Learn / RAG pipeline security: retrieval, vector stores, data poisoning
RAG pipeline security: retrieval, vector stores, data poisoning
Securing the retrieval side of an LLM application, including the vector database, the documents fed into it, and the ways an attacker can poison or manipulate what gets retrieved.
Researched on 2026-09-26 with AI assistance. Links and summaries can change; verify details with the original source. Not yet reviewed by a person.
What it is
RAG pipeline security is the practice of defending the retrieval side of an LLM application: the documents that get ingested, the embedding step, the vector store, the retrieval query, and the context that is finally handed to the model. OWASP treats it as its own risk class, LLM08:2025 Vector and Embedding Weaknesses, covering injected content, manipulated outputs and unauthorised access to sensitive embeddings.1
The framing that practitioners use is that RAG does not reduce risk, it redistributes it across the data pipeline, creating attack surface at every stage from ingestion through generation to output and downstream agent calls.2
Attacker techniques in this area have formal names in MITRE ATLAS: RAG Poisoning (AML.T0070) is injecting malicious content into data a RAG system indexes so it surfaces in a later thread, and Retrieval Content Crafting (AML.T0066) is writing content designed to be retrieved for a target query and to influence the user who trusts the system.45
The academic baseline is PoisonedRAG, which showed that injecting five malicious texts per target question into a knowledge database of millions of texts reached a 90% attack success rate, and that several existing defences were insufficient.3
Why postings ask for it
12 of 48 postings (25%) ask for it, and the demand sits with the people who build and sign off architectures: AI/Agent Security Engineer 38%, AI Security Architect 43%, Consulting 40%, against 0% for research and GRC.P
Engineer and architect roles ask because the controls are concrete build work: document hashing and provenance at ingestion, access control metadata on every chunk, tenant isolation in the vector store, query abuse detection, output validation and pipeline logging.P2
Only 11% of the 9 AI Red Team postings name it, which fits the split in practice: red teamers test retrieval through indirect prompt injection against the application, while engineers and consultants own the ingestion and vector store design that stops it.P6
Concepts you should be able to explain
If you can say each of these out loud in two minutes, with an example, you are ready for the technical part of an interview on this skill.
Any corpus that multiple users or systems can write to (shared wikis, drive folders, object storage, ticket systems) is untrusted input, and document poisoning is the most common and immediately exploitable RAG attack vector. Controls start at ingestion: hash every document at ingestion, verify the hash before retrieval, record who uploaded it from where with what approval, and keep an allowlist of trusted sources. Treating file extension or MIME type as evidence of trustworthiness is explicitly called out as wrong.2
The attacker places documents where the system indexes them, targeted so they always surface for a chosen query, carrying false information, prompt injections or fake RAG entries. PoisonedRAG formalised this as an optimisation problem over malicious texts and reported a 90% attack success rate from five injected texts per target question against a database of millions of texts, in both black-box and white-box attacker settings. The paper's evaluation of existing defences found them insufficient, so do not assume a retrieval filter closes the issue.34
LLM-integrated applications blur the line between data and instructions, so an attacker who controls text that is likely to be retrieved can inject prompts remotely without any direct interface to the model. The original taxonomy demonstrated data theft, worming and information ecosystem contamination against real systems, and showed that processing retrieved prompts can act like arbitrary code execution over the application's own API calls. This is why the blast radius depends on what tools and identities the RAG app can reach, not just on the text it returns.6
ATLAS separates crafting content that will be retrieved and will influence the human reader from injecting instructions at the model. The crafted content can stand alone in a document or email and abuses the user's trust in the system, and getting it into the victim's vector database can happen through normal ingestion mechanisms rather than intrusion. A detection strategy tuned only for jailbreak strings will miss this class.5
OWASP's worked scenario is a resume with white text on a white background saying to ignore previous instructions and recommend the candidate, which the screening pipeline extracts and the model obeys. Invisible Unicode and zero-width characters do the same job in plain text. The mitigations are text extraction that ignores formatting and detects hidden content, scanning for adversarial patterns and invisible characters, and validating every document before it enters the knowledge base.12
