Retrieval-Augmented Generation Poisoning

A large-scale attack where an adversary seeds the public web with malicious documents, knowing they will be crawled, indexed, and retrieved by agents for RAG grounding. This is a proactive, indirect attack that targets the retrieval corpus rather than the agent itself. The attacker anticipates the agent's crawling schedule and search queries, planting content optimized for semantic similarity to legitimate topics. When the agent retrieves this content, it grounds its responses in attacker-controlled narratives, leading to misinformation, brand damage, or downstream exploitation.

The insertion of malicious vector embeddings directly into a vector database to manipulate semantic search results. Unlike corpus poisoning, this targets the post-ingestion index. An attacker with write access injects embeddings that are mathematically close to legitimate query vectors, causing nearest neighbor queries to return adversarial documents. This bypasses source-level filtering because the malicious content resides inside the trusted vector store. Detection requires embedding drift monitoring and provenance verification.

An attack where malicious instructions are hidden within external data sources that an agent retrieves, causing the agent to execute those instructions as if they were part of its system prompt. Common vectors include:

• Hidden text in web pages (white-on-white font, zero-width characters)
• Comments in code retrieved from repositories
• PDF metadata fields containing override commands
• Markdown links with prompt injection payloads in the URL The agent treats retrieved content as authoritative context, making this attack particularly dangerous for tool-calling agents.

An attack that exploits a cross-encoder or re-ranking model to artificially boost the relevance score of a malicious document, ensuring it is surfaced to the agent over legitimate sources. The attacker crafts content that exploits known scoring biases in re-ranking models, such as:

• Over-optimizing for lexical overlap with the query
• Exploiting position bias in listwise ranking
• Injecting authority signals (fake citations, domain spoofing) This attack is subtle because the malicious document appears to be the most relevant result according to the system's own scoring mechanism.

The falsification of document metadata—source, date, authority signals—to deceive an agent into trusting and prioritizing attacker-controlled information. Agents often use metadata as a trust heuristic, giving higher weight to documents from authoritative domains, recent publication dates, or verified authors. An attacker who spoofs these signals can make malicious content appear as a definitive, high-confidence source. This is particularly effective against agents that display citations to end-users, lending false credibility to fabricated information.

A technique that exploits document segmentation by placing malicious content precisely at chunk boundaries. When a document is split into overlapping or fixed-size chunks for embedding, an attacker can craft content so that a malicious payload becomes a standalone, authoritative context fragment. Because chunking algorithms often break on paragraph or sentence boundaries, the attacker's payload is retrieved without the surrounding context that might reveal its adversarial nature. The agent then treats this isolated fragment as a complete, trustworthy fact.