The Removability Gap: An Empirical Evaluation of Taint-Closure Verification, Its Soundness Boundary, and Adversary-Resistant Fusion in Retrieval-Augmented Generation

A companion formalization paper named the Removability Gap — the structural distance between not using a deleted datum and not being influenced by it — and proposed taint-closure removability and adversary-resistant multi-source confidence to close and audit it. This paper reports the empirical validation, end-to-end, on retrieval-augmented generation over a frozen base model (Qwen3-8B and BGE-M3, exact-NN retrieval), with all artifacts sealed in a tamper-evident manifest chain. We report three results and their boundaries without smoothing. First, the gap is real but conditionally witnessed: an information-equivalent paraphrase evades a set-membership deletion check on 200/200 targets and, where it survives retrieval, recovers the deleted fact perfectly (effect size > 2); but the same low lexical overlap that defeats set-membership suppresses retrieval against surviving sibling facts, so population-level witnessing depends on store density (admissible attack rate 17% / 35% / 52.5% as siblings drop 7 / 3 / 1). Second, taint-closure closes the gap in the exact regime: on the same 200 paraphrases, set-membership detects 0, retrieval-dependent detection 34, and taint-closure 200, at zero false-positive rate, with a soundness theorem — while honestly missing an independently-authored equivalent it has no lineage edge to. Third, fusion covers both attack types (detection 1.0 each) — but at a cost the original gate battery did not measure: at the shipped operating point that coverage carries a ≈57% honest false-positive rate (0.569, 95% CI [0.516, 0.622] across seeds), because the honest and adversarial fused-score distributions overlap and the threshold that catches every attack also flags most legitimate deletions. Its worst-case robustness is likewise asymmetric and stated, not blanket: each attack type has exactly one critical channel, so the fused verifier has two disclosed single points of failure. The contribution is a characterized result: the gap exists and is closable by provenance where lineage is recorded, the realizability of the attack is bounded and quantified, and the limits of the defense are mapped rather than hidden.