RAG systems expand the AI attack surface from the model to the entire data pipeline. Attackers don't need to touch the model — they compromise the data it trusts. This guide covers the 10 most exploited RAG attack vectors, MITRE ATLAS-mapped, with a concrete defense for each.
RAG attack vectors are the methods attackers use to exploit Retrieval-Augmented Generation systems by manipulating external data, retrieval pipelines, or prompt context to influence AI outputs — without directly interacting with the model.
They target the data layer, not just the model; bypass traditional AI safety guardrails by exploiting trust in retrieved context; are often undetectable without active scanning, since there are no error logs and no crashes; and can lead to data leaks, policy override, or silent system compromise.
Adversarial instructions embedded using visual concealment: HTML comments, white text, PDF metadata, CSV formula fields, zero-width Unicode. Invisible to users, processed by the model as trusted context.
Scan documents before ingestion, strip instruction-like patterns, validate retrieved content before it reaches the prompt
Attacker-controlled content enters via any write path — upload, web crawl, API sync, supply chain compromise. Once indexed, poisoned chunks are retrieved as authoritative context.
Validate data integrity continuously, use only trusted ingestion sources, monitor for unauthorized data changes
Attacker-crafted content designed to rank highly in semantic search for targeted queries — combining corpus poisoning with search optimization to guarantee malicious content reaches model context.
Use relevance filtering, validate retrieval results, monitor for ranking anomalies
Retrieved documents compete with system instructions for model attention. The key test: does the model follow embedded instructions, or ignore them in favor of system prompt constraints?
Isolate system prompts from retrieved content, sanitize documents, apply strict output controls
Internal documents or customer records surface in responses via retrieval — either intentional exploitation or unintended access control failure. Detected via PII pattern scanning on outputs.
Mask sensitive data, limit retrieval scope per user, apply output filtering before responses are returned
Session A's data appears in session B's retrieval results. Confirmed using canary token probe pairs — a unique token seeded in session A; if it appears in session B's response, contamination is confirmed.
Enforce strict per-session retrieval isolation, audit cross-session query patterns regularly
Adversarial content floods retrieval context, pushing system instructions out of the effective attention window. Tested by checking instruction persistence at maximum context window size.
Limit retrieved context size, prioritize trusted data, reinforce system instructions throughout the prompt
Adversarially crafted documents embed near high-value target documents in vector space, getting retrieved alongside legitimate content. Detected via vector proximity monitoring.
Validate embedding integrity, monitor for vector anomalies, use a hardened vector database
Incremental information extraction across multiple queries — each query reveals a fragment that informs the next, gradually bypassing per-query defenses.
Track session behavior across queries, monitor patterns over time rather than per-query, detect cross-query anomalies
False or biased retrieved content influences model responses without explicit instruction injection — quantified by measuring degradation against a clean-context baseline.
Validate outputs systematically, apply guardrails, monitor response patterns for drift over time
Step 1 — simulate real attacks: inject marked documents, manipulate retrieval queries, and test prompt injection scenarios directly against your live system.
Step 2 — monitor system behavior: analyze outputs, detect anomalies, and track how data actually flows through the pipeline during each test.
Step 3 — identify weak points: pinpoint exactly where failures occur — retrieval layer, data ingestion, or prompt construction.
Step 4 — apply fixes: filter data, strengthen prompts, and add validation layers at the specific points testing revealed as weak.
Step 5 — automate testing: move to continuous scanning and real-time detection rather than a single pre-launch pass.
Most common vectors in practice: document injection, corpus poisoning, retrieval manipulation, prompt injection via retrieved content, and sensitive data leakage — in roughly that order of prevalence.
Attack techniques evolve constantly — new injection methods, new data manipulation approaches, new retrieval exploits. Manual, point-in-time defense will always lag behind; defense needs to be multi-layered and continuously running.
The HexTyx AI Security Assessment tests your RAG pipeline against all 10 attack vectors above with confirmed proof-of-exploit results, not heuristic guesses.
Internal does not mean safe — internal sources can be compromised just as easily as external ones.
Hidden instructions inside documents go completely undetected without it.
Attackers effectively control what the model sees if retrieval isn't filtered and validated.
Silent attacks go undetected indefinitely without continuous behavioral tracking.