake document identifiers are randomly generated or selected from a document library by the client's local sparse reordering mechanism to obscure the true access intent and do not represent the user's actual information needs. The documents corresponding to these identifiers are not actually used to construct the final answer. Sending fake document identifiers mixed with real document identifiers to the server effectively obscures the client's true access pattern, making it impossible for the server to accurately infer the user's query intent from the request list, thus providing an additional layer of privacy protection.

[0049] The blind document acquisition module is used to: send a mixed request list to the server to request and retrieve the full text of the encrypted document corresponding to each document identifier in the mixed request list. The specific implementation process is as follows: 1) The blind document acquisition module receives a list of generated mixed requests from the local sparse reorderer. This list is a collection of... A data structure for document identification, wherein... Each identifier corresponds to a real document. Each identifier corresponds to a fake document. The module encapsulates this list into a standard request message conforming to network communication protocols. The request message explicitly contains operation instructions (e.g., "FetchDocumentsByID") and an array of document identifiers. Subsequently, the module sends the request message to the server's predefined document retrieval interface through an established secure transport channel (e.g., a TLS / SSL connection). The entire sending process does not distinguish between real and fake identifiers in the list, treating them as an equal, holistic set of requests.

[0050] 2) After receiving the request message from the client, the server-side document retrieval interface parses out the operation instructions and related data. An array of document identifiers. The server then performs batch queries in its document storage system (such as a relational database or object storage) based on these document identifiers. The document storage system stores the encrypted full text of each document, with the document identifier as the index key. The server program attempts to find the corresponding encrypted full-text data block for each identifier in the request list. This process is a transparent data read operation for the server; it cannot and does not need to know the semantic or truth / false attributes behind these identifiers.

[0051] 3) If the stored document is already encrypted, the server directly retrieves the ciphertext data block. In some implementations, the server may apply an additional layer of transmission encryption or use a client-specific public key for re-encryption before transmission to provide more comprehensive transmission security. The server will retrieve all... The encrypted full text of each document, in the order of the document identifiers in the request, or encapsulated in a structured response body (e.g., a JSON array, where each element contains a document identifier and its corresponding encrypted full text), is ready to be returned to the client. If a certain identifier does not exist in the storage system (e.g., due to randomly generated fake identifiers), the server can be configured to return a specific error code or an "empty document" ciphertext filled with random data to maintain the integrity of the request list.

[0052] 4) The server returns the assembled response message to the client's blind document retrieval module via the network channel. The body of the response message contains all the requested information. Each document is identified by its corresponding encrypted full-text data. Because all full-text data is encrypted, even if the response is intercepted during transmission, an attacker cannot directly obtain the plaintext content of the document.

[0053] 5) The client's blind document retrieval module receives the response message from the server. The module first verifies the integrity and format correctness of the response. Then, it parses the response body to obtain a document containing... The module generates a list of entries, each containing a document identifier and a short encrypted full-text snippet of the document. This list is stored in the client's temporary memory or secure storage area and then output to the next processing module, the inverse mapping module, for subsequent decryption, context assembly, and inference generation. At this point, the blind document acquisition module has completed its core task: successfully acquiring a mixed encrypted full-text content containing both real and fake documents without exposing the actual set of required documents to the server.

[0054] In this system, the server refers to a remote server system in the network architecture that provides data and computing services. In the system of this invention, the server specifically undertakes core functions such as a vector database, full-text document storage, and inference using a trained large language model. The server receives requests from clients, performs operations such as retrieval, data acquisition, and model inference, and returns the results to the client. Communication between the server and client follows a predefined protocol, and the server provides standardized processing services for obfuscated or mixed requests without needing to know the client's true intentions.

[0055] In this context, the encrypted full-text document refers to the complete original text content of each document in the knowledge base, processed by an encryption algorithm to form ciphertext data. Unlike encrypted digests that only summarize the core content, the encrypted full-text document contains all the detailed information of the document. During storage and transmission, the full-text document remains encrypted, and only clients with the valid key can decrypt and use it. This method ensures that even if the server or transmission link is spied on, the actual content of the document will not be leaked, providing a fundamental data security layer for the entire privacy protection process.

[0056] In another possible implementation, the blind document acquisition module is used to acquire the full text of the encrypted document corresponding to each document identifier in the mixed request list. The specific implementation process is as follows: 1) Decompose the hybrid request list into multiple non-overlapping sublists and bind each sublist to a unique anonymized session identifier. Through a distributed anonymous communication network, these bound sublists are routed to a predefined and non-associative set of storage nodes. Each storage node only knows its assigned sublist and anonymous session identifier, and cannot obtain the complete hybrid request list or infer the global identity and intent of the requester. Specifically: ① Determine a segmentation parameter This parameter determines how many sublists the list will be divided into. For example, for a list containing... A list of document identifiers can be evenly divided into Sublist Each sublist contains approximately Each identifier is assigned a sublist, and each identifier is ensured to appear in only one sublist to avoid overlap.

