An organization is performing an AI security risk assessment. A security architect identifies that their RAG system could be manipulated through malicious content injected into documents that are indexed in the knowledge base. What type of attack is this, and which control should be implemented?

B is correct because injecting malicious instructions into documents that are then retrieved and processed by an LLM as context is called indirect prompt injection. The primary control is scanning and sanitizing documents for adversarial instructions before indexing into the RAG knowledge base, as well as implementing Prompt Shield to detect injection attempts at runtime. A is incorrect because model poisoning affects the model's training process; this attack occurs during inference via retrieved context. C is incorrect because DLP policies control data exfiltration scenarios, not injection of malicious instructions through retrieved content. D is incorrect because code signing verifies document authenticity but does not detect or remove injected adversarial text within legitimate documents.