AltaySec · ATLAS 2026.07
AML.T0071

False RAG Entry Injection

C · Explainer (cannot be honestly simulated in-browser) AML.TA0007 · Defense Evasion

Description

Adversaries may introduce false entries into a victim's retrieval augmented generation (RAG) database. Content designed to be interpreted as a document by the large language model (LLM) used in the RAG system is included in a data source being ingested into the RAG database. When a RAG entry containing the false document is retrieved, the LLM is tricked into treating part of the retrieved content as a false RAG result. By including a false RAG document inside of a regular RAG entry, it bypasses data monitoring tools. It also prevents the document from being deleted directly. The adversary may use discovered system keywords to learn how to instruct a particular LLM to treat content as a RAG entry. They may be able to manipulate the injected entry's metadata including document title, author, and creation date.

Honesty-tier rationale

This technique should be measured against a real defense stack; in-browser, only a simple filter-vs-filter illustration is honest.

Source

← Back to the matrix