Retrieval Poisoning

The attacker directly uploads or inserts a malicious document into the target knowledge base. This is the most straightforward vector, often exploiting weak access controls on document ingestion pipelines.

• Mechanism: The document contains hidden text in white font, zero-width characters, or text encoded in a way that is invisible to human reviewers but parsed by the chunking algorithm.
• Payload: The hidden text contains a prompt injection like "Ignore previous instructions and...".
• Example: Uploading a seemingly benign PDF resume to a company's internal HR knowledge base that contains invisible text instructing the agent to expose salary data.

This attack targets the text-splitting logic of the RAG ingestion pipeline. The adversary crafts a document designed to fragment in a way that creates a malicious standalone chunk.

• Mechanism: The attacker places a malicious instruction between two specific delimiters or at a precise character count boundary, knowing the chunker splits on those markers.
• Result: A chunk is created that consists solely of the adversarial instruction, divorced from its benign surrounding context.
• Key Insight: The attacker must understand or guess the target's chunk size and overlap parameters to execute this precisely.

An indirect attack where the adversary publishes malicious content on the public web, anticipating that the target's RAG system will crawl and index it as an authoritative source.

• Mechanism: The attacker uses search engine optimization (SEO) techniques to rank a poisoned page highly for specific technical queries the target agent is known to research.
• Scale: This is a broadcast attack—a single poisoned page can compromise multiple independent RAG systems that crawl the same web domain.
• Example: Creating a fake documentation page for a popular Python library that includes hidden instructions to exfiltrate API keys.

A sophisticated attack that crafts text to manipulate the vector representation itself, causing malicious content to be retrieved for a wide range of benign, high-probability queries.

• Mechanism: The attacker uses adversarial examples—text perturbed with specific token sequences—to position the malicious document's embedding vector close to clusters of legitimate queries in the vector space.
• Effect: The poisoned document becomes a nearest neighbor for many unrelated user questions, dramatically increasing its retrieval frequency.
• Challenge: This requires white-box or gray-box access to the embedding model to compute effective perturbations.

The attacker plants a logic bomb in the knowledge base that remains dormant until a specific temporal condition is met, evading immediate detection during ingestion.

• Mechanism: The malicious instruction is prefaced with a condition like "If the current date is after 2025-06-01, then...". The model ignores it during testing but executes it later.
• Purpose: To bypass time-bound security audits and human review processes that occur immediately after document upload.
• Variation: Triggers can also be based on user identity, query keywords, or the presence of other retrieved documents.

A kill chain where a primary poisoned document retrieves a secondary, seemingly benign document that contains the final payload, defeating single-document inspection.

• Step 1: Document A is retrieved. It contains no direct malicious instruction, only a command to "search for policy update X."
• Step 2: The agent's own tool-calling ability retrieves Document B, which contains the actual adversarial payload.
• Defense Evasion: Neither document is malicious in isolation; the attack only manifests through the agent's autonomous chaining behavior.