[0057] ② Generate a master session key for this acquisition session. Based on this, a unique anonymous session identifier is derived. ,in It is a cryptographic hash function (such as SHA-256). Indicates a connection operation. It is a random number. Each sublist All the same as this Bind to form a tuple .

[0058] ③ These tuples are sent via a distributed anonymous communication network (such as an implementation based on OnionRouting). For each tuple... The client software uses multiple layers of encryption to construct an anonymous data packet. The packet is transmitted through a series of randomly selected relay nodes in the network. Each relay node decrypts one layer of encryption to obtain the next-hop address and forwards the inner-layer encrypted data packet. Finally, the data packet arrives at a pre-configured or dynamically selected storage node. Storage nodes After decrypting the data packet, only the following can be seen: and the sublist assigned to it for processing It neither knows the complete list of mixed requests nor can it... It can be associated with any specific client identity.

[0059] 2) Upon receiving the sublist, each storage node retrieves the corresponding encrypted document full-text data block in parallel from a decentralized, content-addressed encrypted storage network based on the document identifiers contained in the list. The encrypted storage network uses the hash value of the document identifier as the index key to store the encrypted and fragmented document content, ensuring that storage nodes do not need to know the semantics of the data content when retrieving data blocks, and that a single node cannot recover the complete document. Specifically: storage nodes Upon receiving Then, begin processing its sublists. Each document identifier in Retrieve the full text of the corresponding encrypted document. In this implementation, the full text of the document is stored in an encrypted storage network (such as a private network of IPFS or a similar architecture). Storage node First, calculate the identifier for each document. The content index key. Assume the system uses a fixed encryption key. (or by) If a derived key is used to encrypt a document, then the ciphertext of the encrypted document will be... hash value This will serve as its addressing identifier within the encrypted storage network. Storage node Concurrently send requests to the encrypted storage network The request to retrieve data. Nodes in the encrypted storage network use distributed hash tables or other addressing protocols to assign storage nodes... It directs the user to the peer node that stores the corresponding encrypted data block. Storage node Obtain individual data from the network. Identified encrypted data blocks Due to data blocks It is encrypted and may be further fragmented for storage on different nodes. Throughout the acquisition process, it is impossible to decrypt or understand the data content, nor can it reconstruct the complete plaintext of any document based solely on the partial data blocks acquired.

[0060] 3) The storage node marks the acquired encrypted document full-text data blocks with their bound anonymized session identifiers and sends them to a temporary, secure aggregation buffer via a separate anonymous return channel. The aggregation buffer, based on the same anonymized session identifier, gathers and reassembles the data blocks corresponding to all sub-lists to reconstruct the complete encrypted document full-text set corresponding to all document identifiers in the original mixed request list. Specifically: storage nodes After obtaining all requested data blocks Then, they need to be safely sent back. This involves sending these data blocks along with the received anonymized session identifier. Packaging to form new data units For data transmission back, the storage node... An anonymous return channel needs to be established. This may use a different set of relay nodes than the incoming path, or it may follow the return path mechanism provided by the anonymous communication network. Storage nodes. Data unit Multi-layer encryption is applied, with the destination address set as the network entry point of the aggregation buffer. Encrypted packets are transmitted via multi-hop relay through the anonymous return channel, eventually reaching the aggregation buffer. The aggregation buffer listens for connections from the anonymous network. For each received packet, it decrypts it to obtain... and a set of data blocks The aggregation buffer internally maintains a [database name missing]. A session state table with the same key. The buffer merges the data blocks from all the data blocks. Each storage node, marked as the same Once all the data blocks have arrived, the aggregation buffer will have a complete set of encrypted full-text data blocks corresponding to all document identifiers in the original mixed request list. .

[0061] 4) The aggregation buffer performs integrity verification on the reconstructed set of encrypted full-text documents to ensure that all requested document data has been correctly obtained and has not been tampered with. After successful verification, the complete set of encrypted full-text documents is delivered to the requester who issued the original mixed request list via a one-time secure transmission link. The aggregation buffer and all temporary data from intermediate steps are then immediately cleared, completing the acquisition process. Specifically: After the reorganization is complete, the aggregation buffer must validate the dataset. To ensure the integrity of the request, one approach is for the system to pre-calculate a list of hash values ​​for the ciphertext corresponding to each request document identifier when initially generating the mixed request list. The aggregation buffer can calculate the set of hash values ​​of the received data blocks. and with A comparison is performed to ensure that all requested data blocks have been correctly retrieved and have not been tampered with. Another approach is to use a Merkle tree or similar structure for batch verification. Once verification is successful, a one-time secure transmission link is established between the aggregate buffer and the final requester (i.e., the client). For example, both parties negotiate a temporary session key using the Diffie-Hellman key exchange protocol. Aggregate buffers are used Encrypted complete collection of encrypted documents And send it to the client through this link. After receiving the data, the client uses... Decryption yields the full text of the encrypted document. Once delivery confirmation is complete, the aggregate buffer immediately performs a cleanup operation: permanently deleting all elements related to the encrypted document. All relevant status information and temporarily stored data blocks and temporary session keys At the same time, the client also destroys the temporary key associated with this session. All related temporary data on intermediate nodes (relay and storage nodes in the anonymous communication network) will also be discarded or overwritten when the session ends, ensuring that the entire acquisition process leaves no trace.

