RAG Poisoning: How Attackers Corrupt AI Knowledge Bases Through Document Injection

Summary

RAG poisoning is a cybersecurity attack where adversaries inject malicious or fabricated documents into retrieval-augmented generation (RAG) pipelines to corrupt AI knowledge bases. This attack is particularly effective because it targets the retrieval component rather than the LLM directly, requiring no jailbreaks, model fine-tuning, or access to inference layers. The article outlines distinct threat categories including knowledge base poisoning (replacing true facts with false ones), indirect prompt injection (embedding hidden instructions in retrieved content), and cross-tenant data leakage. A practical walkthrough demonstrates how attackers can inject fabricated documents into a ChromaDB knowledge base to make an LLM report false financial information as fact.