RAG Pipeline Poisoning Drill
Attacker-controlled content planted in a vector store or in a source the retriever trusts, so the model repeats it back as grounded fact.
3 scenarios in this pool
3:12 AM: Vector Store Integrity Anomaly: RAG Ingestion Pipeline Poisoning Detected
A production RAG-powered internal legal research chatbot ingests documents nightly from an S3 bucket (`s3://legalcorp-rag-docs-prod`) via an automated LangChain pipeline. Embeddings are generated with OpenAI `text-embedding-ada-002` and stored in a Pinecone vector index (`legal-prod-v3`). You are the on-call ML Security Analyst responding to a 3 AM PagerDuty alert.
SIEM ALERT [HIGH]: VectorStore Integrity Monitor | 2024-11-14 03:12:07 UTC Triggered: Embedding distribution drift score exceeded threshold (score: 0.91, threshold: 0.75) across 847 newly ingested vectors in index `legal-prod-v3`. Cosine similarity of flagged vectors to existing corpus centroid: 0.21 (baseline: 0.74 +/- 0.08). Source path: `s3://legalcorp-rag-docs-prod/intake/2024-11-13/batch_047/` CloudTrail log fragment: `{"eventTime":"2024-11-13T23:44:11Z","eventName":"PutObject","userIdentity":{"type":"IAMUser","userName":"svc-doc-intake"},"sourceIPAddress":"185.220.101.47","requestParameters":{"bucketName":"legalcorp-rag-docs-prod","key":"intake/2024-11-13/batch_047/merged_precedents_final.pdf"}}` 847 documents ingested; prior nightly average: 112 +/- 23 documents. Flagged batch contains 1 unique source IP not associated with any internal CIDR range.
Your first action after acknowledging the PagerDuty alert is to: