RAG Security

Threats: Prompt Injection via retrieval (LLM01), Supply Chain (LLM05), Data Poisoning (LLM03), Excessive Agency (LLM08)
Standards: NIST AI 600-1 §2.12, §2.4, §2.8; OWASP LLM01/LLM03/LLM05; EU AI Act Art. 10/Art. 15; ISO 42001 A.5.2/A.8.1/A.9.1; MITRE TA0012/TA0002

RAG Attack Surface

Rendering diagram...

flowchart LR
    A[User Query] --> B[Embedding]
    B --> C[Vector Store]
    C -->|Top-k chunks| D[Retriever]
    D --> E[Prompt Template]
    E --> F[LLM]
    F --> G[Response]
    
    H[Attacker] -.->|Poison| C
    H -.->|Inject| D
    H -.->|Craft| A

Threat Vectors

Vector	Mechanism	Impact
Poisoned corpus	Malicious documents ingested into vector store	Indirect prompt injection at retrieval time
Retrieval manipulation	Adversarial query crafts embedding to retrieve attacker-chosen chunks	Context injection, data exfiltration
Access control bypass	User retrieves chunks they shouldn't see (cross-tenant, privilege escalation)	Data leakage, compliance violation
Index corruption	Attacker modifies FAISS/HNSW index files directly	Denial of service, targeted misretrieval

Controls

Layer	Control	Mechanism	Standards
Ingestion	Document sanitisation	Strip/escape control tokens, validate schema, PII scan before indexing	NIST AI 600-1 GOVERN-4, OWASP LLM01
Ingestion	Signed document manifests	Hash + signature per document; verify on re-index	SLSA, ISO 42001 A.3.3
Access	Retrieval authorisation	Tag chunks with ACLs; filter by user identity at query time	EU AI Act Art. 10, ISO 42001 A.5.2
Access	Tenant isolation	Separate vector indexes per tenant; no cross-tenant retrieval	ISO 42001 A.5.1, GDPR Art. 25
Retrieval	Similarity threshold	Reject chunks below cosine similarity threshold (e.g., 0.7)	NIST AI 600-1 MEASURE-2.1
Retrieval	Diversity / MMR	Maximal Marginal Relevance to avoid single-document dominance	NIST AI 600-1 §2.8
Prompt	Instruction hierarchy in template	System prompt immutable; retrieved chunks marked `<context>`; user query marked `<query>`	NIST AI 600-1 MANAGE-2.2, OWASP LLM01
Prompt	Chunk attribution	Require LLM to cite chunk IDs; verify citations post-generation	NIST AI 600-1 MEASURE-2.1, §2.8
Monitoring	Retrieval anomaly detection	Alert on: unusual source distribution, entropy spikes, access pattern changes	NIST AI RMF MEASURE-3.1, MITRE TA0008

Retrieval Authorisation Model

JSON

{
  "chunk_id": "doc-42#chunk-3",
  "content": "...",
  "metadata": {
    "source": "internal-policy-v3.pdf",
    "classification": "confidential",
    "departments": ["legal", "finance"],
    "roles": ["compliance-officer", "cfo"]
  }
}

At query time: filter chunks where user.roles ∩ chunk.roles ≠ ∅ AND user.department ∈ chunk.departments.

Citation Register

Control	Standard	Provision	URL
Value chain risk	NIST AI 600-1	§2.12	https://doi.org/10.6028/NIST.AI.600-1
Data governance	EU AI Act	Art. 10	https://eur-lex.europa.eu/eli/reg/2024/1689/oj
Robustness	EU AI Act	Art. 15	https://eur-lex.europa.eu/eli/reg/2024/1689/oj
Supply chain	OWASP LLM Top 10	LLM05	https://owasp.org/www-project-top-10-for-large-language-model-applications/
Prompt injection	OWASP LLM Top 10	LLM01	https://owasp.org/www-project-top-10-for-large-language-model-applications/
Data poisoning	OWASP LLM Top 10	LLM03	https://owasp.org/www-project-top-10-for-large-language-model-applications/
Asset management	ISO 42001	A.3.3, A.5.2, A.8.1, A.9.1	https://www.iso.org/standard/81230.html
Adversarial staging	MITRE ATLAS	TA0012, TA0002	https://atlas.mitre.org/