rag

Overview ¶

Ghost Vectors — reconstruction of soft-deleted embeddings in HNSW vector databases (arXiv 2606.18497, "Ghost Vectors: Soft-Deleted Embeddings Remain Reconstructible in HNSW Vector Databases", Jun 2026).

HNSW-based vector stores implement deletion as a soft-delete: the record is tombstoned but its raw embedding stays in the index files until a compaction that many deployments never run. An attacker with storage-layer access reads the raw index, extracts the "deleted" vectors, and runs Vec2Text-style inversion to reconstruct the source text — bypassing the store's API-level delete and any right-to-be-forgotten guarantee built on it. The paper reports up to 99–100% recovery in some domains.

The vulnerability is deletion DURABILITY, not the inversion model. This module tests exactly that: insert a canary → delete it through the normal API → read the raw index → success only if the soft-deleted canary's source text is still recoverable. It targets a storage-layer surface rather than an LLM's text output, so it requires common.VectorStoreProbe; against a plain provider it emits OutcomeSkipped + SkipMissingCapability, and the testutil.MockVectorStore double exercises it end-to-end.

Indirect RAG Injection embeds instructions in publicly accessible documents that are ingested by RAG scrapers, achieving indirect prompt injection through the retrieval pipeline.

Source: Hidden-in-Plain-Text benchmark (arXiv 2601.10923)

KG RAG Poisoning inserts perturbation triples into knowledge graph RAG systems to create misleading inference chains.

Source: ScienceDirect research

Package rag implements RAG (Retrieval-Augmented Generation) pipeline attacks.

These attacks target the retrieval and generation stages of RAG systems, exploiting the trust that LLMs place in retrieved context to manipulate outputs, extract information, or inject instructions.

Vector Embedding Attack crafts adversarial documents whose vector representations cluster near target queries in embedding space.

The attack exploits the high-dimensionality (768/1536-dim) of embedding spaces to create documents that appear semantically relevant to target queries but contain adversarial content.

Source: Prompt Security research