Our solution was to

1) persist the parameters in the database

2) pass in reference GUID as a parameter to the report

3) stored procedure is called with said GUID

4) stored procedure pulls parameters using GUID

So, the multivalue params are already in a table, so no need to do any nasty splitting of strings.