reranking
— GELO

The reranker is the post-retrieval refinement step in private RAG. After CAPRISE-decrypted top-k_prime candidates land back inside the CVM (see Embedding + Storage), the reranker re-scores each (query, chunk) pair with a more precise relevance model and selects the final k_final. Two facts make this step its own privacy primitive rather than a thin extension of retrieval.

Protocol primitives (mask, shield, U-Verify, OutAttnMult) are defined in embedding §02. Only rerank-specific additions are listed here.

Same trust posture as the embedder, extended to cover the rerank-specific exit channel.

Four exit-channel leaks are closed structurally rather than statistically:

Not covered. Prompt content the client forwards to an external generator. Query frequency and timing. Side channels in the TEE itself. Replay defense at the protocol layer (re-using (SessionKey, QueryId) re-derives the same QueryKey and breaks AES-GCM — caller must guarantee unique QueryId per session).

Names track architecture, not model family. Each loads as Arc<…Weights> from safetensors via the HuggingFace Hub; the SHA-256 of backbone bytes + head bytes + (for the discriminator) template + pinned token IDs rides as model_identity through every attestation report.

jina-reranker-v3 is deferred. Its listwise packed-context architecture pushes n ≈ 16k+ per forward, which sits in the fused-permuted-attention regime documented in gelo-llm.md §3 — a 5–7 week prerequisite. CC-BY-NC-4.0 license is also a blocker for commercial deployments. Revisit alongside the LLM-serving stack.

Each card pairs [component ↦ source ↦ what it secures ↦ threat]. Ordered by request path: trait → heads → session keys → bundle → in-TEE sort → HTTP route.

The rerank stage adds no new privacy primitive at the PCIe boundary — it reuses the same GELO mask + TwinShield round-trip the embedder validated, applied to a different model and a different scoring head. Two figures below trace one layer-block per architecture and add the family-specific scoring head at the bottom. FIG. 02a covers the cross-encoder family (bge-reranker-v2-m3 · XLM-RoBERTa-large · 24 layers); FIG. 02b covers the causal-LM-discriminator family (Qwen3-Reranker-0.6B · Qwen3 backbone · 28 layers). Same 4-offload-group rhythm per block as the embedder; what differs is the input packing and the head.

What to look for between the two figures. ① input packing — the cross-encoder packs [CLS] query [SEP] document [SEP] into one bidirectional sequence; the causal-discriminator wraps (query, document) in Qwen3's chat template and runs causal attention left-to-right. ② scoring head — cross-encoder gathers row 0 (CLS) and runs a 2-layer classifier (dense → tanh → out_proj); causal-discriminator gathers the last-token hidden and computes two dot products against token_embedding.row(yes_id) / .row(no_id) (tied LM head — no separate weight, no GPU offload for the scoring step). ③ per-block topology identical to the embedder family it inherits from — see embedding.html §05 for the same 8-step (BERT) / 9-step (Qwen3) rhythm. The reranker reuses the embedder's gelo_embedder::bert::forward::run / gelo_embedder::decoder::forward::run unchanged; the head is the only new mask boundary.

Mask sampling cadence — three modes, one default

A Haar-uniform orthogonal mask A protects each masked PCIe round-trip. How often A is resampled is a separate dial from where it gets used. Three cadences are coherent at the protocol level; the executor in gelo-protocol ships the first one as the default and exposes the third as an explicit opt-in for the BSS-recovery / parity tests.

Why per-forward + shield is the default. Per-offload's correlation safety is real but the cost is the Haar-QR over an (n+k)×(n+k) matrix, which is O((n+k)³). Reranker inputs at n≈256–512 push the QR cost to 17–23 ms per call — at ~100 calls per forward that is most of the wall-clock. Per-forward sampling does the QR once, then the same A participates in every offload's mix/unmix GEMM (which is GEMM-fast and CBLAS-tractable). Shield rows are sampled fresh per offload regardless (cheap — k Gaussians), and that per-offload freshness is what stops cross-offload ICA without paying the per-offload QR tax. The paper's §3.2 + §4.2 pairing is exactly this trade.

Hardware: AMD Ryzen AI Max+ 395 (Strix Halo). Vulkan adapter: AMD Radeon Graphics (RADV GFX1151) (IntegratedGpu). All numbers under InProcessTrustedExecutor with GELO+mask enabled.

