Pisces: Cryptography-based Private Retrieval-Augmented Generation with Dual-Path Retrieval
Authors: Xiaojian Liang
Lushan Song
Shishuai Du
Weicheng Zhu
Tan Li Hui Faith
Jun Jie Sim
Haibing Jin
Zhenghao Wu
Yingting Liu
Xin Zhang
Jiang-Ming Yang
Pu Duan
Venue: ICLR 2026 Poster (2026)
Keywords: Retrieval-Augmented Generation
Privacy-Preserving
Cryptography
Primary area: alignment, fairness, safety, privacy, and societal considerations
TL;DR: We propose the first cryptography-based RAG framework that protects both queries and documents, while supporting dual-path retrieval.

Abstract: Retrieval-augmented generation (RAG) enhances the response quality of large language models (LLMs) when handling domain-specific tasks, yet raises significant privacy concerns. This is because both the user query and documents within the knowledge base often contain sensitive or confidential information. To address these concerns, we propose $\texttt{Pisces}$, the first practical cryptography-based RAG framework that supports dual-path retrieval, while protecting both the query and documents. Along the semantic retrieval path, we reduce computation and communication overhead by leveraging a coarse-to-fine strategy. Specifically, a novel oblivious filter is used to privately select a candidate set of documents to reduce the scale of subsequent cosine similarity computations. For the lexical retrieval path, to reduce the overhead of repeatedly invoking labeled PSI, we implement a multi-instance labeled PSI protocol to compute term frequencies for BM25 scoring in a single execution. $\texttt{Pisces}$ can also be integrated with existing privacy-preserving LLM inference frameworks to achieve end-to-end privacy. Experiments demonstrate that $\texttt{Pisces}$ achieves retrieval accuracy comparable to the plaintext baselines, within a 1.87% margin.

Published as a conference paper at ICLR 2026
Pisces: Cryptography-based Private Retrieval-Augmented Generation with Dual-Path Retrieval
Xiaojian Liang; ; Lushan Song, Shishuai Du, Weicheng Zhu, Tan Li Hui Faith, Jun Jie Sim, Haibing Jin, Zhenghao Wu, Yingting Liu, Xin Zhang, Jiang-Ming Yang, Pu Duan Ant International, Ant Group
ABSTRACT
Retrieval-augmented generation (RAG) enhances the response quality of large lan- guage models (LLMs) when handling domain-specific tasks, yet raises significant privacy concerns. This is because both the user query and documents within the knowledge base often contain sensitive confidential information. To address these concerns, we propose Pisces, the first practical cryptography-bast framework that supports dual-path retrieval, while protecting both the query and documents. Along the semantic retrieval path, we reduce computation and com- munication overhead by leveraging a coarse-to- oblivious filter is used to privately select a candidate set of documents to reduce the scale of subsequent cosine similarity computations. For the lexical retrieval path, to reduce the overhead of repeatedly invoking labeled PSI, we implement multi- instance labeled PSI protocol to compute term frequencies for BM25 scoring in a single execution. P Pisces can also be integrated with existing privacy-preserving LLM inference frameworks to achieve end-to-end privacy. Experiments demon- strate that Pisces achieves retrieval accuracy comparable to the plaintext base- lines, within 1.87% margin. Our code is available on GitHub
RAG
strategy. Specifically, a novel
INTRODUCTION
Although large language models (LLMs) (Achiam al.) 2023 Liu al. 2024) have achieved re-
markable success in natural language processing tasks, they still exhibit significant limitations in domain-specific tasks, for example, healthcare diagnostics. In particular, LLMS may produce hal-
lucinations due to lack of domain-specific knowledge (Huang et | [0255] Li et al. 2024a) To mitigate these limitations, retrieval-augmented generation (RAG) (Lewis et al. 2020
Gao et al.)
2023 Jiang et al., (023) has emerged as promising paradigm. RAG mainly consists of two pro- cesses: retrieval and generation. Specifically, first retrieves relevant documents from external knowledge bases and then generates higher-quality response by integrating the query with the retrieved documents.
However, RAG systems, which involve private data, raise significant privacy concerns (Huang al., 2024). For instance, in personalized healthcare diagnostics, a healthcare agent with an LLM as the cornerstone for which personalized queries regarding one's health are made against, supported by an RAG system that encompasses a medical knowledge base. The user interacting with the agent would be highly concerned about revealing too much personal information, such as family history, for fear of any potential privacy exposure. Simultaneously, queries could reveal information about the individuals part of the RAG knowledge base, which contains highly sensitive personal information that is hard to anonymize in nature, such rare diseases, clinical notes, or biometric identifiers. These works (Zeng et al. 2024 Huang et al.) (003)) demonstrate that is possible to extract sentences verbatim personally identifiable information from the knowledge base. The leakage of any sensitive information would violate data privacy regulations, such as GDPR (Voigt & Von dem Bussche, 2017), PIPI. (Congress, a), and HIPAA (Congress) b). This highlights the need for privacy in a reciprocal manner, where, during retrieval, the knowledge base does not learn additional information about the user, and the user does not learn additional information about the knowledge base.
2023 Zeng et al.
'Equal contribution.
1 "Coneesoondence to p.duan @ ant-intl.com
htttps://gtt thtp://tgtttttttct com xi

---

Published as a conference paper at ICLR 2026
Table 1: Comparison with prior works.
Retrieval Path
Privacy
Framework
Mechanism
Semantic Lexical
Query
Documents
DP-RAG Grislain 2025 RemoteRAG Cheng et al. 2024
x
d
x
DP. Cryptography
Yao & I. 2025
x
/
/
DP Cryptography
sieces (Ours)
/
/
While recent substantial works (Rovida Leporati 2024 Moon et al. 2024 Xu et al. 2025 Lu
etal. 2023) have focused on private generation in RÁG systems, the private retrieval process remains comparatively underexplored. Besides, as summarized in Table [ existing works on the private retrieval process (Grislain 2025 Cheng et al., 2025 Yao & Li 2025) primarily apply differential privacy (DP). However, these works typically exhibit limited retrieval performance due to support for only semantic retrieval and struggle with lexical retrieval (e.g., BM25). This is because the noise introduced by DP inherently disrupts exact term matching. Works like (Kuzi et al. 2020) suggest that dual-path retrieval, combination of semantic and lexical retrieval, achieves better retrieval performance.
Consequently, we aim tackle challenging question: How can we support dual-path retrieval while ensuring privacy for both the query and documents during the retrieval process?
We consider cryptography-based solution address the question above. Firstly, cryptography- based technologies, such as secure multi-party computation (MPC), support both the similarity computations required by semantic retrieval and the exact term matching essential for lexical trieval, addressing the key limitations of DP-based approaches. This is because cryptography- based technologies do not alter the raw data, while DP involves perturbing the data with irreversible noise, which makes it difficult to perform exact matching. Secondly, during the entire retrieval process, cryptography-bann -based techniques ensure that any raw data exchanged is in an encrypted form, protect- ing the privacy of both the query and documents.
Unfortunately, existing cryptography-basee efficiency when directly deployed to the dual-ppth retrieval. (1) For the semantic retrieval, direct computation of similarities between a query and all documents in a large-scale knowledge base incurs prohibitive computation and communication overhead. (2) For the lexical retrieval, state- of-the-art labeled private set intersection (PSI) methods require multiple invocations to obtain all necessary term frequencies for BM25 scoring, leading significant computational overhead.
technologies suffer from two challenges in terms of
To address these two challenges, we propose a cryptography- bbsed framework, Pisces, that intro- duces two customized cryptography-basee protocols for significant efficiency improvements. (I) For the semantic retrieval, we introduce a novel oblivious filter protocol as the first step of our adopted coarse-to- coarse-to-fine strategy. This protocol privately selects candidate set to substantially reduce the search space. Then, we conduct private cosine similarity computations between the query and can- didates, utilizing MPC primitives.
(2) For the lexical retrieval path, we design a multi-instance labeled PSI protocol that obtains all necessary term frequencies in a single execution, avoiding the overhead of repeated labeled PSI invocations. Pisces provides strong privacy guarantees for both the query and documents while maintaining high retrieval performance, offering practical solution for privacy-sensitive RAG applications.
Our contributions are summarized follows:
To the best of our knowledge, we are the first to propose the cryptography-basee RAG retrieval framework, Pisces, with dual-path retrieval, while ensuring privacy for both the query and documents.
We propose two customized cryptography- protocols for significant efficiency improve- ments. (1) We adopt coarse-to-fine strategy for the semantic retrieval path with novel oblivi- ous filter to reduce computation and communication overhead. (2) We design an efficient multi- instance labeled PSI protocol to avoid the cost of repeated labeled PSI invocations.
2

