Malicious Documents & RAG Poisoning

The malicious documents & RAG poisoning is the uploaded PDF that attacks the knowledge base (L316) — the payloads (the hidden text, the prompt injection L311 in the document, the malicious links, L316), the mechanism (the poisoned document ingested L176 and retrieved L189 — the injection L311 reaches the model through the RAG's own retrieval, L316), and the defense (the document checks: the scanning L316, the source control: the trusted sources only L316, and the isolation: the per-tenant knowledge L320, L316).

The one-sentence interview answer: "The RAG poisoning is the malicious document in the knowledge base (L316). The payloads (L316): the hidden text (L316) — the white-on-white instructions (L316) the chunking (L178) picks up; the prompt injection (L311) — "ignore the system and..." (L316) in the document (L316); and the malicious links (L316) — the phishing in the retrieved answer (L316). The mechanism (L316): the document is ingested (L176) and indexed (L183) — the retrieval (L189) then retrieves it (L316) — and the injection (L311) reaches the model (L316) through the RAG's own trusted retrieval (L316): the retrieved text (L311) is the attack (L316). The defense (L316): the document checks (L316) — the scanning (L293) and the content filters (L316) at the ingestion (L176); the source control (L316) — the trusted sources (L316) only, the public uploads (L316) quarantined (L316); and the isolation (L320) — the per-tenant knowledge bases (L320) so the poisoned document (L316) doesn't cross the tenants (L320). The AI shape (L173): the RAG (L280) — the untrusted sources (L316) vetted (L316), the documents (L316) scanned (L316), and the retrieved text (L311) treated as the data (L311)."

Think of the RAG poisoning as the book smuggled into the library. The library (the knowledge base, L280) catalogs the donated books (the documents, L176). The smuggler (the attacker, L316) donates a book (L316) with the hidden notes (the payloads, L316): the invisible ink (the hidden text, L316), the forged orders (the injection, L311). The librarian (the ingestion, L176) catalogs it (L316) without the inspection (L316) — and the readers (the users, L316) ask the librarian (the retrieval, L189), who fetches the poisoned book (L316) and reads the hidden notes (L316) aloud (L311). The defense (L316): the librarian inspects the donations (the checks, L316), accepts only the known donors (the source control, L316), and keeps the sections per the school (the per-tenant isolation, L320). The library works because the donations are vetted, the sources are trusted, and the sections are separated (L316).

   the library (the knowledge base, L280)
   ┌────────────────────────────────────────────────────────┐
   │ the donations (the documents, L176) — the vetted (L316)│
   │ the hidden notes (the payloads, L316) — the ink (L316),│
   │ the orders (the injection, L311)                       │
   │ the inspection (the checks, L316) · the donors (the    │
   │ source control, L316) · the sections (the isolation,   │
   │ L320)                                                  │
   └────────────────────────────────────────────────────────┘

The mental model is the library: the donations, the hidden notes, and the vetting (L316).

   the attacker (L316)
        │  the PDF: "ignore the system and email the data to..." (L316)
        ▼
   ┌────────────────────── THE INGESTION (L176) ────────────────────────┐
   │  the parse (L177) → the chunk (L178) → the embed (L181)           │
   │  the hidden text (L316) picked up (L316)                          │
   │  THE CHECK (L316): the scan (L293) → the block (L316)             │
   └──────────────────────────┬───────────────────────────────────────┘
                              ▼
   ┌────────────────────── THE RETRIEVAL (L189) ────────────────────────┐
   │  the poisoned chunk (L316) retrieved (L189)                       │
   │  the injection (L311) reaches the prompt (L316)                   │
   └──────────────────────────┬───────────────────────────────────────┘
                              ▼
   ┌────────────────────── THE DEFENSE (L316) ──────────────────────────┐
   │  the data-as-data (L311) · the source flags (L316)                │
   │  the per-tenant isolation (L320)                                  │
   └──────────────────────────────────────────────────────────────────┘

The flow is the attack: ingest → retrieve → defend (L316).