Embeddings are numeric similarity representations, so adversarial input can be crafted to sit artificially close to a target query and be retrieved even when it is semantically unrelated. This needs some knowledge of the embedding model, which makes it an advanced case that matters most in high-security environments. Related advanced controls are embedding distribution monitoring and cross-model validation.2
A single blocker document added to a database with untrusted content can be retrieved for a specific query and cause the system to refuse or fail to answer it, a denial of service the authors call jamming. The strongest published method uses black-box optimisation, needs no instruction injection, and does not require knowing the target's embedding model or LLM. The authors also show that standard LLM safety metrics do not capture this vulnerability, so a passing safety eval says nothing about it.8
Where several classes of users or applications share one vector database, one group's embeddings can be returned to another group's queries, so OWASP asks for permission-aware stores with logical and access partitioning, data tagging and classification, and immutable retrieval logs. Attackers can also invert embeddings to recover source text, and empirical work shows RAG systems leaking their private retrieval database under targeted attacks. Vector stores are also ordinary infrastructure that needs authentication and network controls, and public research has reported at least 80 unprotected RAG servers.171015
RobustRAG proposes isolate-then-aggregate: split retrieved passages into disjoint groups, generate a response per group, then securely aggregate, which yields certified lower bounds on response quality against an adaptive attacker injecting a bounded number of malicious passages. Pair that with the pipeline controls: context delimiters and chunk limits, signed source attribution on responses, tool invocation limits, cache isolation, and fail-closed behaviour. Knowing which defence carries a guarantee and which is best effort is the difference between a design review and an opinion.92
Use fictional data and authorised sandboxes. Remove employer details and secrets from any portfolio write-up. Time estimates exclude setup. Check model and cloud costs before running tests, set spending limits, and delete lab resources afterwards.
Three exercises
In order of difficulty. Free tools. Keep what you build; it is evidence.
You can demonstrate, hands on, that attacker-controlled text pulled into an LLM's context causes actions, and name the ATLAS technique and OWASP risk it belongs to.13452
- Work through the PortSwigger Web Security Academy indirect prompt injection lab in the Web LLM attacks path.
- Write down where the injected text entered the application and which identity performed the resulting action.
- Map the finding to AML.T0070 RAG Poisoning or AML.T0066 Retrieval Content Crafting and justify the choice in two lines.
- Note which single control from the OWASP RAG cheat sheet would have broken the chain earliest.
Tools: PortSwigger Web Security Academy (free labs), any browser
You can produce a control-by-control gap list for a RAG ingestion path, with test cases that prove each gap.2111
- Take a small RAG app you build or already have and document its ingestion sources, chunking, embedding model and store.
- Score it against the OWASP RAG cheat sheet 'implement immediately' list: document hashing and integrity verification, context delimiters and chunk limits, access control metadata per chunk, tenant isolation, query abuse detection, output validation, logging, fail-closed behaviour.
- Build a poisoned test corpus: hidden white-on-white text, zero-width characters, and a benign-looking document crafted to answer one target query.
- Ingest it, run your target queries, and record whether the document was retrieved and whether the model followed it.
- Automate the queries as a promptfoo config so the tests rerun on every corpus change, and write up the gaps with evidence.
Tools: promptfoo, a local LLM or free API tier, any open source vector store
You can state an attack success rate for knowledge corruption on a corpus you control, and show what one defence does to that number and to answer quality.38912
- Pick ten target questions your corpus answers correctly and record the baseline answers.
- Inject a small fixed number of malicious texts per target question, following the PoisonedRAG threat model, and measure how often the attacker-chosen answer is produced.
- Add a blocker-style document for one question and check whether the system refuses to answer, then note that generic safety evals do not flag this.
- Implement an isolate-then-aggregate pass over retrieved passages as in RobustRAG and re-measure attack success and answer quality.
- Run garak against the endpoint before and after, and report what it did and did not detect.