---

Published as a conference paper at ICLR 2026
We conducted comprehensive experiments to evaluate the performance of Pisces. For accuracy, the results show that Pisces achieves retrieval accuracy comparable to plaintext baselines over the ground-truth of the dataset, within a 1.87% margin. At the same time, observe that combin- ing semantic and lexical paths significantly improves retrieval accuracy. For efficiency, the experi- ments demonstrate that our coarse-to-fine strategy saves retrieval time by 41.21% reduces upload and download overhead by 68.77% compared to the fine-only strategy on the large-scale dataset. Additionally, our proposed multi-instance labeled PSI outperforms state-of-the-art labeled PSI pro- tocol (Yang et al., 2024), achieving x speedup in runtime, and reducing upload and download overhead by 70733x and 2.84x, respectively. Overall, Pisces is practical in both accuracy and efficiency.
It's worth noting that while P sces focuses on privacy preservation during the retrieval process, it can seamlessly integrate with existing sivaacy-reseeving LLM inference frameworks to achieve end-to-end private preservation the whole RAG system.
PRELIMINARIES
In this work, variety of cryptographic primitives achieve private RAG retrieval process. Below we briefly summarize each primitive, and further details can be found in Appendix A.1
Secure Multi-Party Computation (Ma et al. 2023 A cryptographic technology that enables multiple mutually distrustful parties to cooperatively compute a predefined function while keeping their data private.
Secret Sharing (Keller 2020). A critical primitive of MPC, that breaks a secret value into multiple shares held by different parties. The secret value can only be reconstructed when sufficient number of shares are combined.
Labeled Private Set Intersection (Chen et al. 2018 PSI (Jarecki Liu 2010) allows two parties to learn the intersection of their sets without revealing any information outside the inter- section. Labeled PSI extends the traditional PSI by returning the label that is associated with each element in the intersection.
Oblivious Pseudorandom Function (OPRF) (Naor et al. 1999) Enables two parties to jointly compute a pseudorandom function such that one party learns the output, while the other learns nothing about the input or output.
Oblivious Value Store (OKVS) (Garimella et al. 202I data structure that encodes a set of key-value pairs into compact representation while preserving the privacy of both keys and values.
Batch private information retrieval-to-Share (PIR-to-share) (Song al. 2025 A crypto- graphic primitive that enables a client to privately retrieve the values corresponding to its queries from the server. After the execution, both parties obtain the secret shares of the retrieved values.
Additionally, we provide detailed descriptions of the semantic similarity (Awasthy et al. 2025 Zhang al. 2025) and BM25 (Robertson et al. 2009 Lu 2024) for lexical retrieval in Appendix A.2
and Appendix A.3 respectively.
3 PROBLEM DEFINITION AND THREAT MODEL.
We formally define the problem of private retrieval in RAG systems, followed by the threat model considered in this paper. Additionally, the Table 6 in Appendix summarizes the frequently used notation in this paper.
3.1 PROBLEM DEFINITION
We consider setting with two parties: server S and user C. The server S holds knowledge base that contains a large corpus of sensitive textual documents D. The user submits a private query Q to S. Let R denote the retrieval module and D* denote the set of top-K documents retrieved from D. Then the retrieval process in our paper is defined as: Enc(D*) = R(Q.D). During the retrieval process, P sces ensures that neither party learns the other's sensitive information.
3

---

Published as a conference paper at ICLR 2026
3.2 THREAT MODEL
We consider a semi-honest adversary. where the two parties and C follow the protocol honestly, but curious about information the other party holding. Our threat model focuses the private information leakage during the retrieval process in the RAG system. We protect the privacy both the user query and the knowledge base the server.
Protection of the user query. During the retrieval process, the server cannot directly access the user query. Moreover, the server remains unaware of which specific documents retrieved, thereby preventing any inference of sensitive user information based on retrieval results.
Protection of the knowledge base. During the retrieval process, the user cannot obtain sensitive information within the documents in the knowledge base, nor know which documents were retrieved.
PROPOSED METHOD
4.1 OVERVIEW
pi sces involves two parties: server S, who holds sensitive knowledge base (a large corpus of textual documents D), and a user C, who holds a private query Q.
Preprocessing
Private Generation Phase
Enerypted Information
Tokenizer
User e
Processing
Semantic Retrioval
Embodding Medel
Query
Private Lexical Retrieval
Response
Enurypied Top-K Chusk Retreval
Embedking
Model
Coarse Masching
Similarity Computation
Server
Tokenizer
Private HM25
Eserypted Top-K Chunk Retrieval
Chanks
Chumks
Score Computation
Figure 1: Overview of our proposed Pisces, where the private retrieval phase is our core contri- bution.
As shown in Figure the whole process of Pisces consists of three phases:
Phase 1: Preprocessing Phase. In this phase, S preprocesses its private document corpus D for efficient retrieval.
Document Chunking. S break down D into N smaller chunks of text, i.c. D C2,.
Vector Embedding. S encodes each chunk (i [1,N]) into vector representations using an embedding model, resulting in D {4; Vi CiEEIIM- where I, and v; are the index and vector representation corresponding to the chunk c;, respectively.
Tokenization & Term Frequencies. S tokenizes each chunk e; (i [1, with tokenizer and computes the term frequencies, resulting in D = {4/ (wy : total number of unique tokens of Ci wy is the 1-th token in the chunk c; and ifi, is its frequency.
ie
1.pp where m, is the
Phase 2: Private Retrieval Phase. this phase, interacts with to retrieve the relevant chunks for the query Q with privacy preservation.
Local Data Processing, C locally encodes its query Q into vector representations q and tokenizes @ to n tokens, i.e. Ø' {q) Q2......... J. utilizing the same embedding model and tokenizer applied during the preprocessing phase.
4

---

with the Published as a conference paper at ICLR 2026
Private Semantic Retrieval. S and invoke the private semantic similarity protocol Privates (Protocol [
where inputs D and C inputs q. After execution. S obtains the encrypted top- K chunks with the highest similarity scores.
Private Lexical Retrieval. and C invoke the private BM25 protocol IPPivatcBB225 (Protocol 2 where S inputs D' and inputs @' After execution, obtains the encrypted top-K chunks with the highest BM25 scores.
Phase 3: Private Generation Phase. In this phase, C obtains the response to its query Q while preserving privacy.
Context Fusion. Then S fuses the encrypted retrieved 2K chunks with the encrypted query.
Secure Inference. S and C execute the secure LLM inference framework to generate an encrypted response C.
Notably, in this paper, we pay attention to the preprocessing phase and the private retrieval phase, where the private retrieval phase is core contribution. Furthermore, Pisces be integrated with the existing secure inference framework based on various technologies, such as HE (Rovida &
Leporati 2024 Moon al.) 2024), MPC (Xu al. 2025 Lu al. 2023 Pang al. 2024). and
DP (Koga et al. 2024). to achieve end-to-en privacy.
4.2
PRIVATE SEMANTIC RETRIEVAL
Semantic retrieval aims to retrieve the top-K most semantically relevant chunks for query issued by a user from a set of chunks held by a server S. We design an efficient and private semantic similarity protocol Prvvaess (Protocol [T) that leverages coarse-to fine pipeline. Direct computa- tion of the cosine similarity over the entire set of chunks with cryptographic protocols (e.g.. MPC) prohibitively expensive. To mitigate this, we first propose novel oblivious filter (Protocol described in Appendix C that privately selects subset of candidate chunks, significantly reducing the scale of subsequent cosine similarity computations.
Protocol 1: Privates
Input: S inputs the embedded chunk set D {4 va cieELMM where I; and v, the index and vector representation corresponding to the chunk ci respectively. inputs embedded query q.
Output: S learns the encrypted top-K chunks {Ene(en), highest cosine similarities.
1: S computes v <- SimHashh(y)) = 10 for i [1,N] C computes qº Simllash( q) 1
2: S and C invoke the obvious filter Ioblivious Filter (Protocol 3p with {4: v/: ci and
q" as input, respectively. After execution, S learns the candidate chunk set D'.
3: S and C securely compute the cosine similarity between each chunk in D)' and the query using MPC protocols based on secret sharing (Ma et al. 2023). obtaining secret shares of the cosine similarities, respectively.
4: S and C invoke the secure sorting protocol (Li et al.
2024b) with the secret shares of cosine similarities as input. After execution, learns the indices 1 = (41,,42...,,444
of top-K chunks with the highest cosine similarities.
5: S and C invoke the batch PIR-to-share protocol (Song et al. 2025) with D and 1s input, respectively. After execution, S and learn the secret shares (DK) of top-K chunks corresponding to 7", where D = {(211 (.21,,G2..........
6: C encrypts (D&yC to Enc ((DKC) using FHE and sends to S. S computes Enc(D*) + Enc ((D&yC) (DKYS.
We describe the private semantic similarity protocol ПerivateSs (Protocol I as follows:
Step 1 (Lines 1-2) Private Coarse Matching. To leverage the computational efficiency of Ham- ming distance in cryptographic protocols, particularly for large-scale knowledge bases, first
5