Rerank latency — two regimes, two architectures

"Per-pair" alone is ambiguous: it depends on whether the candidate batch fans out across CPU workers (k′ > 1) or runs sequentially (k′ = 1). Both regimes reported for both architectures. Same lever stack (L1+L2+L3+L4+L5+L6) applies to both — same patterns, ported to bert::* and decoder::* separately.

Why Qwen3 is slower at both regimes: 28 layers vs BGE's 24, chat-templated prompt inflates n from ~256 to ~400, and the mask GEMMs scale as (n+k)² · d. The shape of the breakdown is the same on both paths — mask GEMMs are at the AOCL-BLIS AVX-512 floor, GPU is dispatch-bound, attention is 6× smaller after rayon-parallel heads.

Per-bucket breakdown (single-pair k′=1)

Traced with E2E_TRACE=1 on rerank_e2e_bench.rs. Batch trace is empty by design — profile::time is thread-local and rayon workers don't roll up to the main thread.

End-to-end stages (R7 GPU, 100 docs, 1 query, k'=20, k=10)

Optimization headroom landed

All numbers below ride the paper-parity executor default (per-forward Haar mask + shield k=8) and AOCL-BLIS via the blas feature (now default-on for gelo-rag / gelo-reranker / gelo-snp-runner).

Qwen3's batch speedup is slightly larger than BGE's (16.6× vs 15.1×) because L1 alone gives more headroom on the longer-n Qwen3 path (mask GEMMs are (n+k)² · d; n≈400 vs 256 → 2.4× more flops per offload, so the BLIS speedup matters more). BGE's single-pair speedup is smaller because more of its work is in the GPU dispatch column, which doesn't accelerate with CPU-side rayon.

Two non-default options tried and judged not worth turning on:

• L3a · ndarray/blas globally — routes every workspace .dot() through cblas. Marginal on BGE: 1.62 → 1.57 s single-pair, 3.22 → 3.18 s batch (~3% / ~1%). Per-head attention shape (256, 64) · (64, 256) sits on the BLIS-vs-matrixmultiply crossover. Kept as an opt-in blas-ndarray feature for users to try on their own hardware; the global blast radius doesn't justify default-on for a 3% gain.
• L3b · OutAttnMult for the BERT path — plumbed (new BertConfig::use_out_attn_mult + multi_head_attention_with_offload mirroring the decoder path), but on this iGPU at our shapes it regressed both regimes (single-pair 1.74 → 4.33 s; batch 3.23 → 17.83 s — the iGPU serialises per-layer Q·Kᵀ dispatches across rayon workers). Code stays — earns its keep at n ≥ 512 or on a dGPU — but the bench default keeps it off.

Two non-default options tried and judged not worth turning on:

• L3a · ndarray/blas globally — routes every workspace .dot() through cblas. Marginal: 1.62 → 1.57 s single-pair, 3.22 → 3.18 s batch (~3% / ~1%). Per-head attention shape (256, 64) · (64, 256) sits on the BLIS-vs-matrixmultiply crossover. Kept as an opt-in blas-ndarray feature for users to try on their own hardware; the global blast radius doesn't justify default-on for a 3% gain.
• L3b · OutAttnMult for the BERT path — plumbed (new BertConfig::use_out_attn_mult + multi_head_attention_with_offload mirroring the decoder path), but on this iGPU at our shapes it regressed both regimes (single-pair 1.74 → 4.33 s; batch 3.23 → 17.83 s — the iGPU serialises per-layer Q·Kᵀ dispatches across rayon workers). Code stays — earns its keep at n ≥ 512 or on a dGPU — but the bench default keeps it off.

Ranking metrics on the same run

Baseline = BGE-base GELO+mask+Vulkan cosine over CAPRISE index. Subset of 100 NFCorpus docs constructed to retain qrel-relevant docs (subset_corpus in the bench). Single-digit query counts make these numbers high-variance per-stage; the relative deltas matter more than the absolute values at this scale.

Two distinct stories. The bge Δ = −0.032 on 10 queries is within sample noise on a 100-doc subset where the baseline is already strong (subset_corpus deliberately keeps relevant docs). Not evidence of a pipeline bug. The Qwen3 Δ = −0.247 across multiple runs is structural — the QWEN3_RERANKER_TEMPLATE constant omits the <Instruct>: line from the official HF model card example. Without it, the discriminator falls back to a weaker signal. Tracked in §08 as the first follow-up.

