SMASH 2026 · Paper #4 · Result card
Query Logs Are Patient Records: An Unguarded Attack Surface in Clinical RAG, and a Privacy-Preserving Pipeline
An insider rebuilt 20 of 21 synthetic patient records from the query log. Under encryption, retrieval stayed exact and 4-bit embeddings kept 97% of float nDCG@10.
your query Metastatic renal cell carcinoma, second-line therapy after progressionlogged at 14:15corpus scifact (5,183 docs)bits (encrypted run) 4clip percentile 99.9embedder potion-base-8Mclinic day 24 appointments, lag ≤ 15 min
Patient records rebuilt from the log
20 / 21
diagnosis recovered 95% (chance 1.7%), timestamp join right 100%
nDCG@10 kept at b = 4
97%
0.490 vs 0.506 float on scifact; b = 2: 0.016
Encrypted = plaintext
20 / 20
top-1 identical; scores bit-exact in 20/20 after rounding
Price of privacy (server)
14.8 s
vs 3.0 ms in the clear for 5,183 docs; ≈ 48 min at 1M (no proofs)
From the abstract
In privacy-sensitive applications, the server observes the query and controls which evidence is returned, creating both confidentiality and integrity risks. Our protocol reduces private and verifiable retrieval to multiplication of a committed matrix by an encrypted vector and uses low-bit quantization to make this computation practical.
Evidence
Paper vs. your run
| Metric | Paper | Your run | |
|---|---|---|---|
| nDCG@10 at b = 4 / float (scifact) | BGE-large 0.713 / 0.735; Cohere v3 0.719 / 0.718 | 0.490 / 0.506 | static model2vec embedder, so lower absolute nDCG |
| Quality retained at b = 4 | 97% (BGE-large) | 97% | clip at 99.9th pct of |x| |
| nDCG@10 at b = 2 | 0.002 (BGE-large), 0.033 (Cohere v3): collapses | 0.016 | |
| Server time per private query | 4.3–8.7 seconds (verified, SciFact/NFCorpus) | 14.78 s (5,183 docs) | no proofs; TenSEAL CKKS, N = 8192 |
| 1M-document corpus | roughly 19 minutes and $2.22 | ≈ 48 min (linear extrapolation) | no verification; different hardware |
| Retrieval exactness | every document is scored … quality is not traded for privacy | top-1 match 20/20; PIR fetch exact: yes |
Try next
- Collapse mode: he_bits = 2 — At b = 2, nDCG@10 drops to 0.016 — encrypted retrieval is still exact but returns nearly useless documents. This shows the hard floor below which quantization breaks the system.
{"he_bits": 2, "bit_widths": "2,3,4,6,8"} - Broken timestamp join: query_lag_max_min = 45 — When the lookup lag approaches or exceeds the 20-minute slot length, the timestamp join starts mislinking patients. Expect link_acc to drop substantially compared to this run's 100%.
{"query_lag_max_min": 45} - NFCorpus comparison — The paper's NFCorpus BGE-large numbers are b = 4: 0.353 / float: 0.370, with 95% retention. Switching corpus lets you compare a different retrieval difficulty and check that quantization behaviour generalises.
{"corpus": "nfcorpus", "bit_widths": "2,3,4,6,8"}
Read this before sharing
- The clinic, patients and queries are synthetic.
- The paper's succinct proofs are not reproduced, and timings come from one sandbox CPU.