[0062] An anonymous session identifier is a unique, temporary, and unassociated random string or number generated during a specific document retrieval session. It is used in a distributed environment to tag and associate multiple request subtasks and data blocks belonging to the same session, enabling intermediate nodes to perform correct routing and aggregation without knowing the requester's true identity or the full scope of the request. A distributed anonymous communication network is an overlay network composed of multiple relay nodes, designed to hide the identities and communication relationships between the communicating parties. In this network, messages are encrypted and forwarded multiple times through a series of relay nodes. Each relay node only knows its predecessor and successor nodes, but not the original sender or final receiver, thus achieving anonymity. A storage node is a network entity in a decentralized storage architecture responsible for storing and providing data blocks. In this specific implementation, a storage node specifically refers to a server or peer node that receives a list of request sub-lists and retrieves corresponding encrypted data blocks from the underlying storage network based on the document identifiers in the list. Each storage node processes only a small portion of the entire request. An encrypted storage network is a decentralized data storage system with content addressing and encrypted storage at its core. Data (such as full-text documents) is encrypted, fragmented, and stored on multiple nodes using its content hash value as a unique index key before uploading. During retrieval, the client or proxy node only needs to provide the hash index of the content to find and retrieve the corresponding encrypted data block from the network; the storage node itself does not need to and cannot decrypt the data content. An anonymous backhaul channel is a unidirectional communication path built on an anonymous communication network to return data from storage nodes to the aggregation buffer. This channel also utilizes multi-hop relay and layered encryption techniques to ensure that during the data block backhaul process, no intermediate node can associate the returned data with the previously issued specific request sublist or the identity of the final requester. The aggregation buffer is a temporary, secure data aggregation area, typically controlled by the requester or located within its trusted domain. Its function is to receive data blocks from multiple anonymous backhaul channels, recombine them into a complete data set according to the anonymized session identifier attached to the data blocks, and perform integrity checks in preparation for final delivery to the requester. A one-time secure transmission link is a secure communication connection temporarily established for a single data transmission. This link uses a forward-secure key exchange protocol and strong encryption algorithms to ensure the confidentiality and integrity of data during transmission from the aggregation buffer to the final requester. Once the transmission is complete, the session key is immediately destroyed, and the link is closed, making this transmission impossible to replay or associate with any future sessions.

[0063] In another feasible approach, the specific implementation process for generating m fake document identifiers is as follows: 1) Based on the analysis of the original query vector and local historical search records, multiple potential semantic topic categories to which the current query may belong are identified. Then, according to a preset fake identifier generation strategy, the scope of obfuscated topics to be covered and the number of fake document identifiers (m) are determined. The specific implementation process is as follows: Obtain the original query vector and local search history Local historical search records Includes the past Vector sequence of the query And their corresponding topic tags. The system uses a lightweight clustering model, such as a density-based clustering algorithm, for... and Cluster analysis is performed on the vectors in the dataset. The clustering model outputs... Potential semantic topic categories Each category By a central vector It means that, among them This is the mean of all vectors in that category. Next, the system calculates the scope of topics to be obfuscated based on a preset fake identifier generation strategy. The strategy defines a selection function. The function returns a value equal to... Similarity higher than the threshold Category subset ,in, It is the cosine similarity function. The scope of the confused topics is the set. Number of fake document identifiers Determined by the formula in the strategy, for example ,in It is a scaling factor. It is about obscuring the size of the subject area. It is a random disturbance term, from a uniform distribution Medium sampling is used to increase uncertainty.

[0064] 2) For each obfuscation topic that needs to be covered, candidate identifiers that are statistically similar to the topic but unrelated in content are dynamically selected from a dedicated pool of fake document identifiers isolated from the real document library. Randomness is introduced into the selection process to ensure that the generated set of fake document identifiers does not have a deterministic pattern. The specific implementation process is as follows: For confusing the scope of the topic Each topic in The system uses a dedicated fake document identifier pool. Candidate identifiers are selected from the pool. A dedicated pool of fake document identifiers. Stored Each fake document is identified as a fake document. Associate a metadata vector This vector encodes the statistical characteristics of the identifier. The system calculates the topic center vector. With each cosine similarity Then, the system selects based on similarity scores and randomness requirements. Specifically, a probability distribution is defined. ,in The degree of randomness in temperature parameter control. The system uses either roulette wheel selection or direct sampling, from... Selected from There are 10 candidate identifiers, among which To ensure a sufficient total number of candidates, the system checks during the selection process. Ensure that it is unrelated to the actual document content, that is The similarity to any real document topic vector is below a threshold. By introducing a random seed Generated based on the current timestamp and session ID, resulting in a set of candidate identifiers selected each time. It is statistically unpredictable.

