SHARD: cell-keyed residual splitting for alignment-resistant private dense retrieval

Abstract

Dense retrieval systems expose document geometry when vector stores are compromised, and a global protective transform can often be aligned from known pairs. We study SHARD, which splits PCA coordinates into a short routing prefix and a residual protected by independent cell-local orthogonal keys. It supports CKKS ciphertext--plaintext reranking but is evaluated as a leakage trade-off, not a cryptographic document-privacy guarantee. Corrected scoring uses centered document coordinates and an uncentered scoring query, preserving raw ranking up to a query-dependent constant. Across ten BEIR/MIRACL configurations it reproduces raw nDCG@10 and recall, whereas centering both sides loses up to 0.080 nDCG. Cell keys spread diffuse known-pair evidence across compartments, but minimum-norm alignment recovers useful signal far below full key rank, so there is no hard de-anonymization threshold. Real CKKS has maximum score error 2.29e-6 and no top-1 flips; block packing cuts query upload by 74--87% but raises in-process p50 latency by 14--26%. In a strengthened GTR case, an unknown key lowers token-F1 from 0.665 to 0.242; a wide prefix and eight pairs restore much. Under 25--90% release overlap, the unchanged prefix and clean residual norm link persistent rows with R@1 at least 0.9996, although cell-Gram linkage degrades under churn. A formally calibrated Gaussian release gives nDCG@10 at most 0.011 at epsilon=1; its only three strict utility matches occur at epsilon=32768 with linkage R@1 at least 0.995. SHARD preserves retrieval and compartmentalizes alignment evidence, but does not provide DP, unlinkability, or cancellable templates.