rag

Overview ¶

Indirect RAG Injection embeds instructions in publicly accessible documents that are ingested by RAG scrapers, achieving indirect prompt injection through the retrieval pipeline.

Source: Hidden-in-Plain-Text benchmark (arXiv 2601.10923)

KG RAG Poisoning inserts perturbation triples into knowledge graph RAG systems to create misleading inference chains.

Source: ScienceDirect research

Package rag implements RAG (Retrieval-Augmented Generation) pipeline attacks.

These attacks target the retrieval and generation stages of RAG systems, exploiting the trust that LLMs place in retrieved context to manipulate outputs, extract information, or inject instructions.

Vector Embedding Attack crafts adversarial documents whose vector representations cluster near target queries in embedding space.

The attack exploits the high-dimensionality (768/1536-dim) of embedding spaces to create documents that appear semantically relevant to target queries but contain adversarial content.

Source: Prompt Security research