RAG & Knowledge-Base Poisoning

A metadata predicate is only as trustworthy as where its value comes from. When status, date or type are copied out of the submitted document, the passage's author sets them too, so narrowing removes honest rivals and keeps the plant.

A review and a retrieval consume different artefacts. The reviewer reads an added hunk inside the whole page; the model receives one chunk cut from that page, alone. Approval evidences that a person read the file, not the fragment.

A reranking stage drops planted text shaped against an embedding model, which reads as nonsense, and promotes planted text written to read as the ideal answer. It scores relevance to the query, never who wrote the passage.

First-stage similarity search embeds query and passage separately and ranks on vector distance alone. That score never reads the text for fluency, authorship or truth, so text fitted to the encoder's geometry can outrank prose written for a human reader.

A poisoning document does not enter at the index; it enters at one of the sources the corpus ingests. Restricting index writers leaves every feeding source's own writers untouched, and the attacker writes to whichever source reviews least.

One planted passage wins only the questions whose wording lands near it in the retriever's vector space. First-stage search ranks passages by distance to each query, so a single document owns one narrow query neighbourhood, not the whole assistant.

Not at write time. Retrieval searches an index, not the file share, so a planted passage is inert until the next scheduled build parses, chunks and embeds it - a delay the attacker neither sees nor controls.

The strongest corpus plant contains no instruction at all: it is an ordinary declarative sentence that happens to be false. A screen matching directive-shaped text has nothing to match, and the model is reading, not disobeying.

Nothing about authorship. The title, byline and publisher in a source chip are values the fetched page declared about itself, so a page the attacker wrote supplies its own credentials alongside its claim.

Ranking rewards clarity. A passage wins by restating the anticipated question in the answerer's own vocabulary and answering it directly, so the highest-scoring plant reads like the best-written reference entry in the corpus, not like anything anomalous.

Narrowing removes candidates, and a planted chunk is never among them: it satisfies the predicate by construction, while legitimate documents with blank or non-conformant metadata are dropped. Fewer rivals means a better chance at the top-k slots.

Context-dependence, placed deliberately. The material framing the paragraph — a heading, a date, a scoping sentence, a pronoun's antecedent — sits next to it, not inside it, so a split that separates them emits only the assertive half.

It has to out-answer the corpus's genuine best passage for a query the attacker guessed in advance, judged by a stage that reads both. That is a quality contest, so the construction lands on thinly covered questions.

The fit dies while the document survives. A re-embed recomputes every vector with a different function, so a passage shaped against the old encoder's geometry lands somewhere unremarkable. What still ranks is whatever the passage plainly says.

They cannot see the index or the review roster, so they read observable proxies of each feeding source's pre-publication review: how fast a submission appears, whether prior submissions show up verbatim, and whether corrections are ever reverted. The source with the loosest review is the pick.

Near-identical text embeds to nearly the same vector, so copies chase the same questions rather than new ones, and ingest that keeps one representative removes most of them. Reach follows position, not count.

Durability comes from the plant being a stored text artefact rather than a decoding accident. It is retrieved again for every future asking of the same question, so it reproduces exactly where a hallucination does not.

A whole coherent artefact, not a string. The destination page has to keep standing up to inspection: self-declared metadata matching the chip, a layout and register that read like the impersonated publication, and continuous availability while the answer circulates.

It depends on steerability, not on the score. Ranking above the docs is ordinary retrieval behaviour; a finding needs evidence that an untrusted author can choose which question their passage wins, and a consequence downstream when it does.

Trace each field back to the moment it entered the index payload. Fields parsed out of the artefact - front matter, embedded properties, filename - were written by the submitter. Fields stamped at receipt or derived from the caller were not.

No. The reranking stage promoted the passage that read most like the best answer, which is its job. The defect is an unattended workflow treating relevance order as authority over a corpus anyone who files a ticket can write into.

An offline harness proves a property of a function you hold, not of a deployment. The live path differs in the unit indexed, the text extracted, the encoder pin, the scoring mix and the competition — any one ends the fit.

The weakest-reviewed source is not automatically the best target. Price each on three things together: how loose its review is, how likely its owner is to notice and revert, and whether its content actually reaches readers. A loose source nobody retrieves, or one whose owner reverts within a day, is a poor foothold.

Enumerate the phrasings buyers use, then gauge genuine competition for each by probing the assistant itself. Well-covered questions need several distinct passages each; thinly covered ones need one. The count is the sum, not a constant.

Compare clocks, not attempts. Repeated queries inside one index generation settle nothing; establish when the document was written, which builds have run since, whether the source still holds it, and whether the current index contains a chunk from it.

Determinism plus provenance reopens it. The same wording returns across fresh sessions, phrasings and model changes, and that wording is present verbatim in a retrieved chunk and in the stored row behind it - a decoding accident reproduces neither.

Work from the turn's fetch record, not from a retry. If a fetched page declared that publisher and the chip reproduces it, the attribution was supplied by that page; if no fetched text carried the name, the generation produced it.

The review buys attacker cost, not coverage: the whole-page reading must stay unremarkable, but the reviewed and consumed artefacts differ. The prompt line buys less, because the construction need not read as an instruction.

It is a shared finding whose root cause sits outside the team that runs the assistant. The assistant owner cannot fix the partner's review, and their instinct to lock down the index buys nothing against a write that never targeted the index. The real decision is whether to keep ingesting a source whose review they neither see nor set.