---

Published as a conference paper at ICLR 2026
translate cosine similarity computations into Hamming distance. Concretely, S and C convert their vector embeddings vi (i [1. and into C-bit binary vectors vγ and q". respectively, using SimHash (Charikar 2002). They then invoke the obvious filter Iobiviious Filter (Protocol 3
that operates over Hamming space to identify a candidate set of chunks, which is much smaller than the full chunk set, without revealing any sensitive information about the query or knowledge base.
Step 2 (Line 3) Private Cosine Similarity Computation. After identifying the candidate set of chunks, S and C. perform fine-grained matching by jointly computing the cosine similarity between each candidate chunk and the query utilizing MPC protocols (Ma et al. 2023) based on
secret sharing.
Step 3 (Lines 4-6) Encrypted Top-K Chunk Retrieval. Given the computed cosine similarities, S and C privately retrieve the corresponding top-K encrypted chunks. Concretely, C first obtains the indices of the top-K chunks with the highest cosine similarities utilizing a secure sorting pro- tocol (Li et al. 2024b). S and C. then retrieve these chunks in secref-shared form utilizing a batch PIR-to-share protocol (Song et al. 2025). Finally, they convert the secret shares of top- chunks into homomorphic eneryption ciphertexts. This conversion is optional and depends on the input type of the subsequent secure LLM inference framework.
4.3 PRIVATE LEXICAL RETRIEVAL
Lexical matching adopted in this paper considers alternative scoring metric described in A.3 for the top-K chunks. To achieve lexical matching efficiently and privately, we design an efficient private BM25 protocol. We first explore labeled PSI to privately obtain term frequencies for BM25 scoring. Furthermore, to reduce the overhead of repeatedly invoking labeled PSI for each chunk, we introduce multi innttiiittttnce labeled PSI protocol IM (Protocol and the details are shown in Appendix D) based on OPRF and OKVS, that computes all per-chunk query term frequencies in single execution.
We describe the private BM25 protocol IPrivteBM25 (Protocol 2 as follows:
Step 1 (Lines 1-4) Private BM25 Scores Computation. Firstly, C privately obtains the term frequency of each query token in each chunk by invoking the multi-instance labeled PSI protocol (Protocol 4.. From these term frequencies, C could compute the document frequency (i.e., the number of chunks in which q, appears) for each query token qj- Then S and C jointly compute the BM25 score for each chunk utilizing MPC protocols based on secret sharing (Ma al., 2023).
Step 2 (Lines 5-7) Encrypted Top-K Chunk Retrieval. Given the computed BM25 scores, S and C privately retrieve the corresponding top-K encrypted chunks. This step is similar to Step in the private similarity matching protocol PPiivtteS (Protocol I and therefore we omit the details here.
4.4 PRIVATE GENERATION
Pisces can be integrated with various secure LLM inference frameworks.
Integrate with HE-based Secure Inference Frameworks. As discussed in Section 3.1, S receives the homomorphically encrypted retrieved chunks along with the encrypted query. It then executes the HE-based secure LLM inference framework Rovida Leporati (2024); Moon et al. (2024) to compute an encrypted response, which is subsequently returned to C.
Integrate with MPC-based Secure Inference Frameworks. S and C avoid converting the secret shares of the retrieved chunks into homomorphic ciphertexts, skipping Step 6 of the private semantic similarity protocol (Protocol [T and Step of the private BM25 protocol (Protocol 2. Instead, secret shares its query with S. They then use these shares directly to execute the MPC-based secure
LLM inference framework (Xu et al.) 2025 Lu et al.) 2023 computing secret shares of the response.
Pang et al.) 2024), thereby jointly
Integrate with DP-based Secure Inference Frameworks. Upon receiving both the homomorphi- cally encrypted retrieved chunks and the encrypted query, S injects differential privacy noise into the received encrypted result. This perturbed result is then sent to C, who decrypts and proceeds with the DP-based secure LLM inference framework (Koga et al. 2024) produce the response.

---

Published as a conference paper at ICLR 2026
Protocol 2: I BM2
Input: S inputs the tokenized chunk set D' [i (wiy : t (e(Lm)) reti
where my is the total number of unique tokens of с₁, wi, is the I-th token of chunk oj and tff is its term frequency. inputs tokenized query Φ' (91.92.....9.. where the number of tokens in Q.
Output: S learns the encrypted top-K chunks {Ene(en), Encc(2))),E(((2))e)) En.(c)))... Enc((cxx) with the highest BM25 scores.
I: S and C invoke the
labeled PSI protocol IM (Protocol 4 with {wiJ : tffahe(LLNN [e(.))) and Q' as input, respectively. After execution, C learns the term frequency (f., of each token qj (j E [1,1]) in each chunk a; (i [1,N]), where
q) Wi,, Wf.j t- ifiy, and otherwise tf.. = 0.
2: C computes the document frequency dfj t Σ 1 (1fl,) > 0?1: for each token qj (jE [I,n]).
C and locally computes log [+ N-df,+0.5) 4fj+0.5 .tfy and (1-b+ba
Lrg Lave
respec-
tively, for i E [1,N] and j E [1,m].
4: S and secure computes the BM225 scores according Equation T
utilizing MPC pro- tocols based secret sharing (Ma et al. 2023). Then S and C learns the secret shares of BM25 scores, respectively.
5: S and C' invoke the secure sorting protocol (Li et al. 2024b) with the secret shares of BM25 scores as input. After execution, C learns the indices I -2,,,2,,.... .xk of
tok-K chunks with the highest BM25 scores.
6: S and C invoke the batch PIR-to-share protocol (Song al. 2025 with D and 1 as input, respectively. After execution, S and learn the secret shares (D*) of top-K chunks corresponding t!', where D G2.,,.2.....CC.. ,.K).
7: C encrypts (D&yC to Enc ((DRC) using FHE and sends to S. S computes Enc(DK) - Enc ((DR))) + (D
5 EXPERIMENTS
In this section, we first introduce the experimental settings. Then evaluate the practicality of P Pisces in two parts: (1) the accuracy of P Pisces compared to the plaintext baseline, and (2) the efficiency of Pisces compared state-of-the-as cryptographic techniques.
5.1 EXPERIMENTAL SETTINGS
Embedding Model and Tokenizer. We employ an open-source embedding model, granite- embedding-smann amall--nglishh dimensional vector representations. Additionally, we utilize an open-source tokenizer BERT De- vlin et al. 2019) for chunk and query tokenization.
(Awasthy et al. 2025) to encode chunks and the query into 384-
Datasets. We use three datasets: ClapNQ, SQuAD, and HotpotQA as RAG datasets. The details of these datasets are shown in Table 7 For the Dev aesswerbbe dataset (300 queries in total), 300 queries and take the average to obtain stable results, while for the other datasets, we run 1,000 queries.
Baselines. To demonstrate the accuracy of Pisces, we compare Pisces against the plaintext baseline and ba-based approaches listed in Table I under the same RAG architecture. To demon- strate efficiency, we compare the semantic retrieval of P icess against a semantic retrieval baseline without coarse matching and the lexical retrieval of p sces against lexical retrieval baseline with the labeled PSI protocol LSE (Yang et al. 2024).
https://github. wttp:///.oooo/oooooo/e//

---

Published as a conference paper at ICLR 2026
Environment. All of our experiments conducted Apple M4 Pro machine with 24 GB of RAM, running macOS 15.6.1 (24G90).
5.2 ACCURACY EVALUATION
We evaluate the accuracy of Pisces against the plaintext baseline through two complementary approaches.
First, for each of the retrieval paths, we compare the chunks retrieved by Pisces with those by the corresponding plaintext retrieval paths. Tables and present semantic and lexical retrieval aceuracy under the Top-5 and Top-10 10 settings, respectively, compared to the plaintext baseline. The results demonstrate that Pi scsess achieves semantic retrieval accuracy ranges from 78.02% to 90.44% for Top-5, and from 74.8 44% to 86.83% for Top-10. At same time, lexical retrieval ac- curacy ranges from 85.72% to 98.22 22 % for Top-5 and from 86.44% to 98.02% for Top-10. The accuracy drop in the semantic retrieval path mainly stems from the information loss when approx- imating cosine similarity with Hamming distance via SimHash. The slight degradation in lexical retrieval accuracy is primarily due to precision loss during secure BM25 score computation.
Table 2: Semantic retrieval accuracy against the plaintext baseline.
Top-5
Top-10
Dataset
Accuracy
Time (s)
Accuracy
Time (s)
Dev wew_annweeeble
87.67%
3.47
86.83%
3.56
ClapNQ
Train answerable
80.30%
4.12
77.78%
4.17
Train single answerable
90.44%
7.33
81.39%
7.88
Dev_v2.0 Training.v22 v2.0
78.02%
3.37
75.96%
3.41
SQuAD
78.14%
4.38
74.86%
4.46
Dev distractor
79.90%
18.91
79.80%
20.10
HotpotQA
Dev ffllwiki
79.46%
19.27
78.23%
20.76
Training
82.92%
147.08
81.42%
160.90
Table Lexical retrieval accuracy against the plaintext baseline.
Top-S
Top-10
Dataset
Accuracy
Time (s)
Accuracy
Time (s)
Dev answerable
97.47%
1.40
96.53%
ClapNQ
Train answerable
95.62%
2.07
95.13%
2.24
Train_single rrainsingle_ansserable annserable
95.64%
5.94
94.99%
6.86
Dev v2.0 Training.v2.0
97.56%
1.39
97.32%
1.42
SQuAD
98.22%
2.59
98.02%
2.82
Dev odvitttrattorr Dev oul_fulwiki
90.06%
21.46
89.48%
25.02
HotpotQA
90.58%
21.39
89.85%
25.61
Training
85.72%
238.60
86.44%
265.91
Second, we evaluate the chunks retrieved by both Pisces and the plaintext bascline against the dataset ground-truth. Figure and (Agurd5 F) compare the top-5 and top- retrieval ac- curacy between P Pisces and the plaintext baseline, respectively. The results demonstrate that (1) Pisces achieves retrieval accuracy comparable to that the plaintext baseline, and (2) combin- ing semantic and lexical retrieval improves overall retrieval performance. Furthermore, we evaluate the retrieval accuracy of our proposed Pisces against existing DP-based approaches listed in Ta- ble The detailed top-5 and top- 10 accuracy results, presented in Table 8 and Table 9 respectively, demonstrate that Pisces achieves significantly superior retrieval accuracy compared to DP-based approaches.
8

