Skip to content
REDMAW

AI Systems

RAG / Context Poisoning

Adversarial content is placed in a retrieval corpus so it is later selected into an AI system's context.

RedMaw Research6 min read

Definition

Context poisoning is the placement of adversarial content into a retrieval corpus such as a knowledge base, shared drive, ticket system or crawled source, so that it is selected as relevant context for future queries.

How the attack works

  1. 01The attacker identifies a source that feeds the retrieval index
  2. 02Content is authored to rank highly for targeted queries
  3. 03The content is indexed alongside trusted material
  4. 04A legitimate query retrieves it into the model's context
  5. 05The system produces manipulated output or takes an unintended action

How adversarial validation works

RedMaw evaluates which sources can write into the corpus, inserts marked benign content within authorized scope, and confirms whether it is retrieved and whether behavior changes as a result.

Tags

  • ai
  • rag
  • retrieval
  • prompt injection

Validation

How RedMaw validates this attack

Validation runs only inside authorized scope, with agreed exploitation limits.

  1. 01Map every source that can write to the retrieval corpus
  2. 02Insert marked benign content within authorized scope
  3. 03Confirm retrieval for targeted queries
  4. 04Record behavior change and re-test after pipeline changes

Keep going

Related

Capabilities

Use cases

Further reading

Attack LibraryAI Systems

Indirect Prompt Injection

The attacker never talks to the model. The content the model reads does it for them.

· 7 min read

Stop assuming you are secure. Prove it.

Continuously test what an attacker can actually reach across your applications, SaaS identities, internal infrastructure and AI systems.

Request a demoExplore the platform