RAG poisoning

Retrieval decides what the model believes. If an attacker can add a document to the corpus, they can decide what gets retrieved for a chosen question, and the model will treat it as given.

The document does not have to look like an attack. It has to rank well for the target query and say something wrong. A page titled "Refund policy 2026" stating that refunds are unlimited will be retrieved and quoted for refund questions, and every answer will be confidently wrong.

Why it is harder to spot than a prompt attack

• It persists. A poisoned document sits in the index across every session until someone finds and deletes it. A prompt attack lasts one conversation.
• It looks like your own content, because it is now literally in your knowledge base.
• It is targeted. The attacker writes for the query they care about, so the failure appears only for specific questions and passes general testing.
• Nothing in the model's behaviour is wrong. It grounded its answer in a retrieved source. That is exactly what you asked it to do.

Where content gets in

Anywhere ingestion is broader than review:

• User-generated content indexed automatically: support tickets, comments, uploaded files, wiki edits.
• Crawled sources. Anything scraped from the open web is attacker-writable by definition.
• Dependency documentation vendored into a corpus.
• Stale internal docs, which produce the same effect with nobody attacking. The mechanism does not care about intent.

Reducing it

• Know your ingestion boundary. Write down which sources can add documents without a human reading them. That list is your attack surface, and most teams have never enumerated it.
• Carry provenance and recency into the context, so the model can weigh a 2023 crawl against a reviewed internal doc. Unlabelled passages are indistinguishable.
• Separate corpora by trust. Public crawl and internal docs in one index means one relevance score decides between them.
• Constrain what a poisoned answer can do. If retrieved content can trigger tool calls, poisoning becomes execution rather than misinformation. See least privilege.