[0065] 3) Filter and adjust the initially selected set of fake document identifiers, checking and removing any identifiers that are directly related to or conflict with the genuine document identifiers identified in this search, while ensuring that the format, length, and distribution characteristics of fake document identifiers are statistically indistinguishable from those of genuine document identifiers. The specific implementation process is as follows: Obtain a preliminary set of candidate identifiers Then, filtering and adjustments are performed. First, the system obtains the set of real document identifiers identified in this search. For each candidate identifier The system checks whether it is related to any A direct association exists, such as sharing the same prefix, suffix, or a hash value collision. If an association exists, remove it. Next, the system adjusts the remaining candidate identifiers to ensure format matching. Real document identifiers follow a specific format, such as a UUID or a fixed-length hash string. The system uses formatting functions. The fake identifiers are converted to the same format, for example, through padding or truncation. Then, the system analyzes the length distribution of the real document identifiers. and character distribution And fine-tune the false labels to make the set of false labels more complete. Length distribution and character distribution and and They are statistically indistinguishable. This can be verified by the Kolmogorov-Smirnov test or the Jensen-Shannon divergence to ensure... and ,in and It is a preset threshold. Finally, the system... Randomly select exactly These identifiers form the final set of fake document identifiers. .

[0066] 4) Output the final adjusted m fake document identifiers and submit them along with the real document identifiers to the subsequent processing module. Simultaneously, cache the set of fake identifiers and their associated metadata features locally for use in the subsequent reverse mapping and cleaning stage. The specific implementation process is as follows: The system outputs a set of fake document identifiers: The output is a list or array, directly passed to the subsequent processing module of the local sparse reorderer to construct a mixed request list. Simultaneously, the system creates a cache entry for the current session within the local region. The cache key is the session ID. Cached values ​​include And the metadata features associated with each fake document identifier, such as the corresponding metadata vector. and the selected obfuscated topics The cache is stored in an encrypted memory area or secure database on the client side, and access is controlled by permissions. Cache data is retrieved and used during the reverse mapping and cleaning phase. Specifically, after the large language model generates the initial results, the reverse mapping module identifies content in the text that may originate from fake documents based on the cache's metadata characteristics and filters or corrects it. After the session ends, cached data is automatically cleared according to a retention policy, typically deleted immediately after a request-response cycle is completed to ensure privacy and security.

[0067] The inverse mapping module is used to: input the acquired full-text encrypted document into the trained large language model for inference to generate initial results; perform inverse mapping on the initial results to filter out generation noise introduced by the content of documents corresponding to fake document identifiers; and output the final response. Specifically: When the full text of an encrypted document is input into the trained large language model, a prompt instruction with an encrypted attention mask is sent to the model. This mask instructs the model to ignore document content corresponding to fake document identifiers during inference. The model then generates an initial result based on the encrypted document and the prompt instruction. Combining this with the fake document identifiers, the model uses features of fake documents stored locally on the client to perform inverse mapping and cleaning on the initial result to filter out noise, resulting in and outputting the cleaned final response. The specific implementation process is as follows: 1) The large language model used in this system is a pre-trained language model based on the Transformer decoder architecture. Its network layer structure consists of the following parts: ① Lexical embedding layer: maps the input lexical IDs to high-dimensional vectors. Assume the vocabulary size is... The hidden layer dimension is Then this layer is a ① The matrix. ② Positional encoding layer: Generates a unique vector with the same dimension as the word embedding vector for each position in the input sequence, so that the model is aware of the sequence order. Typically generated using sine and cosine functions. ③ Multi-layer Transformer decoder block stack: The core of the model, consisting of... It consists of stacked identical layers. Each layer contains two main sublayers: a) a multi-head self-attention sublayer: allowing each position in the sequence to pay attention to all other positions in the sequence (limited by a causal mask or the cryptographic attention mask provided by this scheme). The computation involves a query matrix. Key matrix Value matrix Its output undergoes residual connections and layer normalization. b. Feedforward neural network sublayer: A fully connected network, typically containing two linear transformations and an activation function (such as GeLU). Its output also undergoes residual connections and layer normalization. ④ Final layer normalization and output layer: Layer normalization is performed after the last Transformer block, and then the hidden state is mapped back to the vocabulary space through a linear layer (weights shared or independent of the word embedding layer), and the probability distribution of the next word is calculated through the Softmax function.

[0068] The training process of this model consists of two stages: ① Pre-training stage: Training is performed on a massive unlabeled text corpus using an autoregressive next-word prediction objective. The objective function is to maximize the likelihood probability of the sequence. ,in It is the first Each word element, These are model parameters. ② Instruction fine-tuning and alignment stage: Using high-quality instruction-response pair datasets and dialogue datasets, supervised fine-tuning is performed on the pre-trained model to enable the model to learn to follow human instructions, understand complex prompts, and generate helpful, accurate, and harmless responses.

