Chunk Boundary Attack

The attack leverages the deterministic nature of document chunking algorithms. By placing a malicious payload precisely at the boundary where a text splitter divides content, the attacker ensures the payload becomes a standalone, self-contained chunk. This isolated chunk lacks the surrounding context that would normally dilute or contradict its authority, causing the retrieval system to treat it as a coherent, high-relevance document. Common targets include fixed-size character splitters with overlap, recursive character text splitters, and semantic splitters that rely on embedding similarity thresholds.

Once segmented, the malicious chunk enters the vector database as an independent embedding. During semantic search, the attacker's payload is retrieved in isolation, divorced from the legitimate document it was injected into. This is the core mechanism of harm: the agent receives a fragment that appears to be a complete, authoritative statement. Key consequences include:

• Authority hijacking: The chunk presents itself as a standalone policy or fact.
• Context stripping: Safety disclaimers or contradictory information in adjacent chunks are excluded.
• High relevance scoring: The attacker can optimize the payload's text to match anticipated user queries, ensuring top-k retrieval.

Unlike prompt injection, which targets a single interaction, a chunk boundary attack is persistent and passive. The poisoned content resides in the knowledge base indefinitely, affecting every future query that triggers its retrieval. Detection is difficult because:

• The injected text can be grammatically and semantically coherent with the source document.
• The attack leaves no trace in application logs until the malicious chunk is retrieved and acted upon.
• Traditional content filters scanning the full document may not flag a fragment that only becomes dangerous when isolated at a boundary.

The attack's success is directly tied to the predictability of the chunking strategy. Attackers can reverse-engineer or infer the chunking method through probing:

• Fixed-size chunking (e.g., 512 tokens with 10% overlap) provides a precise insertion target.
• Recursive splitting on characters like \n\n, ., or ? allows boundary prediction based on punctuation placement.
• Semantic chunking based on embedding distance can be gamed by inserting text that creates a sharp semantic discontinuity, forcing a split at the attacker's chosen point. Understanding the target's chunking configuration is the primary reconnaissance step for this attack.

Effective boundary attack payloads are crafted with specific linguistic properties:

• Self-contained authority: The text reads as a complete directive or fact, often using imperative mood or declarative statements.
• Query alignment: The payload is optimized to match the embedding of anticipated user questions, increasing retrieval probability.
• Boundary padding: Filler text or whitespace is used to push the payload to the exact split point.
• Contextual camouflage: The payload mimics the tone, terminology, and formatting of legitimate documents in the target corpus.
• Token efficiency: Payloads are designed to fit within a single chunk's token limit to avoid fragmentation.

While related to corpus poisoning, a chunk boundary attack is a more surgical technique. Corpus poisoning broadly seeds malicious documents across the web, hoping they are crawled and indexed. A chunk boundary attack targets a specific, already-trusted document and exploits its internal segmentation. The attacker does not need to establish a new document's authority; they parasitize the existing trust and relevance score of the host document. This makes the attack more precise and harder to attribute than large-scale poisoning campaigns.

The foundational technique of inserting malicious content into an agent's context window to manipulate its reasoning. Unlike chunk boundary attacks, which exploit segmentation, injection targets the assembled prompt itself.

• Mechanism: Overrides system instructions or triggers unintended tool use
• Vector: Can occur via user input, retrieved documents, or tool outputs
• Relationship: Chunk boundary attacks are a specialized delivery mechanism for injection payloads

Exploits the well-documented positional attention bias of LLMs where content in the middle of long contexts receives less scrutiny. Attackers place malicious instructions in this 'attention trough'.

• Mechanism: Leverages recency and primacy bias in transformer attention
• Synergy: Combined with chunk boundary attacks to position payloads at specific positional offsets
• Defense: Requires position-invariant attention mechanisms or sliding window re-evaluation

The insertion of malicious vector embeddings into a vector database to manipulate semantic search results. Nearest neighbor queries return adversarial documents instead of legitimate ones.

• Attack Surface: FAISS, Pinecone, Weaviate, and other ANN indexes
• Method: Crafting embeddings that are semantically close to common query vectors
• Chunk Boundary Nexus: Contaminated chunks placed at segmentation boundaries achieve higher retrieval scores due to their isolated, self-contained nature

An attack that exploits the cross-encoder or re-ranking model to artificially boost the relevance score of a malicious document, ensuring it surfaces to the agent over legitimate sources.

• Target: The second-stage retrieval pipeline after initial ANN search
• Technique: Crafting documents with features that trigger high scores in the re-ranker
• Amplification: Boundary-positioned chunks often appear as highly relevant, self-contained answers, making them prime candidates for re-ranking elevation

The falsification of document metadata—source, date, authority signals—to deceive an agent into trusting and prioritizing attacker-controlled information.

• Fields Targeted: source, timestamp, author, confidence_score
• Impact: Overrides agent heuristics that weight documents by recency or authority
• Chunk Boundary Context: Spoofed metadata on boundary-positioned chunks creates the illusion of a complete, authoritative source document

The manipulation of an agent's recursive summarization process, causing critical safety instructions to be dropped or distorted as the context is compressed over time.

• Mechanism: Injects content designed to survive or corrupt summarization passes
• Long-Term Effect: Safety guardrails degrade across extended multi-turn interactions
• Boundary Attack Synergy: Chunks engineered for boundary placement resist summarization because they are retrieved as discrete, high-signal units that summarizers treat as essential facts