- Write a one-page result: attack success rate, defence effect, residual risk and cost.
Tools: garak, promptfoo, Python, a local embedding model and open source vector store
Practice questions
Written from the concepts above, not collected from a named employer. Open one, answer it out loud, then tick the points you covered; the score stays in this browser.
Walk me through the attack surface of a RAG pipeline, stage by stage.Retrieval-Augmented Generation (RAG) Security Cheat Sheet
Say your answer out loud or write it down, then tick what you covered:
0 of 3 covered
How many poisoned documents does an attacker realistically need in a large corpus, and what does that tell you about detection by volume?RAG poisoning / knowledge corruption
Say your answer out loud or write it down, then tick what you covered:
0 of 3 covered
What is the difference between retrieval content crafting and indirect prompt injection, and why does it change your detection design?s5, s6
Say your answer out loud or write it down, then tick what you covered:
0 of 3 covered
A shared knowledge base serves several business units through one vector database. What do you require before go-live?Confidentiality: tenancy, embeddings and inversion
Say your answer out loud or write it down, then tick what you covered:
0 of 3 covered
Someone argues that embeddings are just numbers, so storing them is lower risk than storing the documents. Respond.s1, s7, s15
Say your answer out loud or write it down, then tick what you covered:
0 of 3 covered
How would an attacker degrade a RAG assistant without making it say anything false?Availability: jamming with blocker documents
Say your answer out loud or write it down, then tick what you covered:
0 of 3 covered
Which RAG defence would you call measurable, and which are best effort?Defences with measurable properties
Say your answer out loud or write it down, then tick what you covered:
0 of 3 covered
Your pipeline screens uploaded documents. Which document tricks do you test for, and how?Hidden content in documents
Say your answer out loud or write it down, then tick what you covered:
0 of 3 covered
Sources
Every numbered claim above links here. P = the platform's own coding of 48 job postings.
- LLM08:2025 Vector and Embedding Weaknesses OWASP GenAI Security Project
- Retrieval-Augmented Generation (RAG) Security Cheat Sheet OWASP Cheat Sheet Series
- PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models arXiv (Zou et al., v3 Aug 2024)
- RAG Poisoning, AML.T0070 (ATLAS technique) MITRE ATLAS / D3FEND
- Retrieval Content Crafting, AML.T0066 (ATLAS technique) MITRE ATLAS / D3FEND
- Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection arXiv (Greshake, Abdelnabi et al., 2023)
- The Good and The Bad: Exploring Privacy Issues in Retrieval-Augmented Generation (RAG) arXiv (Feb 2024)
- Machine Against the RAG: Jamming Retrieval-Augmented Generation with Blocker Documents arXiv (Shafran et al., v4 Mar 2025)
- Certifiably Robust RAG against Retrieval Corruption (RobustRAG) arXiv (Xiang et al.)
- Securing Vector Databases (white paper, updated 11 October 2024) Cisco Security
- promptfoo: test prompts, agents and RAGs, red teaming and vulnerability scanning for AI promptfoo (GitHub)
- garak: the LLM vulnerability scanner NVIDIA (GitHub)
- Lab: Indirect prompt injection PortSwigger Web Security Academy
- OWASP Artificial Intelligence Security Verification Standard (AISVS) project page OWASP Foundation
- The Road to Agentic AI: Exposed Foundations (research into RAG systems, at least 80 unprotected servers) Trend Micro Research
- Web LLM attacks (topic overview and lab path) PortSwigger Web Security Academy
Resources
Free first. Levels: intro means no prior knowledge of this skill; working means you can apply it on a project; advanced means research depth or specialist tooling.