[0069] 2) The inverse mapping module first receives data from the blind document acquisition module, which contains... The module maps the full text of each encrypted document. Using the client's local key, it decrypts all encrypted documents to obtain the plaintext content. Then, the module concatenates this plaintext content into a long context text block in a predefined order (e.g., random order or sorted by document identifier). Assume the first... The plaintext of this document is Then the concatenated context for At the same time, the module needs to construct a clear prompt, such as: "Please answer the user's question based on the following document context: [User's original query text]". This prompt will be combined with the concatenated context. Input prompts that together form the model A crucial step is generating an encrypted attention mask. The module determines the appropriate concatenation context based on a locally stored list of fake document identifiers. In the input sequence, which positions of the tokens belong to the fake document content? The module generates a sequence with a total length equal to the input sequence. Same binary vector The values ​​for tokens belonging to fake document content are 1 (indicating they need to be masked), while the values ​​for tokens belonging to real document content and prompts are 0. Then, a lightweight symmetric encryption algorithm (such as AES-GCM) and a key held only by the client are used to encrypt this original binary mask vector. Encryption is performed to obtain the encrypted attention mask. .

[0070] 3) The inverse mapping module will assemble the input prompts. and encrypted attention mask The large language model inference interface is sent to the server. The server receives the encrypted attention mask. Afterwards, instead of decrypting, it is directly used as a special input parameter. On the server side, when the large language model performs multi-head self-attention calculations at each layer, it will use the encrypted mask. This is applied to the calculation of attention weights. Specifically, it is used in calculating the attention score matrix. Afterwards, will and Add, where The part that is encrypted as "masked" corresponds to a very large negative value (such as -10) after decryption. 9 This process can be formally represented as: ,in, yes The effect of decryption during internal model computation (in practice, this can be achieved through homomorphic encryption or by combining the model with encryption hardware, allowing computation to take place in a ciphertext state or a protected environment; this is a conceptual description). Thus, when generating each new term, the model's attention mechanism ignores information from the context of the fake document. Based on the context and prompts that have been effectively shielded from fake content, the model performs autoregressive decoding to generate a text output. This output is the initial result. .

[0071] 4) The server will display the initial results. The result is returned to the client's inverse mapping module. Since model inference may be imperfect, or edge cases may exist in the application of encrypted attention masks, the initial result... A small amount of noisy phrases, facts, or style may still remain from fake documents. The inverse mapping module initiates the cleaning process. This module utilizes "fake document features" stored locally on the client side. These could be metadata, a list of topic keywords, or embedding vectors of fake documents cached during the generation of fake document identifiers. The module then uses the initial results... The text is compared with the features of these fake documents. The cleaning algorithm can employ one or more of the following strategies: ① Keyword matching: If a sentence or phrase in the initial result contains high-frequency keywords from the fake document features, and the phrase has weak relevance to the context of the real document, it is filtered out. ② Semantic similarity: The semantic similarity between each sentence in the initial result and the cached topic vectors of fake documents is calculated. If it exceeds a certain threshold, it is considered a noise sentence and is deleted or rewritten. ③ Consistency check: A local lightweight model is used to verify whether the factual statements in the initial result are consistent with the context of the real document, and inconsistent statements are eliminated. After the above cleaning, correction, or rewriting, a semantically coherent, accurate, and clean text output is obtained. The inverse mapping module will The final response is output to the user interface, completing the entire question-and-answer process.

[0072] The encrypted attention mask is an encrypted binary vector of the same length as the input sequence. In the large language model of the Transformer architecture, the attention mask controls which other positions each position in the sequence can "see" when calculating attention weights. In this technical solution, the binary value of the mask indicates which positions' tokens belong to fake document content (corresponding to a mask value of negative infinity or a very large negative number, such as -inf), and which belong to real document content (corresponding to a mask value of 0). Encrypting the mask before sending it prevents the server from directly deciphering the distribution of the masked content before inference, thereby indirectly inferring the location of fake documents and enhancing privacy protection.

[0073] The initial result refers to the raw text output generated by the trained large language model after receiving a context consisting of the full text of an encrypted document and a prompt instruction with an encrypted attention mask. This output contains the content that the model infers and generates based on all inputs (including the context of real and fake documents). Since noise information from fake documents is also input into the model, the initial result may contain statements that are irrelevant to the user's query intent, inconsistent, or even incorrect, i.e., "generated noise".

[0074] The final response is the clean text prepared for presentation to the user, obtained by the client-side inverse mapping module after performing "inverse mapping cleaning" on the initial result. The cleaning process utilizes knowledge about fake documents stored locally on the client to identify and filter out the noise generated by the content of fake documents in the initial result. The final response should only reflect the generated content that is highly relevant and accurate to the user's original query, based on the context of the real document; it is the final answer provided by the system to the user.

