Can an AI answer questions about my private files without the provider reading them?

October 16, 2026 · 5 min read

SentX SI

For the services most people use today, the honest answer is no. Upload a document and ask it questions, and the provider's infrastructure reads what you sent. At SentX, the privacy policy states that internal systems process conversations for inference, training, and research, and that submissions are not confidential. That is a design choice, not an accident: the quality of file-based answers depends on the model having full access to the content. What is changing is the architecture underneath, and a paper submitted to arXiv on October 15, 2026 points at a concrete step toward the answer yes.

Source: [2610.22297] Private Retrieval Augmented Generation via Random Projection; Privacy Policy | SentX SI (sentx.ai); Victoria AI Model Card | Capabilities, Evidence and Limits | SentX SI

How private-file answering works today

To answer questions about your files, a system usually runs a pipeline called retrieval-augmented generation. Your documents are converted into numerical summaries, known as embeddings, and stored in a searchable index. When you ask a question, your question becomes an embedding too; the system finds the stored passages closest to it and hands those passages to the language model, which composes the answer. Every stage of that chain sits on the provider's servers, which is why the provider can read your files: the index, the matching, and the generation all happen in the clear. SentX's policy is explicit about the consequences. Submissions may enter the training corpus and model weights, which are retained permanently, and interaction content may later surface in interactions with other users in approximate form. Account deletion removes your account-side data but does not reach what is already baked into weights or shared memory.

Source: Privacy Policy | SentX SI (sentx.ai)

That last detail matters for the question in the headline. Without the provider reading them has two parts: the machine must not need readable content to find the right passage, and the company must not keep readable copies. Today's services fail both.

What the new paper changes

Private Retrieval Augmented Generation via Random Projection, by Dixi Yao, Tahseen Rabbani and Tian Li (arXiv:2610.22297), attacks the first part. The idea is simple: take a random matrix and multiply it into every vector in the datastore, and the same matrix into every query vector. The retrieval server then works only on the projected, scrambled vectors and never sees the originals. Because the identical transformation is applied on both sides, the relative geometry survives. The authors prove that semantic similarity between a query and the documents it should match is preserved, so the right passages still come back on top.

Source: [2610.22297] Private Retrieval Augmented Generation via Random Projection

The privacy result is more modest than the proof. The authors show the projection substantially mitigates data-extraction attacks, meaning attacks that try to reconstruct document content from the index, but they do not claim to eliminate them. Scrambled vectors still carry structure, and the paper measures resistance empirically under strong attack models, reporting privacy comparable to methods built on formal differential-privacy guarantees while achieving better retrieval and generation quality than those differential-privacy methods. Differential privacy pays for its formal guarantee in accuracy; the projection approach trades that formalism for performance. The authors describe their result as the first suggestion that random projection can serve as a competitive, practical baseline for private RAG.

Source: [2610.22297] Private Retrieval Augmented Generation via Random Projection

Three limits are worth keeping in view. This is a preprint, submitted a day before this article was written, so the results are author-reported and not independently replicated. The provable part is similarity preservation; the privacy part is measured, not guaranteed the way a differential-privacy budget is. And the method covers the retrieval datastore, the place where your documents live in waiting, not every component of a commercial service.

Source: [2610.22297] Private Retrieval Augmented Generation via Random Projection

Sorting your files in ten seconds

The paper's boundary turns into a usable test even before any service ships it. Sort every document into one of two buckets.

Bucket one, safe for a disclosed non-confidential service, holds material you are allowed to submit and do not mind the provider keeping permanently, using for training, and potentially echoing back to another user in approximate form. SentX's policy draws the line for you: it advises against submitting trade secrets, privileged communications, protected health information, financial account credentials, or any content you wish to keep private. If a file clears that list and your own judgment, it belongs in bucket one, understood that training is inseparable from the service and there is no toggle.

Source: Privacy Policy | SentX SI (sentx.ai)

Bucket two, needs a confidential pipeline, holds everything on that list, plus anything you would not want a rival, a client, a patient, or the other side of a negotiation to see. Until a service demonstrably runs private retrieval, bucket-two files stay off the cloud: processed by tools that run entirely on your device, or handled by a vendor whose architecture and contract actually keep the content out of their infrastructure. A marketing promise of privacy is not one of those.

The test per file takes seconds. Does it contain something the policy names, or something you would be uncomfortable keeping forever and showing to someone else? Yes goes in bucket two. No goes in bucket one. Every file lands in exactly one, and the sort costs nothing.

The architecture in the paper is a research step, not a product feature, and the honest answer for SentX today is unchanged: if a file is sensitive, the policy's own advice is not to send it. What the paper does is make the destination of that advice legible. Private file-question-answering is now a defined engineering problem with a working candidate design, and the two-bucket sort is how you protect yourself in the meantime.

Source: Privacy Policy | SentX SI (sentx.ai); Victoria AI Model Card | Capabilities, Evidence and Limits | SentX SI