RAG Poisoning
Description
Adversaries may inject malicious content into data indexed by a retrieval augmented generation (RAG) system to contaminate a future thread through RAG-based search results. This may be accomplished by placing manipulated documents in a location the RAG indexes (see Gather RAG-Indexed Targets).
The content may be targeted such that it would always surface as a search result for a specific user query. The adversary's content may include false or misleading information. It may also include prompt injections with malicious instructions, or false RAG entries.
- ATLAS ID
- AML.T0070
- Maturity
- DemonstratedShown to work in research or red-team exercises.
- Platforms
- Generative AIAgentic AI
Mitigations
- AML.M0020Generative AI Guardrails
Apply retrieval guardrails to reject untrusted, malicious, irrelevant, or unsupported RAG content.
- AML.M0035AI Red Team
Seed controlled malicious or misleading content into representative ingestion sources. Improve source authorization, provenance, content validation, indexing controls, and retrieval-time filtering.