An organization is performing an AI security risk assessment. A security architect identifies that their RAG system could be manipulated through malicious content injected into documents that are indexed in the knowledge base. What type of attack is this, and which control should be implemented?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — when attackers slip malicious instructions into documents that your RAG system later retrieves and feeds to the LLM, that's indirect prompt injection. You need to scan and sanitize documents before indexing, and use Prompt Shield to catch injection attempts at runtime.
Full Explanation
Indirect prompt injection with content scanning and sanitization on documents before indexing is correct because injecting malicious instructions into documents that are then retrieved and processed by an LLM as context is called indirect prompt injection. The primary control is scanning and sanitizing documents for adversarial instructions before indexing into the RAG knowledge base, as well as implementing Prompt Shield to detect injection attempts at runtime. The model poisoning attack with model retraining using clean data is incorrect because model poisoning affects the model's training process; this attack occurs during inference via retrieved context. The data exfiltration attack with DLP policies on the Azure AI Search index is incorrect because DLP policies control data exfiltration scenarios, not injection of malicious instructions through retrieved content. The supply chain attack with code signing for all documents in the knowledge base is incorrect because code signing verifies document authenticity but does not detect or remove injected adversarial text within legitimate documents.