揭露多租户RAG中账号合谋的隐私泄露风险，提出可验证审计方案。
Auditing Privacy in Multi-Tenant RAG under Account Collusion
- 发现相同租户账号合谋会放大隐私泄露，呈√k倍增长
- 实测验证在多种场景下泄露强度与√k成正比
- 无需暴露索引即可审计，适合需合规的生产系统
多租户RAG服务通常以账户为隐私边界，每个账户获得(ε_acc, δ_acc)-DP检索保障。我们发现，在同一索引的账户合谋情况下，该框架低估了隐私泄露。对于高斯噪声后选择的检索方式，k个协同的同租户账户联合泄露量达到Θ(√k ε_acc)，而非ε_acc；我们设计了一种匹配的成员推断攻击，并在标量、Top-K、训练嵌入器及生产级HNSW设置中验证了预测的√k AUC趋势。随后，我们提出一种验证者可运行的审计协议，可在不披露索引或改变检索规则的前提下，对最多申报上限k_max的联盟进行审计，报告结果为(PASS, ε_audit)。该声明仅针对检索通道：生成通道泄露和对抗鲁棒的联盟规模估计是互补的审计谓词。
原文摘要 · Abstract (English)
Multi-tenant RAG services often treat the account as the privacy boundary: each account receives an $(\varepsilon_{\text{acc}},δ_{\text{acc}})$-DP retrieval guarantee against the tenant index. We show that this framing understates leakage under same-index account collusion. For Gaussian noise-then-select retrieval, $k$ coordinated same-tenant accounts compose to joint leakage $Θ(\sqrt{k}\,\varepsilon_{\text{acc}})$, not $\varepsilon_{\text{acc}}$; we give a matching membership-inference attack and validate the predicted $\sqrt{k}$ AUC trend in scalar, top-$K$, trained-embedder, and production-scale HNSW settings. We then give a verifier-runnable audit protocol that attests noise-then-select retrieval and reports $(\textsf{PASS},\varepsilon_{\text{audit}})$ for coalitions up to a declared cap $k_{\max}$, without disclosing the index or changing the retrieval decision rule. The claim is retrieval-channel only: generation-channel leakage and adversarially robust coalition-size estimation are complementary audit predicates.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。