Child-protective services IT worries that malicious instructions on scraped web pages could be retrieved into a RAG index and then followed by the model. What risk is the team highlighting?

Indirect prompt injection through the RAG path occurs when untrusted retrieved text contains instructions the model may follow. Child-protective services IT correctly worries that scraped web pages indexed into RAG can carry malicious directives that later appear in context and influence answers about sensitive family services. The risk is content-borne instruction override inside retrieval, not merely wrong facts.

The claim that embeddings mathematically forbid retrieved text from affecting answers fails by concept: embeddings select content, and the generator still conditions on retrieved tokens. Requiring all municipal RAG systems to run without any documents fails as a conclusion—it abandons grounding rather than securing the retrieval pipeline. Scraper rate limits alone proving content is instruction-safe fails because rate limiting controls crawl speed, not the adversarial semantics of page text.

Exam caveat: CPS and other high-sensitivity domains need stricter allowlists, source reputation, and “retrieved text is data” prompting, plus human review for consequential guidance. Indirect RAG injection differs from a user typing “ignore instructions” directly, though both target instruction-following. On the exam, map scraped or uploaded untrusted content influencing the model to indirect injection.

Operational check: Inject a canary instruction into a disposable web page, allow the scraper to index it in a test collection, query until it retrieves, and verify the assistant does not obey the canary; quarantine sources that fail.