Why treat retrieved documents in a RAG prompt as untrusted input?

## The trust model people get wrong Teams reason about prompt injection as a user-input problem: someone types something adversarial into the chat box. Retrieval opens a second, quieter path. Every document in the index becomes prompt content the moment a query matches it, which means the write permissions on your corpus are, transitively, permissions to influence your model's instructions. An internal wiki that any employee can edit, a shared drive that accepts uploads, a ticketing system that ingests customer email, a crawler pulling public pages — each is an input channel whose contents will one day be read by the model as though you had written them. ## Indirect prompt injection The attack is called indirect because the attacker never talks to the model. They plant text where retrieval will find it and wait for a victim's query to pull it in. The payload can be blunt ("ignore previous instructions and…") or subtle: instructions in white text or a comment, a fake system-message block, a paragraph that redefines what the assistant is allowed to disclose, or content crafted to rank highly for a common query so it is retrieved often. The reason it works is architectural. Everything the model sees — your instructions, the user's question, the retrieved passages — arrives as tokens. Role separation between turns is a strong prior learned in training, not an enforced boundary like a parameterised SQL query. It raises the cost of an attack; it does not make one impossible. Any defence you describe purely in terms of wording should be presented as probabilistic. ## Injection-layer hygiene Still worth doing, because it moves the odds. Keep the operating contract in the privileged instruction turn and never let retrieved text share that turn. Wrap each chunk in an unambiguous, clearly labelled boundary and declare in the instructions that everything inside is reference material to be quoted and cited, never obeyed. Sanitise the retrieved text so it cannot forge that boundary — strip or escape your delimiter sequence and any text imitating a role header. Prefer to strip invisible characters and zero-width tricks at ingest. State explicitly that no retrieved content may alter the citation or abstention rules, which gives the model a specific conflict to resolve rather than a general plea. ## Why hygiene is not enough A sufficiently persuasive passage still wins sometimes, and you cannot enumerate the persuasive passages in advance. So the design assumption must be: some fraction of the time, the model will do what the document said. Everything after that is blast-radius engineering. **Gate side effects on user authority.** A retrieval-backed assistant with the ability to send mail, write to a system of record, or spend money must derive that authority from the authenticated user's permissions and, for irreversible actions, from an explicit confirmation. Text in a document is never authorisation. **Do not put secrets in the context.** Anything in the window — API keys, other users' data, internal identifiers — is exfiltratable if the model can be talked into emitting it. **Control the exfiltration channel.** A classic trick is to induce the model to emit a link or image whose URL encodes data from the conversation; rendering it makes the client leak. Do not auto-render links or remote images from untrusted content, and constrain any outbound URL to an allowlist. **Constrain the output shape.** An answer that is required to be citations plus prose has far less room to carry a payload than free-form output that may include arbitrary structured commands. ## Ingest-side controls The cheapest defence is often not letting the payload in. Know who can write to each source and treat externally-writable sources as a distinct, lower-trust tier — possibly excluded from high-privilege sessions entirely. Scan incoming documents for injection-shaped content and for invisible text. Keep provenance metadata on every chunk so an incident can be traced to a document, an author and a timestamp, and so you can answer "what else did that author touch?" in minutes rather than days. ## Detection and response Log the injected context alongside each response, not just the answer — without it you cannot reconstruct what the model was told. Watch for answers that diverge sharply from their cited passages, for attempted actions outside the session's normal envelope, and for chunks that appear in many unrelated queries. Have a path to quarantine a document and invalidate its index entries quickly, and rehearse it. ## The honest position in an interview There is no known complete fix for indirect prompt injection as of 2026. Saying so, then describing layered mitigation — restrict who can write to the corpus, sanitise and delimit on the way in, assume occasional compliance, and make the consequences of compliance small — is a stronger answer than claiming a prompt wording that solves it.