RAG & Vector DB Security
Retrieval-Augmented Generation (RAG) connects language models to external enterprise knowledge. Security vulnerabilities arise from embedding poisoning, multi-tenant isolation leaks, and insecure ETL data parsers.
See the workflow →The Four Audit Focuses
A RAG security audit systematically tests every layer of the retrieval pipeline.
- Document parsing & ETL
- Vector DB isolation
- Embedding poisoning
- Retrieval context safety
Core Concepts
Understanding vector search vulnerabilities and knowledge retrieval attacks.
Vector Database & Pipeline Risks
Vector databases (Pinecone, ChromaDB, Milvus, Qdrant) store high-dimensional embeddings for semantic search. Attackers exploit missing multi-tenant access controls or manipulate vector similarity (cosine/Euclidean distance) to hijack query results or extract unauthorized tenant records.
- Test multi-tenant ACLs and metadata filtering
- Probe vector store APIs for unauthorized data access
- Audit PDF, HTML, and Docx ETL document parsers
- Verify encryption and access controls for vector indexes
RAG Attack Vectors
RAG security requires auditing the entire lifecycle: data ingestion (malicious file parsing), storage (embedding manipulation), retrieval (context hijacking), and generation (indirect prompt injection via retrieved chunks).
- Embedding poisoning: forcing malicious chunks into top-k results
- Metadata injection: spoofing source documents and permissions
- Cross-tenant leakage: retrieving vector chunks across user boundaries
- Parser exploits: executing code via malicious document uploads
The Audit Workflow
A structured testing methodology for enterprise RAG architectures and vector stores.
Audit ingestion & ETL parsers
Analyze how raw documents are loaded, cleaned, and chunked. Test parsers against malicious PDF/Docx payloads.
Evaluate vector DB access control
Verify tenant isolation and metadata filtering. Test whether users can query embeddings outside their scope.
Simulate embedding poisoning
Inject crafted text chunks designed to capture cosine similarity queries and override legitimate knowledge.
Verify context sanitization
Ensure retrieved chunks are sanitized before being passed to the LLM context window to prevent indirect injection.
Related Pages
Deep dives into language model security, injections, and data integrity.
Prompt Injection Attacks
Direct, indirect, and RAG injection techniques and mitigations.
LLM Red Teaming
Structured adversarial testing against language model applications.
Data Poisoning and Backdoors
Training data corruption, corrupted embeddings, and trojan behavior.
AI Supply Chain Security
Securing external datasets, embedding models, and third-party dependencies.