RAG Security, Provenance & Data Poisoning

When: Weeks 3--4, with controlled poisoning tests after baseline retrieval works.

• Vector-store access control and retrieval-time tenant/document filters.

• Row-level security where appropriate; it does not replace complete authorization design.

• Citation spoofing and provenance: source IDs, ownership, chunk IDs, page/section metadata, and server-generated citation links.

• Indirect injection in documents, metadata, OCR text, tables, and retrieved chunks.

• Data poisoning: malicious or misleading content inserted into the corpus.

• Ingestion risks: file type/size, parser vulnerabilities, archive bombs, path traversal, remote URL ingestion, and untrusted metadata.

Practice: insert a clearly labeled malicious test document into a disposable corpus. Ask a related question and measure whether the model follows the instruction or emits an attacker-controlled URL. Test provenance, trust labels, source filtering, instruction/data separation, authorization, and citation validation.

Do not learn yet: production-scale poisoning campaigns or assume one malicious document owns every answer. Measure retrieval probability, exposure, and impact.