[0075] A privacy-preserving enhanced retrieval generation system of the present invention includes: 1) Client-side Semantic Offset Generator: Instead of directly sending the original query vector, this module generates a semantic offset vector, which is a carefully computed noise vector in the semantic space. Specifically, this module first generates the original query vector based on the user query. ,in This is a unit vector that, after L2 normalization, represents the user's true semantic intent in the query. Then, a random vector is selected... The semantic directions orthogonal to the true semantic intent represented are used as noise direction vectors. and will With a preset coefficient Perform a product operation to obtain the semantic offset vector. ,in It is a non-negative scalar real number used to control the offset strength. Finally, a garbled query vector is generated by adding a semantic offset vector to the original query vector. ,in This is a standardized query vector used to initiate a retrieval to the server. Obfuscated query vectors. It points to the edges of multiple clusters rather than the center of a single cluster, which makes it impossible for the server to infer which specific topic the user is interested in.

[0076] 2) Server-side superset retrieval module: based on obfuscated query vectors Retrieve Top-N documents from a vector database (N is much larger than the actual required k). Because... Located at the edge of a cluster, the returned document superset contains a mixture of documents from different semantic clusters (i.e., a mixture of "real documents" and "noisy documents"). The document superset includes the document identifier and corresponding cryptographic digest for each document.

[0077] 3) Local Sparse Reorderer: Utilizes a local small model or lightweight scorer based on the original query vector. The downloaded encrypted digests of the Top-N documents are reordered to select the true Top-k document identifiers. The specific implementation process includes: First, calculating the original query vector. Semantic vector corresponding to each cryptographic digest in the document superset Similarity score ,in, It is the first The unit semantic vector obtained after decrypting and encoding a cryptographic digest, operators Represents the dot product. The range of values ​​is , and according to First, sort the documents from largest to smallest and select the document identifiers corresponding to the top k digests. Second, generate m fake document identifiers. Third, combine the k real document identifiers with the m fake document identifiers to form a mixed request list. The difference from PIR-RAG is that PIR-RAG downloads the full text, while this scheme only downloads the encrypted digest first, greatly reducing bandwidth usage.

[0078] 4) Blind Document Acquisition Module: This module sends a mixed request list containing both real and fake document identifiers to the server. The server returns the encrypted full text of all requested documents. Specifically, the blind document acquisition module is used to: send the mixed request list to the server to request and retrieve the encrypted full text of the document corresponding to each document identifier in the list.

[0079] 5) Inverse Mapping Module: This module combines the inverse mapping concept from previous modules, but not only restores the entity, it also filters out generation noise caused by fake documents. Specifically, the inverse mapping module is used to: input the acquired full-text encrypted document into the trained large language model for inference to generate initial results; perform inverse mapping on the initial results to filter generation noise introduced by the content of documents corresponding to fake document identifiers; and output the final response. Specifically, when inputting the full-text encrypted document into the trained large language model, an encrypted attention mask is sent to the model. The prompt instruction, a mask used to instruct the model to ignore document content corresponding to fake document identifiers during inference, is used by the large language model to generate initial results based on the encrypted full text of the document and the prompt instruction. Subsequently, combining fake document identifiers, the "fake document characteristics" stored locally on the client side were used to... Perform inverse mapping cleaning to filter out generated noise, obtain and output the cleaned final response. .

[0080] The workflow of the privacy-preserving retrieval enhancement generation system of the present invention is as follows: 1) User input query ,in It is a natural language text string. The local model calculates the embedding of the original query vector. The system randomly selects a semantic direction noise vector orthogonal to the true intent. Calculate the obfuscated query vector This process is performed by the client-side semantic offset generator. Even if the server intercepts the obfuscated query vector... The restored semantics are also vague or point to the wrong domain (e.g., shifting "diabetes treatment" to "general healthy diet").

[0081] 2) The server receives the obfuscated query vector. The system retrieves encrypted digests and document identifiers for the top-N (e.g., N=100) documents from a vector database. This process is performed by a server-side superset retrieval module. Due to the offset, these N documents are distributed across multiple semantic clusters (unlike PIR-RAG, which focuses on a single cluster).

[0082] 3) The client receives N encrypted digests and calculates the similarity score locally. ,in, This is a summary vector, from which k truly relevant documents (e.g., k=5) are selected. This process is performed by a local sparse reorderer. To prevent information leakage through access patterns, the client generates m fake document identifiers.

[0083] 4) The client requests the encrypted full text of k+m documents from the blind document acquisition module. The server uses these encrypted full texts of the k+m documents as context input to train the large language model. The client also includes an encrypted attention mask. (i.e., an encrypted AttentionMask) instructs the model to logically ignore fake documents, or for the client to ignore them upon receiving the initial result. Then, the results are cleaned using locally stored "fake document features." This process is coordinated and executed by the inverse mapping module, ultimately outputting the final response. .