---

Published as a conference paper at ICLR 2026
100
baseline (flldd) Places [haichedd]
Dual
60
Aecurecy
20
Caylin Der
Claptin, Tran
Capli Paan dingi
Shull Der
Soulo, Taan
HatpooA Dev detracter
hasplot Dev Anlwal
HasperA, Waining
Figure Top-5 Retrieval accuracy comparisons between Pisces and plaintext baseline over ground-truth.
5.3 EFFICIENCY EVALUATION
We evaluate the efficiency of the two retrieval paths of P Pisces, respectively.
Table 4: Efficiency comparisons with Fine-only Strategy
Fine-Only Strategy
Dataset
Time (s)
Upload (MB)
Download (MB)
Accuracy
answerable
1.855
26.64
100.00%
ClapNQ
Train answerable
69.47
230.82
99.83%
Train single answerable
278.77
1195.62
99.94%
Dev_v2. Train_v2.0
1.714
24.06
24.147
99.64%
SQuAD
3.66
87.97
315.18
99.95%
Dev distractor
34.19
1008.39
4610.26
99.94%
HotpotQA
Dev fullwiki
33.91
1031.45
4719.76
99.97%
Coarse-to-Fine Strategy
Dataset
Time (s)
Upload (MB)
Download (MB)
Accuracy
wasswerable Train answerable
3.56
23.95
23.32
86.83%
ClapNQ
36.35
85.64
77.78%
Train seaiin_ingll__nveeeeee
7.88
113.07
442.97
81.39%
Dev. Dev_y2.0 y2.0
3.41
21.96
13.93
75.96%
SQuAD
Train_v2.0
4.46
43.51
118.29
74.86%
Dev_distractor fuvlfiikiiki
20.10
324.90
1439.70
79. 79.80%
HotpotQA
20.76
330.69
1467.45
78.23%
For the semantic retrieval path, we evaluate the efficiency of our proposed coarse-to-fine strategy against a fine-only baseline (without coarse matching), with both implemented using encrypted com- putations. The results shown in Table demonstrate that for large-scale dataset, the coarse-to-fl fine strategy significantly saves retrieval time by 38. 78% ~ 41.21%, reduces the upload and download overhead by 67.53% ~ 67.78% and 68.49% 68.77%, respectively. In contrast, small-scale datasets, the fine-only strategy outperforms ours, as the coarse matching step itself, rather than co- sine similarity computation, becomes the computational bottleneck.
For the lexical retrieval path, we evaluate the efficiency of our proposed multi-instance labeled PSI protocol [M (Protocol 4 with the state-of-the-art labeled PSI protocol LSE (Yang al.

---

Published as a conference paper at ICLR 2026
Table 5: Efficiency comparisons with labeled PSI
Labeled PSI
Dataset
Time (s)
Upload (MB)
Download (MB)
Dev answerabll
3.89
1.62
0.60
ClapNQ
Train answcrable
27.57
4.21
11.35
Train_single_aa singglcc.asswraall
138.89
21.22
57.77
Dev v2.0
3.15
0.48
2.03
SQuAD
Train_v2.0
45.89
6.99
30.05
Dev.distr Dev Dellfulliiki
1051.98
161.61
382.26
HotporQA
1179.58
176.89
414.16
Multi-instance Labeled PSI
Dataset
Time (s)
Upload (MB)
Download (MB)
Dev answerable
0.009
0.0003
0.58
ClapNQ
wnc
0.056
0.0003
4.00
Truin.singl..at single.answerable
0.28
0.0003
21.04
Dev_v2.0
0.008
0.0004
1.49
SQuAD
Train_v2.0
0.099
0.0004
22.64
Dev distractor
2.35
0.0006
79.82
HotpoiQA
Dev fullwiki
2.59
81.44
2024). The results shown in Table demonstrate that our proposed multi-instance labeled PSI outperforms LSE by up to 496.03x, 70733x, and 2.84 in running time, upload overhead, and download overhead, respectively.
RELATED WORK
RAG with Dual-Path Retrieval. Multiple works (Kuzi et al. 2020 Gao al. 2021 Li at 2022)
demonstrate that leveraging semantic and lexical retrieval together significantly improves retrieval performance. Inspired by this, we aim to design P Pisces that privately supports dual-path retrieval to guarantce the retrieval accuracy.
RAG with Retrieval Process Protection. Recent work applies differential privacy by injecting noise into embeddings to protect privacy during the retrieval process. Several works (Grislain 2025
He et al. 2025) focus on protecting documents during the semantic retrieval, while Cheng al. Cheng al. (2225) propose RemoteRAG protect the query. Yao and Li (Yao & Li 2025) further attempt to protect both the query and documents. However, all of these works only consider single retrieval path, i.e., semantic retrieval. In contrast, P sicees supports dual-path retrieval, semantic and lexical, while protecting both the query and documents.
7 CONCLUSION
In this paper, we propose Pisces, the first practical cryptography-busee RAG framework that sup- ports dual-path retrieval while protecting both the query and documents. We design novel crypto- graphic protocols tailored for efficient semantic and lexical retrieval: coarse-to-fine semantic strat- egy that employs novel oblivious filter over Hamming distance, and an efficient multi-instane labeled PSI protocol that obtains BM25 term frequencies sively evaluate P Pisces and find only a 1.87% deviation in retrieval accuracy relative to plaintext baselines. On large-scale datasets, our coarse-to ponsee-tofiin to-fine strategy reduces runtime by 41.21 1% and up- load/download overhead by 68.77% compared labeled PSI further outperforms LSE by up to 496.03x in runtime, 70733 x upload overhead. These results demonstrate that sces is both accurate and efficient.
a single execution. We comprehen-
fine-only strategy. Our proposed multi-instance
10

---

Published as a conference paper at ICLR 2026
REFERENCES
Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Tige Akkaya, Florencia Leoni Ale- man, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, al. Gpt-4 technical report. arxiv preprint arXiv:2303.0877 2023.
Parul Awasthy, Aashka Trivedi, Yulong Li, Meet Doshi, Riyaz Bhat, Vishwajeet Kumar, Yushu Yang, Bhavani lyer, Abraham Daniels, Rudra Murthy, et al. Granite embedding r2 models. arXiv preprint arXivv2508.2100 10085, 2025.
Alexander Bienstock, Sarvar Patel, Joon Young Seo, and Kevin Yeo. Batch (PIR) and labeled {PSI) with oblivious ciphertext compression. In 33rd USENIX Security Symposium (USENIX Security 24), pp. 5949-5966, 2024.
Moses S Charikar. Similarity estimation techniques from rounding algorithms. In Proceedings of the thiry-fourth annual ACM symposium on Theory of computing, pp. 380-388, 2002.
Hao Chen, Zhicong Huang, Kim Laine, and Peter Rindal. Labeled psi from fully homomorphic encryption with malicious security. In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, pp. 1223-1237, 2018.
Yihang Cheng, Lan Zhang, Junyang Wang, Mu Yuan, and Yunhao Yao. Remoterag: A privacy- preserving Ilm cloud rag service. arXiv preprint arXiv:2412.12773 2024.
Yihang Cheng, Lan Zhang, Junyang Wang, Mu Yuan, and Yunhao Yao. RemoteRAG: A privacy- preserving LLM cloud RAG service. In Wanxiang Che, Joyce Nabende, Ekaterina Shutova, and Mohammad Taher Pilehvar (eds.), Findings of the Association for Computational Linguistics:
ACL 2025, pp. 3820-3837, Vienna, Austria, July 2025. Association for Computational Linguis- tics. ISBN 979-8-89176-256-5. doi: 10. 18.18653/v1 httpw///2222mmm 2.0....iniings-ac...
Kelong Cong, Radames Cruz Moreno, Mariana Botelho da Gama, Wei Dai, Ilia Iliashenko, Kim Laine, and Michael Rosenberg. Labeled psi from homomorphic encryption with reduced compu- tation and communication. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, pp. 1 1135-1150, 2021.
National People's Congress. Personal information protection law of the people's 's republic of china, a. URt/attp://ee.nnc. gov. en. cdurl wwtp:/c1-2//29///////12211 694559. htm
United States Congress. Health insurance portability and accountability act, b. URL http://
Www. cms www.hh..... gov/hipaa/
Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language understanding. In Proceedings of the 2019 conference of the North American chapter of the association for computational linguistics: human language technologies, volume 1 (long and short papers), pp. 4171 2019.
Michael Freedman, Yuval Ishai, Benny Pinkas, and Omer Reingold. Keyword search and obliv- ious pseudorandom functions. In Theory of Cryptography: Second Theory of Cryptography Conference, TCC 2005, Cambridge, MA, USA, February 10-12, 2005. Proceedings 2, pp. 303- 324. Springer, 2005.
Luyu Gao, Zhuyun Dai, Tongfei Chen, Zhen Fan, Benjamin Van Durme, and Jamie Callan. Com- plement lexical retrieval model with semantic residual embeddings. In European Conference on Information Retrieval, pp. 146-160. Springer, 2021.
Yunfan Gao, Yun Xiong, Xinyu Gao, Kangxiang Jia, Jinliu Pan, Yuxi Bi, Yixin Dai, Jiawei Sun, Haofen Wang, and Haofen Wang. Retrieval-augmente generation for large language models: A survey. arXiv preprint arXiv:23122 22...12..99999 2(1), 2023.
Gayathri Garimella, Benny Pinkas, Mike Rosulek, Ni Trieu, and Avishay Yanai. Oblivious key- value stores and amplification for private set intersection. In Advances in Cryptology-CRYI CRYPTO 2021: 4sst Annual International Cryptology Conference, CRYPTO 2021, Virtual Event, August 16 16-20,e0 2021, Proceedings, Part II 41, pp. 395 425. Springer, 2021.
11