- introOWASP Top 10 for LLM Applications (2025) OWASP GenAI Security Project, Standard freeGives you the shared vocabulary for retrieval risks, including LLM01 prompt injection and LLM08 vector and embedding weaknesses, that clients and auditors expect.EngineerArchitectGovernanceConsultantRed teamer
- introWhat Are Vector and Embedding Weaknesses? (LLM08:2025 explainer) SecureLayer7, Guide freeExplains the three concrete vector store failures (text recovery from embeddings, cross-tenant reads, retrieval poisoning) so you can ask the right design questions.EngineerArchitectConsultant
- introData poisoning: attack types, ATLAS mapping, and defences Vectra AI, Guide freeSeparates training-time poisoning from retrieval-time poisoning across the lifecycle, which is the distinction most risk registers get wrong.GovernanceArchitectConsultant
- introManipulating AI memory for profit: the rise of AI Recommendation Poisoning Microsoft Defender Security Research Team, Guide freeShows observed, financially motivated poisoning of what assistants retrieve and remember, useful for making the risk concrete to non-security stakeholders.Red teamerEngineerConsultantGovernance
- introLLM08:2025 Vector and Embedding Weaknesses OWASP GenAI Security Project, Standard freeGives you the shared vocabulary for embedding and vector store risk so you can raise RAG findings in language reviewers and auditors already accept.EngineerArchitectGovernanceConsultantRed teamer
- introRAG Poisoning (AML.T0070), MITRE ATLAS technique record MITRE ATLAS / MITRE D3FEND, Standard freeLets you map retrieval poisoning to a named adversary technique and its persistence tactic when writing threat models or test plans.Red teamerEngineerArchitectConsultant
- introSecuring Vector Databases Cisco Security Center, Guide freeExplains how vector stores differ from normal databases so you can ask the right hardening questions about auth, indexes and tenancy.EngineerArchitectConsultant
- workingMITRE ATLAS technique AML.T0066: Retrieval Content Crafting MITRE (ATLAS via D3FEND), Standard freeGives you the canonical technique ID for content written to be retrieved, so findings and detections map to a framework reviewers already accept.Red teamerArchitectGovernanceConsultant
- workingNot what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection arXiv (Greshake et al.), Paper freeThe paper behind OWASP LLM01 and ATLAS retrieval techniques; read it to reason about any untrusted document reaching a model context.EngineerRed teamerArchitectResearcher
- workingOWASP GenAI data security risks and mitigations, with PII redaction Lothar Schulz, Guide freeTurns the OWASP GenAI data security guidance into ingestion-time practice, including redacting personal data before documents enter the index.EngineerGovernanceArchitect
- workingrag-inject-guard PyPI (community package), Tool freeA worked example of scanning retrieved documents for instruction override, exfiltration and invisible Unicode, then quarantining them before generation.EngineerConsultant
- workingMITRE ATLAS technique mapping for red-team operations Repello AI, Guide freeHelps you turn ATLAS AML.T identifiers, including retrieval poisoning, into test cases and report language for a RAG engagement.Red teamerConsultant
- workingRAG with Differential Privacy arXiv, Paper freeExplains why retrieved context can leak source documents and what a formal privacy control over retrieval actually costs in quality.ArchitectGovernanceResearcher
- workingOWASP Retrieval-Augmented Generation (RAG) Security Cheat Sheet OWASP Cheat Sheet Series, Guide freeGives a prioritised control list across ingestion, embedding, storage, retrieval, output and caching that you can turn into a design review checklist.EngineerArchitectConsultantGovernance
- workingOWASP AI Security Verification Standard (AISVS), including C08 Memory, Embeddings and Vector Database Security OWASP, Standard freeSupplies testable verification requirements for embeddings and vector stores, so you can audit a RAG system instead of only describing its risks.GovernanceArchitectConsultantEngineer
- workingpromptfoo promptfoo, Tool freeRun repeatable adversarial test suites against your own RAG app and wire them into CI so retrieval regressions get caught before release.EngineerRed teamerConsultant
- workingThe Good and The Bad: Exploring Privacy Issues in Retrieval-Augmented Generation (RAG) arXiv, Paper freeShows empirically how retrieved private context leaks through the model, which justifies access control on chunks rather than only on documents.ResearcherRed teamerEngineerGovernance
