Scoping a RAG poisoning test, how do you price which of several feeding sources to attempt?

## Reframing the choice as a purchase A junior framing is: find the source with the weakest review and write there. A senior framing prices the whole attempt, because the goal is not "a write got accepted" but "a durable write into a store real queries read." Weak review is one input to that price, not the whole of it. Take the concrete setting: a compliance-answering assistant whose index is built by ingesting three outside-fed sources - a standards body's public errata page, a vendor-maintained product FAQ, and a partner intake queue that accepts filings for review. A red-teamer scoping the engagement can attempt any of the three. Which is the best buy? ## The axes to price **Review cost.** How hard is it to get a write accepted at this source? This is the axis the weak-review proxies measure. It sets the up-front cost of the attempt. **Durability.** Once accepted, how long does the write survive? A source whose owner watches for and reverts anomalies gives a short-lived foothold even if the initial write was trivial. The relevant question is not just "will review let it in" but "will anyone notice and pull it later." A loosely-reviewed but closely-audited source can be a worse target than a moderately-reviewed but unwatched one. **Reach.** Does this source's content plausibly get retrieved for the queries that matter? Sources are not equal contributors to answers; some are rarely surfaced. A write that lands easily into a source nobody's questions retrieve is worthless. The best target is one whose content is both easy to write and actually reaches readers. **Identity and time cost.** What does the attempt cost the attacker? A queue that ties every submission to a vetted, named filer imposes an identity cost - the attacker spends a credential or a persona they may not get back - even if the review itself is light. An open page costs almost nothing. Time matters too: a source that only rebuilds occasionally stretches the engagement. ## Why weakest review is often not the answer Put those together and the weakest-reviewed source frequently loses. The errata page might publish instantly (cheap review) but be closely watched by an editor who reverts oddities (poor durability). The vendor FAQ might review lightly and rarely change but almost never be retrieved for the queries in scope (poor reach). The partner queue might have a real moderator (higher review cost) but, once past it, produce a document nobody re-reads and that answers exactly the queries of interest (high durability and reach). The best buy is the one that maximises durable, reaching foothold per unit of cost - not the one that is simply easiest to write to. ## What the red-teamer reports The engagement chair has to report not just "it worked" but what the attempt cost: which source was chosen and why, how many identities or credentials were spent, how long the write survived, and whether it demonstrably reached answers. That report is the deliverable, and it is framed in exactly these axes. ## Discipline about what a success proves A landed write proves the source's review was passable and the write is currently present. It does not prove permanence - the owner may revert tomorrow - and it does not, on its own, prove reach unless retrieval was demonstrated. A careful red-teamer separates "accepted at the source" from "durable" from "reaches answers," because conflating them overstates the finding. ## Why interviewers ask it This is production judgment: given several viable sources, choose and justify. A candidate who says "pick the weakest review" has priced one axis. The stronger answer weighs durability, reach and cost, and can explain a case where the weakest-reviewed source is the wrong buy. That reasoning is what a red-team scoping decision actually looks like, and it is what a defender must anticipate about how targets are selected.