[0084] This invention achieves fine-grained intent hiding, significant bandwidth optimization, complete semantic preservation, and sustainable privacy protection in a synergistic architectural manner, providing a more practical and comprehensive privacy protection solution for cloud-based retrieval enhancement generation services. Specifically: ① It utilizes offset vectors to retrieve a superset of documents spanning multiple semantic clusters from a vector database, followed by precise filtering on the client side. This method avoids the huge bandwidth overhead of downlink transmission of the entire target cluster document, while allowing the server to only observe mixed and scattered document return patterns, preventing inference of the fine-grained topics of true user interest, effectively resolving the contradiction between communication overhead and privacy granularity in traditional private information retrieval architectures; ② The application of semantic offset technology enables the client to proactively send obfuscated query vectors, processed with conscious bias, to the server, instead of the original query vector. The query intent received by the server is ambiguous or misleading, thus cutting off the path for privacy inference from the query source. This proactive obfuscation at the vector level fundamentally protects the semantic privacy of user queries; ③ The system implements vector-level obfuscation, with its protection mechanism acting on the semantic embedding space, rather than performing token-level replacement or modification of the original text. This means that the original content of all documents remains intact and encrypted during transmission and storage, completely avoiding the contextual semantic breaks caused by replacing placeholders in traditional dynamic de-identification techniques, and ensuring the semantic integrity upon which large language model inference relies. ④ The entire protection process does not consume privacy budget. The system's privacy protection stems from obfuscating and occluding retrieval paths and access traffic, rather than adding noise during model generation. Therefore, it does not suffer from the privacy budget exhaustion problem inherent in differential privacy methods, providing sustainable and stable privacy protection without potentially compromising the quality of generated content due to added noise.

[0085] like Figure 2 As shown, an embodiment of the present invention provides a privacy-preserving retrieval enhancement generation method, comprising: S1. Receive user queries, generate original query vectors based on user queries, and generate obfuscated query vectors by adding semantic offset vectors to the original query vectors; S2. Receive the obfuscated query vector, retrieve and return a document superset containing documents with multiple different semantic clusters from the vector database based on the obfuscated query vector, and the document superset contains the document identifier and corresponding encrypted digest of each document. S3. Based on the original query vector, reorder and filter the encrypted digests in the document superset to determine the document identifiers of real documents related to the original query vector from the document superset, and generate a mixed request list containing document identifiers of real documents and fake document identifiers. S4. Send the mixed request list to the server to request and retrieve the full text of the encrypted document corresponding to each document identifier in the mixed request list; S5. Input the full text of the acquired encrypted document into the trained large language model for inference to generate initial results. Perform inverse mapping on the initial results to filter out generation noise introduced by the document content corresponding to the fake document identifier, and output the final response.

[0086] Optionally, the above technical solution further includes: randomly selecting a semantic direction orthogonal to the true semantic intent represented by the original query vector as a noise direction vector, and multiplying the noise direction vector with a preset coefficient to obtain a semantic offset vector.

[0087] Optionally, the encrypted digests in the document superset are reordered and filtered based on the original query vector to determine the document identifiers of real documents related to the original query vector from the document superset, and a mixed request list containing document identifiers of real documents and fake document identifiers is generated, including: The similarity score between the original query vector and each encrypted digest in the document superset is calculated, and the encrypted digests are sorted in descending order of similarity score. Based on the sorting result, the top k encrypted digests are selected to determine the document identifiers of the corresponding real documents, and m fake document identifiers are generated. The document identifiers of the k real documents and the m fake document identifiers are combined to form a mixed request list.

[0088] Optionally, the acquired encrypted document is input into the trained large language model for inference to generate initial results. The initial results are then subjected to inverse mapping to filter out generation noise introduced by the content of documents corresponding to fake document identifiers. The final response is then output, including: When the full text of the encrypted document is input into the trained large language model, a prompt instruction with an encrypted attention mask is sent to the trained large language model. The encrypted attention mask is used to instruct the trained large language model to ignore the document content corresponding to the fake document identifier during the inference process. The trained large language model generates an initial result based on the full text of the encrypted document and the prompt instruction. Combined with the fake document identifier, the initial result is cleaned by inverse mapping using the fake document features stored locally on the client to filter out generated noise, and the cleaned final response is obtained and output.

[0089] It should be noted that the beneficial effects of the privacy-preserving retrieval enhancement generation method provided in the above embodiments are the same as those of the privacy-preserving retrieval enhancement generation system described above, and will not be repeated here. Furthermore, the method and system embodiments provided in the above embodiments belong to the same concept, and their specific implementation processes are detailed in the method embodiments, and will not be repeated here.

[0090] An electronic device according to an embodiment of the present invention includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements any of the above-described privacy-preserving retrieval enhancement generation methods.

[0091] An embodiment of the present invention provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements any of the above-described privacy-preserving retrieval enhancement generation methods.

[0092] The above description is merely a preferred embodiment of the present invention and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of disclosure in this invention is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-disclosed concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this invention.