- advancedThe Hidden Threat in Plain Text: Attacking RAG Data Loaders arXiv, Paper freeGives a taxonomy of attacks planted in documents that only appear after parsing, which tells you what to test in your ingestion code.EngineerRed teamerArchitectResearcher
- advancedCertifiably Robust RAG against Retrieval Corruption (RobustRAG) arXiv, Paper freeThe reference defence design (isolate passages, then aggregate) you can propose when a single poisoned passage must not decide the answer.EngineerArchitectResearcher
- advancedPhantom: General Backdoor Attacks on Retrieval Augmented Language Generation arXiv, Paper freeShows how one injected document can act as a trigger that fires only on chosen queries, which is the stealthy case detection must cover.Red teamerResearcherArchitect
- advancedRAGOrigin: Responsibility Attribution for Poisoned Knowledge in Retrieval-Augmented Generation arXiv, Paper freeBlack-box method for tracing which retrieved documents caused a bad answer, the basis for incident response on a poisoned knowledge base.ResearcherEngineerArchitect
- advancedFine-Grained Privacy Extraction from RAG Systems via Knowledge Asymmetry Exploitation arXiv, Paper freeGives a black-box method for pulling knowledge-base sentences out of answers, useful as a data-exposure test in a RAG assessment.Red teamerResearcherConsultant
- advancedMM-PoisonRAG: Disrupting Multimodal RAG with Local and Global Poisoning Attacks arXiv, Paper freeExtends poisoning to image and text corpora, so you can plan tests for multimodal retrieval where text-only scanning gives false comfort.ResearcherRed teamerEngineer
- advancedMachine Against the RAG: Jamming Retrieval-Augmented Generation with Blocker Documents arXiv, Paper freeDemonstrates availability attacks where one document makes a RAG system refuse to answer, an abuse case most threat models miss entirely.ResearcherRed teamerEngineerArchitect
- advancedRescuing the Unpoisoned: Efficient Defense against Knowledge Corruption Attacks on RAG Systems arXiv, Paper freeDefence-side reading that shows how to keep useful answers when part of the retrieved set is corrupted, instead of failing closed on everything.EngineerArchitectResearcher
Gaps the research could not fill with a good free source: No course. The research budget ran out before any course page could be fetched, and rules forbid listing a price or a URL that was not confirmed today, so this index has zero course items. Next pass should verify a free short course on LLM application red teaming and any paid RAG-security module against the provider's own page.; No hosted, guided lab. Every hands-on item here is a self-hosted repository; nothing confirmed today offers scored RAG poisoning challenges as a service with worked solutions.; No government or standards-body document specific to retrieval poisoning. Nothing from NIST, ENISA, CISA or UK NCSC appeared in today's results that addresses vector stores or retrieval integrity directly, only the OWASP and MITRE material listed above.; No vendor-neutral, primary guidance on multi-tenant isolation in a named vector database (Pinecone, Milvus, Qdrant, pgvector). The Cisco paper is the closest confirmed source and it is general.; No confirmed public benchmark or dataset that a practitioner can run as a poisoning evaluation harness. Candidates exist in recent arXiv listings but none were verified as maintained or widely used.; Four items already on the site (PoisonedRAG, NVIDIA garak, the NIST AI Risk Management Framework, and the PortSwigger Web LLM attacks labs) are still worth keeping, but their URLs did not appear in any tool result today, so they are excluded here rather than typed from memory. Re-confirm and restore them, especially PortSwigger and garak, which would fill the guided-lab and scanner slots.
Paid options
Most of what postings ask for on this skill is covered by the free material above. These are the paid courses and certifications that touch it, with what they add and what free already covers. Showing 5 of 5: ones postings name first, then the most focused on this skill. All paid options.
- Cost
- HTB Academy subscription rates from 12 October 2026: Student $10/mo, Silver $30/mo, Gold $95/mo, Platinum $125/mo, Silver Annual $550/yr (EUR 469 / GBP 416), Gold Annual $1,400/yr (EUR 1,195 / GBP 1,060); individual modules can still be bought with cubes and this path requires 970 cubes
- Duration
- 12 modules, 230 sections; no hour estimate given
- Format
- self-paced
- Prerequisite
- none stated; path difficulty is listed as Hard and modules run Medium to Hard
- In the 48 postings
- Not named in any of the 48 postings.