---

Published as a conference paper at ICLR 2026
Nicolas Grislain. Rag with differential privacy. In 2025 IEEE Conference Artificial Intelligence (CAI), pp. 847-852. IEEE, 2025.
Longzhu He, Peng Tang, Yuanhe Zhang, Pengpeng Zhou, and Sen Su. Mitigating privacy risks in retreeeal-augmented generation via locally private entity perturbation. Information Processing & Management, 62(4):104150, 2025.
Lei Huang. Weijiang Yu, Weitao Ma, Weihong Zhong, Zhangyin Feng, Haotian Wang, Qianglong Chen, Weihua Peng, Xiaocheng Feng, Bing Qin, et al. A survey on hallucination in large language models: Principles, taxonomy, challenges, and open questions. ACM Transactions on Information Systems, 43(2):1-55, 2025.
Yangsibo Huang, Samyak Gupta, Zexuan Zhong, Kai Li, and Danqi Chen. Privacy implications of retrieval-based language models. arXiv preprint MxXi::3305,148855 2023.
Stanistaw Jarecki and Xiaomin Liu. Fast secure computation set intersection. International Conference on Security and Cryptography for Networks, pp. 418-435, Springer, 2010.
Zhengbao Jiang, Frank F Xu, Luyu Gao, Zhiqing Sun, Qian Liu, Jane Dwivedi- Yu, Yiming Yang, Jamie Callan, and Graham Neubig. Active retrieval augmented generation. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pp. 7969-7992, 2023.
Marcel Keller. Mp-spdz: versatile framework for multi-party computation. Proceedings of the 2020 ACM SIGSAC conference on computer and communications security, pp. 1575-1590, 2020.
Tatsuki Koga, Ruihan Wu, and Kamalika Chaudhuri. Privacy-preserving retrieval-augmeentdd gen- eration with differential privacy. arXiv preprint arXiv:2412.04697, 2024.
Saar Kuzi, Mingyang Zhang, Cheng Li, Michael Bendersky, and Mare Najork. Leveraging semantic and lexical matching to improve the recall of document retrieval systems: A hybrid approach. arXiv preprint arXiv:2010.01195, 2020.
Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich Küttler, Mike Lewis, Wen-tau Yih, Tim Rocktäschel, et al. Retrieval- -urreval- gener- ation for knowledge-intensive nlp tasks. Advances in neural information processing systems, 33: 9459-9474, 2020.
Hang Li, Shuai Wang, Shengyao Zhuang, Ahmed Mourad, Xueguang Ma, Jimmy Lin, and Guido Zuccon. To interpolate or not to interpolate: Prf, dense and sparse retrievers. In Proceedings of the 45th international ACM SIGIR conference on research and development in information retrieval, pp. 2495-2500, 2022.
Jiarui Li, Ye Yuan, and Zehua Zhang. Enhancing Ilm factual accuracy with rag to counter hallu- cinations: A case study domain-specific queries in private knowledge-bases. arXiv preprint 4tXi:24403.10446 2024a.
Jingyu Li, Zhicong Huang, Min Zhang, Jian Liu, Cheng Hong, Tao Wei, and Wenguang Chen. Panther: Private approximate nearest neighbor search in the single server setting. Cryptology ePrint Archive, 2024b.
Aixin Liu, Bei Feng, Bing Xue, Bingxuan Wang, Bochao Wu, Chengda Lu, Chenggang Zhao, Chengqi Deng, Chenyu Zhang, Chong Ruan, et al. Deepseek-v3 technical report. arXiv preprint arXiv:2412.19437.. 2024.
Wen-jie Lu, Zhicong Huang, Zhen Gu, Jingyu Li, Jian Liu, Cheng Hong, Kui Ren, Tao Wei, and WenGuang Chen. Bumblebee: Secure two-party inference framework for large transformers. Cryptology ePrint Archive, 2023.
Xing Han Lü. Bm25s: Orders of magnitude faster lexical search via eager sparse scoring. arXiv preprint arXiv:2407.03618 2024.
12

---

Published as a conference paper at ICLR 2026
Junming Ma, Yancheng Zheng, Jun Feng, Derun Zhao, Haoqi Wu, Wenjing Fang, Jin Tan, Chaofan Yu, Benyu Zhang, and Lei Wang. {SecretFlow-SPU): A performant and (User-Friendly) } frame- work for Privacy-Preseevinng machine learning. In 2023 USeNIX annual technical conference (USeNIX ATC 23), pp. 17-33, 2023.
Jungho Moon, Dongwoo Yoo, Xiaoqian Jiang, and Miran Kim. Thor: Secure transformer inference with homomorphic encryption. Cryptology ePrint Archive, 2024.
Moni Naor, Benny Pinkas, and Omer Reingold. Distributed geoudoraandon functions and kdcs. In International conference on the theory and applications of cryptographic techniques, pp. 327-346.
Springer, 1999.
Qi Pang. Jinhao Zhu, Helen Möllering, Wenting Zheng, and Thomas Schneider. preserving, accurate and efficient inference for transformers. 2024 IEEE Symposium on Security and Privacy (SP), pp. 4753-4771, IEEE, 2024.
Bolt: Privacy-
Stephen Robertson, Hugo Zaragoza, et al. The probabilistic relevance framework: Bm25 and be- yond. Foundations and Trends@ in Information Retrieval, 3(4):333-38) 2009.
Lorenzo Rovida and Alberto Leporati. Transformer- based language models and homomorphic en- cryption: An intersection with bert-tiny. In Proceedings of the 10th ACM International Workshop on Security and Privacy Analytics, pp. 3-13, 2024.
Adi Shamir. How share a secret. Communications of the ACM, 22(11):612-61) 613, 1979.
Lushan Song, Qizhi Zhang, Yu Lin, Haoyu Niu, Daode Zhang, Zheng Qu, Weili Han, Jue Hong, Quanwei Cai, and Ye Wu. Suda: An efficient and secure unbalanced data alignment framework for vertical (Privacy-Preserving' machine learning. In 34th USENIX Security Symposium (USENIX Security 25), pp. 7663-7682, 2025.
Paul Voigt and Axel Von dem Bussche. The EU General Data Protection Regulation (GDPR). Springer, New York, USA, 2017.
Tianshi Xu, Wen-jie Lu, Jiangrui Yu, Yi Chen, Chenqi Lin, Runsheng Wang, and Meng Li. Breaking the layer barrier: Remodeling private transformer inference with hybrid (CKKS) and (MPC). In 34th USENIX Security Symposium (USENIX Security 25), pp. 2653-2672, 2025.
Yunbo Yang, Yiwei Hu, Ruofan Li, Xiaolei Dong, Zhenfu Cao, Jiachen Shen, and Shangmin Dou. Lse: Efficient symmetric searchable encryption based on labeled psi. IEEE Transactions on Services Computing, 17(2):663-574, 2024.
Dixi Yao and Tian Li. Private retrieval augmented generation with random projection. ICLR 2025 Workshop Building Trust in Language Models and Applications, 2025.
Shenglai Zeng, Jiankun Zhang, Pengfei He. Yue Xing, Yiding Liu, Han Xu, Jie Ren, Shuaiqiang Wang, Dawei Yin, Yi Chang, et al. The good and the bad: Exploring privacy issues in retrieval- augmented generation (rag). arXiv preprint arXiv:2402.16899, 2024.
Yanzhao Zhang, Mingxin Li, Dingkun Long, Xin Zhang, Huan Lin, Baosong Yang, Pengjun Xie, An Yang, Dayiheng Liu, Junyang Lin, et al. Qwen3 embedding: Advancing text embedding and reranking through foundation models, arXiv preprint arXiv:2506.05177 2025.
A DETAILED PRELIMINARIES
A.1 CRYPTOGRAPHIC PRIMITIVES
A.1.1 SECERT SHARING
Secret sharing (Shamir, 1979 Keller 2020)is one of the critical primitives of MPC. this paper, we adopt 2-out-of-2 arithmetic secret sharing technology. The main idea of it is to break secret value into 2 shares, each of which is held by a party. For example, S, who holds the secret value x Fp. wants secret share this secret value with another party C. To do this, Ps first generates random value E Fp its share (x) = r, and then sends (x) = x mod F. another party C. Therefore (x)3 (x)C mod F which, for simplicity, denote (x) (x)
13