[0093] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. A privacy-preserving enhanced retrieval generation system, characterized in that, include: Client-side semantic offset generator, server-side superset retrieval module, local sparse reordering generator, blind document acquisition module, and inverse mapping module; The client-side semantic offset generator is used to: receive a user query, generate an original query vector based on the user query, and generate an obfuscated query vector by adding a semantic offset vector to the original query vector. The server-side superset retrieval module is used to: receive the obfuscated query vector, retrieve and return a document superset containing multiple documents with different semantic clusters from the vector database based on the obfuscated query vector, and the document superset contains the document identifier and corresponding encrypted digest of each document; The local sparse reorderer is used to: reorder and filter the encrypted digests in the document superset based on the original query vector, so as to determine the document identifiers of real documents related to the original query vector from the document superset, and generate a mixed request list containing the document identifiers of the real documents and the fake document identifiers. The blind document acquisition module is used to: send the mixed request list to the server to request and obtain the full text of the encrypted document corresponding to each document identifier in the mixed request list; The inverse mapping module is used to: input the acquired full text of the encrypted document into the trained large language model for inference to generate an initial result, perform inverse mapping processing on the initial result to filter out the generation noise introduced by the document content corresponding to the fake document identifier, and output the final response.

2. The privacy-preserving enhanced retrieval generation system according to claim 1, characterized in that, The client-side semantic offset generator is further configured to: randomly select a semantic direction orthogonal to the true semantic intent represented by the original query vector as a noise direction vector, and multiply the noise direction vector with a preset coefficient to obtain the semantic offset vector.

3. The privacy-preserving enhanced retrieval generation system according to claim 1, characterized in that, The local sparse reorderer is specifically used to: calculate the similarity score between the original query vector and each encrypted digest in the document superset, sort the encrypted digests in descending order of the similarity score, select the top k encrypted digests based on the sorting result to determine the document identifiers of the corresponding real documents, generate m fake document identifiers, and combine the document identifiers of the k real documents with the m fake document identifiers to form the hybrid request list.

4. A privacy-preserving retrieval enhancement generation system according to any one of claims 1 to 3, characterized in that, The inverse mapping module is specifically used to: when the full text of the encrypted document is input into the trained large language model, send a prompt instruction with an encrypted attention mask to the trained large language model. The encrypted attention mask is used to instruct the trained large language model to ignore the document content corresponding to the fake document identifier during the inference process. The trained large language model generates the initial result based on the full text of the encrypted document and the prompt instruction. Combining the fake document identifier, the initial result is cleaned by inverse mapping using the fake document features stored locally on the client to filter out generated noise, and the cleaned final response is obtained and output.

5. A privacy-preserving enhanced retrieval generation method, characterized in that, include: Receive user queries, generate an original query vector based on the user queries, and generate a confused query vector by adding a semantic offset vector to the original query vector; The system receives the obfuscated query vector, retrieves and returns a document superset containing multiple documents with different semantic clusters from the vector database based on the obfuscated query vector, and the document superset contains the document identifier and corresponding encrypted digest of each document; Based on the original query vector, the encrypted digests in the document superset are reordered and filtered to determine the document identifiers of real documents related to the original query vector from the document superset, and a mixed request list containing the document identifiers of the real documents and fake document identifiers is generated. The mixed request list is sent to the server to request and retrieve the full text of the encrypted document corresponding to each document identifier in the mixed request list; The acquired encrypted document is input into the trained large language model for inference to generate an initial result. The initial result is then subjected to inverse mapping to filter out the generation noise introduced by the document content corresponding to the fake document identifier, and the final response is output.

6. The privacy-preserving enhanced retrieval generation method according to claim 5, characterized in that, Also includes: A semantic direction orthogonal to the true semantic intent represented by the original query vector is randomly selected as a noise direction vector, and the noise direction vector is multiplied by a preset coefficient to obtain the semantic offset vector.

7. The privacy-preserving retrieval enhancement generation method according to claim 5, characterized in that, Based on the original query vector, the encrypted digests in the document superset are reordered and filtered to determine the document identifiers of real documents related to the original query vector from the document superset, and a mixed request list containing the document identifiers of the real documents and fake document identifiers is generated, including: The similarity score between the original query vector and each encrypted digest in the document superset is calculated, and the encrypted digests are sorted in descending order of similarity score. Based on the sorting result, the top k encrypted digests are selected to determine the document identifiers of the corresponding real documents, and m fake document identifiers are generated. The document identifiers of the k real documents are combined with the m fake document identifiers to form the hybrid request list.

8. A privacy-preserving retrieval enhancement generation method according to any one of claims 5 to 7, characterized in that, The acquired encrypted document is input into the trained large language model for inference to generate an initial result. The initial result is then subjected to inverse mapping to filter out generation noise introduced by the document content corresponding to the fake document identifier. The final response is then output, including: When the full text of the encrypted document is input into the trained large language model, a prompt instruction with an encrypted attention mask is sent to the trained large language model. The encrypted attention mask is used to instruct the trained large language model to ignore the document content corresponding to the fake document identifier during the inference process. The trained large language model generates the initial result based on the full text of the encrypted document and the prompt instruction. Combining the fake document identifier, the initial result is cleaned by inverse mapping using fake document features stored locally on the client to filter out generated noise, and the cleaned final response is obtained and output.

9. An electronic device, characterized in that, The method includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the privacy-preserving retrieval enhancement generation method according to any one of claims 5 to 8.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the privacy-preserving retrieval enhancement generation method according to any one of claims 5 to 8.

Images