RAG systems introduce security threats that traditional applications do not face. A traditional application can leak data through a SQL injection or an access control bypass. A RAG system can leak data through a crafted query that retrieves documents the user should not see, a prompt injection that causes the LLM to reveal system instructions, or a poisoned document that manipulates the model's behaviour. Here is the complete RAG security framework.
Retrieval Manipulation
An attacker crafts a query designed to retrieve documents outside their access level. Example: a query that exploits semantic search to match unrelated documents, or a query that bypasses metadata filters. Defence: strict access-controlled retrieval (tag every document chunk with permissions, check at query time), query validation (reject queries that appear designed to probe the knowledge base), and result filtering (post-retrieval check that all results pass access control).
Document Poisoning
An attacker modifies or injects documents into the knowledge base that contain malicious instructions or misleading information. If a poisoned document is retrieved, the LLM may follow the injected instructions or generate incorrect responses. Defence: document source validation (only ingest from trusted sources), content scanning (detect and flag potentially malicious content), version control (track document changes and alert on suspicious modifications), and retrieval diversity (do not rely on a single document for any response).
Warning
Document poisoning is an underappreciated risk. If your RAG system ingests from user-editable sources (wikis, shared drives), implement content validation before indexing.
Context Window Manipulation
An attacker crafts a query that causes the retrieval system to fill the LLM's context window with irrelevant documents, pushing the system prompt and relevant context out of the window. This can cause the LLM to ignore safety instructions. Defence: context window monitoring (track how much of the context window is consumed by retrieved documents), priority ordering (system prompt and relevant context always come first), and context size limits (cap the number of retrieved documents per query).
Conclusion
RAG security requires defending against threats at three layers: retrieval manipulation, document poisoning, and context window manipulation. The defence is consistent with traditional security principles: validate inputs, control access, scan for anomalies, and maintain audit trails.
Key Takeaways
- Three RAG-specific threats: retrieval manipulation, document poisoning, context window manipulation
- Access-controlled retrieval: tag every document chunk, check permissions at query time
- Document poisoning: validate sources, scan content, track versions, diversify retrieval
- Context window monitoring: ensure system prompt always has priority in the context window
- RAG security is an extension of traditional security — same principles, different attack surface