Your Cloud Vector DB Is Leaking Every Query Your Users Ever Asked

Every time your RAG pipeline hits an outsourced vector index, you’re handing a stranger the keys to your corpus and your customers’ intent. At scale, that’s not a privacy footnote — it’s a liability. A new cryptographic system claims to fix it without making you wait three minutes per search.

What happened

Researchers built Spruce, a system for running retrieval-augmented generation vector search over outsourced indexes without revealing the query or the corpus to the cloud host. The core problem is brutal: naive cryptographic protection of embeddings at million-document scale costs ~90 GB of communication per query and takes minutes. Even the best prior work still ran 10–22 seconds per query — unusable in production. Spruce sidesteps this by replacing full-precision embedding comparisons with binary code Hamming-distance computation under two-server multi-party computation (MPC), then reranking only a small candidate set. Across four real corpora ranging from 383K to 5.42M documents, full private scans complete in 0.21–2.97 seconds at 10 Gbps inter-server bandwidth — 4.8–6.7× faster than the closest prior system measured. A “private pruning” mode cuts that further to 0.06–1.09 seconds with 13.1–22.9× speedups, while retaining 93.9%–97.3% of full-float retrieval quality (NDCG). On the largest corpus, combining pruning with a local “dealer” node improves sustained throughput by 31.5× at 1 Gbps. The median candidate sets passed to reranking are tiny: just 382–1,952 documents out of millions, which is where retrieval precision and recall either holds or collapses.

Cold read

The 10 Gbps inter-server bandwidth assumption is doing enormous work here. Enterprise cloud deployments rarely guarantee that between independently operated servers, and the 1 Gbps numbers — while still impressive — represent a significantly harder deployment story. The two-server MPC model requires that your two servers are non-colluding, which means contractual and operational guarantees, not just cryptographic ones; if both servers are in AWS us-east-1 under the same account manager, you’ve bought theater. The quality retention numbers (93.9%–97.3% NDCG) sound good but are measured against the authors’ own binary-code pipeline, not necessarily against the raw retrieval quality your current unencrypted system delivers — the baseline matters enormously and the abstract doesn’t fully clarify this chain. There is also no latency data for the reranking step that follows candidate selection; total end-to-end query latency in a live RAG system will be higher than the headline numbers suggest. Finally, “four corpora” is a thin evaluation surface for a claim of production readiness.

What it means for you

• Signal maturity: 2/5 — Novel and genuinely fast for its class, but the infrastructure assumptions are lab-grade
• Who gets hurt: Vector database vendors (Pinecone, Weaviate, Qdrant) selling “just trust us” outsourced index hosting to regulated-industry customers — healthcare, legal, finance
• What breaks if this is true: The implicit SaaS bargain that “you outsource the search, we see your data” becomes legally and technically avoidable, which is bad for any vendor whose moat depends on corpus lock-in
• Why it might not land: Two-server non-collusion is operationally hard to certify at scale; compliance teams will want audited guarantees that cryptographers and lawyers haven’t agreed on yet
• Watch for: A managed “privacy-preserving RAG” offering from a major cloud provider that absorbs this or similar MPC-over-embeddings work — that’s the signal this crossed from research to product pressure

Forecast as of 2026-09-05

By Q3 2027, at least one enterprise vector database vendor will announce a private/confidential retrieval feature citing MPC or equivalent cryptographic techniques — but it will require co-located or explicitly partnered dual-server infrastructure, confirming that the non-collusion assumption remains the binding constraint preventing mainstream adoption.

Source: Spruce: Scalable Private Outsourced Retrieval Using Compact Embeddings — Peichun Hua, Yunming Xiao. https://arxiv.org/abs/2609.03376v1