AsrielNetworksRAG poisoning
Contaminating a retrieval corpus or vector index so that retrieved passages steer the model toward an attacker's outcome.
Definition
Retrieval-augmented generation grounds a model's answer in passages fetched from a corpus at query time. RAG poisoning contaminates that corpus, or the index over it, so that the passages the retriever returns carry the attacker's content: a false fact, an instruction, a link, a bias. The model then repeats or obeys it with the authority of “your own documents”.
The corpus is often the weakest boundary in the system. It is fed by crawlers, uploads, shared drives, ticket systems and wikis that many people can write to, and a single well-placed chunk can be retrieved for thousands of queries because embeddings reward topical similarity, not provenance.
How it manifests
- A retrieved chunk carrying instructions or a trust level below the rest of the corpus (
document.retrievedwithsuspicious_instructions). - Answers that cite a document nobody recognises, or that changed after an ingestion job.
- Retrieval hot spots: one document returned for an unusually broad set of queries.
- Confirmed effect: after consuming the chunk, the agent proposes or executes a risky tool call the chunk pointed at.
How AsrielNetworks detects it
The RAG rule watches retrieval and consumption events and separates two levels: a suspicious retrieved document (a warning), and confirmed influence, where the trace shows the retrieval followed by a risky action. The second is what raises severity. When the chunk also carries instructions, the indirect prompt injection rule fires with it, so the finding names both the carrier and the effect.
- RAG poisoning or contamination
ai.rag.poisoning· medium
A suspicious retrieved document, distinguished from confirmed influence over a risky action. - Indirect prompt injection
ai.prompt_injection.indirect· high
Untrusted retrieved instructions correlated with a later sensitive tool proposal in the same trace.
References
- Zou et al., PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models (2024).
- OWASP GenAI Security Project, LLM08:2025 Vector and Embedding Weaknesses.
- Carlini et al., Poisoning Web-Scale Training Datasets is Practical (2023), on how cheaply public corpora are poisoned.
- MITRE ATLAS, AML.T0020 Poison Training Data.