A malicious resident uploads a PDF whose hidden white-on-white text tells the 311 RAG stack to ignore privacy rules. Which GenAI attack pattern is this?

Indirect prompt injection delivers adversarial instructions through content the application retrieves or processes—such as a PDF with hidden white-on-white text—rather than through the resident's visible chat box alone. When a 311 RAG stack indexes or retrieves that PDF, the hidden directives can attempt to override privacy rules during generation. This pattern is foundational for civic RAG: untrusted documents become an instruction channel.

Pass-the-ticket against the city's Kerberos realm is an authentication ticket theft/reuse attack; it is not how hidden PDF text overrides LLM privacy rules. A SYN flood against the document upload gateway is a network availability attack that exhausts connection state; it does not encode instructional payloads for the model. Row-hammer against vector database DRAM is a hardware fault-injection concept; it is not the attack pattern described by poisoned retrieved document text.

Exam caveat: indirect injection can arrive via web pages, emails, tickets, or tool outputs—not only PDFs. Defenses differ from direct injection because sanitizing the chat UI is insufficient if retrieval reintroduces attacker text. Also distinguish steganographic/hidden text from ordinary malicious but visible instructions in a document.

Operational check: sanitize and inspect uploaded documents before indexing; separate retrieved content from system instructions; apply untrusted-content delimiters and allowlists; scan for hidden text layers; and restrict which corpora the 311 RAG may trust for policy-bearing instructions. Treat every resident upload as hostile input to the prompt assembly pipeline.