Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

SOTA privacy experiment: decouple stored embeddings with shadow queries

未关闭
  • 哪里不对？
#970 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
5/5
预计耗时
一周以上
新手友好度
35/100
Issue 类型
功能
描述清晰度
基本清楚
活跃度
活跃
技术栈
wasm
领域
databases, machine-learning, performance, security

调研方向

未指定任何实现文件或测试。首先针对现有的 RuVector 索引，梳理五个冻结条件和自适应的集合级攻击，然后定义报告中列出的基准输入和测量指标。完成的标准是满足每个 promotion gate，同时保持删除功能和租户隔离；或者记录证伪结果并拒绝该设计，而不改变生产默认值。

由索引模型根据 Issue 内容生成。

描述

Finding

Shadow Queries for Private Retrieval in Vector Databases, submitted 2026-09-04, targets embedding inversion rather than query privacy. Instead of storing a document embedding directly, SHAQ generates diverse semantically relevant shadow queries per document and stores embeddings of those queries. The originating team reports text recovery as low as 0.2104, up to 19.50% more defended tokens than baseline defenses, MAP@10 up to 0.7967, and up to 5.53% utility improvement over the compared defense.

Evidence class: originating-team measured, not independently reproduced by RuV. The arXiv manuscript is under the arXiv perpetual non-exclusive license. No implementation license suitable for code reuse was verified in this cycle, so this issue imports no source code.

RuV implication

This is orthogonal to issue #967. #967 addresses outsourced query privacy under a two-server non-collusion model. This issue addresses stored-embedding inversion if an attacker obtains or queries the vector representation itself.

Potential reuse: RuVector hosted indexes, Core Memory enterprise memory, Cognitum RAG, MCP retrieval, RVF provenance, and bounded RuVector WASM stores.

Reversible experiment

Compare five frozen conditions:

A. ordinary document embeddings

B. additive-noise defense at matched retrieval utility

C. vector scaling or normalization defense at matched retrieval utility

D. one shadow-query embedding per document

E. diverse multi-shadow-query indexing with a fixed generation budget

Use at least two embedding models and three corpora with materially different document length and semantic density.

Attack model

Reproduce a modern embedding inversion baseline such as vec2text, then add an adaptive attacker that knows the defense architecture and generation prompt family but not secret tenant data.

Required benchmark report

Record corpus digest, embedding model and version, shadow generator and version, prompts, seeds, document count, query count, index size, construction latency, generation tokens and cost, MAP@10, recall@10, p50/p95/p99 query latency, storage multiplier, inversion recovery, defended-token rate, CPU, memory, and energy where measurable. Include malformed documents, low-information documents, duplicate content, updates, deletes, distribution shift, and adversarial query patterns.

Promotion gate

A shadow-query design advances only if all are true:

  1. inversion recovery falls by at least 50% relative to ordinary document embeddings
  2. retrieval quality loses no more than 1 absolute point of MAP@10 or recall@10 against the stronger baseline
  3. p95 query latency regresses by less than 10%
  4. index storage stays below 3 times the document-embedding baseline
  5. generation cost is amortized within the declared customer workload horizon
  6. deletion and tenant isolation semantics remain exact

Falsification

The defense may simply move sensitive information from a document embedding into several semantically revealing query embeddings. Test an adaptive attacker over the entire per-document shadow set, not one vector at a time. If privacy gain disappears under set-level attacks, reject the design.

A cheaper dimensionality reduction or quantization baseline must also be included. If it performs within variance at lower cost, prefer the simpler defense.

Security and governance

Shadow queries are derived sensitive artifacts and inherit the source document's tenant, retention, deletion, and access policy. They cannot be logged or reused across tenants. Retrieval quality is not evidence of privacy. Privacy measurements cannot authorize release or declassification.

Existing RuVector indexing remains the rollback path. No production format migration or default change is authorized.

主要语言
Rust
星标
4.5k
派生
603
平均合并
1 天 11 小时
30 天内合并 PR
56

环境准备

我们还没有检查这个项目的环境配置文件。先看它的 README，通用步骤见我们的新手贡献指南。

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

ruvnet/RuVector 的其他 Issue

查看 ruvnet/RuVector 的全部 Issue

相似的 Issue

更多 Rust Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。