Cybersecurity glossary
What is Retrieval Poisoning?
Learn what retrieval poisoning is, how attackers plant documents so RAG systems fetch them, how it enables indirect prompt injection, and how to protect ingest, ranking, and indexes.
Definition
Retrieval poisoning is an attack that manipulates which documents a RAG or search pipeline returns—by inserting, promoting, or tampering with indexed content—so the LLM sees attacker-chosen context and treats it as trusted knowledge or instructions.
Why retrieval poisoning matters
RAG is only as honest as its corpus. Retrieval poisoning does not need to jailbreak a model if it can become the model’s source. Edit a public page your crawler loves, drop a file in a shared drive, or upsert a chunk that embeds close to ‘password reset policy,’ and the assistant will teach the attacker’s version.
This is an integrity attack on inference-time knowledge. Retraining will not fix it. Cleaning or isolating the index will.
How poisoned content wins retrieval
Gain an ingest foothold
Wiki edit, public webpage, email the assistant indexes, or a write-capable vector API.
Craft for rank
Match likely queries, repeat target terms, or optimize embeddings so the chunk is a near neighbor.
Hide the payload
Instructions or false facts sit after a benign heading, in metadata, or in low-contrast HTML.
Wait for a user question
A normal query retrieves the poisoned chunk into the prompt.
Shape the answer
The LLM quotes false policy or follows hidden instructions (indirect injection).
Spread via citations
Users trust the assistant; they copy the lie into tickets and future docs, reinforcing the poison.
Poisoning entry points
Open collaboration
Wikis, Git READMEs, and issue comments the indexer treats as documentation.
Web-grounded RAG
Live browsing or search APIs that fetch attacker-controlled URLs.
Writeable indexes
Overprivileged upsert keys or tools that can ‘remember’ facts forever.
Compromised sync
A poisoned SaaS connector that mirrors malicious files into the corpus.
Retrieval poisoning versus training poisoning
| Aspect | Retrieval poisoning | Training data poisoning |
|---|---|---|
| When it hits | At query time, via fetched chunks | At train/fine-tune time, via weights |
| Fix | Remove or demote the document; reindex | Retrain or replace the model |
| Typical tell | Odd new citations for stable questions | Trigger phrases that work even with an empty index |
| Relationship | Often carries indirect prompt injection | Can implant backdoors independent of RAG |
- Treat corpus publishers as privileged: reviews, signed-off sources, and least-privilege upserts.
- Separate untrusted web content from internal knowledge; do not mix them in one prompt casually.
- Require allowlisted citations for policy and security answers.
- Monitor chunks that suddenly rank for many unrelated queries.
- Re-embed and re-review after crawls; detect unexpected content diffs.
- Disable agent tools that can write to the production index without approval.
- Red-team with documents designed to rank for your top customer questions.
- Remember: deleting a page in the CMS is not enough until the vector payload is gone.
The practical takeaway
Retrieval poisoning makes the attacker the most ‘relevant’ author in your knowledge base. The model then sounds authoritative while teaching a lie or following hidden instructions.
Control ingest, isolate untrusted sources, watch ranking anomalies, and delete poisoned vectors—not only the original file. RAG integrity is a publishing problem as much as an ML problem.
Related security terms
Retrieval-Augmented Generation (RAG)
The architecture whose retrieval step this attack targets.
Indirect Prompt Injection
What poisoned documents often contain once they are retrieved.
Vector and Embedding Weaknesses
Index flaws that make poisoning and leakage easier.
Training Data Poisoning
Corrupts weights; retrieval poisoning corrupts inference-time context.
Vector Database
A common place poisoned chunks are stored and ranked.
Frequently asked questions
What is retrieval poisoning in simple terms?
The attacker gets their document into the set of ‘relevant’ chunks. The assistant then answers from that document as if it were company truth.
Do they need to change the model?
No. The weights can be clean. Poisoning the wiki, the crawl, or the vector upsert is enough.
How is this different from indirect prompt injection?
Poisoning is about winning retrieval (being selected). Injection is about what the selected text tells the model to do. Real attacks usually do both.
What is ‘SEO for RAG’?
Crafting titles, repeated phrases, and embeddings so a malicious page outranks honest ones for important queries.
Can keyword search be poisoned too?
Yes. Vector indexes are trendy, but stuffed keywords, compromised CMS pages, and wiki edits poison lexical retrieval as well.
How do you detect it?
Watch for new chunks that rank for many queries, sudden citation of unknown sources, and ingest events from untrusted authors.
How do you reduce it?
Control who can publish into the corpus, review ingest, isolate untrusted web RAG, require citations to allowlisted sources, and sign index writes.
References
Explore authoritative guidance and frameworks related to retrieval poisoning.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.