M1.11 R2 — Batched prefill

The L2 path above runs N rerank candidates through Rayon as N independent single-stream forwards. That extracts CPU parallelism, but each forward pays its own GELO mask sample and its own per-layer GPU dispatch, and N forwards contend for the iGPU's serial work queue. M1.11 R2 restructures rerank so all N (query, doc) pairs ride one batched forward: one prefill pass with N per-sequence masks A_b derived from a shared batched-forward seed, one GPU dispatch per layer covering the whole batch. The per-row security argument is unchanged from the Rayon-per-worker model — identical A_b structure, just dispatched as one batched call — so no new AloePri derivation is required (the c4 spot-check at B=16 is paranoia rather than protocol revision).

Result — Qwen3-Reranker-0.6B, B = 8

A/B against serial single-stream rerank × N (no concurrency, no Rayon). The acceptance baseline is deliberately *not* the existing Rayon path: Rayon is orthogonal CPU parallelism that the batched design composes with, not against. Measuring against serial lets the M1.11 mechanism (GPU dispatch amortisation + per-sequence mask vectorisation) appear in isolation. Two subsequent CPU-side optimisations stack on top of the substrate.

Hardware: Strix Halo iGPU (RADV GFX1151, Vulkan). Speedup ratio is the load-bearing number; absolute wall fluctuates ±10 % across runs because the iGPU and CPU share unified memory.

Where the wall goes (post-optimisation)

GPU dispatch count crashes 8× (896 → 112) and total CPU mask work shrinks ≈ 4.7×. GPU now dominates batched wall at 60 % — the characteristic shape of a GPU-bandwidth-bound private-rerank workload on this iGPU. Shield-fill share grows in relative terms even though the bucket size doesn't change much; the D1.7 sub-stream RNG optimisation lands in the decode bench and carries over for decode-shaped reranker workloads, but rerank at B = 8 doesn't yet show it as a top-tier bucket.

Client interface unchanged: the rerank service still emits a fixed-shape AES-GCM bundle exactly as before. The batched path is chosen automatically when more than one candidate is submitted.

Protocol fidelity

Nine reranker-specific tests across four files validate masked-vs-plain agreement and the wire-format round trip:

• cross_encoder_parity.rs — masked and plaintext executors agree on score within 1e-3 on synthetic 2-layer BERT weights; top-1 rank preserved.
• causal_discriminator_parity.rs — same shape; softmax([no, yes])[1] agrees within 1e-3 and [0, 1] bounds hold under both executors.
• bundle_round_trip.rs — full rerank() → wire-shape EncryptedRerankBundle (always k_max items) → client decrypts with matching QueryKey → recovers exactly top_k real items in the in-TEE rank order. Wrong session key fails to open.
• comparative_bench.rs::real_models_bge_vs_qwen3 — #[ignore] real-weight A/B; both rerankers select a RAG-grounded doc at rank 0.
• gelo-snp-runner integration tests — /rerank returns 501 unconfigured; returns a valid bundle when configured; client reconstructs and opens it via the session-derived key.

What's landed

• crates/gelo-reranker — full crate, 9 source files, 4 test files.
• gelo-snp-runner /rerank HTTP route with mock-issuer integration test.
• E2E bench crates/gelo-rag/tests/rerank_e2e_bench.rs with E2E_DOCS · E2E_QUERIES · E2E_KPRIME · E2E_KFINAL · E2E_SKIP_BGE · E2E_SKIP_QWEN3 knobs and configurable corpus subsetting.
• Real-weight bench crates/gelo-reranker/tests/comparative_bench.rs::real_models_bge_vs_qwen3 running on AMD Vulkan iGPU.
• This documentation page.

Highest-impact next levers

Deferred / out of scope

• jina-reranker-v3 — listwise n≈16k forwards need gelo-llm.md §3's fused permuted attention + FlashAttention to land first. License is CC-BY-NC-4.0. Revisit alongside the LLM-serving stack.
• Shredder at the pooled activation — round-2 §6 follow-up. Only relevant if a deployment needs to export scores for downstream use (calibrated cutoffs, hybrid fusion). Default TEE-internal architecture already keeps scores sealed.
• Score-DP accountant — formal (ε, δ) budget over rerank score exports. Same trigger as Shredder.
• ECDH-bound session-key handshake — currently session_secret is a 32-byte token the client supplies per request. An attestation-bound ECDH KEX will replace it; the SessionKey::derive API surface stays identical.
• Game-of-Arrows attack bench in reranker mode — round-2 §4.3. The construction is safe by the same argument that protects the embedder; the empirical confirmation is gated on lifting the attack reference into a workspace test.