AI threat catalogueApplication and Integration SecurityProduction
RAG-Specific Attacks (Document Poisoning)
Attackers plant prepared documents in the knowledge base an AI system draws on via RAG (retrieval-augmented generation, looking up internal documents before answering). When retrieved, the system adopts the false content or hidden commands.
Description
Many corporate AI assistants ground their answers in an internal knowledge base built from wikis, drives, emails or tickets. Attackers use any path by which content enters this knowledge base: a public channel, an incoming email, a shared document, a file upload. There they place content designed to surface for specific queries, containing false facts or hidden instructions (indirect prompt injection). The model treats retrieved text as trustworthy, produces the intended false answer or follows the instruction. Attackers need no access to the model or its training for this.
Possible impact
False answers appear with the credibility of internal sources and feed into decisions. Hidden instructions can leak confidential data or trigger actions. The poisoning persists in the knowledge base and affects every future query until it is found and removed; business decisions, data protection and compliance are all at stake.
Example
An attacker sends an inconspicuous email with hidden instructions to the accounting team. The AI assistant ingests it into its knowledge base; when an employee later asks for a supplier's bank details, the assistant returns the attacker's account.
Recommended mitigations (7)
Every mitigation states its control type, effect, implementation level and the reason for the classification.
Document source validationTechnical
- Effect
- Preventive
- Implementation level
- Data
- Reason for the classification
- “Document source validation” is primarily technical: System-enforced inspection, transformation, or blocking rules stop or neutralize disallowed content before further processing.
Content integrity monitoring in knowledge baseTechnical
- Effect
- Detective
- Implementation level
- Data, Use & operations
- Complementary control type
- Organizational & process-based
- Reason for the classification
- “Content integrity monitoring in knowledge base” is primarily technical: Software or analytical tools systematically produce and evaluate measurements, deviations, or attack indicators; complemented by binding workflows.
Access controls on RAG document ingestionTechnical
- Effect
- Preventive
- Implementation level
- Data, Application, API & agents
- Complementary control type
- Organizational & process-based
- Reason for the classification
- “Access controls on RAG document ingestion” is primarily technical: Machine-enforced identity, permission, or scope rules constrain unauthorized access and actions; complemented by binding workflows.
Retrieval confidence thresholdsTechnical
- Effect
- Preventive, Detective
- Implementation level
- Data, Application, API & agents
- Reason for the classification
- “Retrieval confidence thresholds” is primarily technical: System-enforced inspection, transformation, or blocking rules stop or neutralize disallowed content before further processing.
Multi-source corroborationTechnical
- Effect
- Preventive, Detective
- Implementation level
- Data
- Reason for the classification
- “Multi-source corroboration” is primarily technical: Software or analytical tools systematically produce and evaluate measurements, deviations, or attack indicators.
Regular knowledge base auditsOrganizational & process-based
- Effect
- Detective
- Implementation level
- Data, Use & operations
- Complementary control type
- Governance & compliance
- Reason for the classification
- “Regular knowledge base audits” is primarily organizational and process-based: A planned, repeatable assessment with ownership and documented follow-up creates the protective effect; complemented by rules and oversight.
Anomaly detection on retrieved contentTechnical
- Effect
- Detective
- Implementation level
- Data, Application, API & agents
- Reason for the classification
- “Anomaly detection on retrieved content” is primarily technical: Software or analytical tools systematically produce and evaluate measurements, deviations, or attack indicators.
Framework mappings
Verified locations in OWASP, NIST AI RMF, MITRE ATLAS, the EU AI Act and further frameworks. The mappings are taxonomic, not evidence of compliance.
Verified references (11)
Every reference states the framework, the exact location and the publishing organisation.
- OWASP LLM Top 10 ASI06:2026 Memory & Context PoisoningASI06 Memory & Context Poisoning, pp. 24–26 of the official PDF OWASP FoundationOriginal
- OWASP LLM Top 10 LLM01:2025 Prompt InjectionLLM01:2025 Prompt Injection, official category page OWASP FoundationOriginal
- OWASP LLM Top 10 LLM04:2025 Data and Model PoisoningLLM04:2025 Data and Model Poisoning, official category page OWASP FoundationOriginal
- OWASP LLM Top 10 LLM08:2025 Vector and Embedding WeaknessesLLM08:2025 Vector and Embedding Weaknesses, official category page OWASP FoundationOriginal
- NIST AI RMF NISTAML.015 Indirect Prompt InjectionTaxonomy Index, pp. x–xi; Section 3.4, pp. 50–53; Glossary, p. 110 National Institute of Standards and Technology (NIST)Original
- NIST AI RMF NISTAML.027 Misaligned OutputsTaxonomy Index, p. xi; Section 3.4.2, pp. 51–52 National Institute of Standards and Technology (NIST)Original
- MITRE ATLAS AML.T0051 LLM Prompt InjectionATLAS.yaml technique object with id AML.T0051 (pinned release v5.6.0) MITREOriginal
- EU AI Act Article 25(4) Responsibilities along the AI value chainArticle 25(4) European Union (EUR-Lex)Original
- EU AI Act Article 9(1), 9(2)(a), 9(2)(d) Risk management systemArticle 9(1), 9(2)(a), 9(2)(d), read with Article 9(3) European Union (EUR-Lex)Original
- BSI R18 Vergiftung von hinterlegten Wissensdaten (Knowledge Poisoning) (Text, Bild, Video)Kap. 4, R18, p. 26 Bundesamt für Sicherheit in der Informationstechnik (BSI)Original
- BIML BIML-LLM raw:10 Query DataPDF p. 15, [raw:10:query data] Berryville Institute of Machine Learning (BIML)Original
Terms on this page
Glossary terms that occur in this entry. Every link leads to the full explanation.
- Prompt Injection Manipulated input or planted content redirects a language model.
- RAG (retrieval augmented generation) The model pulls matching documents from your own knowledge base before answering.
Related threats
More entries from the topic group Application and Integration Security.
Assess this threat in your own system
The live demo contains all 52 threats of this catalogue, including the EU AI Act and GDPR assessment. The free single modules cover AI risk, the EU AI Act and GDPR. No sign-up; the assessment runs locally in your browser.
Cite this entry
For reports, policies or internal documents; the link leads directly to this entry.
“RAG-Specific Attacks (Document Poisoning)”. Versatile AI Risk Assessment, AI threat catalogue, as of July 2026. https://www.versatile-ai-risk-assessment.com/en/wissensbasis/threats/rag-document-poisoning/