Auditing Privacy in Multi-Tenant RAG under Account Collusion

2026-05-19

AI Summary

This work addresses a critical privacy vulnerability in multi-tenant Retrieval-Augmented Generation (RAG) systems, where colluding accounts can jointly issue queries to breach individual differential privacy guarantees, leading to severe information leakage. The paper proposes the first auditable privacy verification protocol that requires no modification to existing RAG deployments. By integrating general-purpose cryptographic tools—such as Merkle logs and zero-knowledge proofs—with six RAG-specific primitives—including embedder commitments and index vector commitments—it constructs an end-to-end auditing framework that explicitly decouples retrieval and generation channels. This framework enables estimation of collusion scale and tracking of Rényi differential privacy (Rényi-DP) bounds. Empirical evaluation confirms a leakage rate bounded by √k·ε_acc and demonstrates quantitative (PASS, ε_audit) privacy auditing without exposing the index structure or model weights.

Abstract

Multi-tenant retrieval-augmented generation (RAG) services advertise per-account differential privacy as the operative leakage boundary: each account's queries are guaranteed to satisfy $(\varepsilon_{\text{acc}}, δ_{\text{acc}})$-DP with respect to the index. We identify same-index multi-account collusion as a privacy-boundary failure: for $k$ same-tenant accounts coordinating against the tenant's index -- the operative regime -- known DP composition theory implies joint leakage degrades unconditionally at rate $Θ(\sqrt{k} \cdot \varepsilon_{\text{acc}})$ for Gaussian-noised retrieval. Cross-tenant and external collusion match the rate only under explicit access-control failure (M4); without M4 these regimes have zero leakage by design and reduce to an architectural audit, not a DP audit. We exhibit an attack realizing the rate and derive a RAG-specific MIA prediction we test empirically. To make this per-account/joint gap auditable, we design the first audit protocol that operates against unmodified RAG deployments and issues a quantitative $(\textsf{PASS}, \varepsilon_{\text{audit}})$ verdict for the retrieval-score channel -- the noise-then-select step the per-account DP guarantee actually covers -- without index disclosure, pipeline redesign, or model-weight exposure. Generation-channel privacy (LLM output conditioned on selected documents) is a separate audit predicate that should compose with ours; we explicitly scope it out. The protocol composes generic cryptographic primitives (Merkle ledgers, ZK function-application proofs, Gaussian noise attestations) with six RAG-specific primitives (embedder commitment, index-content vector commitment, per-account query ledger, noise-then-select attestation, cross-tenant containment proof, coalition-size estimator) and supports both closed-form audit bounds and Rényi-DP moments-accountant tracking.

Problem

• multi-tenant RAG
• account collusion
• differential privacy
• privacy auditing
• joint leakage

Innovation

• multi-tenant RAG
• account collusion
• differential privacy auditing
• noise-then-select attestation
• privacy boundary failure