ATK-016 Data integrity
RAG Source Poisoning
Applies to: RAG, LLM, Agentic AI · Last reviewed 2026-05-01
Prerequisites
- RAG corpus ingests content from sources with broad write access (user-generated content, shared wikis, public web crawl).
- Source content is added to the index without provenance validation or trust scoring.
Test approach
With written authorization, the tester contributes adversarial content to an ingestion source (in a non-production replica or with explicit corpus authorization). After ingestion, the tester issues legitimate-sounding queries that should retrieve the poisoned content, observing model behavior. Distinct from ATK-002 in that the attack vector is the upstream content-creation process rather than the retrieval layer.
Expected evidence
- Poisoned content added (with hash and timestamp).
- Ingestion logs confirming the content reached the index.
- Retrieval logs and model output.
- Cleanup.
Detection signals
- New high-trust corpus entries originating from low-trust sources.
- Embedding similarity of newly ingested content to known injection corpora.
- Spikes in retrievals of newly ingested content.
Defensive recommendations
- Apply provenance and trust scoring at ingestion; require review for content from low-trust sources.
- Limit who can contribute to high-trust corpora.
- Continuously scan the corpus for injection patterns after the fact (drift detection).
- Reference AI-CTRL-002 (Data Provenance).
Framework mappings
- OWASP LLM Top 10: LLM03:2025
- OWASP Agentic Top 10: AAI01
- MITRE ATLAS: AML.T0020
- NIST AI RMF: MAP-4.1, MEASURE-2.10
Related AI Controls Catalog entries
These controls provide the audit test procedures that validate defences against this attack pattern.