Cybersecurity glossary
What is Retrieval-Augmented Generation (RAG)?
Learn what retrieval-augmented generation (RAG) is, how LLMs fetch documents before answering, why poisoned or over-privileged retrieval is a security issue, and how to design safer RAG pipelines.
Definition
Retrieval-Augmented Generation (RAG) is an architecture that looks up documents or records at query time, inserts the retrieved text into an LLM prompt, and asks the model to answer using that context rather than relying only on training weights.
Why retrieval-augmented generation matters
A model’s weights go stale the day training ends. Retrieval-Augmented Generation (RAG) solves that by fetching current tickets, wikis, contracts, or product docs at question time and stuffing them into the prompt. That is how internal assistants “know” last week’s incident without a new training run.
The security implication is immediate: whatever you retrieve becomes model-visible context. A poisoned PDF, a ticket the user cannot open in the UI, or a web page with hidden instructions is no longer sitting quietly in storage. It is in the same window as the system prompt.
How a typical RAG request flows
Ingest documents
Files are chunked, embedded, and indexed with metadata such as tenant, owner, and classification.
Embed the question
The user query is turned into a vector or keyword query against the index or source system.
Retrieve candidates
Top chunks, rows, or API results are selected—ideally after ACL filters, not before.
Build the prompt
Retrieved text is concatenated with the system prompt and user question inside the context window.
Generate an answer
The LLM produces a reply that may quote, summarize, or silently follow instructions in those chunks.
Cite or act
The app may show sources, store the exchange, or trigger tools based on the grounded answer.
Where RAG helps and where it fails
Fresh internal knowledge
Answers can reflect current runbooks and policies without retraining the base model.
Over-sharing by retrieval
If ACLs are applied in the UI but not in the indexer, the model can quote documents the user cannot open.
Hostile documents
A wiki page or email can contain instructions that override the system prompt once retrieved.
Stale or wrong neighbors
Semantic search can return similar-looking but unauthorized or outdated chunks, and the model will still sound confident.
RAG design choices that change risk
| Design choice | Safer pattern | Weaker pattern |
|---|---|---|
| Access control | Filter by identity and classification before prompt assembly | Retrieve first, ask the model not to reveal secrets |
| Chunking | Preserve headings, owners, and sensitivity labels on every chunk | Strip metadata so the model cannot tell source or audience |
| Query rewriting | Bound expansion; do not silently search other tenants or private spaces | Let the model rewrite queries into unrestricted index scans |
| Citations | Show source IDs the user can open; drop answers with no permitted source | Free-form answers with no way to audit which chunk was used |
| Untrusted web RAG | Sandbox fetched pages; treat HTML as hostile; disable tools on those turns | Fetch arbitrary URLs and paste full page text into the prompt |
- Apply the same document ACLs in retrieval that you apply in the product UI.
- Isolate tenant indexes or enforce mandatory tenant metadata filters on every query.
- Treat retrieved text as untrusted: it can carry indirect prompt injection.
- Store classification and owner on chunks; never drop labels during embedding.
- Limit top-k and max retrieved tokens so hostile text cannot drown the system prompt.
- Prefer citation-required answers for internal knowledge assistants.
- Review ingest paths (uploads, sync jobs, crawlers) as you would a public comment field.
- Log which document IDs were retrieved, not only the final completion.
The practical takeaway
Retrieval-Augmented Generation (RAG) grounds an LLM in documents fetched at query time. That improves freshness and auditability when retrieval is authorized and citations are real.
It also moves your knowledge base into the prompt. If a chunk can be retrieved, it can be quoted, followed as an instruction, or leaked. Secure RAG is access-controlled retrieval plus untrusted-context handling—not a smarter model.
Related security terms
Large Language Model (LLM)
The generator that consumes retrieved context and produces the answer.
Vector Database
Where many RAG systems store and search embeddings of documents.
Embedding
Numeric representations used to match queries to documents.
Retrieval Poisoning
Attacks that plant or promote malicious content into the retrieved set.
Indirect Prompt Injection
Hidden instructions that ride into the prompt via retrieved files or pages.
Frequently asked questions
What is RAG in simple terms?
Instead of asking the model to remember everything, the app searches a knowledge base, pastes the best snippets into the prompt, and then asks the model to answer from those snippets.
Why do teams use RAG instead of fine-tuning?
RAG can cite fresher internal documents without retraining. Fine-tuning still has a role for style or specialized skills, but it is slower and does not replace access control on live data.
Does RAG make hallucinations impossible?
No. The model can still ignore, mix, or invent details. RAG reduces some fabrication when retrieval is relevant and the prompt requires citations, but it is not a truth guarantee.
What is the main security risk in RAG?
Untrusted or over-privileged retrieved text becomes part of the model’s instructions. That enables retrieval poisoning, indirect prompt injection, and leakage of documents the user should not see.
Is vector search required for RAG?
No. RAG can use keyword search, SQL, APIs, or hybrid retrieval. Vector databases are common because they match meaning, not only exact words.
How should authorization work in RAG?
Filter candidates before they enter the prompt, using the user’s identity and document ACLs. Do not retrieve a document and hope the model will refuse to quote it.
Can RAG leak data across tenants?
Yes, if indexes are shared without tenant isolation, if metadata filters are missing, or if logs store retrieved chunks alongside prompts.
References
Explore authoritative guidance and frameworks related to retrieval-augmented generation (rag).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.