Attacks / Standard term
Retrieval-Augmented Generation (RAG) poisoning
Manipulating a retrieval corpus or ranking path so an AI system receives attacker-chosen instructions or false evidence.
An attacker can edit an indexed page, upload a crafted document, compromise an ingestion source, or optimize content for the retriever. If selected, that content may distort the answer or attempt an indirect prompt injection. Retrieval does not automatically grant authority, but systems that mix untrusted passages with instructions and powerful tools can turn corpus manipulation into a larger attack.
Builder example
The corpus, ingestion pipeline, metadata, embedding index, and ranking system are all security-relevant inputs. Source provenance, write permissions, version history, trust labels, and evidence support checks help distinguish authoritative records from merely relevant text.
Common confusion: RAG poisoning can target facts, ranking, or instructions. It overlaps with indirect prompt injection when the poisoned content contains commands, but false or strategically ranked evidence is harmful even without an instruction string.