private-rag

Rust workspace for a working retrieval-only private RAG stack: a regulated client outsources a confidential corpus to an untrusted cloud, queries it interactively, and gets ranked results back — without the cloud seeing plaintext text, plaintext embeddings, or which document matched.

The stack composes an attested SEV-SNP CVM, a per-forward orthogonal-mask split-inference protocol (GELO) against a commodity Vulkan GPU, and distance-preserving ciphertext (CAPRISE) at rest. Extends end-to-end to private LightRAG retrieval over Ring-ORAM + XorMM volume-hiding multimaps.

Design and measurement docs: https://nulltea.github.io/rag-privacy/

Workspace layout

Commands

cargo test
cargo test -- --ignored        # downloads embedding model via fastembed

AloePri attack harness

evals/aloepri-attacks/ ports the AloePri attack suite from vendor/aloepri-py/src/security_qwen/ and runs it against an obfuscated Qwen3-1.7B GGUF served by a patched llama-server. Captures observables, runs prompt-inversion attacks against them. Measured results in docs/prototype/aloepri-llm.html; operator runbook in evals/aloepri-attacks/README.md.

The patched llama-server builds from the vendor/llama.cpp submodule, pinned at github.com/nulltea/llama.cpp branch m2_7-tensor-dump (upstream ggml-org/llama.cpp master + one commit adding --tensor-filter REGEX and --tensor-dump-path FILE):

git submodule update --init --recursive vendor/llama.cpp
docker build \
    -f evals/aloepri-attacks/m2_7/vulkan-m2_7.Dockerfile \
    -t aloepri-llama-server:latest \
    vendor/llama.cpp

Fresh clones get the patched source directly — no manual patch-apply step. Rebase recipe for bumping the fork onto newer upstream is in the eval's README.