Prompt Injection › Injection in Retrieval-Augmented Generation

Retrieval-augmented generation (RAG) pipelines introduce a specific injection surface. As covered in the RAG chapters, these systems augment model responses by retrieving relevant documents from a corpus and including them in the context. The model combines the retrieved text with the query to produce a grounded answer.

The injection surface is the corpus itself. If an attacker can write documents that enter the retrieval index, they can inject instructions that will be retrieved whenever a relevant query arrives. Unlike direct injection (which requires the attacker to be in the conversation) or indirect injection through web pages (which requires the attacker to control a web resource the model browses), corpus poisoning can be mounted by anyone who can contribute documents to the indexed collection.

Corpus poisoning attacks work as follows. An attacker identifies the domain of a RAG application (say, a company's internal knowledge base or a public documentation index). They construct documents that:

1. Contain content likely to be retrieved (high semantic similarity to common queries)
2. Embed malicious instructions that will execute when the model processes the document

A knowledge base document might look entirely legitimate to human reviewers while containing a hidden injection:

A visual review of this document shows normal expense policy text. The injection is visually present but easy to overlook in a long document. When the RAG system retrieves this document in response to an employee query about expenses, the model reads the injected instruction alongside the policy text.

Corpus poisoning is particularly concerning in open-source or community-maintained knowledge bases, public wikis, shared document repositories, or any system where untrusted users can add content. The attacker does not need to compromise the system itself; they need only contribute a document that passes whatever review process exists. Human reviewers are unlikely to notice carefully crafted injections, especially those using invisible techniques. And because the injection is delivered through a legitimate content submission channel, it bypasses perimeter defenses that look for malicious network traffic.

A sophisticated variant of corpus poisoning uses the retrieval mechanism itself as a targeting system. An attacker who understands what queries a RAG application processes can craft documents with deliberately high similarity to specific queries, making sure their malicious document is retrieved for particular topics.

For example, if the attacker knows a financial application processes queries about wire transfers, they can poison the index with a document engineered to score highly for wire-transfer queries, making sure their injection fires specifically when users ask about moving money. This kind of targeted attack produces high-value outcomes from a small number of injected documents, because the injection fires precisely when users are performing high-consequence actions.

The embedding models used for retrieval are themselves a consideration here. Most production RAG systems use dense retrieval with neural embeddings. An attacker who understands the embedding space can construct adversarial documents that score highly for specific query embeddings through a process analogous to adversarial examples in image classification: small changes to the document text that have large effects on the computed similarity. Research has shown that it is possible to craft short "adversarial passages" that retrieve near the top of the results for a wide range of queries, maximizing injection reach across a query distribution rather than targeting specific queries.

The scoring asymmetry is important here. Retrieval systems typically return the top-$k$ documents by similarity score. An injected document only needs to be retrieved; it does not need to be the most relevant document. If an attacker can push a malicious document into the top-5 results for a target query class, the injection will fire on every query in that class, even if four other documents are more semantically relevant. Retrieval thresholds, result diversity, and embedding quality all affect injection risk.

Several techniques make injections harder to detect:

• Whitespace injection: Embedding instructions in strings of spaces or zero-width characters that are invisible in most text renderers but processed by the model. A document may appear to contain only policy text while carrying hidden instructions in what looks like blank space.
• Unicode steganography: Using Unicode homoglyphs (characters that look identical to common letters but have different code points) or bidirectional text marks (characters that reverse text direction) that display as innocent text but spell out instructions when processed as bytes.
• Markdown injection: In environments that render markdown, using collapsed sections, HTML comments, or image alt text that is not displayed to users but is present in the raw text fed to the model. A rendered document shows clean text; the raw markdown contains injections in comment tags.
• Comment injection: In code or configuration files, embedding instructions in comments that the model reads as context. A Python file might contain a comment that appears to be documentation but is a prompt injection in disguise.
• Font and color steganography: In environments that process formatted documents like PDFs or HTML, setting injected text to white on a white background or to a font size of zero. The content is invisible to readers but present in the raw document that gets passed to the model.

The challenge for defenders is that these techniques exploit the gap between how humans read text and how models tokenize and process it. A human reviewer sees a clean document; the model sees everything, including content that rendering has made invisible. This means visual review of documents before indexing is not a reliable defense against sophisticated injection attempts. Any defense that depends on a human reading documents will miss content that the rendering layer hides.