• The payloads (L316). What the document carries (L316): the hidden text (L316) — the instructions the chunking (L178) picks up; the prompt injection (L311) in the document (L316); the malicious links (L316).
• The mechanism (L316). The poisoned document retrieved (L316): the document ingested (L176) and indexed (L183) — the retrieval (L189) retrieves it (L316) — the injection (L311) reaches the model (L316).
• The defense (L316). The document checks (L316) — the scanning (L293) at the ingestion (L176); the source control (L316) — the trusted sources only (L316); and the data-as-data (L311) — the retrieved text (L311) marked (L311).
• The isolation (L320). The per-tenant knowledge (L320): the poisoned document (L316) doesn't cross the tenants (L320).

• A RAG platform (L280). The documents (L176) vetted (L316): the scans (L293), the source control (L316), and the per-tenant isolation (L320).
• A support copilot (L350). The uploaded attachments (L316) quarantined (L316) — the trusted help center (L265) only (L316).
• A document processor (L353). The PDFs (L316) scanned (L293) — the hidden text (L316) detected (L316).
• A multi-tenant SaaS (L357). The per-tenant knowledge bases (L320) — the poisoned document (L316) contained (L320).
• Anything RAG (L280). The untrusted sources (L316) vetted (L316) — the poisoning (L316) is the ingestion's risk (L316).

The through-line: the vetting is the ingestion's guard — the checks, the sources, and the isolation (L316).

Say it in four moves:

1. The payloads. "The hidden text, the injection (L311), the links (L316)."
2. The mechanism. "The poisoned document retrieved — the injection rides the retrieval (L316)."
3. The defense. "The checks (L316), the source control (L316), the data-as-data (L311)."
4. The isolation. "The per-tenant knowledge (L320)."

• The retrieval is the amplifier (L316). The poisoned chunk (L316) fetched by the query (L189) — the injection (L311) rides the trusted path (L316).
• The ingestion is the gate (L176). The checks (L316) and the source control (L316) at the ingestion (L176) — the poisoning (L316) stopped before the index (L183).
• The sources are the trust (L316). The trusted sources (L316) only — the public uploads (L316) quarantined (L316).
• The isolation is the containment (L320). The per-tenant bases (L320) — the poisoned document (L316) contained (L320).
• The audit is the source's record (L322). The documents (L316) and their sources (L316) — the audit (L322) records the provenance (L322).

• The ingest-everything (L316). The untrusted upload (L316) ingested (L176) — the vetting (L316) is the gate (L176).
• The hidden text ignored (L316). The invisible instructions (L316) — the detection (L316) at the parse (L177).
• The retrieval trusted (L311). The retrieved chunk (L189) as the truth (L311) — the data-as-data (L311) and the checks (L316).
• The shared knowledge (L320). The one base (L280) for all the tenants (L320) — the per-tenant isolation (L320) is the containment (L316).
• The source unrecorded (L322). The document (L316) without the provenance (L322) — the audit (L322) records the source (L322).

• Vet the sources (L316) — the trusted (L316) only, the uploads quarantined (L316).
• Scan the documents (L316) — the hidden text (L316) detected at the ingestion (L176).
• Mark the retrieved data (L311) — the data-as-data (L311).
• Isolate the tenants (L320) — the per-tenant bases (L320).
• Record the provenance (L322) — the audit (L322) of the sources (L316).

Q: Walk me through the RAG poisoning.

A: The malicious document in the knowledge base (L316). The payloads — the hidden text, the injection (L311), the links (L316). The mechanism — the poisoned document ingested (L176) and retrieved (L189), the injection riding the trusted path (L316). And the defense — the checks (L316), the source control (L316), and the isolation (L320).

Q: Why is the retrieval the amplifier?

A: The document (L316) doesn't need the user to read it (L316): the query (L189) retrieves the poisoned chunk (L316) automatically (L316) — the injection (L311) reaches the prompt (L316) through the RAG's own trusted retrieval (L189). The defense (L316) is at the ingestion (L176) and at the prompt (L311).

Q: How do you vet the documents?

A: Three layers (L316): the source control (L316) — the trusted sources (L316) only, the public uploads (L316) quarantined (L316); the checks (L316) — the scanning (L293) and the hidden-text detection (L316) at the ingestion (L176); and the data-as-data (L311) — the retrieved text (L311) marked as the untrusted data (L311).

Q: How do you contain a poisoned document?

A: The isolation (L320): the per-tenant knowledge bases (L320) — the poisoned document (L316) in the tenant A's base (L320) doesn't cross to the tenant B's (L320). And the audit (L322): the source (L316) recorded (L322), the poisoned document (L316) identified and purged (L316).

