RAG Poisoning
RAG poisoning is an attack that inserts manipulated content into the knowledge source a retrieval-augmented generation system draws from, so the model treats the planted material as authoritative context.
The Attack Targets the Corpus, Never the Model
Retrieval-augmented generation grounds a model's answers in documents fetched at query time. Poisoning the corpus therefore changes the answers without touching weights or prompts. Model-level defenses have nothing to inspect, since the model is reasoning faithfully over the material it was handed. The material is the problem.
Enterprise Corpora Have Many Authors
A retrieval index typically spans a wiki, a ticketing system, a shared drive and a support inbox. Write access to any of those is write access to the model's context. A vendor who files a support ticket, a contractor with wiki rights and an attacker who compromised one account all gain the same reach, and no review step sits between a document being written and a document being retrieved.
Two Outcomes Follow From One Technique
The first is misinformation at scale, where a planted document causes the system to state something false with the confidence that retrieval grounding gives it. The second is instruction delivery, since content entering the context window can carry indirect prompt injection aimed at any agent reading the output. Poisoning that reaches an agentic pipeline converts a false answer into a false action.
Provenance Is the Control That Holds
Treating retrieved content as untrusted input, recording which source each retrieved chunk came from, and restricting the corpus to material from reviewed origins address the problem where it lives. Data poisoning covers the training-time equivalent, with one difference that matters operationally. Training-time poisoning requires a retrain to introduce and a retrain to remove, while a poisoned retrieval index changes behavior the moment a document lands and recovers the moment it is deleted.
Related Terms
Full AI Visibility. Full Control. One Connected Platform.
Enterprise AI is expanding faster than most governance programs can track. Kovrr connects every AI signal across browser, endpoint, network, identity, and vendor systems into a single platform so security, governance, and risk teams work from the same evidence.
