Patent Application: Secret Sharing Meets Enterprise RAG

Data Protection Requirements in Enterprise RAG

RAG deployments may store source documents, embeddings, retrieved passages, prompts, and answers across several components. Concentrating business knowledge can create exposure if storage, permissions, or processing environments are compromised.

1. Storage exposure
   Source text, embeddings, and logs need protection appropriate to their content. Their storage locations and access controls vary by architecture; a vector database does not necessarily store every original document.
2. Credential and key exposure
   Compromised credentials or encryption keys can expose the information they protect. The wider system still requires key management and separation of access.
3. Privileged access
   Administrative access needs appropriate permissions, separation of duties, and audit controls to limit exposure of sensitive information.

Three Functions Described in the Announcement

ZENMU Engine applies an all-or-nothing transform (AONT) to data and distributes the resulting fragments. In the RAG integration, protected source information is stored across separate locations, and only authorized context is reconstructed for processing. This adds a layer of protection alongside access and network controls.

1. Transformed fragments in distributed storage
   In the announced design, a single fragment is insufficient to reconstruct the protected source. The level of protection depends on the transformation method, separation of storage and access, and controls over reconstruction.
2. Temporary reconstruction for processing
   The information needed for an authorized operation is reconstructed temporarily in memory and designed to be cleared after processing. Logs, caches, backups, and downstream services require separate controls to address any retained copies.
3. Protection of prompts and answers
   According to the release, distributed protection also applies to stored prompts, answers, and related data. Logging, retention periods, and access permissions are defined for each deployment.

Security Objectives and Implementation Boundaries

The approach aims to reduce the risk of confidential information being exposed through a single storage component. A complete security design must also cover embeddings, authorization, data processing, external models, and operations.

1. Reduced concentration of reconstruction risk
   AONT distributes the data needed for reconstruction. The system still requires credential management, transport encryption, and management of any other keys used in the deployment.
2. Integrity and availability considerations
   Damaged fragments may prevent reconstruction. The mechanism does not independently detect malicious content in source documents or prevent data poisoning; source validation and recovery controls remain necessary.
3. Restricted access to protected content
   The design aims to prevent reconstruction when access is limited to only part of the distributed data. Administrators who can access sufficient fragments or the processing environment still need appropriate restrictions and oversight.

Looking ahead

According to the May 2026 release, security evaluation at the National Institute of Advanced Industrial Science and Technology (AIST) began in April 2026. Prototype development and work with early adopters were also planned. The release did not announce evaluation results, security certification, or a patent grant.

Patent application details

Company profiles

Aegis Application Co., Ltd.

Aegis Application supports AI requirements definition, proposals, technical evaluation, and implementation planning with clients and technology partners. In this project, it coordinates business requirements and deployment support.

ZenmuTech, Inc.

ZenmuTech provides data protection technology, including the ZENMU Engine SDK, ZENMU Virtual Drive, and the Query Ahead® confidential computation platform. The project uses its distributed data protection capability.

Technica AI Inc.

Technica AI combines AI research, engineering, and systems integration for enterprise use. It develops the AIKNOW knowledge platform and, in this collaboration, is responsible for RAG platform design and implementation.

Media inquiries

This release was distributed via PR TIMES (ZenmuTech, Inc.).