Threat dossier · P2

RAG and knowledge-base poisoning

Agents treat retrieved documents as trusted knowledge; poisoning moves the attack from the prompt into the corpus, where it persists and affects every future query that retrieves it.

Direct answer

What is rag and knowledge-base poisoning?

RAG poisoning corrupts the documents an agent retrieves, so a small number of injected texts reliably steer answers and downstream actions long after the attacker’s original interaction ended.

Coverage statements below are limited to the current HOL Guard support contract and do not imply universal model or harness protection.

Copied text includes the canonical source and review date.
Reviewed Reviewer: HOL Guard EngineeringReview cadence: 30 days

Representative attack path

Defensive model only. This sequence omits weaponized payloads and is not attributed to a specific incident unless a source explicitly says so.

  1. Step 1

    An attacker contributes or corrupts documents reachable by the retrieval index.

  2. Step 2

    Poisoned texts are optimized to rank for target queries.

  3. Step 3

    A later task retrieves the poisoned document as knowledge.

  4. Step 4

    The agent’s answer or plan follows the injected content.

Coverage boundary

What this control can cover

  • Consequential actions influenced by retrieved content are still policy-evaluated at action boundaries on supported surfaces.

What it does not prove or prevent

  • Corpus or index sanitization and retrieval-time filtering.
  • Verification that retrieved natural-language knowledge is true.

Policy pattern

Policy pattern for rag and knowledge-base poisoning

Keep untrusted context or overbroad autonomy from becoming unconditional execution authority on supported action surfaces.

Use when: Agents treat retrieved documents as trusted knowledge; poisoning moves the attack from the prompt into the corpus, where it persists and affects every future query that retrieves it.

Decision pattern

  1. Identify the trust boundary and consequential action class.
  2. Apply least privilege and the narrowest supported policy.
  3. Require review for sensitive or ambiguous actions.
  4. Preserve only redacted, versioned evidence needed to reproduce the decision.

Limitations

  • Corpus or index sanitization and retrieval-time filtering.
  • Verification that retrieved natural-language knowledge is true.

If you suspect prompt injection

  1. Step 1

    Response 1

    Quarantine the poisoned documents and trace their origin.

  2. Step 2

    Response 2

    Audit retrieval logs for other affected queries.

  3. Step 3

    Response 3

    Rebuild the index from verified sources.

  4. Step 4

    Response 4

    Retest downstream actions after cleanup.

Sources and mappings

Related dossiers

Neighboring threat classes that share attack paths or trust boundaries with this dossier.