RAG Security: Complete Guide to Context Injection | Quiz

Why: Action filters inspect intended actions before execution – if a user asked to search but the model attempts to delete, the action filter blocks the mismatched operation. Context: This is part of output validation (Control 5) which assumes attacks may have succeeded and implements output-side defenses. Remember: Action filters catch intent mismatch – user said search but model tried delete.

Why: This is retrieval poisoning through user-submitted content – the attacker exploited the fact that support tickets are indexed to inject content designed to be retrieved for policy queries. Context: Many knowledge bases include user-generated content like tickets and forum posts which creates an attack surface for content injection. Remember: User submissions get indexed – attackers can submit content crafted to be retrieved.

Why: The article states that average enterprise RAG indexes contain 250,000 or more chunks from sources like Confluence, SharePoint, Google Drive, and email. Context: This massive scale makes finding one poisoned document like finding a needle in a haystack – emphasizing the need for automated detection. Remember: 250,000 plus chunks – manual review is impossible at enterprise scale.

Why: Obedience detection scans responses for phrases suggesting the model followed instructions from retrieved content such as ‘as instructed in the document’ or ‘per the retrieved policy’. Context: These phrases indicate the model may have executed hidden instructions embedded in poisoned documents rather than just citing information. Remember: Obedience detection catches the model confessing it followed document instructions.

Why: SEO for RAG refers to attackers studying retrieval algorithms and crafting documents optimized to rank highly for target queries – essentially search engine optimization against internal retrieval systems. Context: This sophisticated attack ensures malicious documents are retrieved for specific queries the attacker wants to influence. Remember: SEO for RAG – attackers optimize poisoned content to win retrieval ranking.

Why: Standard input validation focuses on user prompts but the LLM in a RAG system receives what appears to be authoritative internal documentation – not malicious user input. Context: Context injection bypasses prompt-level defenses entirely because the attack vector is retrieved content not user queries. Remember: Input validation watches the front door – context injection comes through the library.

Why: Hidden text techniques such as white text on white backgrounds, zero-width characters, or CSS-hidden content are invisible to human reviewers but visible to the retrieval system. Context: These techniques allow attackers to embed malicious instructions that pass human review while still being indexed and retrieved. Remember: Hidden text – invisible to humans but visible to retrieval systems.

Why: The article states that the full six-layer defense stack achieves under 1% attack success rate – down from 97% with no protections. Context: This dramatic reduction proves that layered defenses work but requires all six controls working together. Remember: Under 1% with full stack – from 97% to under 1% through defense-in-depth.