RAG Pipelines

Retrieval-Augmented Generation (RAG) is an architecture that connects a language model to an external knowledge base. Instead of relying solely on training data, the model retrieves relevant document chunks at query time and injects them into its context before generating a response. Most enterprise AI assistants, internal chatbots, and document Q&A systems are RAG-based.

From an offensive perspective, RAG introduces a distinct attack surface that sits outside the model itself. The knowledge base, the retrieval layer, and the vector database each present exploitation paths that are independent of the model's safety filters and prompt handling. Content injected through the retrieval path arrives in the model's context as trusted data rather than user input, which means it bypasses input-level mitigations entirely.

Pages in This Section

Knowledge Base Poisoning via Document Injection covers injecting malicious documents into the knowledge base through upload endpoints or shared storage, crafting content that gets retrieved and executed as context instructions when users query relevant topics.

Retrieval Layer Manipulation covers abusing retrieval parameters such as top_k, score_threshold, namespace, and metadata filters to surface restricted chunks, access cross-tenant content, and bypass access controls enforced at the application layer.

Vector Database Query Manipulation covers directly querying exposed vector database APIs — Qdrant, Weaviate, Chroma, Milvus — to enumerate collections, dump stored chunks via the scroll API, and extract knowledge base content without going through the chat interface.

Exploiting Chunking and Embedding Behaviour covers fingerprinting the pipeline's chunking strategy, crafting documents where poisoned payloads land in isolated chunks with high retrieval scores, and abusing overlap windows and semantic boundaries to maximize injection effectiveness.

Persistent RAG Poisoning covers writing durable entries directly to the vector store that survive re-ingestion cycles, affect all users querying related topics, and persist until an administrator manually audits individual vector store points.