---

Published as a conference paper at ICLR 2026
A.1.2 LABELED PRIVATE SET INTERSECTION
The PSI (Jarecki & Liu 2010 allows two parties, a server S and client C, learn the intersection of their respective element sets without revealing any additional information outside the intersection. Labeled PSI (Chen al. 2018 Bienstock et al. 2024 Cong et al. 202T) extends the traditional PSI by allowing the server S to associate a label with each element, and the client C learns the labels for elements in the intersection. Formally, inputs a set of key-value pairs {(x; ((x))) where x; an element and (xx;) is its corresponding label, while C inputs set of key Y. After execution, C learns a of pairs (6))))))) for EXnY.
A.1.3 OBLIVIOUS PSEUDORANDON FUNCTION
The OPRF (Freedman and a client C, to jointly compute a pseudorandom function (PRF) F.(.). As shown in Figure 3 S takes PRF key input and learns nothing, while C takes input and learns the PRF value (x(x). Moreover, C learns nothing about the PRF key k and S learns nothing about the input or the output of C.
2005)
cryptographic primitive that enables two parties, a server S
Functionality FOPRE
Parameters:
Two parties and PRE F(-). Functionality:
Wait for input from S, where & is PRF key.
Wait for input from C.
Output (x) to C.
Figure 3: Ideal functionality of OPRF
A.1.4 OBVIOUSLY KEY-VALUE STORE
The OKVS (Garimella al. 2021) is data structure that encodes of key-value pairs into compact representation while preserving the privacy of both keys and values. The definition is as follows:
Definition (Oblivious Key- Valuv Store). An OKVS parameterized by key space K. and value space, and consists of two algorithms:
I or 1 Encode((k), v1), (2),.))...... (kn, vn)): The encode algorithm takes n key-value pairs v(k,, (2), (kn, vn)} C (K x V as input, and outputs a structure I (or an error terminator with negligible probability).
v + Decode(T, k)) The decode algorithm takes an OKVS structure and a key E as input, and outputs the corresponding value v E V.
Correctness: An OKVS is correct if, for all X C x V with distinct keys such that Encode(X) r 1 and (k, v) X, it holds that Decode (T = v;
Computationally Obliviousness: An OKVS computationally oblivious if, for any two key sets with n distinct keys K k2.......... kp c. K. and K' KK.KK...,KKK K. and a uniformly random value set V (v.. versary not able distinguish between Encode((k), (k2, v2), v2).... (k,, Encode((K), (K), va)) -L
vn) C V, a probabilistic polynomial-time ad-
and
This computationally obliviousness property ensures that the OKVS reveals no information about the encoded keys or values beyond the decoded results for given keys.
A.1.5 BATCH PRIVATE INFORMATION -ETRIEVAL-TO-SHALEE
The PIR-to-share (Song et al., 2025) is a cryptographic primitive that enables a client C to pri- vately retrieve the values corresponding its queries from the server S. After that, S and C
14

---

Published as a conference paper at ICLR 2026
obtain the secret shares of queried values, respectively. As shown in Figure S takes its data D of size N as input, while takes its queries / = (4.44......4 (index set) as input. S lears data shares (D(L))) (D[I))' ..... (D[b)}² corresponding to C's queries and learns data shares (D(4)) (D[4)) ...... (D(b)) During this process, learns nothing about C's queries, and C only leams the secret shares of the retrieved values rather than the raw data of S.
Functionality FPIR2Share
Parameters:
Two parties S and C.
Functionality:
Wait for input from S.
Wait for input / 22 from C.
Sample (D(4))> (D(1)) :.... (D(L)) and (D(I)) (DI2)) (D uniformly, such that
(D[A)}* + (D(4)) (D(4))..... (D()))) (D(I))* (D[A))
= (D()) (D[4)>-
Output the shares (Din)>, (D(A)) (D.)))))..((((())) to Ps and (D(A)) (D(L))
(D)()))
Pc-
Figure 4: Ideal functionality of FPIRZShare
A.2 SEMANTIC SIMILARITY
Semantic similarity (Awasthy et al. 2025 Zhang et al. 2025 is a measure the degree to which the meanings of two linguistic units, such words, phrases, sentences, documents, alike, based on their semantic content rather than lexical matching. It plays a fundamental role in many natural language processing tasks, including information retrieval and text summarization. Contem- porary methods operationalize meaning via vector representations. Similarity is then measured with distance functions in embedding space, such cosine similarity, Hamming distance, and Euclidean distance. In this paper, we choose cosine similarity as our similarity metric.
A.3 BEST MATCHING 25
Lü 2024). which A popular algorithm to achieve lexical retrieval BM25 (Robertson et al. 2009
is probabilistic information retrieval algorithm widely used to rank documents according to their document
relevance given query. an enhancement to the traditional term frequency- frequency (TF-IDF) algorithm, which measures the importance of term within set of documents. BM25 takes document length into account and introduces a saturation function to term frequencies, which helps prevent common terms from dominating the results to improve the ranking accuracy.
Given a document set D) = (di,d2...... dy) and query Q = {41 92....,9m): where d, denotes the i-th document in D, N is the total number of documents in D, qj is the j-th term in Q, is the total number terms Q, the BM25 relevance score for document d; relative to this query is defined as:
n
Score (d.))
Σ IDF(q;) R(gj,di)
N N-dff+0A.
ifi.)
Σ log 1+ +05
tfi,j + ki (1- 1--b+
Fuve
where IDF(q)) is the inverse document frequency of q₁ and R(q),d) d) is the relevance document d, relative to the term q)- Besides, df, is the document frequency for term qj, iec. the /) in which qj appears, (f, fí, is the term frequency of q; in
for the
number of documents in the document the document d, 14 is the length of the document d, lave is the average length of the document set D), 1 0 and 0 < are constant values, λ controls the saturation of the term frequency and adjusts the impact of normalization of document length.
B NOTATION
We summarize the frequently used notation in Table
15

---

Published as a conference paper at ICLR 2026
Table 6: Notation Table
Symbol
Description
The server, who holds sensitive knowledge base. The user, who holds a private query.
D
Document set in the knowledge base. Query.
Q
N
Chunk number of D. Unique token number of Q. i-th chunk.
n Cj
I
Index of chunk
V;
Vector representation of chunk e;- Unique token number of chunk C;- I-th token of chunk c₁- Term frequency of wi, in chunk ci. Embedded chunk set.
Wi
Lfu
D'
[]: va c)eeIL
D
[ (wa :m (e(1.N]
Tokenized chunk set.
qj
j-th token of query Q. Vector representation of query Q. Tokenized query.
Q 99
C OBLIVIOUS FILTER
The core idea of the oblivious filter is to convert an approximate (fuzzy) matching problem into an exact matching task. The detailed oblivious filter protocol shown in Protocol In this protocol, both the server S and the user C select the same projections to mask their binary vector(s). A chunk considered candidate match if its projected binary vectors match the query's projected binary vectors on at least two projections. This protocol allows the server S to identify candidate set of chunks that are likely to match the query.
To privately achieve the above matching, we employ 2-out-of-TT Shamir secret sharing scheme. The client can only reconstruct secret value it obtains at least two shares for chunk. Furthermore, to prevent the client to learn which specific chunks are matched, the server S encrypts all shares with additive HE. As a result, the client would reconstruct the secret in ciphertext, which ensures the client could not learn any information throughout the oblivious filter.
D MULTI-INSTANCE LABELED PRIVATE SET INTERSECTION
We design a customized multi-instance labeled PSI protocol (Protoco] to support repeated invoca- tions of labeled PSI with the same small client query set. This protocol features two key innovations. First, the setup phase only involves the server and produces reusable OKVS structure I. It can be efficiently reused across multiple queries without recomputation. Second, the interactive phase minimizes computational overhead. It only requires a single, small-scale OPRF execution per query, independent of the server's data size. These optimizations significantly reduce both communication and computation costs compared to conventional labeled PSI protocols.
DETAILED DATASET
Table 7 shows the details of the datasets used in this paper, including the number of documents and the number of chunks.
16

