An elections office uses RAG over voter-guide PDFs. Which AI threat should testing specifically target?

Elections RAG over voter-guide PDFs must specifically test for indirect prompt injection: malicious instructions embedded in retrieved civic documents that influence model behavior without appearing in the user prompt. Attackers (or careless publishers) can hide directives in PDF text that the retriever surfaces and the model obeys—altering answers, exfiltrating context, or steering voters. Targeting this threat in testing works because retrieval-augmented systems expand the trust boundary to every document in the corpus; securing only the chat box is insufficient. Testing for training data extraction of memorized voter records from foundation model pretraining weights fails because it targets the base model’s pretraining data rather than malicious instructions embedded in the retrieved voter-guide corpus. Testing for model denial of service from oversized embedding batches overwhelming the vector database during peak queries fails because it addresses infrastructure capacity rather than document-borne instruction injection. Testing for embedding inversion recovering voter queries from stored vector representations in the retrieval index fails because it concerns privacy leakage of query vectors, not directives that change how the assistant answers. Exam caveat: indirect injection may be subtle (HTML, hidden text, or low-contrast PDF layers); tests should include realistic corpus tampering, not only obvious ‘ignore previous instructions’ banners. Operational check: poison a staging corpus with planted directives, verify whether the assistant follows them, harden with corpus allow-listing, sanitization, instruction/data separation, and output validation, and block production promotion until injection tests fail closed.