Multi-tenant RAG services often treat the account as the privacy boundary: each account receives an $(\varepsilon_{\text{acc}},δ_{\text{acc}})$-DP retrieval guarantee against the tenant index. We show that this framing understates leakage under same-index account collusion. For Gaussian noise-then-select retrieval, $k$ coordinated same-tenant accounts compose to joint leakage $Θ(\sqrt{k}\,\varepsilon_{\text{acc}})$, not $\varepsilon_{\text{acc}}$; we give a matching membership-inference attack and validate the predicted $\sqrt{k}$ AUC trend in scalar, top-$K$, trained-embedder, and production-scale HNSW settings. We then give a verifier-runnable audit protocol that attests noise-then-select retrieval and reports $(\textsf{PASS},\varepsilon_{\text{audit}})$ for coalitions up to a declared cap $k_{\max}$, without disclosing the index or changing the retrieval decision rule. The claim is retrieval-channel only: generation-channel leakage and adversarially robust coalition-size estimation are complementary audit predicates.

翻译：多租户RAG服务通常将账户视为隐私边界：每个账户针对租户索引获得$(\varepsilon_{\text{acc}},δ_{\text{acc}})$-差分隐私检索保证。但我们证明，这种表述低估了相同索引下账户串谋导致的泄露。对于高斯噪声后检索（Gaussian noise-then-select）机制，$k$个协调一致的相同租户账户会组合产生联合泄露$\Theta(\sqrt{k}\,\varepsilon_{\text{acc}})$，而非$\varepsilon_{\text{acc}}$；我们提出了匹配的成员推断攻击，并在标量、Top-$K$、训练嵌入器以及生产规模的HNSW设置中验证了所预测的$\sqrt{k}$ AUC趋势。随后我们设计了一个可验证者执行的审计协议，该协议可证明噪声后检索机制，并在声明上限$k_{\max}$内的联盟中报告$(\textsf{PASS},\varepsilon_{\text{audit}})$结果，同时无需泄露索引信息或修改检索决策规则。该声明仅针对检索通道：生成通道的泄露以及对抗性鲁棒的联盟规模估计属于互补的审计谓词范畴。