RAG Security: When the Knowledge Base Becomes an Attack Vector

An attacker doesn't need to compromise your model to manipulate your RAG system's answers — it's enough to get five malicious documents into your knowledge base among millions of legitimate ones.

Indirect prompt injection via retrieved documents

Indirect prompt injection in RAG happens when adversarial instructions hidden inside a retrieved document reach the model's context window and get executed as legitimate commands, with no malicious content ever appearing in the user's original query. Researchers documented indirect injection via customer-facing inputs: an attacker sends carefully crafted inputs through support tickets, feedback forms, or user-generated content that feeds the RAG corpus — and when another user's query triggers retrieval of that poisoned document, the injected instructions execute in the model's context.

Knowledge base poisoning: the threat specific to RAG

Knowledge base poisoning is the main threat unique to RAG: an attacker who can insert or modify documents in the knowledge base can embed malicious instructions the LLM will follow once those documents get retrieved. Adversaries inject documents designed to be simultaneously relevant to specific queries (so they get retrieved with high probability) and to contain embedded instructions designed to override the LLM's behavior once included in context.

Surprising effectiveness with very little effort

A USENIX Security 2025 study showed that injecting just five poisoned texts per target question into a knowledge base with millions of documents can achieve attack success rates of 90% across multiple benchmark datasets and different LLMs — an effort-to-impact ratio that makes this one of the most efficient attack vectors against AI systems known so far.

The supply chain vector nobody expects

If an attacker compromises a vendor's documentation, or can inject content into publicly accessible documentation that ends up indexed, they gain indirect access to the target's RAG corpus through a supply chain vector that requires no direct access to the target organization at all — attacking a third party whose content your RAG system indexes is, in practice, attacking you without touching your infrastructure.

Document-level access controls as the core defense

The most effective mitigation isn't trying to perfectly detect malicious content — it's limiting which sources can contribute content to the knowledge base without review, applying granular access controls at the document level (not just the whole-index level), and treating any user-generated or third-party content source feeding a RAG system as an active attack surface, with the same rigor you'd apply to unaudited third-party code.