An attacker with edit rights to an internal wiki plants pages containing false remediation steps. A RAG assistant indexes the wiki nightly and begins recommending the false steps, although its underlying language model was never retrained or modified. What best describes this attack?
Select an answer to reveal the explanation.
Short Explanation
Your chef never changed, but someone swapped the recipe cards on the shelf. That's retrieval corpus poisoning — the model faithfully repeats whatever the knowledge base hands it. Don't fall for weight tampering; indexing a wiki never touches the model's parameters.
Full Explanation
A retrieval-augmented generation system grounds answers in documents fetched from a knowledge base at query time. Indexing converts documents into embeddings stored in a vector database; it does not change the language model. If an attacker can insert or edit documents in the source, the poisoned content is retrieved as trusted context and the model presents it as an answer, which is why the false steps appeared without any retraining. Defenses include strict write controls on sources, content review and provenance tracking, trust scoring of sources, and citations so users can see where an answer came from. Model weight tampering requires altering parameters through training, fine-tuning, or file modification; nightly indexing updates only the vector store. Membership inference is a privacy attack that tries to determine whether a record was in training data and does not change outputs. Direct prompt injection means the attacker submits instructions as their own prompt, but this attacker edited the wiki rather than chatting with the assistant. Exam caveat: corpus poisoning is related to data poisoning but targets retrieval data, so cleaning the corpus and reindexing fixes it without retraining. Operational check: audit recent wiki edits, remove the poisoned pages, reindex, and restrict edit rights on sources the assistant trusts.