Simulate a poisoned document or memory entry

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R13 — Qdrant point deletion & snapshots

   R17 — NIST Privacy data quarantine & deletion

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Simulate a live RAG document poisoning or persistent memory poisoning incident (plus a C3 corrupted schema ingestion batch).

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   Execute containment: quarantine the source document/memory via D10, purge all derived vector chunks and caches, roll back the C3 ingestion batch, verify end-to-end deletion, and rerun D5 retrieval/citation verification tests.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   Post-incident drill report and quarantine/deletion audit log for Drill 3.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R13Qdrant Documentation↗ qdrant.tech

  Collections, payload metadata indexing, pre-filtering, multitenancy partitioning, and snapshots.

• R17NIST Privacy Framework↗ nist.gov

  Identify-P, Govern-P, Control-P, Communicate-P, and Protect-P lifecycle controls.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsQdrant
  Multitenancy

  Shows payload-based partitioning with per-tenant indexes and a tenant field, which is exactly the filter an attacker tries to strip or bypass in a vector tenant-escape test.

  R13checked 2026-11-11
• videoSystemDR - Scalable System Design · 20:36
  Detecting & Mitigating Data Poisoning Attacks in Vector Databases for RAG | AI Security

  Covers how poisoned vectors get inserted and how to detect them, the detection logic behind the D10 sleeper-agent scrubber.

  R13checked 2026-11-11
• videoDeploy & Defend · 7:58
  RAG Data Poisoning Attack Walkthrough | LLM Security (Vulnerable Lab)

  A hands-on lab run through a poisoning attack end to end, giving you the exact steps to replay as the live incident simulation.

  R13checked 2026-11-11
• articleNIST
  Privacy Framework

  Supplies the Identify-P, Govern-P, Control-P, Communicate-P and Protect-P controls that determine what must be deleted, retained and disclosed after poisoned data lands in a collection.

  R17checked 2026-11-11
• docsMicrosoft Learn
  4. AI Memory / Context Poisoning (Corruption)

  Describes how poisoned rules persist and spread between agents through shared retrievals and caches, the propagation path the scrubber must trace after containment.

  R13checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.