mlsanityData to 13 Oct 2026

Auditing Privacy in Multi-Tenant RAG under Account Collusion

arXiv 2605.19847 ↗First posted 19 May 2026cs.CR cs.IR cs.LGcited by 0

Not on the map. Why?

Abstract (arXiv)

Multi-tenant RAG services often treat the account as the privacy boundary: each account receives an (varepsilonacc,δacc)-DP retrieval guarantee against the tenant index. We show that this framing understates leakage under same-index account collusion. For Gaussian noise-then-select retrieval, k coordinated same-tenant accounts compose to joint leakage Theta(√k,varepsilonacc), not varepsilonacc; we give a matching membership-inference attack and validate the predicted √k AUC trend in scalar, top-K, trained-embedder, and production-scale HNSW settings. We then give a verifier-runnable audit protocol that attests noise-then-select retrieval and reports (textsfPASS,varepsilonaudit) for coalitions up to a declared cap kmax, without disclosing the index or changing the retrieval decision rule. The claim is retrieval-channel only: generation-channel leakage and adversarially robust coalition-size estimation are complementary audit predicates.

Key facts. No citing papers in the map yet (data through 13 Oct 2026). Builds on 13 of its 41 references that are in the map. First posted on arXiv 19 May 2026.

Builds on

13 of 41 references.

References · 13

  1. 2016Deep Learning with Differential Privacycited by 2,718
  2. 2016Efficient and robust approximate nearest neighbor search using Hierarchical Navigable Small World graphscited by 857
  3. 2017Renyi Differential Privacycited by 648
  4. 2013The Composition Theorem for Differential Privacycited by 296
  5. 2018Improving the Gaussian Mechanism for Differential Privacy: Analytical Calibration and Optimal Denoisingcited by 218
  6. 2023Text Embeddings Reveal (Almost) As Much As Textcited by 192
  7. 2024The Good and The Bad: Exploring Privacy Issues in Retrieval-Augmented Generation (RAG)cited by 159
  8. 2021Eluding Secure Aggregation in Federated Learning via Model Inconsistencycited by 67
  9. 2024Here Comes The AI Worm: Unleashing Zero-click Worms that Target GenAI-Powered Applicationscited by 59
  10. 2016Privacy Odometers and Filters: Pay-as-you-Go Compositioncited by 32
  11. 2024RemoteRAG: A Privacy-Preserving LLM Cloud RAG Servicecited by 17
  12. 2021Concurrent Composition of Differential Privacycited by 12
1 more
  1. 2026Your Privacy Depends on Others: Collusion Vulnerabilities in Individual Differential Privacycited by 1

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026Understanding Disclosure Risk in Differential Privacy with Applications to Noise Calibration and Auditing (Extended Version)
  2. 2026Mind the Hook: Source-Level Auditing of Privacy Defenses in Retrieval-Augmented Generation
  3. 2024Noisy Neighbors: Efficient membership inference attacks against LLMs
  4. 2026Detectability in Diversity: Improved Canary Crafting for Privacy Auditing in One Run
  5. 2026Auditing Fairness-Privacy Trade-offs: Subpopulation-Level Effects of Fairness-Enhancing Algorithms
  6. 2026Subgroup Membership Inference Audits of Differentially Private Synthetic Text
  7. 2025AlignDP: Hybrid Differential Privacy with Rarity-Aware Protection for LLMs
  8. 2025The DCR Delusion: Measuring the Privacy Risk of Synthetic Data