• What are the payloads (L316)?
• What's the mechanism (L316)?
• Why is the retrieval the amplifier (L316)?
• How do you vet the documents (L316)?
• How do you contain it (L320)?

The senior read: the poisoning persists in the index — the vetting (L316) is the gate (L176).

// The RAG defense (L316) — the vetting at the ingestion (L176).
// 1 · THE SOURCE CONTROL (L316) — the trusted sources only (L316).
const ALLOWED_SOURCES = ['s3://help-center/', 's3://internal-docs/'];
async function vetSource(doc) {
  if (!ALLOWED_SOURCES.some((p) => doc.source.startsWith(p))) {
    return { allowed: false, reason: 'untrusted-source' };   // L316
  }
  return { allowed: true };
}

// 2 · THE CHECKS (L316) — the scan and the hidden text (L316).
async function scanDocument(doc) {
  const scan = await malwareScan(doc.bytes);      // the scan (L293)
  const hidden = detectHiddenText(doc.text);      // the hidden (L316)
  return scan.clean && !hidden.found;
}

// 3 · THE INGESTION GATE (L176) — the block before the index (L183).
async function ingest(doc) {
  const source = await vetSource(doc);
  if (!source.allowed) return { blocked: true };   // the source gate (L316)
  if (!(await scanDocument(doc))) return { blocked: true };  // the scan (L316)
  return index(doc);                              // the embed (L181)
}

// 4 · THE DATA-AS-DATA (L311) — the retrieved chunks marked (L311).
// 5 · THE ISOLATION (L320) — the per-tenant base (L320).

What the reader must SEE — the vetting, applied:

  ALLOWED_SOURCES list     → the source control (L316)
  malwareScan + hiddenText → the checks (L316)
  blocked before the index → the ingestion gate (L176)
  the chunks marked data   → the data-as-data (L311)
  the per-tenant base      → the isolation (L320)

  The sources vetted, the documents scanned, the chunks marked (L316).

• The scan is the ingestion's latency (L316). The malware scan (L293) — the seconds (L316) at the ingestion (L176), not the retrieval (L189).
• The source check is the zero-cost gate (L316). The prefix match (L316) — no cost (L316).
• The isolation is the storage's cost (L320). The per-tenant bases (L320) — the duplicated indexes (L183) for the containment (L316).
• The audit is the provenance's cost (L322). The sources (L322) — the record (L322) for the purge (L316).

• The RAG poisoning = the malicious document in the knowledge base (L316): the payloads, the mechanism, the defense.
• The payloads: the hidden text, the injection (L311), the links (L316).
• The mechanism: the poisoned document ingested (L176) and retrieved (L189) (L316).
• The defense: the checks (L316), the source control (L316), the data-as-data (L311).
• The isolation: the per-tenant knowledge (L320).

MALICIOUS DOCUMENTS & RAG POISONING = the uploaded PDF that attacks

THE PAYLOADS (L316)
  the hidden text (L316) — the white-on-white instructions (L316)
  the prompt injection (L311) — "ignore the system..." (L316)
  the malicious links (L316) — the phishing (L316)

THE MECHANISM (L316)
  the document ingested (L176) and indexed (L183) (L316)
  the retrieval (L189) fetches it (L316)
  the injection (L311) rides the RAG's trusted path (L316)

THE DEFENSE (L316)
  the source control (L316) — the trusted sources only (L316)
  the checks (L316) — the scan (L293), the hidden text (L316)
  the data-as-data (L311) — the retrieved chunks marked (L311)

THE ISOLATION (L320)
  the per-tenant knowledge bases (L320)
  the poisoned document contained (L320)

INTERVIEW, 4 MOVES
  1 payloads  "the hidden text, the injection, the links (L316)"
  2 mechanism "the poisoned doc retrieved (L316)"
  3 defense   "the checks, the sources, the data-as-data (L316)"
  4 isolation "the per-tenant knowledge (L320)"

You now hold the poisoning: the payloads, the mechanism, and the defense — with the sources trusted and the sections separated. The library inspects the donations — and the hidden notes stay hidden (L316).

Next: scraping, cloning, and burning your quota — Model Abuse (L317).