Poison the Vector, Not the Words

An attacker crafts a gibberish passage whose embedding sits near thousands of questions — so it's retrieved everywhere

Technique first revealed 29 Oct 2023

🗺️ RAG Knowledge Assistant Knowledge / Training Data Poisoning

RAG Knowledge Assistant

InstructionsDataActionsControl / decisionFeedback / logs

👆 Click a component to inspect

SetupStep 1 / 7

An open ingestion path

The assistant's library is filled automatically from places staff can add to — a shared wiki, an uploads folder, a public docs site. Anyone with access to one of those can put a document into the library.

⚙️Ingestion config (over-permissive)config

sources:
  - kb_internal_wiki        # staff-editable
  - partner_docs_site       # third-party contributions accepted
  - public_uploads/         # anyone with a link
sanitize_active_content: false
provenance_scoring: false
new_chunk_anomaly_check: false
reindex: nightly

← / → keys