---

Published as a conference paper at ICLR 2026
Protocol I Obliviiuss. Filter
Input: 8 inputs the set D (4, v,, ( (L where I, is the binary vector representation
corresponding to the chunk ci. C imputs binary vector qº E {0.11e.
where for all i [1,N"] Output: S learns a candidate set D' ( .4) VE(L.N)
Hv .q") r (i.e., Hamming distance at most r).
Setup Phase:
S generates a random keypair (pk, for an additive HE scheme.
2: S sets the projection weight + Tvt- C] and the number of projections T < 160. S
randomly selects 7' projection masks {m, {0,11)) he(1.r] such that ||m, || for all
ie [1,7].
3: S selects 2N random numbers (xi)E(LLM) and {st)ee1.N)) and initializes an empty collec- tion C.
4: S selects random linear polynomial Pr(x) = ax + with random coefficient a for i [I.N]
5: S computes ciphertext Vi.j f Enc(pk, Pi(x)) and key ki, Hash(v) A m;)) for i e
[ [1,
6: S inserts the pair (i,) into C.
7: S invokes OKVS.Encoden
to obtain the OKVS structure I.
Interactive Phase:
1: S sends the public key pk, projection masks (mi)ett.r) OKVS structure r, and random numbers {x; [e C.
2: C computes fj + Hash(q my) for e [1,
3: C invokes OKVS.Decodes. (e(r)) to obtain {dihe(1.77)
d-dj
4: C computes candidate secret ciphertext: Stjj dj ddj-xj Xj" x-x; for each combination
(i from the (1) possible pairs of indices from [1,7].
5: C shuffles all computed ciphertexts {si,) } to form the set $ and sends $ to S.
6: S decrypts
obtain + (Dec(sk,s)) S).
7: For each (from the original setup) that appears in P, S adds the corresponding item
(4, w ci) to the result set D'.
8: S returns D' as the final result.
Table 7: Details of datasets we evaluated in this paper. "Documents" denotes the number of docu- ments in the dataset, and "Chunks" denotes the number of chunks generated from breaking down all the documents in the dataset.
Dataset
Documents
Chunks
Dev_ans eeeeabbeee
290
1990
ClapNQ
Train_ answerable
1751
14010
Train Train-singla single answerable
8996
71363
Dev_v2.0 Training-v2.0.
35
1204
SQuAD
442
19029
Dev distractor
66581
269602
HotpotQA
Dev_ fel_fullwiii
66573
276013
Training
482021
1795146
F SUPPLEMENTARY ACCURACY EXPERIMENTAL RESULTS
The top-10 retrieval accuracy comparison between Pisces and plaintext baseline is shown in Fig- ure 5) Furthermore, we evaluate the retrieval accuracy of our proposed Pisces against existing DP-hased approaches listed in Table [ The detailed top-5 and top-10 accuracy results, presented in
17

---

Published as a conference paper at ICLR 2026
Protocol 4: MuttLPSI
Input: S inputs set D' = (ww C inputs set Q' = 92,,92,..... An).
Output:
C learns (el where if qj - wi,r then [f. - Ifu, and otherwise
ffz
Setup Phase:
1: S selects a random PRF key k and two key derivation functions KDFg and KDF1
2: initializes an empty set S.
3: S computes fLj + (K, wa.)), kL + ki, my + KDFI(i,n)) and C₁ & AES. J 0f ((a) for [1,N]. [1,m]]-
4: S inssetss the key-value pair Ci., into for [1,N]./ (1,m:.
5: S 'nvokes (KVS.Enc) to obtain the OKVS structure r.
Interactive Phase:
S sends the OKVS structure I and key derivation functions KDFo, KDF; C.
2: S and C. invoke an OPRF protocol with PRF key & and Q' 92.142....... -a as inputs, respectively. After execution, obtains the PRF results D (di.d2..... ..................... dn}. 3: C initializes K, 0 and M; = 0 for i [1,N].
4: C computes K, - (f, and m + KDF (i, for i [1,N], E [1.n].
5: C adds K,, to K2 and m',, to M, for E [1,N].] [1,n].
6: C invokes OKVS. Decode K2) to obtain ciphers fc., (cL.
7: C computes Ptj <- AES. Dec(m/..:ci) for [1,M],J E [1,m].
8: If Pi. starts with Of (where is security parameter), parses p.j as Of vay and set [f, Vi,j- Otherwise, set ST. <- O.
9: C returns (tfl,) (e(LM))E the result.
Table 8 and Table 9 respectively. Following the original papers, we configure the privacy parameters as: 8 for DP RAG (Grislain 2025), = 1280 for RemoteRAG (Cheng et al.) 2024), and a 0.1
for Yao & Li 2025).
Retrieval Path
Framework Plaintext baseline (filld) (hatched)
Semmntic Lexical
20
Clppia frai
Captt Iain single
Hoteataa Dev distracter
HotporoA Dev, fulleis
HetpotOA Training
Cappo
SQuaD
SQuAD
Figure 5: Top-10 10 retrieval accuracy comparison between Pisces and plaintext baseline over ground-truth.
18

---

Published as a conference paper at ICLR 2026
Table 8: Top-5 retrieval accuracy comparison between Pisces and baselines over ground truth.
Results for DP RAG (Grislain 2025) uses I, RemoteRAG (Cheng et al. 2204 uses 1280,
and Yao & 2025 uses σ 0.1.
Top-5
Dataset
Framework
Semantic
Lexical
Dual-Path
Plaintext DP-RAG (Grislain 2025
36.38%
47.42%
59.66%
26.37%
26.37%
Dev.answerable
RemoteRAGi Cheng al 2024
35.54%
35.54%
Yao & 2025
15.45%
15.45%
Pisces
30.145
47.15%
58.05 %
Plaintext
22.99%
36.78%
45.78%
DP-RAG (Grislain 2025
17.47%
17.47%
ClapNQ
Train answerable
RemoteRAG CChnne al 2024
22.39%
22.39%
Yao & 2025
6.68%
6.68%
Pisces
19.22%
36.72%
44.41 %
Plaintext
27.57%
40.12%
50.56%
DP-RAG Grislain 2025
21.31%
21.31%
Train single answerable
RemoteRAG (Cheng et al. 2024
26.52%
26.52%
Yao & 202
4,41 %
4.41%
Fisces
23.44%
39.82%
49.39 %
Plaintext
33.80%
91.90%
93.30%
DP-RAG Grislain 2025
24.74%
24.74%
Dev_v2.0
RemoteRAG CCheng 2024
33.18%
33.18%
Yao & 2025
14.78%
14.78%
P1sces
25.20%
91.609%
93.10% %
SQuAD
Plaintext
26.4%
81.10%
84,80%
DP-RAG Grissain 2025
20.34%
20.34%
Training.v2.0
RemoteRAG (Chene et al. 2024
25.48%
25
Yao & 2025
9.08%
9.08%
Pisces
17.40%
80.905
84.10% %
Plaintext
7.28%
43.62%
46.27%
DP-RAG Grislain 2025
5.70%
5.70%
Dev distractor
RemoteRAGi CCheng al. 2024
7.09%
7.09%
Yao & 2025
1.27%
1.27%
Pisces
6.57%
43.60%
46.08 %
Plaintext
4.99%
34.86%
36.44%
DP-RAG (Grislain 2025
3.87%
3.87%
HotpotQA
Dullfulwwiki
RemoteRAG Chene el al. 2024
4.97%
4.97%
Yao & 2025
1.02%
1.02%
Pisces
4.36%
34.80%
36.00 %
Plaintext
6.69%
36.24%
39.21%
DP-RAG Grissaan 2025
4.00%
4.00%
Training
RemoteRAG CCeng cl al 2024
6.48%
6.48%
Yao & Li 2025 2025
0.83%
0.83%
P1sces
6.01 %
34.42%
37.74% %%
19