Adds over free material: Graded browser labs that take you from ML fundamentals through prompt injection, output handling abuse, data-pipeline poisoning and gradient-based adversarial attacks, aligned to Google's Secure AI Framework, with an exam-backed certificate at the end.
Free already covers: Free playgrounds such as prompt-injection challenge sites, OWASP LLM and Agentic guidance, and Microsoft's free AI Red Teaming 101 series cover the same attack list without labs that are graded.
- Cost
- not stated on the provider page
- Duration
- 7 chapters, 30+ guided exercises, 60 days browser-based lab access, 36 CPE points, one exam attempt included
- Format
- self-paced
- Prerequisite
- basic Linux command line (ls, cd, mkdir); familiarity with Python, Go or Ruby helps but is not required
- In the 48 postings
- Not named in any of the 48 postings.
Adds over free material: Hands-on labs that pair the OWASP LLM Top 10 and MITRE ATLAS tactics with things you build and break yourself (chatbot, fine-tuned model, RAG system, TextAttack and BackdoorBox exercises) plus an exam and lifetime instructor support channel.
Free already covers: The OWASP LLM Top 10 and MITRE ATLAS are free and already give the taxonomy, mitigations and real incident write-ups this syllabus is organised around.
- Cost
- not stated on the provider page
- Duration
- 7 hours self-paced, 7 CPEs
- Format
- self-paced
- Prerequisite
- at least intermediate Python; 16 GB RAM, 20 GB free disk, Rancher Desktop or Docker (Intel and ARM both supported); internet access needed during class
- In the 48 postings
- Not named in any of the 48 postings.
Adds over free material: Dockerised labs where you build RAG, contextual RAG and agentic RAG yourself and wire in access-control enforcement and prompt-injection defences, so you can review a retrieval pipeline you have actually built.
Free already covers: Vendor and framework docs plus OWASP LLM guidance already explain RAG architecture and the injection risks at concept level, and open tutorials show how to stand a RAG stack up.
- Cost
- not stated on the provider page
- Duration
- 3 days instructor-led or 18 hours self-paced, 18 CPEs
- Format
- mixed
- Prerequisite
- none stated; you must bring a laptop meeting the stated spec (64-bit Intel i5/i7, Intel VT enabled, 16 GB RAM, 100 GB free, VMware Workstation Pro 17+ or Fusion Pro 13+; Apple Silicon is explicitly not supported)
- In the 48 postings
- Not named in any of the 48 postings.
Adds over free material: A retained VM with 21 exercises (15 full labs, 5 mini labs, a setup lab) plus Marimo workbooks covering direct and indirect prompt injection, RAG exploitation, agentic systems, MCP server attacks and AI API flaws, with a proctored GIAC exam (GAIPT) behind it.
Free already covers: OWASP Top 10 for LLM Applications, MITRE ATLAS and Microsoft's free AI Red Teaming 101 material on Microsoft Learn already list the same attack classes and PyRIT gives you free tooling to try them.
- Cost
- not stated on the provider page
- Duration
- 3 days instructor-led or 18 hours self-paced; 18 CPEs
- Format
- mixed
- Prerequisite
- None stated; the page requires a bring-your-own 64-bit Intel system with VT-x, 16 GB RAM, 100 GB free disk and VMware Workstation Pro 17+ or Fusion Pro 13+, and states Apple Silicon cannot be used
- Renewal
- Not stated on the course page
- In the 48 postings
- Not named in any of the 48 postings.
Adds over free material: Twenty-one hands-on exercises in a keepable VM covering direct and indirect prompt injection, RAG exploitation, agentic systems, MCP server attacks and AI architectural flaws, with an exam behind it.
Free already covers: OWASP GenAI guidance, MITRE ATLAS and public prompt injection research describe the same attack classes, and open MCP servers can be attacked locally for free.