---

Published as a conference paper at ICLR 2026
Table 9: Top- 10 retrieval accuracy comparison between Pisces and baselines over ground-trun truth.
Results for DP-RAG (Grislain 2025) uses 1, RemoteRAG (Cheng et al. 2202 uses 1280, and Yao & 2025 uses o 0.1.
Top-10
Dataset
Framework
Semantic
Lexical
Dual-Path
Plaintext DP-RAG (Grislain 2025
42.47%
54.84%
67.30%
36.92%
36.92%
Dev.answerable
RemoteRAG Cheng al 2024
41.91
41.91% %
Yao & 2025
20.63%
20.63%
Pisces
36.56%
54.35%
65.443 %
Plaintext
27.69%
43.16%
52.10%
DP-RAG (Grislain 2025
23.79%
23.79%
ClapNQ
Train answerable
RemoteRAG CChene al 2024
26.92%
26.92%
Yao & 2025
9.04%
9.04%
Pisces
21.95%
42.96%
50.75 %
Plaintext
31.60%
46.92%
56.66%
DP-RAG Grislain 2025
27.94%
27.94%
Train annweealn
RemoteRAG (Cheng et al. 2024
30.33%
30.33%
Yao & 2025
6.05%
6.05%
Fisces
27.63%
46.83%
55.92 %
Plaintext
40.70%
94.60%
95.70%
DP-RAG Grislain 2025
34.86%
34.86%
Dev_v2.0
RemoteRAG CCheng 2024
40.00%
40.00%
Yao & 2025
19.94%
19.94%
P1sces
31.80%
94.40%%
95.50% %
SQuAD
Plaintext
34.80%
85%
89. 99.00%%
DP-RAG Grislain 2025
30.12%
10%
Training.v2.0
RemoteRAG (Chene et al. 2024
30.12%
12%
Yao & 2025
12.20%
12.20%
Pisces
22. 10%
85.00%
88,40 %
Plaintext
8.55%
52.48%
54.69%
DP-RAG Grislain 2025
7.45%
7.45%
Dev distractor
RemoteRAGi CCheng al. 2024
8.52%
8.52%
Yao & 2025
1.84%
1.84%
Pisces
7.77%
51.91%
54.31 %
Plaintext
6.17%
40.18%
41.52%
DP-RAG (Grislain 2025
5.45%
5.45%
HotpotQA
Dullfulwwiki
RemoteRAG Chene el al. 2024
6.08%
6.08%
Yao & 2025
1.30%
1.30%
Pisces
5.16%
40.17%
41.40 %
Plaintext
7.62%
42.83%
45.77%
DP-RAG Grissaan 2025
5.50%
5,50%
Training
RemoteRAG CCeng cl al 2024
7.40%
7.40%
Yao & Li 2025 2025
1.22%
1.22%
P1sces
6.84%
40.66%
43.83%
20


Reviews:
[{"review_id": "4TDQ5ECXoQ", "reviewer": "Reviewer_J7a5", "summary": "This paper presents Pisces, a framework for cryptography-based privacy-preserving retrieval-augmented generation (RAG). The goal is to protect both user queries and knowledge base documents while maintaining retrieval efficiency and accuracy. Pisces integrates dual-path retrieval — combining semantic and lexical matching — with novel cryptographic mechanisms. The semantic path adopts a coarse-to-fine strategy using an oblivious filter over Hamming distance and secure multi-party computation (MPC) for cosine similarity, while the lexical path employs a multi-instance labeled private set intersection (PSI) protocol to compute BM25 scores privately. The authors claim that Pisces achieves retrieval accuracy close to plaintext baselines (within 1.14%) and substantially improves efficiency (up to 496× faster in certain PSI tasks).", "questions": "see the weakness", "limitations": "", "rating": 4, "confidence": 2, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "1. Comprehensive framework design: The paper systematically integrates multiple cryptographic primitives (MPC, PSI, OPRF, OKVS) into a cohesive RAG retrieval pipeline, ensuring privacy for both queries and documents.\n\n2. Dual-path retrieval consideration: Supporting both semantic and lexical retrieval paths under privacy-preserving constraints is an ambitious and meaningful direction for improving private RAG systems.", "weaknesses": "1. Limited novelty and unclear challenge motivation: The paper’s technical contributions appear incremental, and it lacks a clear explanation of the key challenges being solved. The Introduction mostly summarizes system components and prior cryptographic methods, but does not articulate the specific research problem or insight that distinguishes Pisces from existing privacy-preserving RAG frameworks. Overall, it reads more like a technical report than a research paper with a well-defined innovation.\n\n2. Unclear use of “cryptography-based” in the title: Although the framework is described as cryptography-based, the cryptographic novelty is not obvious. From the description, the “cryptography” aspect mainly involves using an embedding model and tokenizer to encode queries and documents, which is standard in most RAG architectures. If the cryptographic contribution only lies in combining existing MPC/PSI primitives, it does not sufficiently justify the “cryptography-based” claim. The authors should clarify how Pisces provides new cryptographic advances beyond typical embedding-based privacy mechanisms.\n\n3. Missing experimental comparison with Table 1 baselines: The paper introduces several baseline methods in Table 1 (e.g., DP-RAG, LPRAG, RemoteRAG, etc.), but these methods are not actually compared in the experimental section. Without quantitative results against those baselines, it is difficult to assess whether Pisces offers meaningful advantages in accuracy, efficiency, or privacy protection.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "z105pHYwSB", "reviewer": "Reviewer_24E7", "summary": "The paper proposes Pisces, the first practical cryptography-based RAG framework that supports dual-path retrieval, while protecting both the query and documents. \n\nAlong the semantic retrieval path, we reduce computation and communication overhead by leveraging a coarse-to-fine strategy. Specifically, a novel oblivious filter is used to privately select a candidate set of documents to reduce the scale of subsequent cosine similarity computations.", "questions": "see the above comments.", "limitations": "", "rating": 4, "confidence": 5, "soundness": 2, "presentation": 2, "contribution": 1, "strengths": "The paper proposes the first cryptography-based RAG retrieval framework with dual-path retrieval, while\nensuring privacy for both the query and documents.\n\nThe authors  propose a coarse-to-fine strategy for the semantic retrieval path with an oblivious filter to\nreduce computation and communication complexity.", "weaknesses": "1. The motivation of why applying MPC to RAG with LLMs is seriously unclear to me.Please rewrite this part. \n\n\n2. The motivation and possible usage scenarios of your proposed system in reality  needs to be verified. \n\n3. Please provide the strict privacy definition, your Cryptography-based Private RAG seems only protect the privacy in the whole system in certain parts.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "7LnAc4dxFv", "reviewer": "Reviewer_EtQD", "summary": "Pisces proposes the first cryptography-based retrieval-augmented generation (RAG) framework that simultaneously protects both user queries and documents through dual-path (semantic and lexical) private retrieval, achieving near-plaintext accuracy with significantly improved efficiency.", "questions": "See weakness", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The paper presents a well-structured and logically coherent framework.\n\n2. The proposed method designs customized cryptographic protocols that effectively balance privacy protection and retrieval efficiency.", "weaknesses": "1. Limited support for multi-user concurrency. The current framework is designed for a single client–server setting and does not easily extend to multi-user or concurrent query scenarios.\n\n2. Limited dataset scale and diversity. The evaluation is conducted on moderate-sized, English-only datasets, which limits the generalizability to large-scale or domain-specific applications.\n\n3. Lack of empirical security analysis. The paper provides theoretical privacy guarantees but does not include empirical evaluations against potential attacks such as reconstruction or traffic analysis.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "9tc1h8XAew", "reviewer": "Reviewer_Nqrz", "summary": "The paper focuses on an important research question of privacy-preserving retrieval augmented generation. Compared to differential privacy based methods, cryptography methods can provide more utility and stronger privacy guarantees with a scarification of efficiency and a burden for users to upload and download more data. Authors show that the feasibility of the solution with experiments", "questions": "1. I think work in Huang et al., 2023 and Yao & Li, 2025 considered lexical retrieval. But they did not consider the retrieval of considering semantic and lexical retrieval at the same time. Is this a point that the paper wants to articulate?\n2. I think this baseline is missing. [1]\n3. I am a little bit confused by the structure. So, at the final inference stage, retrieved documents and queries are encrypted through MCP and the user uses a private key to decode and get responses. But during the retrieval phase, the tokenizer and embedding model need the plain text of the query, would that leak privacy? I think at this stage, the query is not encrypted.\n4. Why in Figure 2, ClapNQ_Train_single. Pisces (with MPC) has higher accuracy than plaintext? Is it because of randomness? If so, I think multiple experiments should be conducted and error bars need to be reported.\n5. Why in Table 4, HopotQA, encrypted text computation can have less time than plain text computation?\n\n[1] Koga, Tatsuki, Ruihan Wu, and Kamalika Chaudhuri. \"Privacy-Preserving Retrieval-Augmented Generation with Differential Privacy.\" arXiv preprint arXiv:2412.04697 (2024).", "limitations": "", "rating": 4, "confidence": 5, "soundness": 1, "presentation": 2, "contribution": 3, "strengths": "1. The paper fills the blanks of no cryptography solution in the field of privacy-preserving RAGs.\n2. The paper considers the case of semantic and lexical retrieval.", "weaknesses": "1. Authors mentioned some DP-based methods and argued that they may harm utility. Is there any empirical experiment to support that? It seems that I didn't find a comparison to these baselines in the evaluation.\n2. The motivation is confused. Why the answer to \"How can we maintain retrieval performance while ensuring privacy for both the query and documents during retrieval?\" Is using cryptography-based methods? Why do other methods not achieve this?\n\nI think the motivation and high-level idea is interesting but there are some technical problems that need to be resolved. I hope the authors can provide some rationale for them before the paper reaches the acceptance standard.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)